JP6685118B2 - Personal information protection / use server - Google Patents

Description

  The present invention discloses necessary personal information to a business operator in a client-server system in which a server that centrally manages personal information and a large number of user terminals are connected by a network, and aims to use the personal information. The present invention relates to a personal information protection / use server capable of protecting personal information without disclosing more personal information than a business operator needs.

  In the modern information society, a huge amount of personal information is accumulated and stored in a database in various businesses such as various offices, medical institutions, and public offices. If such personal information is exchanged or used in an unrestricted manner without the person's knowledge, his / her information will be mishandled and suffer unforeseen disadvantages. There is also a risk that personal information such as credit card usage may be known to others and privacy may be infringed. On the other hand, personal information that has been accumulated and stored in a database should be managed appropriately and should be disclosed to the business operator that provides services to the individual, so that the individual address of the service provider can be increased. It will also be beneficial to individuals as there is no need to give out information such as contact information.

  As a technique for protecting and using personal information accumulated in business establishments, for example, for the purpose of protecting personal information in a system that allows widely distributed personal information to be used via the Internet, The access policy for setting the access authority is received from the owner of personal information and stored on the proxy server, and when there is access from an external accessor who accesses via the Internet, access within the proxy server By analyzing the policy, the access authority of the external access person is determined, and based on the analyzed access authority, the external access person is made to use the personal information in the database, which reduces the operation burden on the data beta administrator. Information access control to reduce the burden of confidentiality Law has been proposed (e.g., see Patent Document 1.). In addition, a personal information server having a personal information database including a table storing the personal information of the customer including a plurality of partial information and a table storing the access right of the business operator to each partial data (field) of the personal information, and the customer The server of the business operator and the terminal of the customer who provide the service are connected to each other via the network, and when the business server requests the personal information server to access the personal information, the customer ID of the personal information The access right table for each field of the personal information is searched with and the business name, and based on the access right setting record obtained as a result of the search, the table storing the personal information of the customer is searched by the customer ID of the personal information, The personal information of only the fields that can be accessed by the access right for each field of the information is on the business server side Access right management method to receive has been proposed (e.g., see Patent Document 2.).

Japanese Unexamined Patent Publication No. 2002-014862 (page 3-5, FIG. 1, FIG. 8 to FIG. 11) JP-A-2002-324194 (pages 5-6, FIGS. 1-5)

  The information access control system described in Patent Document 1 controls the access authority to a database in a situation where personal information is dispersed in a wide area and a database containing the personal information can be accessed via the Internet. Is to do. In this system, a large number of databases distributed over the Internet are managed by individual database administrators, which increases the possibility of leakage or theft of personal information from the databases. In addition, the access policy for setting the access authority of the external access person to the personal information in the database is that the owner of the personal information accesses the plurality of database management information systems from the terminal via the Internet and individually registers it. . Therefore, while the operational load and confidentiality responsibility of the database administrator are reduced, the labor and burden of the personal information owner increases. Also, in this system, the proxy server determines the attributes of the external access person and the contents of the access rule, sets the access authority for the access request from the terminal of the external access person, and identifies the person identified by the personal identification information. Information is searched and access control is performed for external access persons such as whether or not part or all of personal information can be read from the database, but security measures against unauthorized access persons are not always sufficient. There is a possibility that personal information may be stolen by unauthorized access from the outside.

  The access right management method described in Patent Document 2 does not store personal information in a plurality of company servers, but centrally manages personal information in the personal information server, thereby reducing the burden of inputting and changing personal information. It alleviates. In this access right management method, it is necessary to set an access right for each field of personal information for each business operator who is a user of personal information and store the access right information for each business operator in the database. Moreover, if the business server that wants to use the personal information to provide the service to the customer does not set the access right, and the business server requests the personal information from the personal information server, the terminal of the customer who receives the service is displayed. The personal information server makes an inquiry, adds the field-specific access right set by the customer to the database, and returns the personal information of the access-permitted field to the business entity server based on the access right. As described above, the system is complicated, and it cannot be said that the system is easy to use for a business operator who provides services to customers. Further, similar to the system described in Patent Document 1, security measures against unauthorized access cannot be said to be perfect, and there is a risk that personal information may be stolen by unauthorized access from the outside.

  The present invention has been made in view of the above circumstances, is a system for centrally managing personal information, has a low possibility of leakage or theft of personal information from a database, and is troublesome for personal information owners. It is possible to realize a system that is easy to use even for businesses that provide services to customers, security measures against unauthorized access are sufficient, and personal information is stolen by unauthorized access from the outside. The purpose is to provide a personal information protection / use server that does not cause any concern.

According to the present invention, individual personal information composed of a plurality of personal component information is distributed and stored in a plurality of databases, a large number of information users are divided into groups, and accessible among a plurality of databases. It was made possible by the idea of defining the database in groups. In this specification, each database that stores personal information in a distributed manner is called a database unit.
That is, the invention according to claim 1 is provided with a database that stores information resources consisting of a large number of personal information, controls the access right to the information resources to the information user, and protects the personal information. In a personal information protection / use server (hereinafter, referred to as "PC server") that enables resources to be taken out and used, the personal information protection / use server is composed of a plurality of personal component information input corresponding to each of a plurality of information items. individual personal information, and stores the personal information separately dispersed in each group comprising associating one information item or two or more information items uniquely allocated code in multiple databases units, personal information Information item of the above and the above-mentioned code as a key, the personal component information of the personal information is stored in any of the database units of the plurality of database units. Whether to store calculated in location calculator, a 1 multiple information users for each group grouped, is allowed to information users belonging to the group to access the plurality of databases units One or two or more database units are respectively defined in the access right table, and personal component information of personal information is stored in relation to the code in the database unit which is the storage location calculated by the storage location calculator. When the information user controls with the access control unit, and the information user logs in with the identification information for identifying the information user and tries to retrieve the personal information with the code assigned to the personal information, the information user From the access right table using the identification information for identifying the group to which the Taken out access said information user, as controlled by the access controller to retrieve the personal component information corresponding to each information item from one or more databases units to which access is permitted to the code as a key It is characterized by having done.

  According to a second aspect of the present invention, in the PC server according to the first aspect, one or two or more databases that the information user is permitted to access among the plurality of database units for a limited time or a single time. Each unit is defined in a different access right table, and when an information user logs in with identification information for identifying the information user and tries to retrieve the personal information with the code assigned to the personal information, The access right of the information user is retrieved from the other access right table using the identification information of the information user and the code as a key, and the code is used as a key from one or more database units to which access is permitted. Personal component information corresponding to the information item is retrieved within a fixed time or only once Sea urchin, characterized in that as control by the access control unit is performed.

  According to a third aspect of the invention, in the PC server according to the first or second aspect, the information user receives a code assigned to the personal information from an individual and provides the service to the individual. It is characterized by being a business operator that does.

  According to a fourth aspect of the present invention, in the PC server according to any one of the first to third aspects, the individual database units which are the storage locations of the information item, the code and the information resource are encrypted and distributed. It is characterized by writing to multiple log files.

  In the PC server of the invention according to claim 1, personal information is centrally managed. Then, individual personal information composed of a plurality of personal component information (name, address, date of birth, etc. unique to the individual) is dispersed into a plurality of database units, and one information item (name, address, date of birth). Separately for each group (name, gender, occupation and place of work, landline phone number and fax number, mobile phone number and email address, etc.) including two or more information items (day, family composition, work place, income, etc.) Therefore, even if the database is stolen, there is less possibility that personal information that can identify an individual for the first time by a set of a plurality of personal component information is leaked and stolen. Further, even if it is possible to retrieve a plurality of individual component information belonging to one information item at a time by designating a plurality of codes assigned to individual information of an individual when extracting information resources from a database, one code When it is configured to prohibit taking out a plurality of pieces of personal component information at once by specifying, the possibility of leakage or theft of personal information from the database becomes lower. In this server, instead of setting access rights to the database for each information user, many information users are divided into groups and access rights to the database are defined for each group, so personal information is registered. The labor and burden on the individual to do so is reduced.

  In addition, for example, when the information user is a business that provides a service to the individual after receiving the presentation of the code assigned to the personal information from the individual, the business that uses this server is By logging in with and entering the code presented by the customer, the personal information can be retrieved from the database, which makes it easier for the business operator to use the personal information. In this case, if the minimum access right to personal information required by each group is defined in the access right table, access will be made using the identification information for identifying the group to which the business operator belongs as a key. When personal information is taken out based on the access right of the business operator defined in the rights table, only personal component information about the information items required by the business operator is retrieved, so more personal information is leaked than necessary. There is no fear of doing it. Further, even if the database of this server can be illegally accessed, a large amount of personal component information cannot be retrieved from the database at a time, so a large amount of personal information can be prevented from leaking in a short time. .

  Therefore, when this PC server is used, the possibility of leaking or theft of personal information from the database is low, the labor and burden on the owner of personal information is small, and it is easy to use even for businesses that provide services to customers. The system can be implemented, security measures against unauthorized access are sufficient, and there is less concern that personal information will be stolen by unauthorized access from outside.

  In the PC server of the invention according to claim 2, in the method in which the business operator (information user) logs in with the identification information and retrieves the personal information for the information item defined in the access right table using the identification information of the group as a key. When personal information that cannot be retrieved is required, the business operator logs in with the business operator's identification information and enters the code presented by the customer. The access right of the business operator is extracted from the access right table of 1., and the personal information is extracted from the database unit to which the access is permitted. In this case, by defining the access right to the information item temporarily needed by the business operator, which is different from the information item required by the group, in another access right table, the identification information of the business operator can be obtained. And the necessary personal information is temporarily retrieved based on the access right defined in another access right table using the code as a key. Therefore, this server not only provides convenience to service beneficiaries, but also makes it easier for businesses to use personal information.

  In the PC server of the invention according to claim 4, it is difficult to associate the storage location of the personal component information from the operation log (history), and it is possible to more reliably prevent the personal information from being leaked or stolen from the database.

FIG. 1 is a schematic diagram showing an example of an embodiment of the present invention and illustrating a schematic configuration of a PC server and a system including the PC server. It is a schematic diagram for explaining the relationship between the PC server and the customer and the service provider according to the present invention. It is a figure for demonstrating one example of the extraction of the information resource from the database of the PC server which concerns on this invention, Comprising: It is a figure which shows an information resource in the table format of a relational database. FIG. 9 is a system configuration diagram for explaining an example of a flow at the time of an operation of generating a PC code (code uniquely assigned to a customer's personal information) and writing personal information in the PC server according to the present invention. It is a figure which shows the storage system of the information resource in the database of this PC server in a table format. It is a system configuration | structure figure for demonstrating an example of the flow at the time of the operation which updates the personal component information of personal information in the PC server which concerns on this invention. It is a system configuration | structure figure for demonstrating an example of the flow at the time of the operation which deletes the personal component information of personal information in the PC server which concerns on this invention. It is a system block diagram for explaining an example of the flow at the time of the operation of taking out the personal component information of the personal information in the PC server according to the present invention. 9 is a flowchart of a series of operations described with reference to the system configuration diagram in FIG. 8. It is a system block diagram for demonstrating another example of the flow at the time of the operation which takes out the personal component information of personal information in the PC server which concerns on this invention. FIG. 9 is a system configuration diagram for explaining an example of a flow at the time of an operation of extracting personal component information of personal information in a PC server according to another embodiment different from that shown in FIG. 8. FIG. 12 is a system configuration diagram for explaining an operation procedure for setting an access right definition in another access right table in the PC server shown in FIG. 11.

The best mode for carrying out the present invention will be described below with reference to the drawings.
The PC server according to the present invention is a server for centrally managing personal information in a centralized manner. As shown in FIG. 2, the PC server 10 owns personal information via a communication network such as the Internet 12. Many customers 14 terminals (smartphones, tablet terminals, mobile phones, personal computers, etc., hereinafter simply referred to as “terminals”), and many businesses (service providers that provide various services to the customers 14). ) 16 terminals are connected respectively. Then, the customer 14 receives the issuance of the PC code uniquely assigned to the personal information of the customer from the PC server 10 (arrow a), and registers the personal information in the PC server 10 (arrow b). On the other hand, when the service provider 16 provides a service to the customer 14, for example, when the customer purchases at a shop or mail order on the Internet and delivers a product, the customer 14 sends a PC code through the shop or the like. Is received (arrow c), the PC code is accessed to the PC server 10 (arrow d), and the minimum personal information necessary for providing the service is acquired from the PC server 10 (arrow e).

As shown in FIG. 1, the PC server 10 is unique to an individual regarding an information item (R) such as a communication interface 18 implemented by a REST (REpresentational State Transfer) protocol, a name, an address, a telephone number, a work place, and the like. An information resource database 20 that manages a large number of personal information (P) composed of a plurality of personal component information (V) in a distributed manner as described later, and an access right to the information resource stored in this database 20. An access control unit 22 for controlling Here, the personal information (P) is [information item (R ₁ ): personal component information (V ₁ )], [information item (R ₂ ): personal component information (V ₂ )], ..., [information item (R _n ): Personal component information (V _n )] is a set of a plurality of component information that can be represented in the format. In addition, the PC server 10 generates a PC code (C) uniquely assigned to the input personal information (P), and a different algorithm for each information item (R) of the personal information (P). The encryption key (encryption key) table 26 used when encryption is performed by the personal computer (P), the information item (R) of the personal information (P), and the PC code (C) generated by the PC code generator 24 as the encryption key. A storage location calculator 28 that calculates the storage location of the personal component information (V) of the information (P), and an access right table 30 that defines the access right of the service provider 16 to the information resources stored in the database 20. ing. In addition, although not shown in FIG. 2, a plurality of log files for recording the usage status and the investigation status of the PC server 10 are provided.

  In the information resource database 20, personal information (P) composed of a plurality of personal component information (V) is associated with a PC code (C) assigned to the personal information (P), and a plurality of databases are provided. It is distributed and stored in units. That is, the plurality of personal component information (V) forming the personal information (P) is calculated by the storage location calculator 28 using the information item (R) of the personal information (P) and the PC code (C) as encryption keys. It is separately distributed and stored in the database unit which is the storage location. In this case, one personal component information (V) is stored in one database unit for personal information (P) of one individual. For example, name and sex, fixed telephone number and FAX number, and mobile telephone number. For information items such as e-mail address, date of birth and age, occupation and work place, work place and address and telephone number, a group of personal component information including two or more information items is stored in one database unit. You may do it. In the following, the database unit will be described as a collection corresponding to a table (table) of RDB (relational database) which is one of the data structures.

  Further, when the information resource is retrieved from the database 20, a plurality of personal component information (V) can be retrieved at a time for one information item (R) for a plurality of PC codes (C), but one PC code For (C), it may be prohibited to retrieve a plurality of individual component information (V) for a plurality of information items (R) at one time. Specifically, a plurality of PC codes (C) can be designated, but only one information item (R) can be designated as the communication interface 18. This is shown in FIG. 3 in a table format in RDB. In the example shown in FIG. 3, a plurality of telephone numbers enclosed by the one-dot chain line A can be retrieved at one time, but names, telephone numbers, addresses, and dates of birth enclosed by broken lines T can be retrieved at one time. Can not. The set of personal component information (V) for one PC code (C) (name, telephone number, address and date of birth in the row direction of the table) can identify an individual. The set of component information (V) cannot be extracted at one time, while the set of multiple personal component information (V) corresponding to multiple PC codes (C) (set of multiple names in the column direction of the table). , A set of a plurality of telephone numbers, etc.) can be retrieved at a time, but an individual cannot be specified only by such a set of a plurality of personal component information (V). Therefore, the possibility of leakage or theft of personal information from the database 20 is reduced.

  Next, an example of the flow of operation procedures (operation flow) in the PC server 10 will be described for each operation based on the system configuration diagrams shown in FIGS. 4, 6 to 8 and 10 to 12. In these drawings, illustration of components that are not related to each operation is omitted.

First, a flow at the time of operations of generating a PC code and writing personal information will be described with reference to FIG.
When the personal information (P) is input from the terminal of the customer 14 to the PC server 10, the personal information (P) is transferred to the communication interface 18 (ST1), whereby the PC code generator 24 receives a REST request for code generation. Will be issued. Here, the personal information (P) is a set of information items (R): personal component information (V), [information item (R ₁ ): personal component information (V ₁ )], [information item (R) ₂ ): Personal component information (V ₂ )], ..., [Information item (R _n ): Personal component information (V _n )]. Specifically, the information item (R) is an index (headline) such as a name, telephone number, address, date of birth, and the personal component information (V) is a name such as “Taro Yamada” unique to an individual, For example, a telephone number such as "075-123-4567", an address such as "○○ ward, △△ town XX address of Kyoto city", a date of birth such as "January 15, 1980", and the like. When the PC code (C) uniquely assigned to the personal information (P) is generated in the PC code generator 24, the PC code (C) is passed to the storage location calculator 28 and the personal information (P) is also transferred. The information items (R) ((R ₁ ), (R ₂ ), ..., (R _n )) included in are stored in the storage location calculator 28 (ST 2). Then, the access control unit 22 stores the personal information in the storage location calculated by the storage location calculator 28, that is, in any one of the plurality of collections 20-1, 20-2, ..., 20-n. The personal component information (V) extracted from P) is written (ST3). In each of the collections 20-1, 20-2, ..., 20-n, personal component information (V) of a plurality of personal information (P), as shown in (a) to (d) of FIG. Each is stored in table format. Further, the PC code (C) generated by the PC code generator 24 and the value of the storage location calculated by the storage location calculator 28 are passed to the communication interface 18, and the information item (R) of the personal information (P), etc. At the same time, it is encrypted and written in the log file 32 (ST4). At this time, the information item (R), the PC code (C), and the storage location are stored in a plurality of log files so that the storage location of the personal component information (V) of the personal information (P) is not determined from the log. It is good to distribute and write. The PC code (C) generated by the PC code generator 24 is passed to the communication interface 18, returned as a REST reply (ST5), and sent to the terminal of the customer 14.

Next, the flow at the time of the operation of updating the personal component information (V) of the personal information (P) will be described based on FIG.
When the PC code (C), the information item (R) of the personal information (P) to be updated, and the personal component information (V) are input from the terminal of the customer 14 to the PC server 10, the PC code (C). , The information item (R) and the personal component information (V) are transferred to the communication interface 18 (ST1), and a REST request for updating the personal information is issued. As a result, the PC code (C) and the information item (R) are passed to the storage location calculator 28 (ST2), and the storage location calculator 28 calculates the storage location of the information item (R) to be updated. Then, the storage location of the information item (R) calculated by the storage location calculator 28 by the access control unit 22, that is, one of the plurality of collections 20-1, 20-2, ..., 20-n. The personal component information in the collection is updated with the new personal component information (V) (ST3). Further, the PC code (C) and the value of the storage location calculated by the storage location calculator 28 are passed to the communication interface 18, and they are encrypted and distributed in the log file 32 (ST4), and the PC code (C ) Is passed to the communication interface 18, returned as a REST reply (ST5), and sent to the terminal of the customer 14.

Next, the flow of the operation of deleting the personal component information (V) of the personal information (P) will be described with reference to FIG.
When the PC code (C) and the information item (R) of the personal information (P) to be deleted are input from the terminal of the customer 14 to the PC server 10, the PC code (C) and the information item (R) are input. It is transferred to the communication interface 18 (ST1), and a REST request for deleting the personal component information is issued. As a result, the PC code (C) and the information item (R) are passed to the storage location calculator 28 (ST2), and the storage location calculator 28 calculates the storage location of the information item (R) to be deleted. Then, the storage location of the information item (R) calculated by the storage location calculator 28 by the access control unit 22, that is, one of the plurality of collections 20-1, 20-2, ..., 20-n. The personal component information (V) in the collection is deleted (ST3). Further, the PC code (C) and the value of the storage location calculated by the storage location calculator 28 are passed to the communication interface 18, and they are encrypted and distributed in the log file 32 (ST4), and the PC code (C ) Is returned as a reply of REST (ST5) and sent to the terminal of the customer 14.

  The personal information (P) stored in the database 20 of the PC server 10 is used as follows. In order to use this PC server 10, it is necessary for an individual and a business operator (service provider) to obtain a login ID for logging in to the system in advance. Also, many businesses that have login IDs are divided into multiple groups for each service industry that have common access rights to the database, and group IDs are set for each group. , The group ID of the group to which the business operator belongs is associated.

  For example, when a customer purchases a product at a shop or mail order on the Internet, the customer informs the courier through the shop or mail order of the PC code (C). The courier who receives the presentation of the PC code (C) accesses the PC server 10 from a terminal such as a smartphone and uses the PC code (C) to send the product from the PC server 10 to obtain the minimum personal information (P). That is, the personal component information (V) such as name, address and telephone number is taken out to provide a service such as delivery of goods to the customer. An example of the flow when the personal component information (V) of the personal information (P) is taken out will be described with reference to FIG.

  When the delivery company inputs the login ID (S) into the PC server 10 from the terminal, the login ID (S) is transferred to the communication interface 18 (ST1), and thereby a REST request for login to the PC server 10 is issued. Further, when the information item (R) of the PC code (C) and the personal information (P) is input, the PC code (C) and the information item (R) are transferred to the communication interface 18 (ST2), which causes the information item ( A REST request is issued to retrieve personal component information (V) for R). Here, as the information item (R), three items of name, address and telephone number are specified. Then, the group ID (SG) associated with the login ID (S) is passed to the access right table 30, and the access right definition of the delivery company is extracted from the access right table 30 using the group ID (SG) as a key, and the PC Whether or not there is an access right to the three information items (R) for the code (C) is checked (ST3). As a result, when even one of the three information items (R) does not have the access right to the PC code (C), the result is passed to the communication interface 18 and an error message is written in the log file 32 (ST6), It is returned as a reply of REST (ST7), and an error message is sent to the terminal of the delivery company. On the other hand, when there is an access right to the three information items (R) for the PC code (C), the PC code (C) and the information item (R) are passed to the storage location calculator 28 (ST4). Then, the personal information from the storage location calculated by the storage location calculator 28 by the access control unit 22, that is, any three collections among the plurality of collections 20-1, 20-2, ..., 20-n. Three pieces of personal component information (V) of (P) are taken out (ST5). Further, the PC code (C) and the value of the storage location calculated by the storage location calculator 28 are passed to the communication interface 18, encrypted and distributed in the log file 32 and written (ST6). Then, the three pieces of extracted personal component information (V) are passed to the communication interface 18, returned as a REST reply (ST7), and sent to the terminal of the delivery company. FIG. 9 shows a flowchart of the series of operations described above.

  In the above example, the information items (R) of the personal information (P) are specified three at a time, but the communication interface 18 is such that only one information item (R) can be specified. can do. At this time, the operation procedure of ST2 to ST7 is performed for each of the three information items (R) of name, address and telephone number. Then, by repeating the operation procedure of ST2 to ST7 three times, three pieces of personal component information (V) of the name, address and telephone number are sequentially taken out and returned to the terminal of the delivery company.

Next, instead of specifying the information item (R) together with the PC code (C) as described above, only the PC code (C) is specified, and the predetermined information is defined by the access right definition retrieved from the access right table 30. Regarding the embodiment in which the item (R) is designated, the flow at the time of the operation of taking out the personal component information (V) will be described based on FIG.
When the delivery company inputs the login ID (S) into the PC server 10 from the terminal, the login ID (S) is transferred to the communication interface 18 (ST1), and thereby a REST request for login to the PC server 10 is issued. When the PC code (C) is input, the PC code (C) is transferred to the communication interface 18 (ST2), and a REST request for extracting the personal component information (V) is issued. Then, the group ID (SG) associated with the login ID (S) is passed to the access right table 30, and the access right definition of the delivery company is extracted from the access right table 30 using the group ID (SG) as a key, and the delivery is performed. An information item (R) which allows the trader to take out the personal component information (V), for example, three information items (R) of a name, an address and a telephone number are designated (ST3). The information item (R) and the PC code (C) are passed to the storage location calculator 28 (ST4), and the storage location calculated by the storage location calculator 28 by the access control unit 22, that is, a plurality of collections 20-1. , 20-2, ..., 20-n, three pieces of personal component information (V) of the personal information (P) are extracted (ST5). Further, the PC code (C) and the value of the storage location calculated by the storage location calculator 28 are passed to the communication interface 18, encrypted and distributed in the log file 32 and written (ST6). Then, the three pieces of extracted personal component information (V) are passed to the communication interface 18, returned as a REST reply (ST7), and sent to the terminal of the delivery company.

  The access right table 30 of the PC server 10 described above is an information resource that can be accessed by a business operator (a group to which the business operator belongs) to a group ID (SG) for identifying a group that represents the service industry to which the business operator belongs. It is a table that defines (information item (R) of personal information (P)) and is universal while the service of the relevant industry exists. In addition to the access right table 30 as described above, as shown in FIG. 11, another access right table 34 for defining the access right of the business operator for a limited time or a single time may be provided. An operation procedure for setting an access right definition in the another access right table 34 will be described with reference to FIG.

  When the customer inputs the login ID (CO) of the customer into the PC server 10 from the terminal, the login ID (CO) is transferred to the communication interface 18 (ST1) and logs in to the PC server 10. Also, the login ID (S) of the service provider who wants to receive the service, the information item (R) of the personal information (P) that the customer wants to grant access to, and the PC code (C). ) Is input, the login ID (S), the information item (R) and the PC code (C) are transferred to the communication interface 18 (ST2), whereby a REST request for setting an access right to another access right table 34 is made. Will be issued. Then, the login ID (S), the information item (R) and the PC code (C) are passed to another access right table 34 (ST3), and the access right definition and the expiration date thereof are set in the other access right table 34. It Here, the expiration date can be set, for example, in units of hours, but when 0 hours is set as the expiration date, the setting is effective until the access right definition is deleted. In addition, when the customer faces the service provider, the access right can be set as a one-time access right instead of setting the expiration date. When the access right definition is set in another access right table 34, the success or failure (B) of the setting is passed to the communication interface 18 (ST4). Then, the values of the PC code (C) and the information item (R) are encrypted and written in the log file 32 (ST5), and the success or failure of the setting of the access right definition (B) is returned as a reply of REST (ST7). ), Sent to the customer's terminal.

A flow at the time of taking out the personal component information (V) of the personal information (P) using the above another access right table 34 will be described based on FIG. 11.
For example, if a customer forgets something on a train and the electric railroad company's thing left behind informs the customer by e-mail, etc. Consider the case where the postal code and address are temporarily disclosed to the Lost and Found Center. First, the customer sets an access definition in the access right table 34 according to the above-mentioned operation procedure. At this time, a postal code and an address are designated as the information item (R) of the personal information (P). Then, the customer informs the lost article center of the PC code (C). When the Lost and Found Center which has been presented with the PC code (C) inputs the login ID (S) into the PC server 10 from the terminal, the login ID (S) is transferred to the communication interface 18 (ST1), thereby the PC server. A REST request for login to 10 is issued. Further, when the information item (R) of the PC code (C) and the personal information (P) is input, the PC code (C) and the information item (R) are transferred to the communication interface 18 (ST2), which causes the information item ( A REST request is issued to retrieve personal component information (V) for R). Here, a zip code and an address are designated as the information item (R). Then, the login ID (S) and the PC code (C) are passed to another access right table 34, and the login ID (S) and the PC code (C) are used as keys to access the lost property center access right from the other access right table 34. The definition is taken out and it is checked whether or not there is an access right to the information item (R) for the PC code (C) (ST3). As a result, when there is no access right, the result is passed to the communication interface 18, an error message is written in the log file 32 (ST6), returned as a reply of REST (ST7), and the error message is sent to the terminal of the lost-item center. Will be sent. On the other hand, when the user has the access right, the PC code (C) and the information item (R) are passed to the storage location calculator 28 (ST4). Then, by the access control unit 22, from the storage location calculated by the storage location calculator 28, that is, from any one of the plurality of collections 20-1, 20-2, ..., 20-n, personal information ( The personal component information (V) of P) is taken out (ST5). Further, the PC code (C) and the storage location value calculated by the storage location calculator 28 are passed to the communication interface 18, encrypted and distributed in the log file 32 and written (ST6). Then, the retrieved personal information (V) of the postal code and address is passed to the communication interface 18, returned as a reply of REST (ST7), and the information is transmitted to the terminal of the lost article center.

  As described above, this PC server allows a courier who provides a delivery service to a customer who purchases a product at a shop or mail order on the Internet, by using the minimum personal information of the customer necessary for delivering the product. It is used in cases such as acquisition, but other various usage forms are possible. For example, a PC server can be used for a reception system of a company or the like. That is, information such as a visitor's business card is registered in the PC server in association with the PC code issued by the PC server, and the IC sticker in which the issued PC code is stored in the IC chip is given to the visitor. deep. At the next visit after the next time, at the reception, the reader reads the IC tag with the IC sticker attached to the business card, etc., accesses the PC server, retrieves the information indicating the visitor's identity from the PC server, and displays the system screen. To display. In addition, use this PC server in such a way that the visit date and time, the matter, the visit record of the person in charge, etc. are registered in the PC server and the information of the visitor is managed by the PC server. You can

  Further, if an IC tag storing a PC code is attached or attached to personal belongings that make it easy to forget things, the lost article center can access the PC server with the PC code to identify the owner of the drop. In this case, if the information to be disclosed to the Lost and Found Center is limited to a phone number or email address, the owner of the lost article can receive contact from the Lost and Found Center, but more personal information may be disclosed. Absent. Furthermore, if a person with a chronic disease such as a heart carries an IC tag that stores a PC code, when an emergency situation occurs where the person suddenly falls and is transported by ambulance, the paramedics By logging in to the PC server with the log-in ID of the fire department and accessing with the PC code, it is possible to obtain information on the medical history, the family hospital, and the like, and to take more appropriate measures.

  The present invention provides a personal information protection / use server that can use and appropriately protect personal information in a server system in which a server that centrally manages personal information and many user terminals are connected by a network. Therefore, it is widely used in the fields of information technology, product delivery, information management in companies and organizations, and the like.

10 PC Server 12 Internet 14 Customer 16 Service Provider 18 Communication Interface 20 Database 20-1, 20-2, ..., 20-n Collection (Database Unit)
22 access control unit 24 PC code generator 26 encryption key table 28 storage location calculator 30 access right table 32 log file 34 another access right table C PC code P personal information R information item V personal component information S delivery company login ID
SG group ID
CO Customer login ID

Claims (4)

Equipped with a database that stores information resources consisting of a large number of personal information, it is possible to control the access right to the information resources for information users to protect the personal information, and to retrieve and use the necessary information resources. In the personal information protection / use server
Relating individual personal information composed of a plurality of personal component information input corresponding to each of a plurality of information items to a code uniquely assigned to the personal information, one information item or two or more A plurality of database units which are separately distributed and stored for each group including information items ,
A storage location calculator that calculates which database unit of the plurality of database units stores the personal component information of the personal information using the information item of the personal information and the code as a key,
For each group obtained by dividing a large number of information users, an access right that defines one or two or more database units to which the information users belonging to the group are allowed to access among the plurality of database units. A table,
In order to allow the information user to identify the information user by controlling to store the personal component information of the personal information in association with the code in the database unit which is the storage location calculated by the storage location calculator. When the user logs in with the identification information of the user and tries to retrieve the personal information with the code assigned to the personal information, the identification information for identifying the group to which the information user belongs is used as a key from the access right table. An access control unit for extracting the access right of the individual and controlling the personal component information corresponding to each information item from the one or more database units to which the access is permitted by using the code as a key,
A personal information protection / use server characterized by being equipped with. The information user further includes another access right table that defines one or more database units that are permitted to access the plurality of database units for a limited time or a single time.
When the information user logs in with the identification information for identifying the information user and tries to retrieve the personal information with the code assigned to the personal information, the identification information of the information user and the code are used as keys. The access right of the information user is taken out from the other access right table, and the personal component information corresponding to each information item is accessed from the one or more database units to which access is permitted within a certain period of time using the code as a key. The personal information protection / use server according to claim 1, wherein the access control unit controls the personal information protection / use server so that the personal information protection server can be retrieved once or only once. The personal information protection / use server according to claim 1 or 2, wherein the information user is a business that provides a service to the individual by receiving a code assigned to the personal information from the individual. The personal information according to any one of claims 1 to 3, further comprising a plurality of log files for respectively encrypting, distributing, and writing the information items, the codes, and individual database units that are storage locations of the information resources. Protection / use server.

Images