JP6548936B2 - Security gateway device, method and program - Google Patents

Description

  The present invention relates to a security gateway device, method and program.

  BACKGROUND Conventionally, IT (Information Technology) related equipment such as personal computers and servers are connected to the Internet. Furthermore, digital information home appliances such as televisions and digital cameras or various sensor devices are also directly connected to the Internet, and such devices are called IoT (Internet of Things) devices. Data collected from IoT devices may include sensitive data related to personal privacy. For this reason, when utilizing these data, it is required to design an architecture from both the security and privacy viewpoints.

  Non-Patent Document 1 is known that discloses requirements and functions for utilizing such data. Non-Patent Document 1 identifies security and privacy requirements for each use case after clarifying the use cases that utilize data as described above, and is described in European privacy laws and guidelines. Organize matters and extract functions to be implemented on the platform.

EU FP7 project iCore, "D2.2 Security requirements for the iCore cognitive management and control framework", [online], Internet <URL: http: // www. iot-icore. eu / attachments / article / 89 / 20120607_iCore% 20D2.2% 20FINAL. pdf>

  However, Non-Patent Document 1 does not mention a technical solution for meeting security and privacy requirements. In addition, Non-Patent Document 1 does not mention how to interpret the complex conditions defined by the data manager and owner and the laws and guidelines, and that the application accesses across borders.

  An object of the present invention is to provide a security gateway apparatus, method, and program that make it possible to use data accessed by an application while satisfying security conditions for each country.

Specifically, the following solutions are provided.
(1) A security gateway device for extracting data requested from an application provided by a server installed in a first domain from a server installed in a second domain and returning the data to the application, wherein A security policy storage unit storing a security policy defining a provision period of the data for each of the first domains in association with a type and a type of the data; and allowing acquisition of the data by the application, An access control that issues, to the application, a token with an expiration date set for accessing the data based on a privacy certificate issued by a certificate authority of a domain and a provision period defined in the security policy. With the Security gateway device.

The security gateway device of (1) sets an expiration date for accessing data to the application of the first domain based on the privacy certificate and the definition of the security policy for the first domain in the second domain. Issue a token.
That is, the security gateway device confirms permission to accept data from the second domain in the first domain by using the privacy certificate, and the security policy for the application of the first domain on the side of the second domain that is the data provider. Allow the provision of data based on and issue a token to obtain data. An application having a token can use the data within the token's expiration date.
Therefore, the security gateway device can utilize the data accessed by the application, meeting the security conditions of each country.

  (2) The security policy defines the presence or absence of privacy for each type of the application and the type of the data, and processes the data based on the presence or absence of the privacy in response to a request from the application having the token. The security gateway device according to (1), comprising a privacy control unit.

  Since the security gateway device of (2) processes data based on the presence of privacy defined for each type of application and each type of data in response to a request from an application, the data is received regardless of the policy on the data receiving side. Data related to the privacy of the providing side can be concealed.

  (3) The security gateway device according to (2), wherein the privacy control unit sorts the data in response to a request from the application having the token based on a privacy policy for each owner of the data.

  Since the security gateway device of (3) sorts the data based on the privacy policy for each data owner in response to the request from the application, it can provide only the data for which each owner has been authorized.

  (4) The privacy policy defines whether to permit the provision of the data for each owner in association with the type of the application and the type of the data, and the privacy control unit is configured to The security gateway device according to (3), wherein the data authorized by the owner is extracted based on a policy.

  (4) The security gateway device extracts data based on the privacy policy for each data owner according to the type of application requesting the data and the data type, so that detailed settings for each data owner can be made. Control the provision of individual data according to

  (5) A user database is provided in which the identifier of the owner and the attribute are associated, and the privacy control unit receives the condition based on the user database when the condition related to the attribute to be extracted is received from the application. The security gateway device according to (3) or (4), which identifies an owner who satisfies and extracts data about the owner.

  The security gateway device of (5) interprets the query itself because the owner who satisfies the condition can be identified by referring to the user database when the condition regarding the attribute of the data owner is received separately from the data extraction query. You can sort out the data of interest without doing it.

  (6) The security policy is set for each of a plurality of administrators, and the access control unit is configured to set the token based on the shortest period among the provision periods of the data associated with the plurality of administrators. The security gateway device according to any one of (2) to (5), wherein an expiration date is set.

  Since the security gateway device of (6) provides data based on the shortest period among the provision periods managed by a plurality of administrators, the data is provided under the condition of the strictest provision period among the conditions of the plurality of administrators. It can protect.

  (7) The security policy is set for each of a plurality of administrators, and the privacy control unit determines that the data is related to privacy by any of the plurality of administrators in the security policy. The security gateway device according to any one of (2) to (6), which determines that the data relates to privacy.

  The security gateway device of (7) determines that the data relates to privacy when any of the plurality of administrators specifies that the data relates to privacy, and therefore the privacy of the conditions of the plurality of administrators You can protect your data under as safe conditions as possible.

  (8) The access control unit according to any one of (1) to (7), wherein the access control unit verifies the legitimacy of the request for the data from the application by a message authentication code using the token as a common key. Security gateway device.

  Since the security gateway device of (8) verifies the legitimacy of the request for data by the common key, it is possible to improve security by preventing falsification, tampering and the like.

  (9) A method executed by the security gateway device according to (1), wherein the access control unit permits acquisition of the data by the application, and the privacy proof issued by the certificate authority of the first domain. And v. An access step of issuing, to the application, a token having an expiration date for accessing the data based on a document and a provision period defined in the security policy.

  The method of (9) makes it possible to use data accessed by an application, meeting the security conditions of each country, as in (1).

  (10) A program for causing a computer to execute the steps of the method described in (9).

  The program of (10) can cause a computer to function so that the data accessed by the application can be used while satisfying the security conditions for each country.

  According to the present invention, it is possible to use data accessed by an application while satisfying security conditions for each country.

It is a block diagram showing composition of a security gateway device concerning one embodiment of the present invention. It is a figure which shows the example of security policy DB which concerns on one Embodiment of this invention. It is a figure which shows the example of token DB which concerns on one Embodiment of this invention. It is a figure which shows the example of the privacy policy which concerns on one Embodiment of this invention. It is a figure showing an example of user DB concerning one embodiment of the present invention. It is a sequence diagram which shows the token issuing process by the security gateway apparatus which concerns on one Embodiment of this invention, and a data extraction process. It is a block diagram showing composition of a security gateway device in a multi cloud environment concerning one embodiment of the present invention. It is a flowchart which shows the example of the issuing process of the token of the security gateway apparatus in a multi-cloud environment based on one Embodiment of this invention. It is a flowchart which shows the example of the data extraction process of the security gateway apparatus in the multi cloud environment based on one Embodiment of this invention. It is a flowchart following FIG.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing the configuration of a security gateway device 10 according to an embodiment of the present invention.
The security gateway device 10 issues a token based on a security policy in response to a request from an application provided by a server installed in a first domain (ie, an application server providing an application). Then, the security gateway device 10 extracts data requested from the application having the token from the database server (referred to as a DB server) installed in the second domain based on the privacy policy, and returns it to the application.
Domains refer to regions that do not share security or privacy policies, for example, countries.
The security gateway device 10 includes an access control unit 11, a privacy control unit 12, a security policy storage unit (referred to as a security policy DB 31), and a user database (referred to as a user DB 32).

<Issuing Token>
The access control unit 11 is for accessing data based on the privacy certificate 21 issued by the certificate authority of the first domain, which permits the acquisition of data by the application, and the provision period defined by the security policy. Issue a token with an expiration date to the application.

The security policy DB 31 stores a security policy that defines the provision period of data for each first domain (for example, the installation country of the application server) in association with the type of application and the type of data.
The application type refers to, for example, an application related to medical care, an application related to provision of location information, and the like.
The type of data means, for example, types of data on medical care, data on location, and the like. The type of data may be a serial number of a database without dividing a database having privacy (referred to as a privacy database) or a database having no privacy (referred to as a non-privacy database). Also, the type of data may be a privacy database or a non-privacy database divided into serial numbers of the respective databases.
Furthermore, the security policy defines the presence or absence of privacy (that is, privacy information as to whether privacy data or non-privacy data) for each type of data. A security policy is set for each of a plurality of administrators.

Specifically, the security policy DB 31 stores a security policy as shown in FIG. FIG. 2 is a diagram showing an example of the security policy DB 31 according to an embodiment of the present invention.
The security policy defines the provision period of data to the first domain (for example, the installation country of the application server) for each type of data and privacy information for a plurality of administrators set for each type of application. Do.
In FIG. 2, "UK" and "JP" represent the name of the country where the application server is installed, and "h", "d" and "m" represent time, day and month, which are the units of the provision period, respectively. , “Privacy” and “non-privacy” indicate privacy information “with privacy” and “without privacy”, respectively. The number 0 represents that no token is issued. For example, "UK: 1h, JP: 2m, non-privacy": token lifetime issued to UK country application is 1 hour, token lifetime issued to JP country application is 2 months, privacy information is It represents "no privacy".

The privacy certificate 21 guarantees the domain (for example, providing country) in which the application can acquire data and the type of data.
Specifically, the privacy certificate 21 includes the issuing country of the privacy certificate 21, the application IP, the type of application, the installation country of the DB server, the type of data, and the expiration date.
Here, the issue country of the privacy certificate 21 refers to a country in which a certificate authority that issues the privacy certificate 21 is installed, and is the same as the installation country of the application server.
Application IP refers to the IP address of the application server.
The installation country of the DB server refers to a provision country where a DB server providing data that can be acquired by an application is installed.

Upon receiving a request for token issuance from an application, the access control unit 11 acquires, from the security policy DB 31, a security policy corresponding to the type of application for which token issuance is requested.
Next, the access control unit 11 is a provision period to the country of the application (the country where the application server is installed) associated with the type of data defined in the privacy certificate 21 based on the acquired security policy. And each provision period associated with a plurality of administrators is acquired.
For example, in the case of FIG. 2, assuming that DB1 matches the data type in the security policy for application A, and JP is the country of the application (country where the application server is installed), the access control unit 11 is set by the administrator 1 Two months being the provision period to JP, two hours being the provision period to JP set by administrator 2, ..., 5 hours being the provision period to JP set by administrator M To get.
Next, the access control unit 11 calculates the expiration date based on the shortest one of the data provision periods associated with the plurality of administrators. In the case described above, the access control unit 11 calculates an expiration date obtained by adding 2 hours to the current time, based on 2 hours which is the acquired shortest provision period.
Next, the access control unit 11 generates a token, and stores the generated token in the token DB 33 in association with the calculated expiration date.
The access control unit 11 issues, to the application, a token whose expiration date is set.
The token is generated as a common key of the message authentication code.

  FIG. 3 is a diagram showing an example of the token DB 33 according to the embodiment of the present invention. The token DB 33, as shown in FIG. 3, is a token and predetermined information (that is, an application server installation country, an application IP, an application type, data type, privacy information, and an expiration date of the token). And are stored in association with each other.

<Extraction of data>
When a request for data acquisition is received from an application having a token, the access control unit 11 verifies the validity of the request in response to the request from the application.
Specifically, the access control unit 11 acquires a token based on the token DB 33 based on parameters that constitute a request for data acquisition from an application.
Next, the access control unit 11 inputs the concatenation of the parameters excluding the message authentication code into a keyed hash function using a token as a key to calculate a hash value. The message authentication code may be generated, for example, using HMAC-SHA 256 (HMAC: Hash-based Message Authentication Code) using SHA 256 as a hash function.
Next, because the calculated hash value is the same as the message authentication code, the access control unit 11 determines that the message authentication code is generated using the issued token.

The access control unit 11 determines that the token is within the expiration date if the time when the request for data acquisition is received is earlier than the expiration date associated with the acquired token.
If the reception time of the data acquisition request is within a predetermined period from the time stamp (for example, the transmission time of the data acquisition request) included in the parameter, the access control unit 11 determines that the data acquisition request is within the predetermined period It is determined that
The access control unit 11 verifies the legitimacy of the data acquisition request based on the determination.

The privacy control unit 12 processes data in response to a request for data acquisition from an application having a token based on the presence or absence of privacy.
Specifically, based on the privacy policy, if the privacy information associated with the type of application having a token and the type of data is "privacy presence", the privacy control unit 12 processes the data (for example, data is Anonymize. The privacy control unit 12 does not process the data when the privacy information is “no privacy”.

  The privacy control unit 12 determines that the data is related to privacy when any of a plurality of administrators defines that the data is related to privacy in the security policy. In other words, the privacy control unit 12 determines that the data is not related to privacy when it is specified in the security policy not to be related to privacy by all of the plurality of administrators.

  The privacy control unit 12 sorts data based on a privacy policy for each data owner in response to a request for data acquisition from an application having a token.

  FIG. 4 is a diagram illustrating an example of a privacy policy according to an embodiment of the present invention. The privacy policy defines a privacy policy for each data owner, for each type of application, as shown in FIG. Specifically, the privacy policy is associated with the type of application, and the owner of the data authorizes provision of the data for each type of data (circled in FIG. 4) or not (× in FIG. 4) To define. The privacy policy is acquired from the server (privacy policy DB 62 of the local cloud 60 described later) installed in the second domain.

  When the privacy control unit 12 receives the condition regarding the attribute of the owner of the data to be extracted from the application, the privacy control unit 12 identifies the owner who satisfies the condition by the user DB 32, and the owner determines the owner based on the privacy policy of the identified owner. Extract authorized data.

The user DB 32 associates the identifier of the owner with the attribute. FIG. 5 is a diagram showing an example of the user DB 32 according to an embodiment of the present invention. As shown in FIG. 5, the user DB 32 stores the identifier of the data owner and the attribute of the owner in association with each data type (for example, different types of databases).
The owner attribute is an attribute of the owner of data included in the database, and refers to, for example, an attribute such as male, 20's, etc.

  Specifically, the privacy control unit 12 acquires the identifier of the owner stored in the database requested by the application based on the user DB 32 according to the extraction target attribute specified by the application. Next, the privacy control unit 12 determines whether provision is permitted based on the type of application and the privacy policy corresponding to the type of data, based on the acquired identifier of the owner. The privacy control unit 12 extracts only data of the owner who satisfies the condition of the attribute and permits data provision, and returns it to the application.

  FIG. 6 is a sequence diagram showing a token issuing and data extraction process by the security gateway device 10 according to an embodiment of the present invention.

  In step S11, the access control unit 11 receives the privacy certificate 21 from the application.

  In step S12, the access control unit 11 allows the application to access data based on the provision period defined by the security policy, which corresponds to the type of application and the type of data described in the privacy certificate 21. Generate a token with an expiration date.

  In step S13, the access control unit 11 issues the generated token to the application.

  In step S14, the access control unit 11 receives a request for data acquisition from an application having a token.

  In step S15, the access control unit 11 verifies the legitimacy of the data request from the application.

  In step S16, when the access control unit 11 is verified as valid in step S15, the access control unit 11 transmits a request for data acquisition to the server in the second domain.

  In step S17, the privacy control unit 12 receives data from the server of the second domain.

  In step S18, the privacy control unit 12 extracts data for which provision is permitted based on the privacy policy.

  In step S19, the privacy control unit 12 returns the extracted data to the application.

[Example in a multi-cloud environment]
FIG. 7 is a block diagram showing the configuration of the security gateway device 10 in a multi-cloud environment according to an embodiment of the present invention.
The security gateway device 10 is installed at the contact point between the global cloud 50 and the local cloud 60 in a multi-cloud environment.
The security gateway device 10 extracts, from the local cloud 60 installed in the second domain, data requested via the global cloud 50 from an application provided by a server installed in the first domain, Return to the application through

The application makes a request for token issuance via the global query controller 51 of the global cloud 50 with the privacy certificate 21 as a parameter.
The access control unit 11 of the security gateway device 10 sets the expiration date of the token based on the privacy certificate 21 and the validity period of the security policy DB 31, and stores the token in the token DB 33. The access control unit 11 issues a token to the application via the global query controller 51.

  The application having the token is via the global query controller 51 of the global cloud 50, the installation country of the application server, the application type, the data type, the data owner attribute, the query (request to the DB server), the time stamp ( For example, the data acquisition request is made using the transmission time of the data acquisition request and the message authentication code as parameters. The global query controller 51 determines the local cloud 60 to which the query is distributed according to the content of the query from the application.

The access control unit 11 of the security gateway device 10 verifies the legitimacy of the token, and the privacy control unit 12 passes the query of the application to the local query controller 61 of the local cloud 60.
The local query controller 61 determines a database to which the query is distributed according to the content of the query passed from the privacy control unit 12 and extracts data based on the query.
The privacy control unit 12 of the security gateway device 10 sorts data from the data extracted by the local query controller 61 based on the privacy policy DB 62, and returns the data to the application via the global query controller 51.

  FIG. 8 is a flowchart showing an example of token issuance processing of the security gateway device 10 in a multi-cloud environment according to an embodiment of the present invention.

  In step S101, the access control unit 11 receives, from the application, a request for token issuance that includes the privacy certificate 21 as a parameter.

  In step S102, the access control unit 11 verifies the legitimacy of the content described in the privacy certificate 21. More specifically, the access control unit 11 determines whether the issuance country (the same as the installation country of the application server) of the privacy certificate 21 is the same as the IP address information of the request header. Furthermore, the access control unit 11 determines whether the application IP (the IP address of the application server) is identical to the IP address information of the request header. Furthermore, the access control unit 11 determines whether the installation country of the DB server is the same as the country in which the security gateway device 10 is installed. Furthermore, the access control unit 11 determines whether the current time is earlier than the expiration date. If all the determinations are YES, the access control unit 11 moves the process to step S103. If any determination is NO, the access control unit 11 moves the process to step S109.

  In step S103, the access control unit 11 uses the issuing country of the privacy certificate 21 described in the privacy certificate 21 (the installing country of the application server), the application type, and the data type to use the security policy DB 31. Search for. The access control unit 11 acquires a list of validity periods of tokens in the installation country of the application server defined for each administrator and a list of privacy information.

  In step S104, the access control unit 11 determines whether the database designated by the type of data described in the privacy certificate 21 is a non-privacy DB 63 or a privacy DB 64 from the list of privacy information. The access control unit 11 determines the non-privacy DB 63 as the non-privacy DB 63 when all the administrators set the non-privacy DB 63, and determines the privacy DB 64 in other cases.

  In step S105, the access control unit 11 determines the shortest period among the effective periods set by the plurality of administrators from the list of effective periods as the effective period of the token. The access control unit 11 adds up the value of the determined effective period and the current time to calculate the effective period.

  In step S106, the access control unit 11 generates a token.

  In step S107, the access control unit 11 determines the token generated in step S106, the installation country of the application server described in the privacy certificate 21, the application IP, the type of application, the type of data, and the privacy information determined in step S104. And the expiration date of the token calculated in step S105 is associated and stored in the token DB 33.

  In step S108, the access control unit 11 returns the token for which the expiration date is set to the application. Thereafter, the access control unit 11 ends the process.

  In step S109, the access control unit 11 returns, to the application, error information indicating that the request for token issuance is not normal. Thereafter, the access control unit 11 ends the process.

  9 and 10 are flowcharts showing an example of data extraction processing of the security gateway device 10 in a multicloud environment according to an embodiment of the present invention.

  In step S201, the access control unit 11 receives a request for data acquisition from the application, and uses the installation country of the application server of the parameter, the IP address information (application IP) of the request header, the application type, and the data type. The token DB 33 is searched to obtain tokens and token expiration dates associated with these pieces of information.

  In step S202, the access control unit 11 determines whether the time when the request for data acquisition is received is earlier than the expiration date of the token. If this determination is YES, the access control unit 11 moves the process to step S203, and if this determination is NO, the access control unit 11 moves the process to step S213.

  In step S203, the access control unit 11 connects parameters other than the message authentication code (the installation country of the application server, the type of application, the type of data, the type of data, the attribute of the owner of data, the query, and the time stamp) in step S201. A keyed hash function having the acquired token as a key is input, a hash value is calculated, and it is determined whether the calculated hash value matches the message authentication code. If this determination is YES, the access control unit 11 moves the process to step S204, and if this determination is NO, the access control unit 11 moves the process to step S213.

  In step S204, the access control unit 11 uses the parameter time stamp to determine whether the reception time of the data acquisition request is within a certain period from the time stamp. If this determination is YES, the access control unit 11 moves the process to step S205, and if this determination is NO, the access control unit 11 moves the process to step S213.

  In step S205, the access control unit 11 determines whether the database designated by the parameter data type is privacy. If this determination is YES, the access control unit 11 moves the process to step 207, and if this determination is NO, the access control unit 11 moves the process to step S206.

  In step S206, the access control unit 11 acquires non-privacy data from the non-privacy DB 63 via the local query controller 61 using the parameter query, and returns the acquired data to the application. Thereafter, the access control unit 11 ends the process.

  In step S207, the privacy control unit 12 searches the user DB 32 using the attribute of the owner of the parameter data, and acquires a list of the owners of the corresponding data.

  In step S208, the privacy control unit 12 acquires the privacy policy of the owner of the corresponding data from the privacy policy DB 62, using the type of application and the list of the owners acquired in step S207.

  In step S209, the privacy control unit 12 refers to the privacy policy acquired in step S208, and among the data designated by the data type, a list of owners who are permitted to provide the data (hereinafter, a list of data providers Create).

  In step S210, the privacy control unit 12 acquires privacy data from the privacy DB 64 via the local query controller 61 using the parameter query.

  In step S211, the privacy control unit 12 extracts only the owner's data existing in the provider list from the data acquired in step S210, using the data provider list generated in step S209.

  In step S212, the privacy control unit 12 returns the data extracted in step 211 to the application. Thereafter, the access control unit 11 ends the process.

  In step S213, the access control unit 11 returns, to the application, error information indicating that the data acquisition request is not normal. Thereafter, the access control unit 11 ends the process.

According to the present embodiment, the security gateway device 10 confirms the acceptance permission of the data from the second domain in the first domain by the privacy certificate 21 and, at the second domain side that is the data providing source, Permit the provision of data based on the security policy for the domain application, and issue a token for acquiring data. An application having a token can use the data within the token's expiration date. Therefore, the security gateway device can utilize the data accessed by the application, meeting the security conditions of each country.
Furthermore, the security gateway device 10 processes the data in response to the request from the application based on the type of application and the presence or absence of privacy defined for each type of data, so the data is processed regardless of the policy on the data receiving side. It can conceal data related to the privacy of the provider.
Furthermore, since the security gateway device 10 sorts data based on the privacy policy for each data owner in response to a request from an application, it can provide only data for which each owner has been authorized.
Furthermore, security gateway device 10 extracts data based on the privacy policy for each data owner according to the type of data requesting application and the data type, so according to the detailed setting for each data owner It can control the availability of individual data.
Furthermore, the security gateway device 10 interprets the query itself because the owner who satisfies the condition can be identified by referring to the user database when the condition regarding the attribute of the owner of the data is received separately from the data extraction query. You can sort out the data of interest without
Furthermore, since the security gateway device 10 provides data based on the shortest period among the provision periods managed by a plurality of administrators, data is protected under the conditions of the strictest provision period among the conditions of a plurality of administrators. it can.
Furthermore, when the security gateway device 10 determines that the data relates to privacy when any of the plurality of administrators specifies that the data relates to privacy, the security gateway device 10 relates to privacy among the conditions of the plurality of administrators. Protect your data under as safe conditions as possible.
Furthermore, since the security gateway device 10 verifies the legitimacy of the request for data by using the common key, the security gateway device 10 can improve security by preventing falsification, tampering, and the like.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to embodiment mentioned above. Further, the effects described in the embodiments of the present invention only list the most preferable effects resulting from the present invention, and the effects according to the present invention are limited to those described in the embodiments of the present invention is not.

  For example, in the present embodiment, after acquiring the data, the security gateway device 10 extracts the providable data from the acquired data using the list of data providers, but the present invention is not limited thereto. The security gateway device 10 may incorporate the condition of the attribute of the owner into a query and send it to the local query controller 61 to extract data that can be provided to the local query controller 61.

  The series of processes by the security gateway device 10 can also be performed by software. When the series of processes are performed by software, a program constituting the software is installed in a general-purpose computer or the like. In addition, the program may be recorded in a computer readable recording medium (for example, a removable medium such as a CD-ROM) and distributed to the user, or downloaded to the user's computer via the network. May be distributed by

10 Security Gateway Device 11 Access Control Unit 12 Privacy Control Unit 21 Privacy Certificate 31 Security Policy DB
32 User DB
33 Token DB
50 Global Cloud 51 Global Query Controller 60 Local Cloud 61 Local Query Controller 62 Privacy Policy DB
63 Non-privacy DB
64 Privacy DB

Claims (10)

Data requested from an application provided by a server installed in a first domain, which is one country of each country that does not share security or privacy policies, in a second domain of a country different from the first domain A security gateway device installed in a domain other than the first domain, which is extracted from an installed server and returned to the application,
A security policy storage unit storing a security policy that defines the provision period of the data for each of the first domains in association with a database specified by the type of application and the type of data;
A privacy certificate issued by a certificate authority of the first domain, which provides the country of issue of the privacy certificate, the IP address of the application, the type of the application, and data that can be acquired by the application. DB and server installation countries, and the first domain is the privacy certificate nations said indicating privacy certificate including the type of the data, as defined in the first domain in the security policy, the application The period of time for the application to access the data calculated based on the provision period associated with the type of data and the database designated by the type of data, and the time when the provision period is determined Acquiring the data by the set application An access control unit which generates because of tokens, and returns the generated the token to the application,
Security gateway device comprising: The security policy defines the presence or absence of privacy for each database specified by the type of the application and the type of the data,
In response to a request from the application having the token, whether the data is processed based on the type of the application having the token and the privacy information in the privacy information associated with the database specified by the data type The security gateway device according to claim 1, further comprising: a privacy control unit that controls whether or not the security gateway device is configured.   The security gateway device according to claim 2, wherein the privacy control unit sorts the data based on a privacy policy for each owner of the data, in response to a request from the application having the token. The privacy policy defines whether to permit provision of the data for each owner of the data, in association with a database specified by the type of the application and the type of the data;
The security gateway device according to claim 3, wherein the privacy control unit extracts data authorized by the owner of the data based on the privacy policy. A user database in which an identifier of the owner of the data is associated with an attribute;
The said privacy control part specifies the owner who satisfy | fills the said conditions with the said user database, when the conditions regarding the said attribute of extraction object are received from the said application, The data regarding the said owner are extracted. The security gateway device according to any one of the preceding claims. The security policy is set for each of a plurality of administrators.
6. The privacy control unit according to any one of claims 2 to 5, wherein the privacy control unit determines that the data relates to privacy when any of the plurality of administrators defines that the data relates to privacy in the security policy. The security gateway device according to any one of the preceding claims. The security policy is set for each of a plurality of administrators.
The said access control part sets the expiration date of the said token based on the shortest period among the provision periods of the said data matched with these managements in any one of Claim 1 to 6 Security gateway device as described.   The security gateway device according to any one of claims 1 to 7, wherein the access control unit verifies the legitimacy of the request for the data from the application by a message authentication code using the token as a common key. A method performed by the security gateway device according to claim 1, wherein
Said access control unit,
A privacy certificate issued by a certificate authority of the first domain , which provides the country of issue of the privacy certificate, the IP address of the application, the type of the application, and data that can be acquired by the application. The first domain that is the country of issue of the privacy certificate indicated by the privacy certificate including the installation country of the DB server and the type of the data, and the application specified in the first domain by the security policy The period of time for the application to access the data calculated based on the provision period associated with the type of data and the database designated by the type of data, and the time when the provision period is determined Acquiring the data by the set application It generates because of tokens, the method comprising the access step of returning the generated the token to the application.   A program for causing a computer to execute the steps of the method according to claim 9.

Images