JP5712102B2 - Log collection system, method and program - Google Patents

Description

  The present invention relates to a log collection system, method, and program for collecting logs.

In general, in an information system that handles personal information of a user, a log (hereinafter referred to as access) that is output when the user uses the information system as a means of auditing whether the personal information is properly handled. Log)). In many cases, the access log includes a record of access regarding personal information such as when and who handled what information and how.
On the other hand, in an information system that realizes a series of processes for personal information by cooperation of a plurality of servers, an access log is output for each server. Therefore, in order to know how the user's personal information was handled in a series of processing, the access logs output by each server can be collected in one place, and the access logs can be audited in time series order. It is desirable to do. As a technique for collecting access logs from a plurality of servers and performing state management, there is a technique for collecting logs based on integrated user authentication and access control, and performing monitoring, auditing, and analysis (for example, non-patent literature). 1 and Non-Patent Document 2).

Kondo et al., “Audit log tracking method using multi-version parallel processing control of role-based access control information”, Journal of Information Processing Society of Japan, Database 46 (SIG_18 (TOD_28)), December 15, 2005, p. 103-115 “Latest Trends in Integrated Log Management-Intelligent Security Measure Part 5”, [online], Internet <URL: http://it.impressbm.co.jp/e/2009/05/26/772>

However, the rules for assigning user identifiers (hereinafter also referred to as user IDs), which are information for uniquely identifying users, are different among a plurality of servers subject to log collection, for example, because the management entities of the servers are different. There is a possibility that the granularity of information indicating the user attribute such as name is different for each server. In this case, it is difficult to specify access by the same user from the access log collected in one place.
More generally, it is assumed that a specific person in charge analyzes and browses the collected access logs in a centralized manner, so use the history of accessing your personal information output in the access logs. It is not considered to be viewed by the person himself. In addition, the access log may include the user's name, nickname, etc. as the user ID. When collecting an access log including such personal information via the network, there is a security risk such as eavesdropping. Increase.

  The present invention has been made paying attention to the above circumstances, and the object of the present invention is to collect a log centrally and safely, and a log collection system, method and program capable of efficiently browsing a log by a user Is to provide.

  In order to achieve the above object, one aspect of the present invention is to store a first device that collects log data related to access to information by a user, one or more second devices that provide the log data, and an identifier. A first device identifier for identifying a user, and a first temporary identifier whose cryptographic strength is higher than that of the first user identifier. And first storage means for storing user attribute information different from the first user identifier in association with each other, request means for generating a request signal for requesting the log data to the second device, And the second device includes a second user identifier that is an identifier indicating the same user as the first user identifier, and a second temporary identifier that has higher encryption strength than the second user identifier. Associate and store A second storage means, an acquisition means for acquiring the log data including at least the second user identifier in response to the request signal from the first device, and the log with reference to the second storage means First conversion means for converting a second user identifier included in the data into a corresponding second temporary identifier to obtain first conversion log data including the second temporary identifier, the first device Further comprises first receiving means for receiving the first conversion log data from the second device, wherein the third device includes the second temporary identifier included in the first conversion log data from the first device. Referring to the second storage means, the third storage means for storing the first temporary identifier and one or more second temporary identifiers in association with each other, and referring to the third storage means, the first conversion Second temporary identifier included in log data Extraction means for extracting the corresponding first temporary identifier, wherein the first device receives the extracted first temporary identifier from the third device, and the first storage means. The second conversion means for converting the second temporary identifier included in the first conversion log data into attribute information corresponding to the extracted first temporary identifier to obtain the second conversion log data; And the like.

  That is, according to the present invention, logs can be collected centrally and safely, and a user can browse the logs efficiently.

The block diagram which shows the log collection system which concerns on this embodiment. The sequence diagram which shows the log collection process in the log collection system which concerns on this embodiment. The block diagram which shows the usage example of the log collection system which concerns on this embodiment. The figure which shows an example of the table stored in the user information storage part of a log collection server. The figure which shows an example of the table stored in the user information storage part of the information provision server as a (a) hospital server and (b) clinic server. The figure which shows an example of the table stored in the temporary identifier storage part of a cooperation server. The figure which shows the output example of the log data in the information provision server as a (a) hospital server and (b) clinic server. The figure which shows the example of an output of the conversion log data in the information provision server as a (a) hospital server and (b) clinic server. The figure which shows an example of the table stored in the log storage part in a log collection server.

Hereinafter, a log collection system, method, and program according to an embodiment of the present disclosure will be described in detail with reference to the drawings. Note that, in the following embodiments, the same numbered portions are assumed to perform the same operation, and repeated description is omitted.
A log collection system according to the present embodiment will be described with reference to the block diagram of FIG.
A log collection system 100 according to the present embodiment includes a log collection server 101, an information providing server 111, and a cooperation server 121. In addition, the log collection server 101, the information providing server 111, the cooperation server 121, and the user terminal 141 are connected via the network 131. In addition, although the case where the log collection server 101 and the cooperation server 121 were each separated is assumed, not only this but the log collection server 101 and the cooperation server 121 may be united. Further, in the example of FIG. 1, there is one information providing server 111, but a plurality of information providing servers 111 may exist.

The information providing server 111 collects logs in its own server, and transmits log data to the log collection server 101 in response to a request from the log collection server 101 or every predetermined period. The log data is a log related to access to information by the user. In this embodiment, the log data is a log output when using an information system that handles personal information of the user (hereinafter also referred to as an access log). However, the present invention is not limited to this, and a log or the like when using a system that handles information that requires a high security strength such as confidential information or confidential information may be used.
The cooperation server 121 stores the temporary identifiers of the log collection server 101 and the information providing server 111 in association with each other. The temporary identifier indicates an identifier whose encryption strength is higher than that of the user identifier for uniquely identifying the user.
The log collection server 101 receives log data from one or more information providing servers 111 and manages each log in association with each other based on a temporary identifier stored in the cooperation server 121.

The network 131 is a line used for interconnecting the log collection server 101, the information providing server 111, and the cooperation server 121, and a general wired network or wireless network may be used.
The user terminal 141 is, for example, a PC or a mobile terminal. The user can browse his / her access log by referring to the log data managed by the log collection server 101 via the user terminal 141.

Details of the log collection server 101, the information providing server 111, and the cooperation server 121 will be described below.
The log collection server 101 includes a user information storage unit 102, a log request unit 103, a temporary identifier request unit 104, a name conversion unit 105, a log storage unit 106, a log deletion unit 107, and a log browsing unit 108.
The user information storage unit 102 associates a user identifier (also referred to as a first user identifier), a temporary identifier (also referred to as a first temporary identifier), and attribute information in the log collection server 101 with each other. For example, it is stored in a table format. The first user identifier may be a number or other symbol for uniquely identifying the user. The temporary identifier may be, for example, a number or other symbol randomly generated in advance in association with the first user identifier, may be generated by encrypting the first user identifier, or may be generated by using SAML (Security Association Markup). (Language) may be used. Unlike the first user identifier, the attribute information is information that can easily identify the user, and examples thereof include a name, a nickname, and a unified name in the category to which the user belongs.
The user information storage unit 102 only needs to associate at least the first user identifier, the temporary identifier, and the attribute information described above, and may store other information in association with each other.

The log request unit 103 generates a log request signal for requesting log data from the information providing server 111. The log request unit 103 receives log data (also referred to as first conversion log data) converted from the information providing server 111. The first conversion log data is log data generated by the information providing server 111 and will be described in detail later. In addition, the log request unit 103 generates an acquisition request signal for acquiring a temporary identifier in the log collection server 101 corresponding to a temporary identifier (also referred to as a second temporary identifier) in the information providing server 111 included in the conversion log data. Generate. Thereafter, the log request unit 103 receives a temporary identifier in the log collection server 101 corresponding to the temporary identifier in the information providing server 111 from the temporary identifier request unit 104 described later.
The temporary identifier request unit 104 receives the acquisition request signal and the temporary identifier in the information providing server 111 included in the conversion log data from the log request unit 103. The temporary identifier request unit 104 transmits the temporary identifier in the information providing server 111 to the cooperation server 121 via the network 131. Further, the temporary identifier request unit 104 receives a temporary identifier in the log collection server 101 corresponding to the transmitted temporary identifier in the information providing server 111 from the cooperation server 121.

The name conversion unit 105 receives the conversion log data and the temporary identifier in the log collection server 101 corresponding to the temporary identifier in the information providing server 111 from the log request unit 103, respectively. The name conversion unit 105 extracts attribute information corresponding to the temporary identifier in the log collection server 101 from the user information storage unit 102, converts the temporary identifier included in the conversion log data into the extracted attribute information, and converts the attribute information. Log data (also referred to as second conversion log data) is obtained.
The log storage unit 106 receives the second conversion log data from the name conversion unit 105 and stores it.

The log deletion unit 107 deletes log data stored in the log storage unit 106. For example, log data for a specified period is deleted, or log data for a specified user is deleted. The timing at which log data is deleted may be manually performed by the user, or may be executed after a predetermined time has elapsed or at a predetermined time interval.
The log browsing unit 108 extracts partial log data from the log data stored in the log storage unit 106 in accordance with a user input, converts the partial log data into a format that can be viewed by the user, and the log data Is transmitted to the user terminal 141 via the network 131. 1 shows an example in which partial log data is extracted from the log storage unit 106 and the log data is transmitted to the user terminal 141. However, the log browsing unit 108 directly receives the second conversion log data from the name conversion unit 105. It is also possible to extract the partial log data and display the user log data in real time.

Next, the information providing server 111 includes a user information storage unit 112, a log acquisition unit 113, and a temporary identifier conversion unit 114.
The user information storage unit 112 associates a user identifier (also referred to as a second user identifier) in the information providing server 111 with a temporary identifier, and stores such information in a table format, for example. The user information storage unit 112 only needs to associate at least the second user identifier and the temporary identifier, and may store other information in association with each other.
The log acquisition unit 113 receives a log request signal from the log collection server 101 and acquires unacquired log data from the log data 115.
The temporary identifier conversion unit 114 receives log data from the log acquisition unit 113 and a temporary identifier corresponding to the second user identifier included in the log data from the user information storage unit 112, respectively. The temporary identifier conversion unit 114 converts the second user identifier in the log data into a temporary identifier, and obtains converted log data. Thereafter, the temporary identifier conversion unit 114 returns the converted log data to the log collection server 101 via the network 131.

Next, the cooperation server 121 includes a temporary identifier storage unit 122 and a temporary identifier extraction unit 123.
The temporary identifier storage unit 122 associates the user identifier in the linkage server 121, the temporary identifier in the log collection server 101, and the temporary identifier in the information providing server 111 with each other, for example, in a table format. The association of the temporary identifier is performed by, for example, verifying by password authentication whether or not the user associated with the temporary identifier in the information providing server 111 is the same user as the temporary identifier in the log collection server 101, and the same user If so, a general registration process of associating each temporary identifier may be performed, and the description thereof is omitted here.
The temporary identifier extraction unit 123 receives the temporary identifier in the information providing server 111 from the log collecting server 101, extracts the temporary identifier in the log collecting server 101 corresponding to the temporary identifier in the information providing server 111, and outputs the log collecting server 101.

Next, log collection processing in the log collection system according to the present embodiment will be described with reference to the sequence diagram of FIG.
In step S <b> 201, the log request unit 103 of the log collection server 101 requests log data from the information providing server 111.
In step S202, the log acquisition unit 113 of the information providing server 111 acquires log data.
In step S203, the temporary identifier conversion unit 114 of the information providing server 111 converts the second user identifier in the log data into a corresponding temporary identifier, and obtains converted log data.
In step S <b> 204, the information providing server 111 transmits the conversion log data to the log collection server 101.

In step S205, the log collection server 101 receives the conversion log data, and the temporary identifier request unit 104 of the log collection server 101 corresponds to the temporary identifier in the information providing server 111 included in the conversion log data. A temporary identifier in the log collection server 101 is requested.
In step S <b> 206, the cooperation server 121 receives the temporary identifier in the information providing server 111 from the log collection server 101, and the temporary identifier extraction unit 123 of the cooperation server 121 corresponds to the log collection server 101 corresponding to the temporary identifier in the information provision server 111. And the temporary identifier in the log collection server 101 is transmitted to the log collection server 101.
In step S207, the name conversion unit 105 of the log collection server 101 converts the temporary identifier of the log collection server 101 into corresponding attribute information (for example, the name of the user).
In step S208, the log storage unit 106 of the log collection server 101 stores the converted log data converted into attribute information (name). The log collection process according to this embodiment is thus completed.

  After the log collection process described above, the log browsing unit 108 extracts the user's log data in accordance with the user's input, converts it into a format that can be displayed by the browser of the user terminal 141, and transmits it. By displaying the log data converted into the name, it is possible for the user to easily determine whether or not they are the same person, and unauthorized use can be efficiently detected from the log data. In addition, by converting the user identifier into a temporary identifier, the user IDs in the log collection server 101 and the information providing server 111 are not communicated over the network, and the log is improved in security strength without eavesdropping on the user ID. Collecting can be done.

  Further, the log deletion unit of the log collection server 101 may periodically delete all or part of the log data stored in the log storage unit 106. As a result, old log data that cannot be displayed on the user terminal 141 can be deleted to reduce the amount of data, and a reduction in processing speed can be suppressed.

Next, a usage example of the log collection system according to the present embodiment will be described with reference to the block diagram of FIG. In this usage example, it is assumed that the patient has received a medical service for diagnosis at a family clinic based on the test results at the hospital.
A log collection system 300 illustrated in FIG. 3 includes a log collection server 101, a linkage server 121, a hospital server 301-1 and a clinic server 301-2. Since the log collection server 101 and the linkage server 121 perform the same operations as the log collection server 101 and the linkage server 121 shown in FIG. 1, detailed description thereof is omitted here.

  In the hospital server 301-1 and the clinic server 301-2, log data is collected from the examination data 302-1 in the hospital server 301-1 and log data is collected from the examination data 302-2 in the clinic server 301-2. However, since the other configuration is the same as that of the information providing server 111, description thereof is omitted here. In the hospital server 301-1, a log relating to access to patient examination data is recorded in log data, and in a clinic server 301-2, a log relating to access to medical data is recorded in log data.

Next, an example of the user information table stored in the user information storage unit 102 of the log collection server 101 will be described with reference to FIG.
In the user information table shown in FIG. 4, a user ID (first user identifier) 401, a (first) temporary identifier 402, and a name 403 are stored in association with each other. For example, the user ID 401 “A001” is given “aaa111bbb” as the temporary identifier 402 and the name 403 is “Taro Yamada”. Thus, the temporary identifier in the log collection server 101 is given to each user.

Next, an example of the user information table stored in the user information storage unit 112 of the information providing server 111 will be described with reference to FIG. FIG. 5A shows a table stored in the hospital server 301-1 as an example of the information providing server 111, and FIG. 5B shows a table stored in the clinic server 301-2 as an example of the information providing server 111. Indicates the table.
In the user information table of the hospital server 301-1 shown in FIG. 5A, a user ID (second user identifier) 501-1, a (second) temporary identifier 502-1, and a name 503-1 correspond respectively. Attached and stored. Specifically, the user ID 501-1 “Daaa”, the temporary identifier “hs1111”, and the name “Yamada” are associated with each other.
On the other hand, a user ID (second user identifier) 501-2 and a (second) temporary identifier 502-2 are associated with the user information table of the clinic server 301-2 shown in FIG. Stored. Specifically, the user ID 502-2 “1011” and the temporary identifier 502-2 “cl9999” are associated with each other.

Next, an example of the temporary identifier conversion table stored in the temporary identifier storage unit 122 of the cooperation server 121 will be described with reference to FIG.
The temporary identifier conversion table shown in FIG. 6 includes a user ID 601, a temporary identifier 402 in the log collection server 101, a temporary identifier 502-1 in the information providing server (hospital server) 301-1, and an information providing server (clinic office server). Temporary identifiers 502-2 at 301-2 are stored in association with each other. Specifically, the temporary identifier 402 “aaa111bbb” in the log collection server 101, the temporary identifier 502-1 “hs1111” in the information providing server (hospital server) 301-1, and the information providing server (clinician server) 301- 2 is associated with the temporary identifier 502-2 “cl9999” in FIG.

Next, an example of log data output from the information providing server 111 will be described with reference to FIG.
FIG. 7A shows an output example of the log data 700-1 in the hospital server 301-1, and FIG. 7B shows an output example of the log data 700-2 in the clinic server 301-2. Each log data 700 of FIG. 7A and FIG. 7B outputs a set of logs related to date / time, accessor, target person, target data, operation and result. In normal log data, an accessor and a target person are recorded using a user ID in each server. Specifically, in FIG. 7A, the user ID 501-1 “Daaa” of the hospital server 301-1 is recorded as the accessor, and the user ID 501-1 “Dccc” is recorded as the target person.

Next, an example of conversion log data output from the information providing server 111 will be described with reference to FIG.
FIG. 8A shows an output example of the conversion log data 800-1 in the hospital server 301-1, and FIG. 8B shows an output example of the log data 800-2 in the clinic server 301-2. As shown in FIGS. 8A and 8B, the user ID 501-1 is converted into the corresponding temporary identifier 502-1. Specifically, referring to the user information table shown in FIG. 5A, the user ID 501-1 “Daaa” is converted into the corresponding temporary identifier 502-1 “hs1111”, and the user ID 501-1 “Dccc” is changed. It is converted into the corresponding temporary identifier 502-1 “k9999”.

Next, an example of a log storage table stored in the log storage unit 106 of the log collection server 101 will be described with reference to FIG.
In the log storage table shown in FIG. 9, access date / time 901, accessor 902, target server 903, target user 904, target data 905, operation 906, and result 907 are stored in association with each other. Specifically, for example, access date 901 “2011/3/1 10:00”, accessor 902 “Taro Yamada”, target server 903 “hospital”, target user 904 “Saburo Tanaka”, target data 905 “inspection” Data ”, operation 906“ view ”, and result 907“ success ”are associated with each other. As described above, the attribute information (name here) is stored as the accessor 902 instead of the user ID and the temporary identifier, so that it can be easily and uniquely determined whether or not they are the same person.
For example, as shown in FIG. 5, the name notation input by the user may not match even within the same hospital, the organizational system is different between the hospital and the clinic, and the user IDs of patients and medical workers may be different. It is thought that there are many. According to the log collection system 300 according to the present embodiment, since it is converted into the name stored in the log collection server 101, it can be easily and uniquely determined whether or not they are the same person.

  In addition, when a patient browses a log from the log storage table as a user, partial log data of which the user is the target user 904 is extracted from all log data stored in the log storage unit 106, and the user It is displayed via the terminal 141. In addition, when a health care worker browses a log, partial log data for which he / she is an accessor 902 is similarly extracted from all log data stored in the log storage unit 106 and passed through the user terminal 141. Displayed. From the viewpoint of security, it is desirable not to display log data other than the user who has instructed the user terminal 141 to input log data browsing.

  In the above use example, it is assumed that the examination data of the hospital is browsed only by the medical staff of the hospital and the doctor of the clinic, and the clinic data of the clinic is browsed only by the doctor of the clinic. That is, in the log collection server 101, if there is an access result by a user other than a doctor and a medical worker, it can be easily and efficiently determined that there has been unauthorized use.

  According to the present embodiment described above, when log data is collected from a plurality of information providing servers that provide personal information, a temporary identifier whose cryptographic strength is higher than the user ID is used, and a user identifier included in the log data Can be converted into a temporary identifier, and further converted into attribute information such as the user's name or nickname to collect log data, so that even if the granularity of the user identifier and attribute information differs from server to server, Logs can be collected safely, and the user can easily view the logs.

  In short, the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

DESCRIPTION OF SYMBOLS 100,300 ... Log collection system, 101 ... Log collection server, 102, 112 ... User information storage part, 103 ... Log request part, 104 ... Temporary identifier request part, 105 ... Name conversion unit 106 ... log storage unit 107 ... log deletion unit 108 ... log browsing unit 111 ... information providing server 113 ... log acquisition unit 114 ... temporary Identifier conversion unit, 115 ... log data, 121 ... cooperation server, 122 ... temporary identifier storage unit, 123 ... temporary identifier extraction unit, 131 ... network, 141 ... user terminal, 301 ... Hospital server 301-2 ... Clinic server, 302-1 ... Examination data, 302-2 ... Medical data, 401, 501-1, 501-2, 601 ... User ID 402 Temporary identifier, 403 ... name, 502-1, 502-2 ... temporary identifier, 503-1 ... name, 700-1, 700-2 ... log data, 800-1, 800- 2 ... Conversion log data, 901 ... Access date / time, 902 ... Accessor, 903 ... Target server, 904 ... Target user, 905 ... Target data, 906 ... Operation, 907 ... result.

Claims (6)

A log collection system comprising a first device that collects log data related to access to information by a user, one or more second devices that provide the log data, and a third device that stores an identifier,
The first device includes:
A first user identifier for identifying a user, a first temporary identifier whose encryption strength is higher than that of the first user identifier, and user attribute information different from the first user identifier are associated with each other. First storage means for storing
Requesting means for generating a request signal for requesting the log data to the second device,
The second device includes:
Second storage means for associating and storing a second user identifier, which is an identifier indicating the same user as the first user identifier, and a second temporary identifier having an encryption strength higher than that of the second user identifier When,
An acquisition means for acquiring the log data including at least the second user identifier in response to the request signal from the first device;
Referring to the second storage means, a second user identifier included in the log data is converted into a corresponding second temporary identifier, and first converted log data including the second temporary identifier is obtained. Conversion means,
The first device includes:
A first receiving means for receiving the first conversion log data from the second device;
The third device includes:
Second receiving means for receiving the second temporary identifier included in the first conversion log data from the first device;
Third storage means for storing the first temporary identifier and one or more second temporary identifiers in association with each other;
Extraction means for extracting a first temporary identifier corresponding to a second temporary identifier included in the first conversion log data with reference to the third storage means;
The first device includes:
Third receiving means for receiving the extracted first temporary identifier from the third device;
Referring to the first storage means, the second temporary identifier included in the first converted log data is converted into attribute information corresponding to the extracted first temporary identifier to obtain second converted log data And a second conversion means.   The first apparatus further includes browsing means for extracting partial log data including the input user identifier from the second converted log data, converting the data into a viewable format, and presenting the converted log data. The log collection system according to claim 1.   3. The log collection system according to claim 1, wherein the first device further includes a fourth storage unit that stores the second conversion log data. 4.   4. The first device according to claim 1, further comprising a deletion unit that deletes at least a part of the second conversion log data by an input from a user or after a lapse of a certain period of time. The log collection system according to any one of the above items. A first user identifier for identifying a user by the first device; a first temporary identifier having a higher cryptographic strength than the first user identifier; and a user attribute different from the first user identifier Information is associated with each other and stored in the first storage means;
The first device generates a request signal for requesting log data relating to access to information by the user to the second device ;
The second device associates a second user identifier, which is an identifier indicating the same user as the first user identifier, with a second temporary identifier whose cryptographic strength is higher than that of the second user identifier. Storing in the second storage means;
The second device acquires the log data including at least the second user identifier in response to the request signal;
The second device refers to the second storage means, converts the second user identifier included in the log data into a corresponding second temporary identifier, and includes the second temporary identifier. Log data,
The first device receives the first conversion log data from the second device ;
A third device receives the second temporary identifier included in the first conversion log data;
The third device stores the first temporary identifier in association with one or more second temporary identifiers in a third storage means;
The third device refers to the third storage means to extract a first temporary identifier corresponding to a second temporary identifier included in the first conversion log data;
The first device receives the extracted first temporary identifier from the third device ;
The first device refers to the first storage means, converts the second temporary identifier included in the first conversion log data into attribute information corresponding to the extracted first temporary identifier, logging method comprising possible to get a 2 conversion log data. Log used in a log collection system comprising a first device that collects log data related to access to information by a user, one or more second devices that provide the log data, and a third device that stores an identifier A collection program,
In the first device, a computer is
A first user identifier for identifying a user, a first temporary identifier whose encryption strength is higher than that of the first user identifier, and user attribute information different from the first user identifier are associated with each other. First storage means for storing
Function as request means for generating a request signal for requesting the log data to the second device;
In the second device, the computer is
Second storage means for associating and storing a second user identifier, which is an identifier indicating the same user as the first user identifier, and a second temporary identifier having an encryption strength higher than that of the second user identifier When,
An acquisition means for acquiring the log data including at least the second user identifier in response to the request signal from the first device;
Referring to the second storage means, a second user identifier included in the log data is converted into a corresponding second temporary identifier, and first converted log data including the second temporary identifier is obtained. Function as a means of conversion,
In the first device, a computer is
Further functioning as first receiving means for receiving the first conversion log data from the second device;
In the third device, the computer is
Second receiving means for receiving the second temporary identifier included in the first conversion log data from the first device;
Third storage means for storing the first temporary identifier and one or more second temporary identifiers in association with each other;
With reference to the third storage means, function as an extraction means for extracting a first temporary identifier corresponding to a second temporary identifier included in the first conversion log data;
In the first device, a computer is
Third receiving means for receiving the extracted first temporary identifier from the third device;
Referring to the first storage means, the second temporary identifier included in the first converted log data is converted into attribute information corresponding to the extracted first temporary identifier to obtain second converted log data A log collection program for further functioning as second conversion means .

Images