JP5944268B2 - User information management apparatus, program, and method for notifying provision record of user non-specific information - Google Patents

Description

  The present invention relates to an information management technique for processing and providing user information including personal information.

  Currently, service providers (service providers) in many fields acquire and manage user information (personal information, company information, etc.) related to users (service users). For example, when an Internet provider or mobile phone service provider, which is a service provider, receives an application for using a service, it performs identity verification and registers the acquired user information in a database. Such user information is used for communication between the service provider and the user, and for identity verification at the start of a new service.

  In many cases, services provided by service providers are classified into main services and other ancillary services, each of which is further composed of various services. Accordingly, there are various types of services and combinations of services that the user can receive, and the granularity of user information (the size of the information unit) that the user must provide when using the service varies depending on this type. .

  Under such circumstances, the user has anxiety that his / her user information may be leaked or illegally used in exchange for using the service, and tries to register as little information as possible. On the other hand, service providers try to promote the use of more services, including services that require highly granular information registration.

  In such a state where conflicting intentions antagonize, some service providers publish statistical values in user information registered in the database for the purpose of presenting business transparency. For example, in Non-Patent Document 1, a mobile phone service provider discloses the number of subscribers of a main service and the number of subscribers of ancillary services on a homepage of a third party organization.

  In Non-Patent Document 2, resident information and geographic information collected when the US federal government provides public services are edited and published in the form of statistical values. Further, in Non-Patent Documents 3, 4, and 5, information published in a format such as Non-Patent Document 2 is distributed and sold after being combined or processed.

  Further, mobile phone operators in the United States provide personal information (user information) to third party service operators with the permission of the user. For example, in Non-Patent Documents 6 and 7, a third party service provider can access a part of the user's personal information (user information) by obtaining the authorization of the user (personal information owner). Specifically, attribute information such as the current position and age of the user can be acquired.

Association of Telecommunications Carriers, “Mobile Phone / PHS Contract Number Press Release”, [online], [Search August 1, 2012], Internet <URL: http://www.tca.or.jp/ > DATA.GOV, "DATA", [online], [Search August 1, 2012], Internet <URL: http://www.data.gov/> Infochimps, “Data Marketplace”, [online], [Search August 1, 2012], Internet <URL: http://www.infochimps.com/marketplace> Microsoft, “Windows Azure Marketplace”, [online], [Search August 1, 2012], Internet <URL: https://datamarket.azure.com/> factual, “Definitive Global Data”, [online], [searched on August 1, 2012], Internet <URL: http://www.factual.com/> AT & T, “AT & T Developer Program”, [online], [searched on August 1, 2012], Internet <URL: http://developer.att.com/developer/> Verizon Developer Community, "TOOLS & APIS", [online], [Search August 1, 2012], Internet <URL: http://developer.verizon.com/content/vdc/en/verizon-tools-apis. html>

  However, even if the conventional technology as described above is used, the user cannot track and grasp the actual usage status of his / her user information. Therefore, the situation where the user feels uneasy about providing user information is not solved. As a result, depending on the type of service provided, the user tends to refrain from using the service, and there is a problem that it is difficult for the service provider to acquire a sufficient number of users.

  For example, the services disclosed in Non-Patent Documents 1 to 5 provide this anonymized information after converting personal information (user information) into statistical information. However, even if such conversion processing is used, there arises a problem that information leaks in a format that cannot be perceived and recognized by the user.

  In Non-Patent Documents 6 and 7, a third-party service provider must obtain authorization from the user (personal information owner) when accessing a part of the user's personal information (user information). However, once authorization is performed, there remains a problem that the user cannot obtain or track information about the usage state / results thereafter. As a result, the user tends to refrain from authorizing the use of information, and there is a problem that it becomes difficult for the service provider to provide a sufficient service.

  Therefore, an object of the present invention is to provide a user information management apparatus, program, and method that allow a user to grasp the actual usage of user information.

According to the present invention, a user information database that can use a user information database that stores user information and manages user information that can individually identify users ,
Non-specific information generating means for generating non-specific information from which user identification is impossible or difficult,
A non-specific information providing means for providing non-specific information to a third party;
For each attribute of stored user information, an identification information database that stores identification information of the corresponding user, and a provision history that stores attributes used to generate non-specific information for each provided non-specific information Provided record generation / notification means for determining a user corresponding to non-specific information provided to a third party using a database , generating a non-specific information providing record for the determined user, and notifying it A user information management device is provided.

As one embodiment of the user information management device according to the present invention,
This user information management device for each attribute of the user information, Ri further available Der disclosure policy database that stores and generates a disclosure policy disclosure standards is a condition for permitting disclosure to third parties is set ,
The non-specific information generating means preferably generates non-specific information using information related to an attribute satisfying a disclosure standard set in a disclosure policy among information generated from user information.

Further, in the above embodiment, the non-specific information generating means generates non-specific information from the user information using a non-specific method implemented by specifying a non-specific parameter indicating the degree of non-specification,
It is also preferable that the disclosure policy database sets the disclosure criterion as a limit value of the non-specific parameter.

As another embodiment of the user information management device according to the present invention,
The user information management apparatus further includes a use permission means for permitting a third party to use non-specific information,
The non-specific information providing means preferably provides the non-specific information only to a third party whose use is permitted by the use permission means.

  Furthermore, as another embodiment of the user information management device according to the present invention, it is preferable to further include a reward setting means for setting a reward value corresponding to the provided record for the user for each user who is notified of the provided record.

  In the embodiment related to the above disclosure policy, it is also preferable that the disclosure policy database sets a disclosure standard that is determined based on the attribute of the third party to be provided.

Furthermore, as another embodiment of the user information management device according to the present invention,
The non-specific information generating unit generates anonymized information obtained by deleting the data of the attribute specified by the user alone from the user information, and generates non-specific information from the anonymized information based on a request from a third party. It is also preferable.

According to the present invention, it is also possible to use a user information database that stores user information, and a user information management device that manages user information that can individually identify users,
Non-specific information generating means for generating non-specific information from which user identification is impossible or difficult,
A non-specific information providing means for providing non-specific information to a third party;
For each attribute of the stored user information, an identification information database that stores the identification information of the corresponding user is used to determine the user corresponding to the non-specific information provided to the third party, and to the determined user Providing record generation / notification means for generating and notifying provision record of non-specific information;
Have
For each attribute of user information, a disclosure policy that is a disclosure standard that is a condition for permitting disclosure to a third party and that is determined based on the attribute of the third party to be provided is generated. A disclosure policy database that is stored as
The non-specific information generation unit generates non-specific information using information related to attributes satisfying the disclosure criteria set in the disclosure policy among the information generated from the user information.
A user information management device is provided.
According to the present invention, it is further possible to use a user information database that stores user information, and a user information management program installed in a user information management device that manages user information that can individually identify users ,
Non-specific information generating means for generating non-specific information from which user identification is impossible or difficult,
A non-specific information providing means for providing non-specific information to a third party;
For each attribute of stored user information, an identification information database that stores identification information of the corresponding user, and a provision history that stores attributes used to generate non-specific information for each provided non-specific information Provided record generation / notification means for determining a user corresponding to non-specific information provided to a third party using a database , generating a non-specific information providing record for the determined user, and notifying it A user information management program for causing a computer to function is provided.

According to the present invention, there is further provided a user information management method in a user information management apparatus that can use a user information database that stores user information and manages user information that can individually identify users ,
From the user information, and Luz step to generate a non-specific information specific it is impossible or difficult for the user,
And Luz step to provide a non-specific information to a third party,
For each attribute of stored user information, an identification information database that stores identification information of the corresponding user, and a provision history that stores attributes used to generate non-specific information for each provided non-specific information A third step of determining a user corresponding to the non-specific information provided to a third party using the database, and generating and notifying a provision record of the non-specific information for the determined user; A user information management method is provided.

  According to the user information management device, program, and method of the present invention, the user grasps the actual usage status of the user information by notifying the corresponding user of the provision record of the non-specific information generated from the user information. be able to.

1 is a configuration diagram of a network in which a user information management device according to the present invention is installed, and a functional configuration diagram of the user information management device. It is the schematic which shows one Embodiment about the user information table and user identification information table which concern on this invention. It is the schematic which shows one Embodiment about the anonymization information table and disclosure policy which concern on this invention. It is the schematic which shows one Embodiment about the provision request | requirement from a third-party service provider, a provision history table, and a provision record based on this invention. It is a sequence diagram which shows one Embodiment of the user information management method by this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a configuration diagram of a network in which a user information management device according to the present invention is installed, and a functional configuration diagram of the user information management device.

[User Information Management System]
According to FIG. 1, the user information management apparatus 1 is installed in the communication carrier network 4 and is a service provider (service provider) device that manages “user information”. “User information” is personal information, company information, and the like, and is information that can individually identify users (service users). The handling of personal information is regulated by specific laws in order to protect the rights and interests of individuals while considering their usefulness.

  The user information management device 1 acquires “user information” related to the user of the terminal 2 connected to the communication carrier network 4 through communication or other means, and registers and stores it. For example, when a user's service is started, personal information related to the corresponding user such as an address, name, telephone number, and account number is collected, registered, and stored. At this time, the service provider operating the user information management apparatus 1 makes an agreement with the user in the form of a usage rule or the like regarding the usage range of the user information. On this basis, the service provider refers to the user's account number, address, etc., for example, when performing monthly billing processing.

  Further, the user information management device 1 generates statistical information as “non-specific information” that is impossible or difficult to identify the user from “user information” in order to show the transparency of the service. 5 to a third-party organization (service provider apparatus 3).

  Furthermore, the user information management device 1 generates “non-specific information” from the “user information” based on the request of the third party service provider (service provider device 3), This third party service provider is provided (referenced) via the Internet 5, for example. On the other hand, when a third party service provider needs “user information” such as personal information strongly associated with an individual, the third party service provider receives an authorization in advance from the service provider of the user information management device 1, and under this authorization, Information is provided from the user information management apparatus 1.

  In addition, the user can set the granularity of the non-specific information provided to the third party service provider in advance in the form of a disclosure policy. It is also possible to set in advance the allowable range of the purpose of using the non-specific information, the type of third party service provider to be permitted, the upper limit of the number of times of information use, and the like.

  Furthermore, the user information management apparatus 1 sends back a provision record of “non-specific information” to the corresponding user. Here, the provision record may be a provision history in which facts / contents provided during a predetermined period are recorded. The user information management apparatus 1 may notify the provision record to the user of the terminal 2 sequentially every time information is provided to the third party service provider (service provider apparatus 3), or periodically, the provision history May be notified to the user of the terminal 2.

  Here, the terminal 2 can be an information device such as a smartphone, a tablet computer, or a personal computer. The telecommunications carrier network 4 is an example of an access network used / managed by the service carrier, and the present invention is not limited to the use of the telecommunications carrier network 4.

In order to realize the service described above, the user information management device 1
(A) storing “user information” and “identification information” of the user corresponding to each attribute (item) of “user information”;
(B) Generate “non-specific information” from “user information”,
(C) providing “non-specific information” to a third party;
(D) Using the “identification information”, the user corresponding to the “non-specific information” provided to the third party is determined, and the provision record of the “non-specific information” is notified to the determined user. To do.

  The user information management device 1 notifies the corresponding user of the provision record of the “non-specific information” generated from the “user information” in this way, so that the user grasps the actual usage status of his / her “user information”. Make it possible to do.

[Functional configuration of user information management apparatus 1]
Similarly, according to FIG. 1, the user information management device 1 includes a user side communication interface 100, an external network side communication interface 101, a user information database 110, an identification information database 111, an anonymization information database 112, and a disclosure policy. It includes a database 113, a provision history database 114, a provider database 115, and a functional configuration unit as a processor memory. Here, the function configuration unit (processor memory) realizes its function by executing a program that causes the computer mounted in the user information management apparatus 1 to function.

  This functional configuration unit (processor / memory) includes a non-specific information generation unit 120, a non-specific information provision unit 121, a use permission unit 122, a provision record generation / notification unit 123, and a reward setting unit 124. ing.

  The user-side communication interface 100 receives user information from the terminal 2 (user) via the telecommunications carrier network 4, and further sends non-specific information to the third party service provider to the terminal 2 (user). It is an interface for sending provided records. Further, the external network side communication interface 101 receives an unspecified information provision request from the service provider device 3 via the Internet 5 and further transmits non-specific information to the service provider device 3. It is.

  The user information database 110 generates and stores a user information table based on user information received from the terminal 2 (user). The user information table may be generated using user information directly input to the user information management apparatus 1 instead of user information obtained through communication. As will be described later with reference to FIG. 2A, this user information table includes names (names), genders, telephone numbers, addresses (locations) as attributes (items) of data relating to individuals (or companies, etc.). ), Age, current position, etc. A row number and a column number are assigned to each row and column of the user information table, and an item identifier composed of a set of a row number and a column number such as “12” is assigned to each data of each attribute.

  The identification information database 111 stores a user identification information table in which a user corresponding to each data of each attribute in the user information database 110 is recorded. Specifically, in the user identification information table, as will be described later with reference to FIG. 2B, for each item identifier for identifying each data of each attribute (item), a user identifier assigned for each user. Are associated and recorded. Thereby, the corresponding person (user) of the data is associated with each data of each attribute (item) of the user information database 110.

  The anonymization information database 112 stores an anonymization information table that is anonymized information obtained by deleting data of an attribute specified by a user alone from the user information table. As will be described later with reference to FIG. 3A, the anonymization information database 112 is obtained by deleting data such as names, telephone numbers, and the like that are specified by the user from the user information table. is there. Here, for example, an address (residence) can also be deleted, but instead of being deleted, for example, the address is data up to a prefecture name and a city name or county name, and the degree of anonymization is kept above a predetermined level It is also preferable to record with.

  Later, non-specific information can be generated from the anonymized information table created in this way based on the request of the third party service provider. In addition, it is also possible to produce | generate nonspecific information directly from a user information table, without producing | generating this anonymization information table. However, when generating non-specific information, it may be preferable to handle the anonymized information table from the viewpoint of protecting user information.

The disclosure policy database 113 generates and stores a disclosure policy in which a disclosure criterion, which is a condition for permitting disclosure to a third party service provider, is set for each user (identifier) for each attribute of the user information table. . As will be described later with reference to FIG. 3B, the disclosure policy is, for example, among the attributes of the user information table.
(A) Names and telephone numbers are not disclosed, that is, disclosure is not permitted.
(B) For gender, a non-specification (anonymization) parameter to be described later is set to k, and k = 1000 or more k anonymization processing is performed.
The instruction contents are summarized. That is, the disclosure standard in the disclosure policy can be set as a limit value of the non-specific parameter, for example, a lower limit value.

  The disclosure policy database 113 can also set a disclosure standard that is determined based on the attribute of the third party service provider to be provided. For example, it is also preferable to select a disclosure standard in a disclosure policy depending on whether a third-party service provider is certified by a specific certification body. It is also possible to set a disclosure standard (policy) such as “permit disclosure (reference) for government agencies” and “permit disclosure (reference) for large enterprises in a specific industry”. Furthermore, it is also preferable to set a disclosure policy in accordance with the information disclosure status of the third party service provider. Furthermore, it is possible to set a disclosure standard with an upper limit on the number of times of providing (referring to) non-specific information.

  Furthermore, if the third-party service provider is a social network service provider having an equal relationship with the user himself, it is possible to make a setting for disclosing information from each other with the same granularity as the user himself / herself. Furthermore, in addition to the user disclosure policy, it is preferable that the service provider operating the user information management apparatus 1 also has a disclosure policy. In this case, the service provider rejects an information provision request that violates its disclosure policy. For example, when this service provider has set a disclosure policy that refuses disclosure regarding age at all, it is possible not to accept an offer (reference) request for information regarding age.

  The provision history database 114 stores a provision history table in which information about non-specific information provided to the service provider apparatus 3 is recorded. As will be described later with reference to FIG. 3C, the provision history table has items such as provision date and time, recipient (third party name of provision destination), type of provision information, provision granularity, and the like. . Thereafter, the provision history notified to the terminal 2 (user) for return is generated by extracting the corresponding user from the provision history table.

  The provider database 115 is a database in which third-party service providers that have been previously authorized to acquire non-specific information by the service provider that operates the user information management apparatus 1 are registered and stored. Here, as an authorization condition for the service provider of the user information management device 1 to authorize the third party service provider, for example, the third party service provider is a government agency or a large enterprise in a specific industry. Etc. can also be set. It is preferable that only third-party service operators that satisfy such authorization conditions are registered in the operator database 115.

  The non-specific information generation unit 120 performs non-specification processing on the data of the user information table recorded in the user information database 110, and generates non-specific information that makes it impossible or difficult to specify the user. At this time, the non-specific information generation unit 120, as will be described later using the disclosure policy shown in FIG. 3B, among the information generated from the user information table, the disclosure policy recorded in the disclosure policy database 113. Non-specific information is generated using information relating to attributes satisfying the disclosure criteria set in the above.

  Specifically, the non-specific information generating unit 120 specifies a non-specific (anonymization) parameter indicating the degree of non-specification and is implemented as a non-specific method, for example, a k-anonymization method using the parameter k, Is used to generate non-specific information from the user information table.

  Further, the non-specific information generation unit 120 has an anonymization information generation unit, generates an anonymization information table from which the attribute data specified by the user alone is deleted from the user information table. It is also preferable to record in the anonymization information database 112 in advance. In this case, the non-specific information generation unit 120 generates non-specific information from the recorded anonymized information table based on the request of the third party service provider.

  The non-specific information providing unit 121 provides the non-specific information generated by the non-specific information generating unit 120 to a third party service provider. In addition, the use permission unit 122 permits the use of the non-specific information to the third-party service provider (service provider apparatus 3) that has requested use of the non-specific information. At this time, when permitting the use of non-specific information, the use permission unit 122 confirms whether or not this third party service provider is registered in advance in the provider database 115 and is registered in advance. It is also preferable to allow the use only to service providers who are present.

  In this case, the non-specific information providing unit 121 provides (refers to) the non-specific information only to the third-party service provider (service provider device 3) permitted to use by the use permission unit 122.

  The provided record generation / notification unit 123 inputs the non-specific information provided to the service provider apparatus 3 by the non-specific information providing unit 121. Next, using this non-specific information, a provision history table that is a record for each provision is generated and updated, and this provision history table is recorded in the provision history database 114.

  The provided record generation / notification unit 123 further determines a user corresponding to the non-specific information provided to the service provider apparatus 3 using the user identification information table recorded in the identification information database 111. Next, the generated and updated provision record of the non-specific information is notified to the determined user (to the user). Here, the provision record generation / notification unit 123 may sequentially notify the provision record to the user of the terminal 2 every time information is provided to the third party service provider (service provider apparatus 3), or periodically. Specifically, for example, the provision record (provision history) may be notified to the user of the terminal 2 at a monthly frequency.

  The reward setting part 124 sets the reward value corresponding to the provision record which concerns on the said user for every user who is a notification destination of a provision record. This reward corresponds to a consideration for the user for providing user information (personal information) necessary for generating useful non-specific information (statistical information). The reward value is set to increase in proportion to, for example, (a) the number of times non-specific information is provided to a third-party service provider, and (b) the number and granularity of non-specific information provided. Also good. As the reward, various forms such as points on the card, cash, discount of the provided service fee, and the like are possible. For example, it is possible to pay out a reward of 1 yen per provision of non-specific information. In this way, by setting a reward as a price for providing non-specific information, it becomes possible to promote user service usage.

  Furthermore, the remuneration setting unit 124 stores a non-specification parameter as a disclosure criterion in the disclosure policy in the disclosure policy database 113 so that the total reward value within a predetermined period for a certain user is an amount within a predetermined range. It is also possible to adjust the value of (k). In this case, it is also preferable that the user designates in advance the adjustment range of the non-specific parameter from the viewpoint of protecting user information.

  Hereinafter, user information processing in the user information management apparatus 1 described above will be described in detail using an information table and the like.

  FIG. 2 is a schematic diagram showing an embodiment of a user information table and a user identification information table according to the present invention. FIG. 3 is a schematic diagram showing an embodiment of the anonymization information table and the disclosure policy according to the present invention. Furthermore, FIG. 4 is a schematic diagram showing an embodiment of a provision request from a third party service provider, a provision history table, and a provision record according to the present invention.

[User Information Table]
According to FIG. 2 (A), in the user information table, the name (name), gender, telephone number, address (residence), age, current position, etc. are columns as data attributes relating to individuals (or companies, etc.). Make. Data for each user occupies each line. Here, the attribute “current position” in the eighth column is determined from position information (for example, latitude / longitude information) of the base station with which the user's terminal 2 is currently established. Therefore, the “current position” is updated every time the user moves and the base station communicating with the terminal 2 is changed.

  In addition, as another attribute of the user information table, for example, “current direction” facing the terminal 2 can be cited. This “current direction” is obtained when the direction information of the terminal 2 measured by a direction sensor (for example, a 3-axis type acceleration sensor + a 3-axis type geomagnetic sensor) built in the terminal 2 is transmitted to the user via the communication carrier network 4. By being transmitted to the information management device 1, it is recorded in the user information table.

  A row number and a column number are assigned to each of these rows and columns of the user information table, and an item identifier consisting of a set of a row number and a column number is assigned to each data of each attribute (item). For example, an item identifier composed of a combination of a row number and a column number such as “12” is assigned to the data “(sex) woman” in the first row and the second column. Furthermore, since each row is an enumeration of data for each user, a user identifier, for example, id0002 is given to each row.

[User Identification Information Table]
According to FIG. 2B, in the user identification information table, the user identifier of the corresponding user is recorded for each item identifier in the user information table (FIG. 2A). By using this user identification information table, it is reliably determined to which user each data in each attribute of the user information table belongs.

[Anonymization information table]
According to FIG. 3 (A), the anonymization information table is obtained by deleting attribute data such as a name and a telephone number from the user information table (FIG. 2 (A)). is there. Here, for example, an address (residence) can also be deleted, but instead of being deleted, for example, the address is data up to a prefecture name and a city name or county name, and the degree of anonymization is kept above a predetermined level It is also preferable to record with. Similarly, regarding age, it is also preferable to record age data from 40 years old to 49 years old, for example, in the 40s with the degree of anonymization maintained at a predetermined level or higher. Later, non-specific information can be generated from the anonymized information table created in this way based on the request of the third party service provider.

Here, a method of non-specification of information including anonymization will be described. User information including personal information can be converted into statistical information by, for example, totaling data regarding all users and performing processing such as averaging. The user information is not only statistical processing such as a simple sum (average), but also, for example,
It is possible to process and de-specify by a non-specific method such as (a) k anonymization method, (b) l diversification method, or (c) perturbation method.

  Among these, the k anonymization method is a data processing method that guarantees that at least k users having the same data value exist for one attribute of user information. That is, for example, one individual is confused with at least another (k-1) person, and the probability that the individual is specified is suppressed to 1 / k or less. The k-anonymity method is implemented by specifying a non-specification (anonymization) parameter k indicating the degree of non-specification.

  The l diversification method is a data processing method that guarantees that at least l different types of data values exist for one attribute of user information. As a result, for example, when there is only one type of data value for this attribute, it is known that for one person specified up to k people, that one type of data value is taken at least for this attribute. Can be avoided. The l diversification method is performed by specifying a non-specific parameter l indicating the degree of non-specification.

Further, the perturbation method is a data processing method for intentionally adding random noise (random number) to a data value for one attribute of user information to prevent specification of each data value of the attribute. For example, a random number r having a Gaussian distribution is added to the personal information data that the age is X = 33 years old,
(1) Y = X + r = 38
As shown, a value having distortion (Y = 38) is registered in the database. Thereby, even if a third party acquires the attribute value of 38 years old, the true data value cannot be reached. As for the perturbation method, as a non-specific parameter indicating the degree of non-specification, a Gaussian distribution parameter according to the random number r, for example, mean μ and standard deviation σ can be adopted.

  In the following embodiment, the k-anonymization method is adopted as the non-specification method, and the non-specification parameter is set to k. However, as a matter of course, the l diversification method may be used as the despecification method, and the despecification parameter may be l. Furthermore, a perturbation method can be adopted as the non-specification method, and the non-specification parameters can be set to mean μ and standard deviation σ.

[Disclosure Policy]
According to FIG. 3 (B), the disclosure policy is that the disclosure criteria, which is a condition for permitting disclosure to a third party service provider, for each attribute of the user information table (FIG. 2 (A)) is a user (identifier). ) Is set every time. The disclosure policy is, for example, among the attributes of the user information table.
(A) Names and telephone numbers are not disclosed, that is, disclosure is not permitted.
(B) About sex, an address, and age, when implementing the k anonymization process more than the designated non-specification (anonymization) parameter k, you may disclose the information concerning the anonymized attribute data.
The instruction contents are summarized.

  The non-specific information generation unit 120 (FIG. 1) refers to the disclosure policy, performs the k anonymization method with the k value set in the disclosure policy as a lower limit, and satisfies the disclosure criteria (k value) The non-specific information is generated using the information related to.

  In the disclosure policy, it is also possible to specify the non-specifying parameter k for a combination of a plurality of attributes, for example, “sex” and “address”. This is a policy corresponding to a case where the content of the provision request described later is, for example, “the number of male contractors living in Tokyo”.

[Provision request]
According to FIG. 4A, the service provider apparatus 3 makes a request for providing (referring to) non-specific information via the Internet 5. Here, as the contents of this provision request, for example,
(A) Number of male contractors (number of male users),
(B) Number of subscribers residing in Tokyo (number of users with addresses in Tokyo),
(C) Number of subscribers (number of users) whose current position (of terminal 2) is in Tokyo
That require statistical information such as

  Among these, for example, in the case of (a) the number of male contractors, “male” is designated for the attribute “sex”. This corresponds to the fact that, for example, k = 5000 is designated as the reference granularity (unspecification parameter value designated at the time of reference). For example, in the case of (b) the number of subscribers residing in Tokyo, “Tokyo” is designated for the attribute “address”. As a result, for example, k = 1000 is designated as the reference granularity. Furthermore, (c) in the case of the number of subscribers whose current position is in Tokyo, “Tokyo” is designated for the attribute “current position”. As a result, for example, k = 3000 is designated as the reference granularity.

  When the non-specific information generation unit 120 (FIG. 1) receives this provision request, it is designated in the anonymization information table (FIG. 3A) with reference to the disclosure policy (FIG. 3B). k anonymization processing based on the k value is performed to generate non-specific information.

  As an example, for example, a case where the provision request is (a) the number of male contractors will be described. In the disclosure policy (FIG. 3B), the k value of the attribute “gender” is k = 10000 for users having user identifiers id0004 and id0008, and k = 1000 for all other users. Accordingly, k anonymization processing is performed on the attribute “gender” in the anonymization information table (FIG. 3A) by excluding the user data of id0004 and id0008 and setting the reference granularity k = 5000 to obtain non-specific information. For example, “number of male contractors with reference granularity k = 5000 = 5,123 (persons)” is generated.

[Offer History Table]
According to FIG. 4 (B), the provision history table records information about non-specific information provided to the service provider apparatus 3. The provision history table has items such as provision date and time, recipient, kind of provision information, provision granularity, and the like as record items. Other recording items include a reference (provided) purpose, a reference (provided) method, the number of times of provision, a method of non-specification processing performed, and the like.

  Among the record items of the provision history table, the recipient is the name of the third party service provider that is the provision destination. The type of provided information is, for example, an attribute type such as information related to “address”, information related to “age”, and the like, and can be an item in which an item identifier assigned to the user information table is recorded. . Furthermore, the provision granularity is the granularity of the non-specific information provided to the third party service provider, and can be the value of the non-specific parameter k.

[Provided record]
According to FIG. 4C, the provision record is generated by extracting data for the corresponding user from the provision history table (FIG. 4B). Here, by referring to the user identification information table (FIG. 2B) using the item identifier recorded in the “type of provision information” of the provision history table, the corresponding user (user identifier) is acquired. The

  The provided record has items such as provided date and time, recipient, type of provided information, provided granularity, and the like as record items. Among these, the provided information type describes attributes in the user information table such as “address” and “age”. Other recording items include a reference (provided) purpose, a reference (provided) method, the number of times of provision, a method of non-specification processing performed, and the like.

  As described above, the user information processing in the user information management device 1 has been described using the user information table and the like. However, the user information table, the user identification information table, the anonymization information table, the disclosure policy, the provision request, Naturally, the provision history table and the provision record are not limited to the format of the above embodiment. Various other items can be adopted for the items in each table.

[User Information Management Method]
FIG. 5 is a sequence diagram showing an embodiment of a user information management method according to the present invention.

As a premise of the sequence in FIG. 5, the user information management apparatus 1 registers the authorized third party service provider (service provider apparatus 3) in the provider database 115 (FIG. 1).
(S500) The user information management device 1 acquires user information from the terminal 2 via the communication carrier network 4 or another means from the user, and generates and registers a user information table.
(S501) The user information management apparatus 1 acquires information on the disclosure standard from the terminal 2 via the communication carrier network 4 or another means from the user, and generates and registers a disclosure policy.
(S502) The user information management apparatus 1 generates and registers a user identification information table based on the user information table.
(S503) The user information management device 1 generates and registers an anonymization information table based on the user information table.

(S504) The third party service provider (service provider apparatus 3) makes a use permission request for non-specific information to the user information management apparatus 1.
(S505) The user information management apparatus 1 determines whether or not the third-party service provider (service provider apparatus 3) that has made a use permission request is registered as an authorized provider. Here, when a false determination is made, that is, it is determined that the user is not registered, the third-party service provider (service provider apparatus 3) is notified that usage is not permitted.
(S506) On the other hand, when a true determination is made in step S505, the user information management apparatus 1 permits the use of non-specific information to the registered third party service provider (service provider apparatus 3). To be notified.

(S507) The service provider device 3 requests the user information management device 1 to provide predetermined non-specific information.
(S508) The user information management device 1 generates non-specific information on the basis of the request content of the received provision request and the generated / registered disclosure policy.
(S509) The user information management device 1 transmits (provides) the generated non-specific information to the service provider device 3.

(S510) The user information management device 1 generates / updates the non-specific information provision history table every time the non-specific information is provided to the service provider device 3 (s).
(S511) The user information management device 1 determines (all) users corresponding to the provision history table based on the user identification information table.

(S512) The user information management device 1 generates a provision record for each determined user from the provision history table.
(S513) The user information management device 1 transmits the generated provision record to the corresponding user (terminal 2) (return notification).

  Here, it is also preferable that steps S507 to S510 occur each time a request for provision of non-specific information is made by (a plurality of) service provider apparatuses 3. In addition, after the provision history table is generated / updated in step S510, it is also preferable that steps S511 to S513 (corresponding user determination to provision record return notification) occur periodically.

  In addition, as a change mode of steps S504 to S506 (use permission of non-specific information), use permission can be performed using an OAuth protocol which is a standard means of API (Application Programming Interface) authorization. In this case, first, the terminal 2 (user) acquires an access right to the non-specific information that requires authorization from the user information management apparatus 1 to the third party service provider (service provider apparatus 3). Allow that. This is realized, for example, when the user clicks a predetermined link on the Web screen displayed on the terminal 2. Thus, in the embodiment using the OAuth protocol, the service provider device 3 receives permission from the user individually and then receives permission to use non-specific information from the user information management device 1.

  As mentioned above, according to this invention, a user can grasp | ascertain the utilization actual condition of own user information by notifying the applicable user of the provision record of the nonspecific information produced | generated from user information. Thereby, it becomes possible to dispel the anxiety about handling of user information (personal information etc.).

  As a result, the service provider can also smoothly implement a service using user information within a range where there is no risk of infringement of personal information and privacy. Furthermore, to realize the reliability of the handling of user information for users, the promotion of service use by service providers, and the enjoyment of useful non-specific information (statistical information) by third party service providers at once. Is also possible.

  Further, the present invention is not only a personal information (user information) management system of a telecommunications carrier, but also various services for managing personal information such as social network services, online shopping services, online mail services, online web search services, etc. Applies to the system. At this time, since the transparency of the business operation of the service provider operating these service systems can be improved, it is expected to acquire more users.

  It should be noted that various changes, modifications, and omissions of the technical idea and the scope of the present invention can be easily made by those skilled in the art with respect to the various embodiments of the present invention described above. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

DESCRIPTION OF SYMBOLS 1 User information management apparatus 100 User side communication interface 101 External network side communication interface 110 User information database 111 Identification information database 112 Anonymization information database 113 Disclosure policy database 114 Provision history database 115 Provider database 120 Non-specific information generation part 121 Non-specific Information providing unit 122 Usage permission unit 123 Provision record generation / notification unit 124 Reward setting unit 2 Terminal 3 Service provider device 4 Telecommunications carrier network 5 Internet

Claims (10)

A user information database that can use a user information database that stores user information and manages the user information that can individually identify users ,
Non-specific information generating means for generating non-specific information that is impossible or difficult to identify the user from the user information;
A non-specific information providing means for providing the non-specific information to a third party;
For each attribute of the stored user information, an identification information database that stores identification information of the corresponding user, and for each provided non-specific information, store the attribute used to generate the non-specific information Providing a record of the non-specific information provided to the third party by determining the user corresponding to the non-specific information provided to the third party using the provision history database A user information management apparatus comprising: a record generation / notification unit. For each attribute of the user information, Ri further available Der disclosure policy database that stores and generates a disclosure policy disclosure standards is a condition for permitting disclosure to third parties is set,
The non-specific information generation means generates the non-specific information using information related to an attribute that satisfies a disclosure standard set in the disclosure policy among information generated from the user information. The user information management device according to claim 1. The non-specific information generating means generates non-specific information from the user information using a non-specific method implemented by specifying a non-specific parameter indicating the degree of non-specification,
The user information management apparatus according to claim 2, wherein the disclosure policy database sets the disclosure criterion as a limit value of the non-specification parameter. It further has a usage permission means that allows third parties to use the non-specific information,
4. The user according to claim 1, wherein the non-specific information providing unit provides the non-specific information only to a third party whose use is permitted by the use permission unit. 5. Information management device.   5. The user according to claim 1, further comprising a reward setting unit that sets a reward value corresponding to the provided record related to the user for each user notified of the provided record. Information management device.   The user information management apparatus according to claim 2 or 3, wherein the disclosure policy database sets a disclosure standard determined based on an attribute of a third party to be provided.   The non-specific information generating means generates anonymized information obtained by deleting data of an attribute specified by the user alone from the user information, and based on a request from a third party, the non-specific information is generated from the anonymized information. The user information management apparatus according to claim 1, wherein the user information management apparatus generates a user information.   A user information database that can use a user information database that stores user information and manages the user information that can individually identify users,
  Non-specific information generating means for generating non-specific information that is impossible or difficult to identify the user from the user information;
  A non-specific information providing means for providing the non-specific information to a third party;
  For each attribute of the stored user information, using the identification information database that stores the identification information of the corresponding user, the user corresponding to the non-specific information provided to the third party is determined, and the determined user Providing record generation / notification means for generating and notifying the provision record of the non-specific information
Have
  For each attribute of the user information, a disclosure policy that is a disclosure standard that is a condition for permitting disclosure to a third party and that is determined based on the attribute of the third party to be provided is set. A disclosure policy database that is generated and stored can further be used;
  The non-specific information generating means generates the non-specific information using information related to an attribute that satisfies a disclosure criterion set in the disclosure policy among information generated from the user information.
A user information management device. A user information management program installed in a user information management apparatus that can use a user information database that stores user information and manages the user information that can individually identify users ,
Non-specific information generating means for generating non-specific information that is impossible or difficult to identify the user from the user information;
A non-specific information providing means for providing the non-specific information to a third party;
For each attribute of the stored user information, an identification information database that stores identification information of the corresponding user, and for each provided non-specific information, store the attribute used to generate the non-specific information Providing a record of the non-specific information provided to the third party by determining the user corresponding to the non-specific information provided to the third party using the provision history database A user information management program for causing a computer to function as a record generation / notification means. A user information management method in a user information management apparatus that can use a user information database that stores user information and manages the user information that can individually identify users ,
From the user information, and Luz step to generate a non-specific information specific it is impossible or difficult for the user,
And Luz step to provide the non-specific information to a third party,
For each attribute of the stored user information, an identification information database that stores identification information of the corresponding user, and for each provided non-specific information, store the attribute used to generate the non-specific information with the provision history database for indexing the user corresponding to the non-specific information provided in the third party, to the user who indexed, generates a provide recording of the non-specific information, you notice the user information management method characterized in that it comprises a step.

Images