JP6617456B2 - Information processing system, information processing apparatus, and program - Google Patents

Description

  The present invention relates to an information processing system, an information processing apparatus, and a program.

  Provided is a cloud service realized by cooperation between an apparatus such as an image forming apparatus used in an office and one or more computers (hereinafter simply referred to as “server”) connected to the apparatus via the Internet or the like. Yes. For example, a service is provided in which an image forming apparatus scans image data from a document and transfers the image data to a server, and the server performs image processing on the image data and stores the image data in a predetermined storage. Has been.

  The server stores history information related to the use of services in a plurality of companies. Such history information indicates what kind of user used what kind of service, and by analyzing such history information, for example, it is expected to acquire useful materials in marketing activities, etc. can do.

  However, it is not preferable from the viewpoint of privacy protection that the behavior of each user is specified based on the history information. However, if information about the user is completely removed from the history information, the possibility that useful information can be obtained by analyzing the history information is reduced.

  The present invention has been made in view of the above points, and an object of the present invention is to appropriately reduce the relevance between history information relating to computer use and a user.

Therefore, in order to solve the above-described problem, an information processing system including one or more information processing apparatuses includes a storage unit that associates identification information for each user included in history information about computer use in association with identification information for each user. Change the attribute information of each user stored in the storage unit and the replacement unit that replaces the identification information for each set formed by classifying the attribute information of each user in a predetermined unit and a changing unit that, the replacement unit, the change by the change unit is made, among the set of the attribute information stored in the storage unit is formed by being classified by the predetermined unit The presence / absence of a set in which the number of attribute information belonging is equal to or less than a predetermined number is determined. If there is a corresponding set, the predetermined unit is changed.

  It is possible to appropriately reduce the relevance between the history information regarding the use of the computer and the user.

It is a figure for demonstrating the relationship between the cloud service system of embodiment of this invention, and an apparatus. It is a figure which shows the hardware structural example of each computer which comprises the cloud service system in embodiment of this invention. It is a figure which shows the function structural example of the cloud service system in embodiment of this invention. It is a sequence diagram for demonstrating an example of the process sequence performed regarding log data. It is a figure which shows the structural example of log data. It is a figure which shows an example of the user information memorize | stored in the user information storage part. It is a figure which shows an example of the anonymized log data. It is a figure which shows an example of the user information after a change. It is a figure which shows an example of the anonymization of the log data based on the classification unit after a change.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram for explaining the relationship between a cloud service system and devices according to an embodiment of the present invention. In FIG. 1, the cloud service system 1 and each device in the device usage environment 2a, 2b, or 2c are communicably connected by a network N1 such as a WAN (Wide Area Network) represented by the Internet.

  The device use environment 2a, 2b, or 2c (hereinafter referred to as “device use environment 2” when not distinguished from each other) is an environment in which a device that can cooperate with the service provided by the cloud service system 1 is used. An example of the device usage environment 2 is a system environment in an organization such as a company that is a customer of a service provided by the cloud service system 1. For example, the device usage environment 2 may be an office of a certain company. In the present embodiment, it is assumed that the device usage environments 2a, 2b, and 2c are system environments of the customer a, the customer b, and the customer c, respectively.

  The device usage environment 2a includes devices such as the MFP 20a1 and the projector 20a2. The device use environment 2b includes devices such as a TV conference device 20b1 and a TV conference device 20b2. The device usage environment 2c includes devices such as the MFP 20c1 and the electronic blackboard 20c2.

  The MFPs 20a1 and 20c1 are multifunction peripherals (MFPs (Multifunction Peripheral)). Other image forming apparatuses such as a scanner or a printer may be used instead of the MFP 20a1 or 20c1. The projector 20a2 is a projector, that is, a device that projects image data. The video conference devices 20b1 and 20b2 are devices used for video conferences. The electronic blackboard 20c2 is a whiteboard capable of digitizing the drawn content. In addition, this Embodiment may be applied regarding apparatuses other than the apparatus shown by FIG.

  An application program for linking with a cloud service is installed (introduced or installed) in each device. For example, the MFP 20a1 includes an application A and an application B. The projector 20a2 has an application E. Each of the video conference devices 20b1 and 20b2 has an application G. The MFP 20c1 has an application A and an application C. Hereinafter, when these application programs are not distinguished, they are referred to as “appliance apps”.

  A device application that can be installed on each device is concluded for each device between each device usage environment 2 (that is, each customer) and the organization that operates the cloud service system 1 (hereinafter referred to as “service provider”). Depends on the contract being made. In other words, each device usage environment 2 concludes a service contract with the service provider for the service desired to be used for each device. Each device usage environment 2 can download a device application for using the service contracted for each device.

  The cloud service system 1 is a set of one or more computers (information processing apparatuses) that provide various services with which devices can cooperate as a cloud service. For example, as an example of a service linked to the MFP 20a1 or 20c1, a service (image data scanned by the MFP 20a1 or 20c1 and transferred from the MFP 20a1 or 20c1 is stored in a predetermined storage or distributed to a predetermined distribution destination ( (Hereinafter referred to as “cloud scan service”). In addition, a service (hereinafter referred to as “cloud print service”) that causes the MFP 20a1 or 20c1 to download print data uploaded in advance to the cloud service system 1 and cause the MFP 20a1 or 20c1 to execute a print job based on the print data. An example of such a service.

  Note that the service provided by the cloud service system 1 is not necessarily provided as a cloud service. For example, the cloud service system 1 may be a server-side system in a general server client system. The network N1 may be a LAN (Local Area Network).

  FIG. 2 is a diagram illustrating a hardware configuration example of each computer constituting the cloud service system according to the embodiment of the present invention.

  As shown in FIG. 2, each computer includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, and the like that are mutually connected by a bus B.

  A program for realizing processing in each computer is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 executes a function related to each computer in accordance with a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

  FIG. 3 is a diagram illustrating a functional configuration example of the cloud service system according to the embodiment of the present invention. The functions of the cloud service system 1 are classified into three layers such as an application layer 120, a common service layer 130, and a database layer 140.

  The database layer 140 is a layer including a database (storage unit) that stores information necessary for processing executed in the application layer 120 or the common service layer 130. In FIG. 3, the database layer 140 includes a user information storage unit 141, a log storage unit 142, and the like. Each of these storage units can be realized using the auxiliary storage device 102 or a storage device that can be connected to the cloud service system 1 via a network.

  The user information storage unit 141 stores information related to users of services provided by the cloud service system 1. For example, the user information storage unit 141 stores information used for authentication of each user, attribute information of each user, and the like. Hereinafter, information stored for each user in the user information storage unit 141 is referred to as “user information”.

  The log storage unit 142 stores log data (history information) related to the use of the cloud service system 1.

  The application layer 120 is a layer that includes an application program (hereinafter referred to as “server application”) that implements a service provided by the cloud service system 1. In FIG. 3, the application layer 120 includes a portal application 120a, a cloud scan application 120b, a cloud print application 120c, and the like. The portal application 120a is a server application that provides a portal site for services provided by the cloud service system 1. In the portal site, for example, registration of user information, setting of setting information for each user for the server application, and the like can be performed. The cloud scan application 120b is a server application that executes processing related to the cloud scan service described above. The cloud print application 120c is a server application that executes processing related to the above-described cloud print service. The server application can provide a service to a device by cooperating with the device application.

  The common service layer 130 is a layer including functions common to a plurality of server applications or basic functions used from the plurality of server applications. 3, the common service layer 130 includes an authentication unit 131, a user management unit 132, a log generation unit 133, a replacement unit 134, and the like. Each of these units is realized by processing executed by the CPU 104 by one or more programs installed in the cloud service system 1.

  The authentication unit 131 authenticates a user of a device that uses the server application via the device application. Accordingly, the authentication unit 131 identifies the user of each server application.

  The user management unit 132 manages user information stored in the user information storage unit 141. For example, the user management unit 132 changes user information stored in the user information storage unit 141. The change of user information is, for example, addition of new user information, deletion of existing user information, update of existing user information, and the like.

  The log generation unit 133 generates log data related to the use of services provided by the cloud service system 1.

  The replacement unit 134 uses user identification information (hereinafter referred to as “user ID”) included in the log data generated by the log generation unit 133 as user information stored in the user information storage unit 141. It is replaced with identification information for each set (group) formed by being classified in units. As a result, the user ID included in the log data is anonymized. That is, it becomes difficult to specify which user each log data belongs to. However, the user information stored in the user information storage unit 141 can be changed. As a result of the change, there is a possibility that one user is classified into a certain group. Then, even if log data concerning the user is anonymized with respect to the user ID, the relevance with the user is not substantially lost. That is, it is specified that the log data relates to the user. Therefore, when the user information stored in the user information storage unit 141 is changed by the user management unit 132, the replacement unit 134 determines whether there is a group to which only one user belongs. When there is a corresponding group, the grouping unit (hereinafter referred to as “group classification unit”) is changed for the subsequent log data. Specifically, the group classification unit is changed so that a group of only one user does not exist.

  The classification form of each software and each storage unit shown in FIG. 3 is an example, and in order to implement this embodiment, each function of the cloud service system 1 has a hierarchy as shown in FIG. It is not essential to be classified. That is, as long as the device application of each device can be linked with the server application of the application layer 120, the hierarchical structure of functions in the cloud service system 1 is not limited to a specific one.

  Hereinafter, a processing procedure executed in the cloud service system 1 will be described. FIG. 4 is a sequence diagram for explaining an example of a processing procedure executed on log data.

  For example, when any server application in the application layer 120 executes some processing in response to a request from any device, the log generation unit 133 generates log data related to the processing. The log generation unit 133 requests the replacement unit 134 to anonymize the generated log data (S101).

  FIG. 5 is a diagram illustrating a configuration example of log data. In FIG. 5, the log data includes items such as date and time, tenant ID, user ID, department name, service name, and detailed information.

  The date and time is the date and time when the process related to the log data is executed. The tenant ID is identification information of the device usage environment 2 to which the user related to the log data belongs. That is, in the present embodiment, the tenant ID is identification information for each device usage environment 2. Note that “A” is the tenant ID of the device usage environment 2a. The user ID is the user ID of the user related to the log data. Since the user ID may overlap across a plurality of device usage environments 2, each user is uniquely identified by a set of tenant ID and user ID. The department name is the name of the department (organization) to which the user related to the user ID belongs in the device usage environment 2 related to the tenant ID. The service name is the name of the server application that executes the process related to the log data. The detailed information is detailed information (for example, a called method or a parameter for the method) regarding processing related to the log data. The tenant ID, user ID, and department name are specified when the user is authenticated by the authentication unit 131.

  Subsequently, the replacement unit 134 anonymizes the log data with reference to the user information storage unit 141 (S102).

  FIG. 6 is a diagram illustrating an example of user information stored in the user information storage unit. As shown in FIG. 6, the user information storage unit 141 stores user information including a tenant ID, a user ID, a password, a department name, an age, and the like for each user. Since the tenant ID is included in the user information, it can be said that the user information is stored for each tenant ID. Further, since the department name is included in the user information, it can be said that the user information is further stored for each department name.

  In the present embodiment, the replacement unit 134 anonymizes the log data by replacing the user ID included in the log data based on the age included in the user information. However, anonymity may not be ensured if the user ID is simply replaced by age. For example, there is no user of the same age in the accounting department of the device usage environment 2a whose tenant ID is “A”. Therefore, a user is uniquely specified by age. Therefore, as an initial state, the replacement unit 134 classifies each user for each group having a common age of 10 digits, and is included in the log data according to the identification information of each group (information indicating the age 10 digits). Replace the current user ID. As a result, the user ID of the log data in FIG. 5 is replaced as shown in FIG.

  FIG. 7 is a diagram illustrating an example of anonymized log data. In FIG. 7, the user ID is replaced with “30s”. As is clear from FIG. 6, there are two users in their 30s in the accounting department of the device usage environment 2a. Therefore, according to the log data shown in FIG. 7, it is difficult to uniquely identify the user.

  Subsequently, the replacement unit 134 stores the anonymized log data in the log storage unit 142 (S103).

  Thereafter, for example, it is assumed that the user tanaka is transferred to the development department due to personnel changes or the like in the device usage environment 2a. In this case, for example, the administrator of the device usage environment 2a accesses the portal application 120a from his / her terminal, and inputs an instruction to change “accounting” to “development” for the department name of the user tanaka.

  In response to a request from the portal application 120a, the user management unit 132 stores user information whose tenant ID is “A” and whose user ID is “tanaka” among the user information stored in the user information storage unit 141. The department name is changed to “development” (S111). As a result, the user information stored in the user information storage unit 141 is as shown in FIG.

  FIG. 8 is a diagram illustrating an example of the user information after the change. In FIG. 8, the affiliation name of the user information whose tenant ID is “A” and whose user ID is “tanaka” is changed to “development”.

  Subsequently, the user management unit 132 notifies the replacement unit 134 that the user information has been changed (S112). The notification may include a tenant ID related to the changed user information (hereinafter referred to as “target tenant ID”). In response to the notification, the replacement unit 134 specifies the target tenant ID included in the notification and requests the user management unit 132 to obtain a list of user information (S113). The user management unit 132 acquires user information including the target tenant ID from the user information storage unit 141 (S114), and outputs a list of acquired user information to the replacement unit 134 (S115).

  Subsequently, the replacement unit 134 determines the validity of the classification unit of the current group based on the list of user information (S116). Specifically, the replacement unit 134 classifies each user information included in the list into each group according to the current classification unit (unit of 10 digits of age). In this embodiment, after being classified for each department name, it is further classified into groups for every ten digits of age. That is, in the classification of user information at the time of determining the validity of the classification unit, among the items included in the log data, items that can be used for user identification and are not replaced (this implementation) In this form, a group is generated for each value of “tenant ID” and “affiliation department signature”. Therefore, in the anonymization of log data, when the tenant ID and the department name are deleted from the log data, the tenant ID and the list of all user information stored in the user information storage unit 141 are Regardless of whether the department name is different, classification based on age may be performed to determine validity.

  If there is one or more groups to which only one user information belongs as a result of the classification, the replacement unit 134 determines that the current classification unit is not valid. On the other hand, when the user information belonging to all groups is 0 or 2 or more, the replacement unit 134 determines that the current classification unit is valid. That is, in this embodiment, the condition that the classification unit is valid is “no group to which only one user information belongs”. However, different values may be applied to the conditions for the number of user information belonging to each group, such as “there is no group in which user information belongs to a predetermined number or less (for example, 2 or less)”.

  If it is determined that the current classification unit is not valid, the replacement unit 134 changes the classification unit (S117). In the present embodiment, the group classification unit is doubled. That is, the two previous groups are integrated into one. Specifically, the 20s and 30s are grouped together, and the 40s and 50s are grouped together. However, only the group (a group to which only one piece of user information belongs) that is the cause for which validity cannot be ensured may be integrated with other groups. For example, when the validity cannot be ensured by the group of 30s, the 20s and 30s are integrated, and the 40s and 50s may not be integrated. The group integration is recursively executed until there is no group to which only one user information belongs. Information indicating the changed classification unit is stored, for example, in the auxiliary storage device 102 or the like, and anonymization based on the classification unit is applied to log data generated thereafter. That is, the anonymization based on the new classification unit may not be executed for the log data already stored in the log storage unit 142. This is because there were two users in their 30s in the accounting department of the device usage environment 2a until the user tanaka changed, and thus the anonymity of log data before the change of the user tanaka was ensured. However, anonymization based on a new classification unit may be re-executed for the log data stored in the log storage unit 142.

  Note that L-diversity may be considered in determining the classification unit. That is, the fact that there are L groups after classification may be a condition that the classification unit is valid.

  The classification unit may be different for each tenant ID, or for each tenant ID and department name. For example, when the group classification unit is not valid only for the accounting department of the device usage environment 2a, the classification unit may be changed only for the accounting department.

  Thereafter, when the log generation unit 133 generates log data regarding the newly executed processing and requests the replacement unit 134 to anonymize the log data (S121), the replacement unit 134 is based on the changed classification unit. The log data is anonymized (S122). Therefore, for example, the replacement as shown in FIG. 9 is executed.

  FIG. 9 is a diagram illustrating an example of anonymization of log data based on the changed classification unit. In FIG. 9, (1) is log data before anonymization is performed, and (2) is log data after anonymization is performed. In FIG. 9, the user ID “takahashi” is replaced with “20-30 generations”. As a result, based on the log data of (2), it is difficult to specify that the user related to the log data is the user Takahashi. If the user ID “takahashi” is replaced with the 30's, the tenant ID, the department to which the log data belongs, and the 30's are applied to the user information stored in the user information storage unit 141. , The user ID “takahashi” is uniquely specified. This is because the user in the 30s of the accounting department has become one of the users Takahashi due to the transfer of user Tanaka.

  As described above, according to the present embodiment, the identification information (user ID) for each user included in the log data is associated with the identification information and stored in the user information storage unit 141. Are replaced by identification information (for example, teens, 20s) for each set classified in a predetermined unit. As a result, service usage trends for each user cannot be analyzed, but service usage trends by age group can be analyzed. That is, even if the relevance between the user and the log data decreases, it is possible to suppress a decrease in the utility value of the log data.

  Further, in the present embodiment, the validity of the classification unit for anonymization is determined according to the change of the user information. If the classification unit is not valid, the classification unit is changed. Therefore, when a user's structure changes, possibility that anonymity will fall regarding the log data after it can be reduced.

  As described above, according to the present embodiment, the relevance between log data (history information) and each user can be appropriately reduced.

  In this embodiment, for convenience of explanation, an example in which log data is anonymized based on age classification has been described. However, based on other attribute classification (for example, a user's home address). This embodiment may be applied to the case where log data is anonymized.

  Further, in the present embodiment, an example in which the log data is anonymized according to the generation of log data has been described, but the timing of anonymization may be other than when log data is generated. For example, anonymization may be performed during analysis of log data (for example, when report information is generated based on log data). In such a form, the validity of the classification unit may be determined not when the user information is changed but when the log data is analyzed.

  In addition, the present embodiment may be applied to log data generated in an information processing system that provides services other than cloud services (for example, an information processing system in a company).

  In the present embodiment, the example in which the computer that provides the service and the computer that stores the log are the same (cloud service system 1) has been described, but each may be realized by a different computer or computer system. .

  In the present embodiment, the cloud service system 1 is an example of an information processing system or an information processing apparatus. The user management unit 132 is an example of a changing unit.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

1 Cloud service system 2a, 2b, 2c Device usage environment 20a1, 20c1 MFP
20b1, 20b2 TV conference equipment 20a2 Projector 20c2 Electronic blackboard 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 CPU
105 Interface Device 120 Application Layer 120a Portal Application 120b Cloud Scan Application 120c Cloud Print Application 130 Common Service Layer 131 Authentication Unit 132 User Management Unit 133 Log Generation Unit 134 and Replacement Unit 140 Database Layer 141 User Information Storage Unit 142 Log Storage Unit B Bus

JP 2011-170632 A

Claims (6)

An information processing system including one or more information processing devices,
The identification information for each user included in the history information about the use of the computer is formed by classifying the attribute information of each user stored in the storage unit in association with the identification information of each user in a predetermined unit. A replacement unit that replaces with identification information for each set to be performed;
A change unit for changing attribute information of each user stored in the storage unit,
When the change by the change unit is performed, the replacement unit has a number of attribute information belonging to a set formed by classifying each attribute information stored in the storage unit in the predetermined unit. The presence / absence of a set equal to or less than a predetermined number is determined, and if there is a corresponding set, the predetermined unit is changed,
An information processing system characterized by this. The history information and the attribute information of each user include information indicating an organization to which each user belongs,
The replacement unit is a set in which each attribute information stored in the storage unit is classified by the predetermined unit for each organization, and the number of attribute information belonging to the replacement unit is a predetermined number or less. The presence or absence of
The information processing system according to claim 1. The replacement unit is an organization in which each attribute information stored in the storage unit is classified by the predetermined unit for each organization, and the number of attribute information belonging to the organization is a predetermined number or less. Changing the predetermined unit with respect to the history information related to
The information processing system according to claim 2. The attribute information includes a user's age,
The replacement unit replaces the identification information for each user included in the history information, the identification information for each set age of the user is formed by being classified in a predetermined unit,
The information processing system according to claim 1 or 2. The identification information for each user included in the history information related to the use of the computer is formed by classifying the attribute information of each user stored in the storage unit in association with the identification information of each user in a predetermined unit. A replacement unit that replaces with identification information for each set to be performed;
A change unit for changing attribute information of each user stored in the storage unit,
When the change by the change unit is performed, the replacement unit has a number of attribute information belonging to a set formed by classifying each attribute information stored in the storage unit in the predetermined unit. The presence or absence of a set that is less than or equal to a predetermined number is determined, and if there is a corresponding set, the predetermined unit is changed.
An information processing apparatus characterized by that. In the information processing device,
The identification information for each user included in the history information related to the use of the computer is formed by classifying the attribute information of each user stored in the storage unit in association with the identification information of each user in a predetermined unit. A replacement procedure for replacing with identification information for each set to be performed;
A change procedure for changing attribute information of each user stored in the storage unit;
In the replacement procedure, when a change in the change procedure is performed, the number of attribute information belonging to a set formed by classifying each attribute information stored in the storage unit in the predetermined unit is The presence or absence of a set that is less than or equal to a predetermined number is determined, and if there is a corresponding set, the predetermined unit is changed.
A program characterized by that.

Images