JP4967055B2 - Information processing system, method and program - Google Patents

Description

  The present invention relates to management of personal information.

  In recent years, in order to protect personal information and privacy, provisions regarding handling and protection of personal information acquired by various business operators (collectively referred to as “policy”) have been created and applied. On the other hand, along with the development of inter-operator cooperation and distributed processing in the field of information processing, personal information of customers such as Internet users may be transferred between information systems of different operators under certain conditions. As a conventional technique related to such exchange and policy of personal information, a proposal has been proposed in which personal information and its policy are combined and transferred between devices (see, for example, Patent Document 1).

JP 2006-344156 A

  However, in the conventional techniques as described above, the agreement and the confirmation of the policy regarding the delivery of personal information have not been made into procedures, so the effectiveness and efficiency of applying the policy has been a problem.

  In view of the above problems, an object of the present invention is to make a policy agreement and confirmation regarding delivery of personal information a procedure.

Based on the above object, one aspect (1) of the present invention is an information processing system including a personal information providing device and a receiving device, wherein the providing device is the personal information to be provided. Personal information storage means for storing information, receiving a policy regarding the handling of the personal information from the receiving side device, giving a policy regarding the handling of the personal information to the receiving side device, and the providing side At least one of confirming that a part or all of a policy content regarding the handling of personal information possessed by a device and a policy content regarding the handling of personal information possessed by the receiving device are common there, the agreement confirmation means for confirming the agreement between the receiving-side apparatus, and the agreement information generating means for generating a predetermined agreement identification information for identifying a validated the agreement Policy agreement storage means for storing the agreement identification information generated in association with the policy related to the confirmation; confirmation agreement transmission means for transmitting the agreement identification information to the receiving device; and a request for the personal information The agreement information receiving means for receiving the agreement identification information transmitted from the receiving side device in relation, the agreement information verification means for verifying the agreement identification information received from the receiving side device, and the result of the verification is An access control means for executing a series of processes necessary for transmitting the personal information related to the policy corresponding to the agreement identification information to the receiving device when it is affirmative; A side apparatus, a confirmation agreement receiving means for receiving the agreement identification information transmitted from the confirmation agreement transmission means of the providing side apparatus; and the agreement identification information received from the providing side apparatus Agreement information storage means for storing, agreement information transmission means for transmitting the agreement identification information stored in the agreement information storage means to the providing side device in relation to the request for the personal information, and the transmitted agreement identification Personal information receiving means for receiving the personal information transmitted from the providing apparatus corresponding to the information.

According to another aspect (3) of the present invention, the above aspect is captured by a method category, and a providing apparatus including a personal information storage unit storing personal information to be provided , a receiving apparatus, In the information processing method in the information processing system, the providing apparatus receives a policy regarding the handling of the personal information from the receiving apparatus, and gives the policy regarding the handling of the personal information to the receiving apparatus. And that the contents of the policy regarding the handling of the personal information possessed by the providing side device and the content of the policy regarding the handling of the personal information possessed by the receiving side device are partly or entirely common. is at least one of, and agreement confirmation process to confirm the agreement between the receiving-side apparatus, said providing-side device, identify confirmed the agreement And agreement information generating process of generating a predetermined agreement identification information that includes a processing the providing side device, to the generated the agreed identification information in association with the policy according to the confirmed stored in a predetermined policy agreed storage means , the providing-side apparatus, a check agreement transmitting process of transmitting the agreement identification information for identifying to the receiving side device confirmed the agreement, said providing-side apparatus, the receiving side in connection with the request for the personal information An agreement information reception process for receiving the agreement identification information transmitted from a device , an agreement information verification process in which the providing device verifies the agreement identification information received from the receiving device, and the providing device If the result of the verification is affirmative, an access for executing a series of processes necessary for transmitting the personal information related to the policy corresponding to the agreement identification information to the receiving device Run control process and, wherein the receiving side apparatus, a confirmation agreement reception process of receiving the agreement identification information transmitted by said check agreement transmission process of the providing-side apparatus, said receiving-side apparatus, the providing-side Processing for storing the agreement identification information received from a device in a predetermined agreement information storage means, and the receiving device relates the agreement identification information stored in the agreement information storage means to the request for personal information An agreement information transmission process for transmitting to the providing side device, and a personal information receiving process for receiving the personal information transmitted from the providing side device in response to the agreement identification information transmitted by the receiving side device ; , Is executed.
According to another aspect (4) of the present invention, the above aspect is grasped in the category of the program. The personal information storage means for storing the personal information to be provided for the computer, the personal from the other computer. Receiving a policy regarding the handling of information, giving a policy regarding the handling of the personal information to the other computer, and contents of the policy regarding the handling of the personal information possessed by the computer and the individual possessed by the other computer An agreement confirmation means for confirming an agreement with the other computer, which is at least one of confirming that a part or all of the contents of the policy regarding the handling of information is common. Agreement information generating means for generating predetermined agreement identification information for identifying the agreement, and the generated agreement identification information Policy agreement storage means for storing the information in association with the policy relating to authorization, confirmation agreement transmission means for transmitting the agreement identification information to the other computer, transmitted from the other computer in connection with the request for the personal information Agreement information receiving means for receiving the agreement identification information, agreement information verification means for verifying the agreement identification information received from the other computer, and if the result of the verification is affirmative, It is characterized by functioning as an access control means for executing a series of processes necessary for transmitting the personal information related to the corresponding policy to the other computer.
According to another aspect (5) of the present invention, the above aspect is grasped in the category of the program, and the policy regarding the handling of personal information from the computer is transmitted from the other computer. Receiving, giving the computer a policy regarding the handling of the personal information to the computer, and contents of the policy regarding the handling of the personal information possessed by the other computer and the handling of the personal information possessed by the computer Predetermined agreement identification information for identifying an agreement between the computer and the other computer, which is at least one of confirming that a part or all of the content of the policy is common Confirmation agreement receiving means for receiving the consciousness received from the other computer Agreement information storage means for storing information, agreement information transmission means for transmitting the agreement identification information stored in the agreement information storage means to the other computer in relation to the request for the personal information, and the agreement identification transmitted. It is made to function as a personal information receiving means for receiving the personal information transmitted from the other computer corresponding to the information.

  In this way, as a procedural process as a protocol between devices that exchange personal information, an agreement is made in advance regarding the policy of information handling, and thereafter access control such as information exchange is performed on the condition that confirmation of the identification information of the agreement is confirmed. Policy agreement on delivery of personal information by applying filtering that blocks the transition to the authentication process screen, which is the previous stage of information exchange unless it can be confirmed, and filtering so that information exchange processing is not performed unless it can be confirmed And the confirmation can be made into a procedure, and the effectiveness and efficiency of policy application can be improved.

  According to another aspect (2) of the present invention, in any one of the above aspects, the agreement information generation means incorporates predetermined authentication information for authenticating the receiving device into the agreement identification information. .

  In this way, by incorporating information for authenticating the receiving device into the agreement identification information using a processing algorithm such as a hash function or encryption, the providing device does not need to authenticate the receiving device in advance. Therefore, the process of providing personal information using the agreement identification information is speeded up and made efficient.

  Each of the following aspects is an additional configuration suitable for the combination with each of the above aspects, and further improves the policy processing related to information delivery by a synergistic effect based on such a combination.

  An additional aspect (1) is a policy determination device that determines a relationship between a plurality of policies related to information, and a policy storage unit that stores a policy and a target corresponding to the policy in association with each other. , A hierarchical storage means for storing a hierarchical relationship between the respective objects, a policy to be determined, a target corresponding to the policy, a determination target acquisition means for acquiring the target, and for the acquired target, Hierarchy specifying means for specifying a target that is a higher hierarchy in the hierarchical relationship stored in the hierarchical storage means as an upper target; and a policy associated with the specified higher target in the policy storage means A policy identifying unit that identifies the partner policy to be determined, a relationship determining unit that determines a relationship between the policy to be determined and the identified partner policy, And result output means for outputting a result of the determination, and having a.

  An additional aspect (4) is a policy determination method in which the above aspect is captured by a method category, in which a computer determines a relationship between a plurality of policies relating to information. The policy storage means for storing the object corresponding to the policy in association with each other is realized, the computer realizes the hierarchical storage means for storing the hierarchical relationship between the objects, and the computer should determine A determination target acquisition process for acquiring a policy and a target corresponding to the policy, and the computer is in a higher hierarchy in the hierarchical relationship stored in the hierarchical storage unit with respect to the acquired target A hierarchy specifying process for specifying a target as a high-order target and a policy in which the computer is associated with the specified high-level target in the policy storage unit. , A policy identification process that identifies a partner policy to be determined, a relationship determination process in which the computer determines a relationship between the policy to be determined and the identified partner policy, and a computer And a result output process for outputting the result.

  Another additional aspect (5) is a policy determination program for grasping the above aspect in the category of a computer program, and determining a relationship between a plurality of policies concerning information by controlling the computer. A policy storage unit that stores the policy and a target corresponding to the policy in association with each other, and a computer that implements a hierarchical storage unit that stores a hierarchical relationship between the targets. The computer acquires a policy to be determined and a target corresponding to the policy, and the computer has an upper hierarchy in the hierarchical relationship stored in the hierarchical storage unit with respect to the acquired target. The target is identified as a higher-level target, and the computer stores the identified higher-level target in the policy storage unit. The specified policy is specified as the other party policy to be determined, and the computer is caused to determine the relationship between the policy to be determined and the specified other party policy, and the computer outputs the result of the determination. It is characterized by making it.

  As described above, when there is a policy corresponding to each target having a hierarchical relationship, such as the entire company and a specific department, or all related parties and individual related parties, the hierarchical relationship between the targets is related in advance. Then, for a policy corresponding to an arbitrary target such as a specific department or individual relationship destination, a higher-level target in the hierarchical relationship is identified based on the target corresponding to the policy, and it is determined whether there is a contradiction with the corresponding partner policy. Output.

  As a result, when creating or modifying a new policy, considering an agreement, etc., even if multiple policies related to information transfer have a hierarchical structure, the relationship with the new policy can be determined by tracing them manually. The load is eliminated, and the related policy corresponding to the hierarchical relationship can be appropriately processed. In particular, the accuracy, speed, and efficiency of the processing can be greatly improved, and automatic processing for exchanging information is facilitated.

  In another aspect (2), in any one of the above aspects, the hierarchy specifying means is a lower hierarchy in the hierarchy relationship stored in the hierarchy storage means with respect to the acquired object. The target is specified as a subordinate target, and the policy specifying means specifies a policy associated with the specified subordinate target in the policy storage means as the partner policy, and the relationship determining means determines the determination. It is characterized in that the relationship between the power policy and the identified partner policy is determined.

  In this way, by checking the subordinate policy corresponding to the subordinate target of the given target, it is possible to check whether there is a contradiction with the policy for each subordinate organization about the policy of personal information exchanged as a company, etc. It is possible to carry out appropriate processing in a multifaceted manner with respect to the policy.

  In another aspect (3), in any of the above aspects, each of the determination policy and the partner policy describes a condition description describing one or more conditions and an action corresponding to the condition description. The relationship determination means determines a type of relationship between the condition descriptions corresponding to the common action description among the determination policy and the partner policy, and responds to the determined relationship. A policy creating means for creating a new policy by combining the condition description of the judgment policy and the condition description of the counterpart policy, or editing at least one of the judgment policy or the counterpart policy. Features.

  In this way, for the determination policy and the partner policy related to the same action, the type of relationship between the condition descriptions is determined, and a new policy is created by combining the condition descriptions of the determination policy and the partner policy according to the determined relationship. By editing the policy, you can generate a policy that is consistent with the upper and lower hierarchies for any hierarchy, so the accuracy, speed, and efficiency of policy creation and agreement can be greatly improved, and information is exchanged. It becomes easier to automate the process.

  It should be noted that a category (method for the apparatus, program for the method, etc.) different from each of the above-described modes and more specific modes described below are also included in the present invention. For different categories, “means” shall be appropriately read as “process” or “step”. In addition, the order of execution of the processes and steps is not limited to those described above, and can be changed by appropriately replacing or collectively processing within a range not violating the principle of operation.

  According to the present invention, it is possible to procedurally agree and confirm a policy regarding delivery of personal information.

The functional block diagram which shows the structure of embodiment of this invention. The figure which illustrates the information (data) used by embodiment of this invention. The figure which illustrates the information (data) used by embodiment of this invention. The figure which illustrates the information (data) used by embodiment of this invention. The flowchart which shows the process sequence in embodiment of this invention (personal information provision based on policy agreement and agreement identification information). The flowchart which shows the process sequence in embodiment of this invention (determination of the relationship between policies). The conceptual diagram which shows the kind of relationship between the policies in embodiment of this invention. The conceptual diagram which shows the policy which determines a relationship in embodiment of this invention. The conceptual diagram which shows the process sequence which edits a policy, determining a relationship in embodiment of this invention. The flowchart which shows the process sequence in embodiment of this invention (creation and edit of a domain policy). The flowchart which shows the process sequence in embodiment of this invention (determines the relationship between policies and edits a policy).

  Next, modes for carrying out the present invention (referred to as “embodiments”) will be described with reference to the drawings. It should be noted that assumptions common to those already described in the background art and problems are omitted as appropriate.

[1. Constitution〕
In the present embodiment, a personal information providing apparatus 1 shown in FIG. 1 and a receiving apparatus 2 that implements a service using the provided personal information are connected to a communication network N (Internet, cellular phone network, LAN). Etc.) connected to an information processing system (hereinafter also referred to as “this system”). Each of the devices 1 and 2 is configured as a general computer (electronic computer) with at least an arithmetic control unit 6 such as a CPU, a storage device 7 (main memory, flash memory, HDD, etc.) and communication with a communication network N. And means 8 (such as a LAN adapter or a communication gateway device). Communication such as personal information between the providing apparatus 1 and the receiving apparatus 2 is protected by VPN or the like as necessary.

  Further, in each of the devices 1 and 2, a predetermined computer program (not shown) stored (installed) in advance in the storage device 7 controls the arithmetic control unit 6 so that elements (10, 11) such as each unit shown in FIG. , 20, 21 etc.). Of these elements, information storage means can be realized in the storage device 7 in various formats such as various databases (also referred to as “DB”), files, variables such as arrays, various stacks, registers, and system setting values.

  Among such storage means, the personal information storage means 55 of the providing side device 1 is means for storing personal information to be provided, and the content of the personal information includes name, gender, date of birth, Since it may be a general one such as an e-mail address, it is omitted. Further, the management policy storage means 18 of the providing apparatus 1 and the utilization policy storage means 21 of the receiving apparatus 2 are storage means for storing policies relating to the handling of personal information in accordance with the positioning of the policies. The content and expression format of the “policy” here is typically free, but typically, depending on the content of the corresponding personal information, in addition to the user, range of use, purpose of use, transmission / reception, storage, utilization, Handling such as access control and encryption in deletion is described in a predetermined expression format.

An example of a policy is shown.

Policy ID: XXX
User: XX Company Data type: First name, last name, gender, age ...
Purpose: Advertising distribution, data analysis ...
・ ・ ・ ・ ・ ・ ・

  The providing apparatus 1 has a policy determination unit 1a as a part for determining a relationship between a plurality of policies relating to information, and also serves as a policy determination apparatus that performs such determination. The function of the policy determination device realized by the policy determination unit 1a is basically to determine the relationship between a certain policy and a higher-level policy. In relation to this function, the management policy storage means 18 is a policy and a target corresponding to the policy (for example, a company, its department, a specific range of personal information, etc. as a policy application target. Also called “domain”. FIG. 2 shows an example of a policy stored in association with a domain ID indicating a target domain.

  Further, the hierarchical storage means 17 is a means for storing the hierarchical relationship between the objects. In the example of FIG. 3, the hierarchical storage of the domain ID of the domain that is the target (also serving as a reference in the figure) is stored. ing. For example, when considering the domain D11 as a center, the domain (hereinafter referred to as “metadomain”) that is the upper hierarchy is the metadomain D01, and conversely, the domain that is the lower hierarchy of the domain D11 (“ Are called subdomains D21, D22, D23...

  In addition, each means other than the storage means is a processing means for realizing and executing the following information processing functions and operations, but is a functional unit arranged for explanation, and includes actual hardware elements and software modules. The agreement with is not questioned.

[2. Action)
FIG. 5 is a flowchart showing a processing procedure related to delivery of personal information in the present embodiment configured as described above. The processing procedure can be roughly divided into agreement confirmation performed in advance (steps S11 to S13 and steps S21 to S26), and personal information delivery based on the confirmation (steps S14 to S15 and steps S27 to S31).

[2-1. (Processing at the time of agreement confirmation)
In this example, the agreement request transmission means 22 of the receiving device 2 transmits a policy agreement request regarding personal information to be received and utilized in the future to the providing device 1 (step S11). It is assumed that the agreement regarding the policy is confirmed as follows, triggered by the agreement request receiving means 9 receiving the agreement request (step S21).

  That is, in the providing side device 1, the agreement confirming means 10 confirms a predetermined agreement with the receiving side device 2 regarding the policy regarding the handling of personal information (step S22). The form and procedure of the agreement regarding such a policy are free. For example, the receiving apparatus 2 may simply agree to what is presented from the providing apparatus 1, or conversely, the receiving apparatus 2 may use the utilization policy, for example. The providing side device 1 may agree on what is read from the storage means 21 and presented, or both parties agree after confirming the agreement between the policies presented by both parties, or through a process such as partial correction or negotiation thereof. But you can.

  When the agreement is confirmed (step S23: “YES”), the agreement information generating means 20 of the providing-side device 1 as shown in FIG. 4 shows predetermined agreement identification information for identifying the confirmed agreement (FIG. 4). In this example, “a123”) is generated (step S24), and the generated agreement identification information is stored in the policy agreement storage unit 24 in association with the policy for confirmation (step S25). In this embodiment, the agreement information generation means 20 combines elements unique to the individual receiving device 2 with the agreement identification information using a hash function, or only the providing device 1 uses the agreement identification information based on the asymmetric encryption or other encryption method. Embodiments in which predetermined authentication information (such as an identification ID) for authenticating the receiving device 2 is incorporated into the agreement identification information using a processing algorithm such as enabling the receiving device 2 to be identified, but this processing is omitted Is also possible.

  Subsequently, when the confirmation agreement transmitting unit 30 of the providing side device 1 transmits the agreement identification information for identifying the agreement confirmed as described above to the receiving side device 2, in the receiving side device 2, the confirmation agreement receiving unit 32 Then, the agreement identification information transmitted from the confirmation agreement transmitting means 30 of the providing side device 1 is received (step S12), and the agreement identification information received from the providing side device 1 in this way is stored in the agreement information storage means 33 ( Step S13). The agreed policy may be transmitted together with the agreement identification information, so that the final agreement content can be easily confirmed afterwards even if negotiation or partial correction is made during the agreement process.

[2-2. Processing when providing personal information]
Thereafter, when the receiving device 2 tries to receive provision of personal information from the providing device 1, the agreement information transmitting means 42 of the receiving device 2 uses the agreement identification information stored in the agreement information storage means 33. In response to the request for personal information, the information is transmitted to the providing apparatus 1 (step S14). Here, “in relation to the request for personal information” means that, for example, the receiving device 2 side may attach the corresponding agreement information from the beginning and transmit the request for personal information. A process can also be assumed.

  That is, when the request receiving unit 37 receives a request for personal information from the information requesting unit 36 of the receiving side device 2, the agreement information requesting unit 40 of the providing side device 1 responds to the personal information related to the request. Requesting the agreement information from the receiving device 2, the agreement information transmitting means 42 of the receiving device 2 receives the agreement information from the agreement information storage means 33 and transmits it to the providing device 1 (step S14). ).

  In the providing apparatus 1, the agreement information receiving means 45 receives the agreement identification information transmitted from the receiving apparatus 2 in connection with the request for personal information as described above (step S27), and the agreement information verification means 50 The agreement identification information received from the receiving device 2 is verified (step S28). This verification is performed when the received agreement identification information is compared with the corresponding agreement identification information stored in the policy agreement storage means 24, or when the electronic signature is attached with the private key of the receiving device 2 May be any process such as verifying it with the corresponding public key to ensure the authenticity of the other party.

  When the verification result is affirmative, such as when the received agreement identification information matches the agreement identification information in the policy agreement storage unit 24 (step S29: “YES”), the access control unit 60 A series of processes necessary for reading the personal information related to the policy corresponding to the agreement identification information from the personal information storage means 55 and transmitting it to the receiving apparatus 2 (step S31) is executed (step S30). The contents of these series of processes are free, and the series of processes may be the transmission process itself, and as another example, login for logging in to the providing apparatus 1 from the receiving apparatus 2 to receive information. By including the display of the authentication processing screen such as a screen in this processing, it is possible to condition the policy agreement and the verification of the agreement identification information for the access control from the receiving device 2 to the personal information held by the providing device 1 it can. Of course, it is not excluded to log in in advance prior to the transmission of the agreement identification information related to personal information.

  Based on the series of processes, in the receiving device 2, the personal information receiving means 62 receives the personal information transmitted from the providing device 1 in response to the transmitted agreement identification information (step S31) (step S31). S15), which is utilized by the utilization means 16 and stored in the personal information storage means 65 according to the agreed information handling policy. Use of personal information includes advertisement distribution and data analysis. If the confirmation of the agreement (step S23) or the verification of the agreement identification information (step S29) fails (respectively “NO”), the providing device 1 and the receiving device 2 perform error processing according to each.

[2-3. Policy determination in the agreement)
When it is going to agree about a policy between the providing side apparatus 1 and the receiving side apparatus 2 as mentioned above, for example, if both policies are compared and the relationship between both is determined and there is a predetermined commonality There may be cases where consent is established. Such a determination can be performed by either the providing side device 1 or the receiving side device 2, but an example in which the policy determination unit 1a of the providing side device 1 determines the relationship between the two policies will be described below.

  Here, the function of the policy determination apparatus realized by the policy determination unit 1a is basically to determine the relationship between a certain policy and a higher-level policy. This function is, for example, the metadomain D01 in FIG. Is the providing apparatus 1 and the current domain D11 is the receiving apparatus 2, the policy P01 corresponding to the providing apparatus 1 (metadomain D01) and the receiving apparatus 2 (present domain D11) for personal information to be transferred This can be applied to determining the relationship with the policy P11 to be performed.

  Also, it is possible to determine the relationship between domains that are common within the company and common to all personal information, that is, policies that are applicable, and policies that specialize in the contents of individual business divisions or specific personal information. Considering this policy as a combination of internal company policies and business unit policies in this way, we can further consider application partners such as meta-domains and sub-domains to determine relationships with supplier policies. Various combinations are possible.

[2-4. (Basic policy judgment process)
A processing procedure as a unit when the policy determination unit 1a determines a relationship between policies as described above is shown in the flowchart of FIG. 6 (the description in parentheses in FIG. 6 will be described later). That is, first, the determination target acquisition unit 11 acquires a policy to be determined (referred to as “determination policy”) and a target corresponding to the determination policy (step S41). For example, in the example of FIGS. 2 and 3, if the policy ID of the policy to be determined is P11, the current domain D11 corresponding to the policy P11 is acquired. Subsequently, the hierarchy specifying means 12 has a higher hierarchy in the hierarchy relationship stored in the hierarchy storage means 17 (FIG. 3) with respect to the acquired object (for example, this domain D11) (here, the metadomain). D01) is identified as a high-order object (step S42).

  Subsequently, the policy specifying unit 13 sets a higher policy (policy P01 in the example of FIG. 2) that is a policy associated with the specified higher level target (here, the metadomain D01) in the management policy storage unit 18. When it is specified as the other party policy to be determined (step S43), the relationship determining unit 14 determines the policy to be determined (here, policy P11) and the identified partner policy (in this case, the policy P01 which is the higher level policy). (Step S44), and the result output means 15 outputs, for example, the agreement confirmation means 10 or the like (step S45).

  In addition, not only a high-order object but a policy corresponding to the object of the lower hierarchy side can also be determined as a partner policy (in parentheses in FIG. 6). In this case, the hierarchy specifying means 12 is a target (for example, subdomain D21) that is a lower hierarchy in the hierarchical relationship stored in the hierarchy storage means 17 (FIG. 3) with respect to the acquired object (for example, this domain D11). , D22, D23...) As lower targets (step S42), and the policy specifying unit 13 determines a lower policy that is a policy associated with the specified lower target in the management policy storage unit 18. The partner policy is specified as the partner policy (step S43), and the relationship determination unit 14 determines the relationship between the policy to be determined and the specified partner policy (in this case, the lower policy) (step S44).

  The policy determination as described above is not limited to the same domain as illustrated in FIG. 3, and the policy determination can be performed with another domain. For example, in the organization of company A with the domain illustrated in FIG. 3, when the policy of the personal information provided from another company B by designating the department of this domain D11 is the judgment policy, the judgment policy derived from this company B 3 is followed by the hierarchical relationship of FIG. 3, for example, the company-wide common policy corresponding to the meta domain D01 as well as the current domain D11 of the A company, and the departments and staffs corresponding to the sub domains D21, D22,. The relationship can be determined using the individual policy or the like as the partner policy. Note that the upper and lower hierarchies are basically viewed one up (or lower), but may be viewed further (or lower) just in case.

[2-5. Policy example)
Next, an example of the policy is shown. For example, it is assumed that the meta policy (assumed to be pm1), which is the higher policy of the determination policy, is as follows.

<Metapolis pm1>
Rule (
Conditions (
condition (u1.isa (S)) &&
condition (u2.isa (S)) &&
condition (u1.owns (data)) &&
condition (u1.consents (a)) &&
condition (a.isa (Actions)) &&
condition (a! = “send (u1, u2, data)”)
)
Action (
¬ do (a)
)
)

  Here, each of the determination policy and the partner policy includes a condition description describing one or more conditions and an action description describing an action corresponding to the condition description. For example, in the metapolicy pm1 above, each “condition ()” surrounded by “Conditions ()” is a condition description, and the corresponding action description is “Action ()”. That is, if the logical expressions described in all “condition ()” surrounded by “Conditions ()” are true, the action in “Action” can be executed.

  In this example, each condition description is composed of a variable, a descriptor, and an argument. For example, “u1” in the first “condition ()” is a variable name, “.isa ()” is a descriptor, for example “a.isa (b)” and “a belongs to b”. ". Here, “S” represents a set of subjects (people), so “u1.isa (S)” means “variable u1 belongs to set S”. Since “&&” represents AND, in the above example, “Action ()” is applied when the six condition descriptions are satisfied at the same time. Also, “a.owns (b)” means “a owns b”, and “u1.owns (data)” means “variable u1 owns (includes) data”. .

  “Actions ()” is an action description representing a set of action character strings. “! =” Is the same as not equal. Further, “¬” represents a negative logical operation, and in the above, execution of the action a is prohibited when the condition description is satisfied.

Another meta-policy example is shown.

<Metapolis pm2>
Rule (
Conditions (
condition (u.isa (S)) &&
condition (u.owns (att)) &&
condition (a.isa (Actions)) &&
condition (a == “manage (att)”) &&
condition (name.isa (att)) &&
condition (address.isa (att))
)
Action (
do (a)
)
)

  In this meta-policy pm2, as in the above-mentioned meta-policy pm1, if the logical expressions expressed by all the condition descriptions “condition ()” surrounded by “Conditions ()” are true, the action in “Action ()” Can be executed. That is, “u.isa (S)” (user u is included in “Subject” set S), “u.owns (att)” (user u owns attribute information set “att”), “ a == “manage (att)” ”(the action a included in the action set“ Actions ”is“ managing the attribute att ”), and“ name.isa (att) ”“ address.isa (att) ” ”(When“ name ”and“ address ”are included in the“ att ”), the action a may be executed by the action description“ Action (do (a)) ”.

[2-6. Judgment of relationship
The criteria and method for determining the relationship between policies are arbitrary, and it is sufficient to use conventional techniques such as linguistic processing and character string processing as appropriate, and pay attention to semantics for comparison and determination. As an example, the determination of commonality between individual condition descriptions is a unit. For example, taking the commonality between the first condition description “u1.isa (S)” in the metapolicy pm1 and the first condition description “u.isa (S)” in the metapolicy pm2, for example, the variable name “u1 If the variable names are normalized by preliminarily defining the commonality between “u” and “u”, the remaining portions are exactly the same, and the commonality between the two can be recognized. The commonality of descriptors and arguments can be determined in the same way.

  Then, the condition descriptions of each of the two policies are judged based on permutation combinations and partial commonality (variables, descriptors or arguments are the same), etc., and if all are common, they are equivalent (convergence) and all are different. Judgment based on set theory or other criteria such as different (divergence), inclusion (limitation or expansion) if one adds a condition to the other, partial overlap if some conditions are common May be used as appropriate for other agreements and other processing. In addition, although the kind of relationship between such policies is illustrated in FIG. 7, the kind of relationship may be defined freely elsewhere.

[2-7. (Application of judgment results)
Based on the above determination, a new policy can be created or edited by combining two policies. In this case, the relationship determination unit 14 determines the type of relationship (equivalent, different, inclusion, partial overlap, etc.) between the condition descriptions corresponding to the common action description among the determination policy and the partner policy, and creates the policy. The means 16 creates a new policy by combining the condition description of the determination policy and the condition description of the other party policy or edits at least one of the determination policy and the other party policy in accordance with the determined relationship.

For example, consider a case where a domain-specific policy sp having an underlined condition description exists as a policy related to the same action as the metapolicy pm1.

<Domain specific policy sp>
Rule (
Conditions (
condition (medical_records.isa (data))
)
Action (
¬ do (a)
)
)

Consider a case where this domain-specific policy sp becomes the following domain policy dp by inheriting the contents of the meta-policy pm1. In this domain policy dp, the condition description other than the underlined portion is inherited from the meta policy pm1.

<Domain policy dp>
Rule (
Conditions (
condition (u1.isa (S)) &&
condition (u2.isa (S)) &&
condition (u1.owns (data)) &&
condition (u1.consents (a)) &&
condition (a.isa (Actions)) &&
condition (a! = “send (u1, u2, data)”) &&
condition (medical_records.isa (data))
)
Action (
¬ do (a)
)
)

  Actually, a policy corresponding to a personal information group as a unit such as delivery is a policy in which a necessary number of policies (referred to as “unit policies”) such as the domain policy dp are collected. A group. As an example, as shown in the conceptual diagram of FIG. 8, instantiate a unit policy Pm that constitutes a metadomain policy stored in the array pols (m) (specify variable names, arguments, etc. according to the domain) Then, consider the case of incorporating into a domain policy such as this domain stored in the array pols (d).

  Then, each unit policy in the array pols (d) obtained as a result of incorporation is determined as the determination policy Pk, the relationship with the partner policy Pj is determined, and the determination policy Pk is edited according to the determined relationship. . Here, the partner policy Pj is a unit policy that constitutes a policy of a partner of personal information delivery, a policy of a subdomain, etc. (herein referred to as a “domain specific policy”) as in the receiving device 2, for example. Suppose it is stored in pols.

  The sequence of these processes is shown in FIG. 9 (line 1 to line 26), and the contents are shown in the flowchart of FIG. That is, first, a domain policy storage array pols (d) for storing a domain policy is generated (step S51, row 1 in FIG. 9), a meta policy corresponding to the upper parent domain is acquired, and the storage array pols (m) (Step S52, line 2 in FIG. 9). Then, one unprocessed metapolicy is acquired (step S53, line 3 in FIG. 9), the metapolicy is instantiated (step S54, line 5 in FIG. 9), and the instantiated metapolicy is converted into the domain policy storage array pols (d ) (Step S55, line 6 in FIG. 9) is repeated until all the metapolicies have been processed (step S56, line 3 in FIG. 9).

  When all the metapolicies have been processed (step S56: “YES”, line 8 in FIG. 9), the process proceeds to the process of determining the relationship between the policies and editing the policy (step S57). Is more specifically shown in the flowchart of FIG. This process is based on the premise that the domain-specific policy is stored in the array pols beforehand (FIG. 8, line 9 in FIG. 9), and the following process shown between step S71 and step S81 is repeated for all determination policies. (Rows 10 to 25 in FIG. 9) Specifically, every time one determination policy Pk is acquired (Step S72), the processing of Steps S73 to S80 is performed for all counterpart policies Pj.

  That is, in determining the relationship between the determination policy Pk and the partner policy Pj, first, if the determination policy Pk and the partner policy Pj are different (step S74: “YES”, line 13 in FIG. 9), the domain policy storage array pols. The determination policy Pk is deleted from (d) (step S75, line 14 in FIG. 9). If the determination policy Pk extends the partner policy Pj (step S76: “YES”, line 15 in FIG. 9), the determination policy Pk is deleted from the domain policy storage array pols (d) (in FIG. 9). Line 16) Pj is added (step S77, line 17 in FIG. 9). If the determination policy Pk and the partner policy Pj partially overlap (step S78: “YES”, line 18 in FIG. 9), the determination policy Pk is deleted from the domain policy storage array pols (d) (in FIG. 9). (Line 20) On the other hand, a common part of Pk and Pj is generated (line 19 in FIG. 9) and added (step S79; line 21 in FIG. 9).

  Through the processes shown in FIGS. 9 to 11, variable names and values are mutually expressed, such as a domain policy inheriting the metadomain policy illustrated in FIG. 8 and a domain-specific policy of another domain. Even among a plurality of policy groups that may have a difference, it is possible to realize a relationship in an agreeable state from which deviations and contradictions are removed by determining a semantic relationship based on semantics and editing based on the semantic relationship determination.

[3. effect〕
As described above, in the present embodiment, as processing that is procedural as a protocol or the like between devices that exchange personal information (for example, FIG. 5), an agreement is made in advance regarding an information handling policy. Applying access control such as information exchange on the condition of confirmation, filtering to block the transition to the authentication processing screen, which is the previous stage of information exchange unless it can be confirmed, or filtering so that information exchange processing is not performed unless confirmation is possible Thus, for example (step S29), the agreement and confirmation of the policy regarding the delivery of personal information can be made into a procedure, and the effectiveness and efficiency of policy application can be improved.

  In particular, in the present embodiment, information for authenticating the receiving device is incorporated into the agreement identification information using a processing algorithm such as a hash function or a cipher (for example, step S24), so that the providing device previously receives the receiving device. Therefore, the process of authenticating the personal information using the agreement identification information is speeded up and made efficient.

  In the present embodiment, as described above, when there is a policy corresponding to each target in a hierarchical relationship, such as the entire company and a specific department, all related parties and individual related parties (for example, FIG. 2), The hierarchical relationship is associated in advance (for example, FIG. 3). Then, for a policy corresponding to an arbitrary target such as a specific department or individual relationship destination, the higher level target in the hierarchical relationship is identified based on the target corresponding to the policy, and it is determined whether there is a conflict with the higher level policy corresponding thereto. Output (for example, FIG. 6).

  As a result, when creating or modifying a new policy, considering an agreement, etc., even if multiple policies related to information transfer have a hierarchical structure, the relationship with the new policy can be determined by tracing them manually. The load is eliminated, and the related policy corresponding to the hierarchical relationship can be appropriately processed. In particular, the accuracy, speed, and efficiency of the processing can be greatly improved, and automatic processing for exchanging information is facilitated.

  Further, in the present embodiment, the lower-level policy corresponding to the lower-level target of the given target is also determined (for example, in parentheses in FIG. 6), so that the policy of personal information exchanged as a company for each subordinate organization It becomes possible to carry out appropriate processing in a more multifaceted manner with respect to the policy, such as checking whether there is a contradiction with the policy.

  In addition, in the present embodiment, for the determination policy and the partner policy related to the same action, the type of relationship between the condition descriptions (for example, FIG. 7) is determined, and the condition description of each of the determination policy and the partner policy is determined according to the determined relationship. By creating a new policy by editing the policies or editing the policy (for example, FIGS. 9 to 11), a policy that does not contradict the upper hierarchy or the lower hierarchy can be generated for any hierarchy (for example, FIG. 8). The accuracy, speed, and efficiency of the creation and consensus can be greatly improved, and the processing related to information exchange can be automated more easily.

[4. Other embodiments]
In addition, the said embodiment is only an illustration and this invention includes what is illustrated below and other embodiment other than that. For example, the determination of the relationship between policies according to the present invention is not limited to personal information, but a relationship between a plurality of policies concerning information may be determined for trade secrets and other information in general. In the above embodiment, an example of editing a domain policy that is a determination policy according to the determined relationship has been described. However, according to the determined relationship, the condition description of the determination policy and the condition description of the partner policy are changed. If a new policy is created by combining them, more dynamic policy processing can be performed.

  In addition, each element such as means relating to the present invention is not limited to an arithmetic control unit of a computer, but may be realized by other information processing mechanisms such as an electronic circuit based on wired logic or the like. Each configuration diagram, data diagram, flowchart diagram, and the like are merely examples, and the presence / absence of each element, the arrangement order thereof, the execution order of each process, specific contents, and the like can be appropriately changed. For example, the policy determination unit 1 a is not limited to the providing device 1 and may be provided in the receiving device 2.

  In addition, the providing side device and the receiving side device can be realized by using a plurality of devices such as servers as constituent elements, and each storage means can be realized by a separate server device or system, or individual processing means. In general, the configuration is realized by combining a plurality of servers. Depending on the function, the configuration can be flexibly changed, for example, by calling an external platform or the like with an API (application program interface) or network computing (so-called cloud or the like).

DESCRIPTION OF SYMBOLS 1 Provision side apparatus 1a Policy determination part 2 Receiving side apparatus 6 Operation control part 7 Storage device 8 Communication means 9 Agreement request reception means 10 Agreement confirmation means 11 Determination object acquisition means 12 Hierarchy specification means 13 Policy specification means 14 Relationship determination means 15 Result Output means 16 Policy creation means 17 Hierarchical storage means 18 Management policy storage means 20 Agreement information generation means 21 Utilization policy storage means 22 Agreement request transmission means 24 Policy agreement storage means 30 Confirmation agreement transmission means 32 Confirmation agreement reception means 33 Agreement information storage means 36 information request means 37 request reception means 40 agreement information request means 42 agreement information transmission means 45 agreement information reception means 50 agreement information verification means 55 personal information storage means 60 access control means 62 personal information reception means 65 personal information storage means D01 metadomain D11 This domain D21, D22, D23 Domain N communication network

Claims (5)

In an information processing system having a personal information providing device and a receiving device,
The providing device includes:
Personal information storage means for storing the personal information to be provided;
Receiving a policy regarding the handling of the personal information from the receiving side device, giving a policy regarding the handling of the personal information to the receiving side device, and a policy regarding the handling of the personal information of the providing side device the contents part of the contents of the policy on the handling of the said personal information receiving side apparatus has or entirely to ensure that a common, at least one of, in between the receiving-side apparatus and the agreement confirmation means to confirm the agreement,
Agreement information generating means for generating predetermined agreement identification information for identifying the confirmed agreement;
Policy agreement storage means for storing the generated agreement identification information in association with the policy related to the confirmation;
Confirmation agreement transmitting means for transmitting the agreement identification information to the receiving device;
Agreement information receiving means for receiving the agreement identification information transmitted from the receiving device in relation to the request for personal information;
Agreement information verification means for verifying the agreement identification information received from the receiving device;
An access control means for executing a series of processes necessary for transmitting the personal information related to the policy corresponding to the agreement identification information to the receiving device when the result of the verification is positive;
Have
The receiving device is:
Confirmation agreement receiving means for receiving the agreement identification information transmitted from the confirmation agreement transmitting means of the providing side device;
Agreement information storage means for storing the agreement identification information received from the provider device;
Agreement information transmitting means for transmitting the agreement identification information stored in the agreement information storage means to the providing apparatus in association with the request for personal information;
Personal information receiving means for receiving the personal information transmitted from the providing device in response to the transmitted agreement identification information;
An information processing system comprising:   The information processing system according to claim 1, wherein the agreement information generation unit incorporates predetermined authentication information for authenticating the receiving device into the agreement identification information. In an information processing method in an information processing system having a providing side device including a personal information storage unit storing personal information to be provided, and a receiving side device,
The providing side device receives a policy regarding the handling of the personal information from the receiving side device, assigns a policy regarding the handling of the personal information to the receiving side device, and the individual possessed by the providing side device The receiving side, which is at least one of confirming that a part or all of a policy content relating to information handling and a policy content relating to handling of personal information possessed by the receiving side device are common. and the agreement confirmation process to confirm the agreement between the devices,
An agreement information generation process in which the providing device generates predetermined agreement identification information for identifying the confirmed agreement;
A process in which the providing device stores the generated agreement identification information in a predetermined policy agreement storage unit in association with the policy related to the confirmation;
The providing-side apparatus, a confirmation agreement transmitting process of transmitting the agreement identification information for identifying to the receiving side device confirmed the agreement,
An agreement information receiving process in which the providing device receives the agreement identification information transmitted from the receiving device in connection with the request for personal information;
An agreement information verification process in which the providing device verifies the agreement identification information received from the receiving device;
When the verification result is affirmative, the providing device executes a series of processes necessary for transmitting the personal information related to the policy corresponding to the agreement identification information to the receiving device. Access control processing;
Run
The acceptance side apparatus, a confirmation agreement reception process of receiving the agreement identification information transmitted by said check agreement transmission process of the providing-side apparatus,
A process in which the receiving device stores the agreement identification information received from the providing device in a predetermined agreement information storage unit;
An agreement information transmission process in which the receiving device transmits the agreement identification information stored in the agreement information storage means to the providing device in association with the request for personal information;
The acceptance side apparatus, and personal information reception process of receiving the personal information transmitted from the providing side device corresponding to the transmitted said agreed identification information,
The information processing method characterized by performing. Computer
Personal information storage means for storing personal information to be provided;
Receiving a policy regarding the handling of the personal information from another computer, giving a policy regarding the handling of the personal information to the other computer, and contents of the policy regarding the handling of the personal information possessed by the computer Confirming an agreement with the other computer that is at least one of confirming that a part or all of the policy regarding the handling of the personal information possessed by the other computer is common Agreement confirmation means,
Agreement information generating means for generating predetermined agreement identification information for identifying the confirmed agreement;
Policy agreement storage means for storing the generated agreement identification information in association with the policy related to the confirmation;
Confirmation agreement transmitting means for transmitting the agreement identification information to the other computer;
Agreement information receiving means for receiving the agreement identification information transmitted from the other computer in association with the request for personal information;
Agreement information verification means for verifying the agreement identification information received from the other computer;
An access control means for executing a series of processes necessary for transmitting the personal information related to the policy corresponding to the agreement identification information to the other computer when the result of the verification is positive;
A program characterized by functioning as Computer
The other computer receives a policy regarding the handling of personal information from the computer, the other computer grants a policy regarding the handling of the personal information to the computer, and At least one of confirming that a part or all of a policy content regarding the handling of personal information possessed by another computer and a policy content regarding the handling of personal information possessed by the computer are common. Confirmation agreement receiving means for receiving predetermined agreement identification information for identifying an agreement between the computer and the other computer;
Agreement information storage means for storing the agreement identification information received from the other computer;
Agreement information transmission means for transmitting the agreement identification information stored in the agreement information storage means to the other computer in association with the request for the personal information;
Personal information receiving means for receiving the personal information transmitted from the other computer in response to the transmitted agreement identification information;
A program characterized by functioning as

Images