JP6707424B2 - Information processing equipment - Google Patents

Description

The present invention relates to an information processing apparatus, and more particularly to an information processing apparatus configured to transmit information transmitted from each functional module in the information processing apparatus to another information device in a state where sufficient security is ensured.

Conventionally, in an image processing apparatus or an information communication device, log information such as operation status and transmission history is transmitted via a network to a management server for the purpose of collecting or analyzing the information, and the management server transmits the log information. An information management system that manages such information is used.

For example, in Patent Document 1, in a plurality of image processing apparatuses, job histories such as the number of used color pages, the number of used monochrome pages, and the number of output sheets are transmitted to the management apparatus and stored in the management apparatus. However, a totaling system has been proposed in which the totaling result for each user or each department, which is totalized in the management apparatus, is acquired and displayed so that the user or the like can be made aware of the saving.

JP 2012-253578 A

However, in the conventional information processing device, the information transmitted via the network includes
This may include information that should be kept secret, such as personal information, file names, and confidential information.
If the destination information device is an authentication server, it is necessary to send confidential information such as personal information required for authentication, but the information is managed externally for the purpose of simply collecting logs and managing usage history. When sending to the server, it may not be necessary to send personal information or confidential information, or personal information may not be sent.

Further, in the conventional image forming apparatus, a number of software function modules such as a copy module and an image processing module are incorporated, but when the content of information to be transmitted is limited, the internal processing of each function module is performed. , Regarding the information to be transmitted, it discriminates between the information that may be transmitted and the prohibited data that should not be transmitted, delete the prohibited data that should not be transmitted, and transmit the information without the prohibited data to the external device. Was being done.

However, it is complicated to develop so that the information that may be transmitted and the prohibited data that should not be transmitted are distinguished for each functional module, and the development department or vendor of each functional module may differ. Therefore, the judgment as to which data should be prohibited data may not be unified.
Further, at the development stage of the functional module, there is a possibility that the developer may have a different interpretation of the prohibited data, and it is difficult to unify the prohibited data.
In addition, after installing the functional module, there may be a case where the prohibited data that should not be sent such as personal information is mistakenly sent due to a program malfunction, which may cause a problem such as information leakage. There was a problem in terms.

Therefore, the present invention has been made in consideration of the above circumstances, and the information transmitted from the functional module to the information device of the transmission destination is prohibited data that should not be transmitted to other information devices. It is an object of the present invention to provide an information processing device in which sufficient security is ensured by ensuring that data is not transmitted.

The present invention receives a function executing unit that executes a specific function and transmission data to be transmitted from the function executing unit to a predetermined information device, and in the transmission data, a predetermined data that should not be transmitted to the information device. When the prohibition information corresponding to the prohibition item is included, the prohibition information processing unit that creates converted data obtained by converting the prohibition information included in the transmission data, and the created information is created in the information device via a network. An information processing device, comprising: a communication unit for transmitting the converted data.

In addition, the storage device further includes a storage unit that stores a prohibition information list in which the type information of the device to which the information device that is the transmission destination of the transmission data belongs and the prohibition item set in advance for each of the type information is stored. The information processing unit is stored in the prohibition information list in association with the transmission request receiving unit that receives the transmission data from the function executing unit and the type information to which the information device that is the transmission destination of the received transmission data belongs. The prohibition information detection unit that confirms whether the prohibition information corresponding to the prohibition item included in the transmission data is included in the transmission data and detects the prohibition information from the transmission data, and the prohibition detected from the transmission data. And a prohibition information conversion unit that creates converted data obtained by converting information.

According to this, since the prohibition information list in which the type information of the device to which the information device that is the transmission destination belongs and the prohibition item set in advance for each type information are stored is stored, for each type of the information device that is the transmission destination. , You can set the appropriate prohibited items.
If the transmission data contains prohibition information corresponding to the prohibition item associated with the type information of the device to which the information device to which the transmission data is transmitted belongs, the converted data obtained by converting the prohibition information. Is created and transmitted to the information device, it is possible to prevent the prohibited items set in advance from leaking to the outside based on the type information to which the information device of the transmission destination belongs. The information necessary for the processing performed by the device of the type to which it belongs is transmitted to the information device of the transmission destination, so that the function of the information device of the transmission destination is not hindered.

Further, the storage unit stores a transmission destination list in which identification information of information devices that are transmission destinations of the transmission request data is stored in advance, and the transmission destination list includes an identification name of the transmission destination information device, and It is stored in association with the type information indicating the function of the information device, the transmission data includes the destination name of the information device that is the transmission destination, and the prohibition information processing unit uses the transmission destination list. Further comprising a destination determination unit that determines type information associated with an identification name of the information device that matches a destination name included in the received transmission data, and the prohibition information detection unit is configured to perform the determination. The prohibition information corresponding to the prohibition item stored in the prohibition information list in association with the classified information is detected from the transmission data.

Further, the communication unit is characterized in that it transmits transmission information in which the created converted data is encrypted, to the information device.
According to this, in addition to the conversion of the prohibition information included in the transmission data, the transmission information in which the created converted data is encrypted is transmitted to the information device, so that the possibility of information leakage is reduced and security is improved. It can be increased.

Further, the converted data is data in which the prohibition information included in the transmission data is deleted from the transmission data, or data in which the prohibition information is replaced with other information.
According to this, since the data in which the prohibition information is deleted, or the data in which the prohibition information is replaced with other information is transmitted to the information device of the transmission destination, in the information device of the transmission destination,
It becomes difficult to reproduce the prohibited information, the possibility of information leakage is reduced, and the security can be further enhanced.

Further, the storage unit stores a whitelist in which destination names of information devices for which prohibited items are not set are preset and stored, and the destination names of the information devices included in the transmission data are set and stored in the whitelist. In the case of the first name, the communication unit transmits the transmission data to the information device.

According to the present invention, the prohibition information processing unit receives the transmission data to be transmitted from the functional module of the function execution unit to the predetermined information device, and the transmission data includes predetermined prohibition items that should not be transmitted to the information device. If the prohibition information corresponding to is included, the converted data obtained by converting the prohibition information included in the transmission data is created and transmitted to the information device. Therefore, information that should not be transmitted to other information devices is Since it cannot be confirmed by the information device of the transmission destination, information leakage can be prevented and sufficient security can be secured.
Further, when the function execution unit is composed of a plurality of function modules, all the transmission data to be transmitted from the plurality of function modules to the predetermined information device is received by the prohibition information processing unit and the prohibition information conversion processing is performed. Therefore, even if the transmission data is received from multiple function modules at the same time, even if the function module of the function execution unit is changed or a new function module is added to the function execution unit, it is erroneously prohibited due to the operation of the function module. Information is not transmitted to an external information device, and sufficient security can be uniformly ensured.

It is explanatory drawing of one Example of the data transmission by the information processing apparatus of this invention. FIG. 1 is a configuration block diagram of an embodiment of an information processing device of the present invention. FIG. 9 is an explanatory diagram of an example of information stored in a storage unit of the information processing device. 9 is a flowchart of an example of a prohibition information conversion process in the information processing device. 9 is a flowchart of an example of a prohibition information conversion process in the information processing device. 9 is a flowchart of an example of a prohibition information conversion process in the information processing device. It is a flow chart of an example of conversion processing of item contents of a tag character string. It is a schematic explanatory drawing of one Example of the transmission request data which has a data structure of a tag format.

Embodiments of the present invention will be described below with reference to the drawings. The present invention is not limited to the description of the embodiments below.
<Data transmission by information processing device>
FIG. 1 shows an explanatory diagram of an embodiment of data transmission by the information processing apparatus of the present invention.
In FIG. 1, an information processing apparatus 1 of the present invention is an electronic device that performs various information processing such as image processing and information communication function, and performs data communication with other information devices via a network 5.

The information processing device 1 mainly includes a communication unit 12, a prohibition information processing unit 13, and a function execution unit 14 in terms of a portion related to data communication.
The function execution unit 14 is composed of a plurality of function modules (KM1, KM2,..., KMn) that respectively execute various functions. The function module is, for example, a copy module for copying paper, an image acquisition module for reading an image, an image forming module for generating an image, a document creation module for creating a document, a fax module for fax transmission, an authentication module for user authentication. Is equivalent to
If there is a data transmission request for transmitting information from a certain functional module to an external information device, the transmission request data generated by that functional module is given to the prohibited information processing unit 13, and then the communication unit 12 causes the network 5 Sent to. As described above, the transmission request data corresponds to the transmission data transmitted from the function module of the function executing unit 14 to the predetermined information device.
The communication unit 12 transmits data to the network 5 and receives data from the network 5 by either wired communication or wireless communication.

The prohibition information processing unit 13 receives the transmission request data to be transmitted to the information device of the transmission destination from all the function modules of the function execution unit 14, and converts the predetermined prohibition information included in the transmission request data. Mainly, the prohibited information is deleted or replaced with other information.
The prohibition information corresponds to, for example, personal information or secret information, and is information that is prohibited from being transmitted to an external information device based on a preset condition.

The transmission request data to be transmitted from all the function modules of the function executing unit 14 to the external information device is always given to the prohibition information processing unit 13, and the prohibition information processing unit 13 transmits the predetermined prohibition information of the transmission request data. Presence/absence is confirmed.
As a result of the confirmation, if the predetermined prohibition information is present in the transmission request data, the prohibition information portion is deleted from the transmission request data or replaced with other information. The converted data after the prohibition information is deleted or converted is processed by the communication unit 12, if necessary, such as encryption, and transmitted to the network 5, and is transmitted to the information device of the transmission destination via the network 5. Sent.

For example, when the functional module is an authentication module that transmits the authentication information such as the input user ID and password to the external authentication server 2 and performs the authentication process, the authentication module sends the authentication information to the prohibition information processing unit 13. Is sent, and if predetermined prohibition information exists in the authentication information, converted data in which the portion of the prohibition information is deleted or replaced is created.
The converted data is transmitted by the communication unit 12 to the external authentication server 2 via the network 5.

When the function module is a history management module that transmits history information such as the number of times a predetermined print function is executed to the external history management server 3 to perform history management processing, the history management module prohibits the information processing unit. If the history information is sent to 13, and the prohibition information such as personal information exists in the history information, converted data in which the prohibition information part is deleted or replaced is created.
This converted data is transmitted by the communication unit 12 to the external history management server 3 via the network 5.

Further, the functional module is an analysis request module that performs a process of transmitting the analysis information to the external information analysis server 4 in order to have the analysis information composed of a large number of experimental data acquired by a predetermined experiment analyzed. In this case, the analysis information is sent from the analysis request module to the prohibition information processing unit 13, and if prohibition information such as personal information exists in the analysis information, converted data in which the prohibition information part is deleted or replaced is created. To be done.
The converted data is transmitted by the communication unit 12 to the external information analysis server 4 via the network 5.

For the prohibition information, different information is set in advance mainly for each type of information device of the transmission destination, and even if the transmission request data is the same, the prohibition information may be different if the type of the transmission destination is different. The converted data is different.
In FIG. 1, three servers are illustrated as the destinations to which the transmission request data is transmitted, but the information device at the destination is not limited to this.

<Configuration of information processing device>
FIG. 2 is a block diagram showing the configuration of an embodiment of the information processing apparatus of the present invention.
In FIG. 2, the information processing apparatus 1 of the present invention mainly includes a control unit 11, a communication unit 12, a prohibition information processing unit 13, a function execution unit 14, a transmission request acceptance unit 15, a transmission destination determination unit 16, and a prohibition information detection unit. A prohibition information conversion unit 18 and a storage unit 20 are provided.
The above-mentioned prohibition information processing unit 13 is assumed to be composed of a transmission request reception unit 15, a transmission destination determination unit 16, a prohibition information detection unit 17, and a prohibition information conversion unit 18.

The control unit 11 of the information processing device 1 is a unit that controls the operation of each component such as the prohibition information processing unit 13 and the function execution unit 14, and mainly includes a CPU, a ROM, a RAM, an I/O controller, a timer, and the like. It is realized by a microcomputer.
The CPU organically operates various hardware based on a control program stored in advance in the ROM or the like to execute the prohibition information conversion function, the prohibition information detection function, the communication function and the like of the present invention.
In the present invention, in particular, as will be described later, by detecting the prohibition information corresponding to the information device of the transmission destination from the transmission request data output from the function executing unit, the prohibition information is converted to convert the converted data. It is characterized in that information is prevented from leaking by creating it and transmitting it to the information device of the transmission destination.

The communication unit 12 is a unit that transmits and receives information via the network 5. In the present invention, the converted data created by the prohibition information processing unit 13 is transmitted to other information devices via the network 5.
Further, in order to further enhance the security, the transmission information in which the created converted data is encrypted may be transmitted to the information device. The network 5 may be a global public network such as the Internet or a dedicated LAN used only within the company. The communication form may be wired communication or wireless communication.

The prohibition information processing unit 13 receives transmission request data to be transmitted to a predetermined information device from the functional module of the function execution unit 14, and corresponds to a predetermined prohibition item that should not be transmitted to the information device in the transmission request data. If the prohibition information to be included is included, the converted information is created by converting the prohibition information included in the transmission request data.
The prohibition information processing unit 13 mainly includes a transmission request reception unit 15, a transmission destination determination unit 16, a prohibition information detection unit 17, and a prohibition information conversion unit 18.
Converting prohibited information includes deleting the prohibited information and replacing the prohibited information with other information.

If the transmission request data has no prohibition information, the transmission request data and the converted data are the same, and the transmission request data is transmitted to the network 5 as it is.
Also, when trying to send transmission request data including prohibition information to a destination A, if the prohibition information is prohibited to be transmitted to the destination A, for example, from the transmission request data Delete the prohibited information and send to destination A. However, when sending the transmission request data including prohibition information to another destination B, if the prohibition information is not prohibited to be transmitted to the destination B, delete the prohibition information. Instead, the transmission request data is transmitted to the transmission destination B with the prohibition information included.

Whether to delete the prohibition information or replace it with other information may be determined, for example, by displaying the setting of the information processing device on the UI display unit of the information processing device and selecting it by the administrator.
In the case of replacing with other information, for example, the prohibition information part may be replaced with information of a predetermined meaningless character string, information in which the original information cannot be reproduced, or the like.

The function execution unit 14 is a unit that executes various functions of the information processing apparatus, and includes a plurality of function modules that respectively execute specific functions.
For example, as described above, an authentication module that requests authentication from an authentication server, a history management module that sends history information to a history management server, an analysis request module that sends experimental data to an information analysis server, and requests analysis. included.

The transmission request reception unit 15 is a unit that receives transmission request data from each functional module of the function execution unit 14. The received transmission request data mainly includes the information of the transmission destination (destination name) and the content of the information to be transmitted (transmission content). The received transmission request data is given to the transmission destination determination unit 16, and the information of the transmission destination is read from the transmission request data.

The transmission destination determination unit 16 is a unit that determines the type of transmission destination from the received transmission request data. After checking the destination name included in the transmission request data, the information matching the destination name included in the received transmission request data is mainly used by using the destination list 21 stored in advance in the storage unit 20. The type information associated with the device identification name is determined.
For example, if the transmission request data includes information "authentication 001" as the destination name, the transmission destination list 21 is used to change the transmission destination "authentication 001" to the type "authentication server". It is determined to belong.

The prohibition information detection unit 17 is a unit that detects prohibition information from the transmission request data.
The prohibition information is, for example, prohibition information corresponding to the prohibition item stored in the prohibition information list 22 in association with the type information determined by the transmission destination determination unit 16.
In particular, the prohibition information corresponding to the prohibition items stored in the prohibition information list 22 is received in association with the type information to which the information device, which is the transmission destination of the transmission request data received by the transmission request receiving unit 15, belongs. It is confirmed whether or not it is included in the transmission request data, and the confirmed prohibition information is detected from the transmission request data.
As will be described later, the prohibition information list 22 is used to read out the prohibition items set in advance corresponding to the type information of the information device of the transmission destination, and the read out prohibition items are included in the received transmission request data. The presence or absence of corresponding prohibition information is checked to detect the prohibition information.

For example, if the transmission content of the transmission request data contains the information "PSWD001" corresponding to the password, the "password" is a preset prohibition item using the prohibition information list. If it is determined, it is checked whether or not the transmission request data includes prohibition information corresponding to the prohibition item "password", and "PSWD001" in the transmission request data is detected as prohibition information.
The detected prohibition information is converted by the prohibition information converter 18 to create converted data.

The prohibition information conversion unit 18 is a unit that creates converted data obtained by converting the prohibition information detected by the prohibition information detection unit 17 from the transmission request data.
Particularly, the detected prohibited information included in the transmission request data is deleted or replaced with other information to create the converted data.
For example, the prohibition information “PSWD001” detected as described above is deleted from the transmission request data to create converted data.

The storage unit 20 is a unit that stores information and programs necessary to execute each function of the information processing apparatus 1, and is a semiconductor storage element such as ROM, RAM, or flash memory, a storage device such as HDD, SSD, or the like. Storage medium is used.
The storage unit 20 mainly stores a destination list 21, a prohibition information list 22, transmission request data 23, converted data 24, and the like.
FIG. 3 shows an explanatory diagram of an example of information stored in the storage unit 20 of the information processing device.

The transmission destination list 21 stores in advance the identification information of the information device that is the transmission destination of the transmission request data. FIG. 3A shows an example of the destination list 21.
As shown in FIG. 3A, in the transmission destination list 21, for example, the identification name (destination name) of the transmission destination information device, the destination information, and the type information indicating the function of the information device are associated with each other. Will be remembered.
The destination name is a name or number for individually distinguishing the information devices of the transmission destination. The destination information is information (for example, URL) included in the transmission data and used to identify the destination in the network. The type information is information indicating the function or role of the information device, and means a generic name of a device group to which the information device belongs.

In FIG. 3A, the destination information device whose destination name is “authentication 001” has destination information “URL001” and type information “authentication server”.
Further, the information device of the transmission destination having the destination name “management 112” has the destination information “URL002” and the type information “history management server”.
The information device of the transmission destination whose destination name is “Analysis 200” has the destination information of “URL003” and the type information of “information analysis server”.

It is assumed that the transmission request data transmitted from each function module of the function execution unit 14 always includes information corresponding to the destination name as information for specifying the destination of transmission.
After the transmission request receiving unit 15 receives the transmission request data, the transmission destination determining unit 16 reads the destination name included in the transmission request data, and whether the read destination name is in the transmission destination list 21 or not. Check. If the read destination name is in the destination list 21, the destination list 21 is used to determine the type information corresponding to the read destination name.

The prohibition information list 22 stores in advance information that should not be transmitted to an external information device.
For example, in the prohibited information list 22, prohibited items are set in advance for each type information of the destination list. In this case, the prohibition information list 22 stores the type information of the device to which the information device that is the transmission destination of the transmission request data belongs and the prohibition item set in advance for each type information of the device in association with each other.

FIG. 3B shows an example of the prohibition information list 22.
FIG. 3B shows prohibited items for the three types of information shown in FIG.
In FIG. 3B, for example, the type information indicates that “authentication server” has no prohibited items. That is, when the transmission request data is transmitted to the information device whose type information is “authentication server”, there is no information to be converted in the transmission request data, and the transmission request data does not include processing such as encryption. It means that it is sent as it is to the information device which is the “authentication server”.

Further, in FIG. 3B, when the type information is “history management server”, “password” and “file name” are set as prohibited items in advance as prohibited items.
That is, when transmitting the transmission request data to the information device whose type information is the “history management server”, if the transmission request data includes a “password” or a “file name”, the This means deleting the prohibited information corresponding to the "password" or "file name" or replacing it with other information.

Further, in FIG. 3B, when the type information is “information analysis server”, the prohibited items are “password”, “file name”, “user name”, “name”, and “email address”. , “Address”, and “telephone number” are set as prohibited items in advance.
That is, when the transmission request data is transmitted to the information device whose type information is “information analysis server”, the transmission request data includes prohibition information corresponding to the above-mentioned prohibition items such as “password” and “file name”. In the case, it means that the prohibition information corresponding to those prohibition items is deleted or replaced with other information from the transmission request data.

The information set as prohibited items is not limited to these items of information, and may include other personal information, secret information, and the like. The prohibited items may be fixedly set in advance, but may be changed, added, or deleted by the user, the developer of each module, or the like as necessary.

The transmission request data 23 is data transmitted from each functional module of the function executing unit 14 to a predetermined information device. As described above, the transmission request data 23 includes at least the destination name of the information device that is the transmission destination and the transmission content.
FIG. 3C shows an example of the transmission request data 23.
FIG. 3C shows transmission request data to be transmitted to the information devices having the three destination names shown in FIG.
In FIG. 3C, for example, the transmission content of the transmission request data whose destination name is “authentication 001” includes a user ID, a password, and a mail address. Here, the user ID, the password, and the mail address are information necessary for the authentication process.
However, this transmission content is one example, and the transmission request data whose destination name is “authentication 001” does not necessarily include these transmission contents, and may include other information.

Also, it is indicated that the transmission content of the transmission request data whose destination name is “Management 112” includes a user ID, a password, a mail address, a file name, and history information.
Also, it is shown that the transmission content of the transmission request data whose destination name is “analysis 200” includes a user ID, a password, a mail address, a file name, a name, and analysis information. There is.

The data structure of the transmission request data 23 may be an arbitrary data format, and need not be uniquely fixed. However, the information to be transmitted may be described in a prescribed standard format, for example, CSV format data, data having a tag format such as HTML or XML, or json format data. With the data described in these standard formats, it is possible to easily find the position where predetermined information such as a password is described.

The converted data 24 is data obtained by converting the prohibition information portion from the transmission request data 23, and is, for example, data in which the prohibition information corresponding to the prohibition item included in the transmission request data is deleted from the transmission request data 23. Alternatively, it is data obtained by replacing the prohibition information with other information. The converted data 24 is provided to the communication unit 12.
FIG. 3D shows an example of the converted data 24.
FIG. 3D shows the converted data transmitted to the information devices having the three destination names shown in FIG.
In FIG. 3D, for example, the transmission content of the converted data 24 whose destination name is “authentication 001” includes a user ID, a password, and a mail address.
As described above, in the prohibition information list 22, there is no prohibition item for “authentication server”, so there is no information to be deleted or replaced, and the converted data 24 with the destination name “authentication 001” is the transmission request data 23. It is the same.

An information device whose destination name is “authentication 001” belongs to the type of “authentication server”, but since the “authentication server” is a device that executes an authentication function of a user or the like, it receives information necessary for authentication. There is a need. As described above, assuming that the user ID, the password, and the email address are the information required for the authentication, these pieces of information are not deleted, and the “authentication 001” belonging to the type “authentication server” is not deleted. Since the information is transmitted to the information device, the authentication function executed by the information device “authentication 001” is not hindered.

Further, it is shown that the transmission contents of the converted data 24 whose destination name is “management 112” include a user ID, a mail address, and history information.
Here, although the password and the file name were also included in the transmission request data 23 whose destination name is “Management 112”, since the password and the file name are prohibited items of the history management server, they have been converted. The data 24 indicates that the data will be deleted. Alternatively, instead of deletion, other information may be replaced.

The information device whose destination name is “management 112” belongs to the type of “history management server”, but since the “history management server” is a device that executes the function of collecting and saving the history, it is necessary to collect and save the history. It is necessary to receive necessary information, but it is not necessary to receive information that is not related to the history, and it is a problem if personal information or secret information that is not directly related to the history is stored in the history management server.
Since the password and the file name which are not directly related to the history are set as the prohibited items of the history management server, these information items are deleted and the like, and the “management 112” which belongs to the type of “history management server”. The password and the file name cannot be confirmed or reused by the information device of “Management 112” which is the transmission destination, and leakage of information such as the password can be prevented. Further, since the history information, which is information necessary for collecting and saving the history, is transmitted without being deleted, the information device of the “management 112” of the transmission destination should execute the history collecting and saving function without any problem. You can

Further, it is shown that the transmission content of the transmission request data whose destination name is “analysis 200” includes the user ID and the analysis information.
Here, although the transmission request data 23 whose destination name is “Analysis 200” also includes the password, the email address, the file name, and the name, the password, the email address, the file name, and the name. Indicates that it is deleted in the converted data 24 because it is a prohibited item of the information analysis server. Alternatively, instead of deletion, other information may be replaced.

The information device whose destination name is "analysis 200" belongs to the type of "information analysis server", but the "information analysis server" is a device that collects information such as experimental data to be analyzed and performs an analysis function. Therefore, it is necessary to receive the information necessary for collecting and analyzing the information, but it is not necessary to receive the information that is not related to the analysis, and the information analysis server collects personal information and confidential information that are not directly related to the analysis. It is a problem to be used in.
As the prohibited items of the information analysis server, the password, the email address, the file name, and the name that are not directly related to the information analysis are set, so these information are deleted, It is sent to the information device of "Analysis 200" belonging to the type of "Server", and the password, email address, file name, and name cannot be reused in the information device of "Analysis 200" of the transmission destination. It is possible to prevent leakage of information such as passwords. Further, since the analysis information, which is the information necessary for collecting and analyzing the information, is transmitted without being deleted, etc., the information device of the analysis destination “analysis 200” can execute the information collection and analysis function without any problem. You can

As described above, the converted data 24 is given to the communication unit 12 and transmitted to the information device having the destination name included in the converted data 24. However, the converted data 24 includes information corresponding to the prohibited items. Important information such as personal information cannot be confirmed or reused at the destination information device because the information corresponding to the prohibited items cannot be confirmed or deleted because it is deleted or replaced with other information and sent. It is possible to prevent the leak and secure sufficient security.

<First embodiment of prohibited information conversion processing>
FIG. 4 shows a flowchart of the first embodiment of the prohibition information conversion processing in the information processing device.
In FIG. 4, the transmission destination determination unit 16 determines the type of the transmission destination from the transmission request data transmitted from the function execution unit 14 to the external information device, and the prohibition information detection unit 17 corresponds to the determined transmission destination type. After detecting the prohibition information for the prohibited item, the prohibition information conversion unit 18 generates converted data in which the detected prohibition information is deleted or replaced from the transmission request data, and the transmission information in which the converted data is encrypted is transmitted to the network. The following is an example of transmission to the Internet.
In the present invention, the communication unit 12 does not directly transmit the transmission request data to be transmitted to the external information device to the network 5, but checks whether or not there is predetermined prohibition information in the transmission request data, By transmitting the information obtained by processing the prohibited information to the destination information device so that the prohibited information does not leak to the outside, sufficient security is ensured without hindering the function of the destination information device.

In step S1 of FIG. 4, the transmission request acceptance unit 15 checks whether or not the transmission request data transmitted from the function execution unit 14 to the external information device is accepted.
The transmission request data output from each function module of the function execution unit 14 is not directly given to the communication unit 12, but is once accepted by the transmission request acceptance unit 15.
In step S2, if the transmission request data is accepted, the process proceeds to step S3, and if not, the process returns to step S1.

In step S3, the transmission destination determination unit 16 reads the destination name that is the transmission destination included in the received transmission request data, and determines the type of the read destination name (transmission destination). That is, from the destination list 21 stored in the storage unit 20, the type information stored in association with the read destination name is confirmed, and the type of the destination is determined.
For example, if the destination name included in the received transmission request data is “management 112”, the type stored in the destination list 21 of FIG. 3A in association with the destination name “management 112”. Since the information is “history management server”, the type of the destination is determined as “history management server”.

In step S4, the prohibition information detection unit 17 reads the prohibition item for the type of the transmission destination from the prohibition information list 22.
For example, when the type of the transmission destination is determined to be “history management server”, the forbidden item stored in association with the information type “history management server” in the prohibition information list 22 of FIG. 3B is confirmed. By doing so, the password and the file name are read out as the prohibited items.
Similarly, when the type of the transmission destination is determined to be “information analysis server”, the prohibition information list 22 is referred to, and the prohibition items are password, file name, user name, name, mail address, address, and Read out the phone number.
However, if the type of the transmission destination is determined to be “authentication server”, there is no prohibited item.

In step S5, if there is a read prohibited item, the process proceeds to step S7, and if not, the process proceeds to step S6.
In step S6, the control unit 11 encrypts the transmission request data to generate transmission information, and passes the transmission information to the communication unit 12. Then, it progresses to step S10.
For example, in the transmission request data of FIG. 3C, the transmission request data whose destination name is “authentication 001” has no prohibited items, so the process proceeds to step S6, and this transmission request data is encrypted to obtain the transmission information. To generate.

In step S7, the prohibition information detection unit 17 detects the prohibition information for the read prohibited item from the received transmission request data.
For example, in the transmission request data of FIG. 3C, the transmission request data whose destination name is “management 112” has prohibition items such as a password and a file name, and therefore prohibition information for the prohibition items is detected. If the password includes, for example, "ABCD1234", "ABCD1234" is detected as the prohibition information.

In step S8, the prohibition information conversion unit 18 deletes or replaces the prohibition information detected from the transmission request data to create the converted data 24.
For example, in the transmission request data whose destination name is “management 112” in FIG. 3C, the prohibition information for the prohibition items such as the password and the file name is deleted. Alternatively, the prohibition information is replaced with other information. For example, if "ABCD1234" is included as the password, "ABCD1234" is deleted, or "ABCD1234" is replaced with other information such as "00000000" that is not used as the password.

In addition, for example, if the file name "usage history 0805" exists in the transmission request data of "management 112", "usage history 0805" is deleted, or "usage history 0805" is changed to "xxxxxxxxxx". Substitute with other information that you would not use as a filename.
If the prohibition information for the prohibited items such as the password and the file name is deleted from the transmission request data with the destination name “Management 112”, the transmission request data with the destination name “Management 112” will be the user ID, the mail address, and the history. It becomes the converted data 24 including information.

Further, in the transmission request data whose destination name is “Analysis 200” in FIG. 3C, prohibited items such as a password, an email address, a file name, and a name are included. Therefore, the prohibited information for these prohibited items is deleted. To do. Alternatively, the prohibition information is replaced with other information.
If the prohibition information for the prohibited items such as the password, the mail address, the file name, and the name is deleted from the transmission request data with the destination name “Analysis 200”, the transmission request data with the destination name “Analysis 200” includes the user ID and The converted data 24 including the analysis information is obtained.

In step S9, the control unit 11 encrypts the converted data 24 to generate transmission information, and passes the transmission information to the communication unit 12. Then, it progresses to step S10.
In step S10, the communication unit 12 transmits the transmission information to the network 5.
As described above, the prohibition information conversion process and the transmission process for one piece of transmission request data received from the function execution unit are completed.

<Second Embodiment of Prohibition Information Conversion Processing>
5 and 6 show flowcharts of the second embodiment of the prohibition information conversion processing in the information processing device.
Here, an example of prohibition information conversion processing when the transmission request data has a predetermined recognizable data structure and when the transmission request data does not have the predetermined recognizable data structure will be described.
The recognizable data structure means, for example, data having a tag format data structure such as MXL or HTML.

FIG. 8 is a schematic explanatory diagram of an embodiment of transmission request data having a tag format data structure.
In FIG. 8, a transmission request data that starts with a tag <JobResults> and has a prohibition item “password” corresponding to a password in the middle of the data, and includes “1111111a” as prohibition information for the prohibition item. Is shown.
In the transmission request data having such a tag format data structure, a character string corresponding to a preset prohibited item such as "password" is searched for in the transmission request data, and the character string immediately after the character string is searched. It is possible to easily detect the character string in the as the prohibition information.
If this transmission request data is transmitted to the history management server or information analysis server, the password is a prohibited item, so the prohibition information "1111111a" for that prohibited item is deleted, or other information (for example, , 0000).

Further, a tag dictionary in which a keyword for detecting a prohibited item is set and stored in advance is stored in the storage unit 20. In the tag dictionary, a character string used for a tag format data structure and a character string associated with a prohibited item is set in advance. For example, the above-mentioned "password" is stored in the tag dictionary as a character string associated with a prohibited item called password.
In this embodiment, by sequentially searching the registered character strings included in the tag dictionary, the character string associated with the prohibited item is checked whether or not the transmission request data of the tag format data structure exists. Replace or delete the banned information found.

Further, in the following embodiment, in consideration of the case where the personal name and the address are prohibited items, the personal name dictionary and the address dictionary are also stored in the storage unit 20 in order to convert the prohibition information corresponding to the personal name and the address. I shall.

In step S21 of FIG. 5, the control unit 11 checks whether or not there is any processing request from the function execution unit 14. When there are a plurality of function modules of the function execution unit 14, it is checked whether or not there is a processing request from all the function modules.
In step S22, if there is a processing request from the function executing unit 14, the process proceeds to step S23, and if there is no processing request, the process returns to step S21.
In step S23, the transmission request receiving unit 15 checks whether or not the transmission request data to be transmitted from the function executing unit 14 to the external information device is received. If the transmission request data is accepted, the process proceeds to step S25, and if the processing request is not the information transmission request, the process proceeds to step S24.

In step S24, the process inside the device corresponding to the process request is executed, and the process returns to step S21.
In step S25, the transmission destination determination unit 16 checks whether or not the received transmission request data includes information corresponding to the transmission destination.
In step S26, if the received transmission request data includes information corresponding to the transmission destination, the process proceeds to step S28, and if not, the process proceeds to step S27.
In step S27, an error is returned to the function module of the function executing unit 14 that has requested the processing, and the process returns to step S21.

In step S28, the transmission destination determination unit 16 checks whether the transmission destination (transmission destination) of the transmission request data is included in the transmission destination list 21.
In step S29, if the transmission destination of the transmission request data is included in the transmission destination list 21, the process proceeds to step S41 in FIG. 6, and if not, the process proceeds to step S30.
In step S30, it is determined whether or not the data structure of the transmission request data is in a recognizable tag format. For example, by confirming the presence or absence of a predetermined tag, it is determined whether or not the data structure has the tag format as shown in FIG.
When the data structure of the transmission request data is in the recognizable tag format in step S31, the process proceeds to step S32. If the tag format is not a recognizable tag format, the process proceeds to step S33, and conversion processing of prohibition information is performed for personal information that is not preferable for security transmission.

In step S32, for the transmission content included in the transmission request data, the prohibition information corresponding to the prohibition item that matches the character string included in the tag dictionary is converted.
As described above, for example, in the transmission request data, there is a prohibited item that matches the character string “password” included in the tag dictionary, and the prohibited item is a prohibited item associated with the type information of the destination. If so, the prohibition information “1111111a” corresponding to “password” is deleted or replaced with other information.
An example of this prohibition information conversion processing is shown in FIG. 7 described later.
After step S32, the process proceeds to step S33.

In step S33, the item content that matches the character string included in the personal name dictionary is detected from the transmission request data, and the detected item content is converted.
For example, if the character string “Hanako” is set and stored in the personal name dictionary, and the item content “Hanako” exists in the transmission request data, the character string “Hanako” in the transmission request data , Or replace it with a string that is not recognized as a person's name.

In step S34, the item content that matches the character string included in the address dictionary is detected from the transmission request data, and the detected item content is converted.
For example, if the character string "Osaka City" is set and stored in the address dictionary, and the character string beginning with "Osaka City" exists in the send request data, "Osaka City" in the send request data Delete the character string beginning with or replace it with a character string that is not recognized as an address.

In step S35, the item content that matches the character string corresponding to the mail address is detected from the transmission request data, and the detected item content is converted.
The e-mail address is generally described in the data structure defined by the standard, and is a character string of a data structure containing @, for example. Therefore, there is a character string of such a data structure in the transmission request data. If there is a character string corresponding to the mail address, the character string part corresponding to the mail address in the send request data is deleted, or a character that is not recognized as the mail address is checked. Replace with a column.
Through the processes of steps S32 to S35, converted data is created from the transmission request data.

In step S36, as in step S9, the control unit 11 encrypts the converted data to generate transmission information, and passes the transmission information to the communication unit 12.
In step S37, the communication unit 12 transmits the transmission information to the network, as in step S10.

In step S41 of FIG. 6, even when the transmission destination of the transmission request data is included in the transmission destination list 21, it is determined whether the data structure of the transmission request data is in the recognizable tag format as in step S30.
In step S42, similarly to step S31, it is checked whether or not the data structure of the transmission request data is in the recognizable tag format, and if it is not the recognizable tag format, the process proceeds to step S43. If the tag format is recognizable, the same process as step S32 is executed. That is, the prohibition information corresponding to the prohibition item that matches the character string included in the tag dictionary is converted from the transmission request data. Then, it progresses to step S43.

In step S43, it is confirmed whether or not the personal name is set in the prohibited item for the destinations included in the destination list 21. If the personal name is not set as the prohibited item, the process proceeds to step S44.
If the personal name is set as the prohibited item, the item content that matches the character string included in the personal name dictionary is detected from the transmission request data, and the detected item content is converted, as in step S33. Then, it progresses to step S44.

In step S44, it is confirmed whether or not the address is set as the prohibited item for the destinations included in the destination list 21. If the address is not set as a prohibited item, the process proceeds to step S45.
If the address is set as a prohibited item, the item content that matches the character string included in the address dictionary is detected from the transmission request data, and the detected item content is converted, as in step S34. Then, it progresses to step S45.

In step S45, it is confirmed whether or not the mail address is set in the prohibited item for the destinations included in the destination list 21. If the email address is not set as a prohibited item, the process proceeds to step S36.
If the email address is set as a prohibited item, the item content that matches the character string corresponding to the email address is detected from the transmission request data, and the detected item content is converted, as in step S35. Then, it progresses to step S36.

Thereafter, as in the case shown in FIG. 5, in step S36, the control unit 11 encrypts the converted data to generate transmission information, passes the transmission information to the communication unit 12, and in step S37, the communication unit 12 Sends the transmission information to the network.
As described above, the prohibition information conversion process and the transmission process are completed for the transmission request data having the tag format data structure received from the function execution unit.

FIG. 7 shows a flowchart of the conversion processing of the prohibition information of the tag format character string shown in the above step S32.
In step S51 of FIG. 7, the first character string of the registered character strings in the tag dictionary is read.
For example, if 100 character strings in the tag format are registered in the tag dictionary in advance, the character string registered first is read.
The process from the next step S52 to step S54 is performed on the read character string. Hereinafter, the character strings are read one by one in the order of registration, and the same process is repeated for 100 registered character strings.

In step S52, it is checked whether the registered character string read from the tag dictionary matches the prohibited item of the destination type.
Since it is already known that the destination name of the transmission request data is in the destination list 21 by the processing of steps S28 and S29, first, the destination list 21 is used to correspond to the destination name of the transmission request data. Get type information.
Next, the prohibited items stored in association with the acquired type information are read from the prohibited information list 22.
Then, it is checked whether or not the registered character string read from the tag dictionary matches the read prohibited item.

For example, when the destination name of the transmission request data is “management 112” in FIG. 3C, “history management server” is acquired from the destination list 21 as the type information corresponding to the destination name, and the prohibition information is obtained. From the list 22, the password and the file name are read as the prohibited items stored in association with the acquired “history management server”.
It is checked whether the registered character string read from the tag dictionary is a character string that matches the password, which is a prohibited item, or a character string that matches the file name, which is a prohibited item. If the registered character string currently read from the tag dictionary is "password", "password" is stored in the tag dictionary as a character string associated with the prohibited item called password, as described above. Therefore, the registered character string read from the tag dictionary is determined to be a character string that matches the password, which is a prohibited item of the “history management server”.

Further, for example, if the registered character string currently read from the tag dictionary is “property”, “property” is stored in the tag dictionary as a character string associated with a prohibited item called an attribute. Then, it is determined that the registered character string “property” read from the tag dictionary does not match the password and file name, which are prohibited items of the “history management server”.

In step S53, if the registered character string read from the tag dictionary matches the prohibited items of the destination type, the process proceeds to step S54, and if they do not match, the process proceeds to step S55.
In step S54, the prohibition information conversion unit 18 converts the prohibition information corresponding to the prohibition item that matches the registered character string read from the tag dictionary in the transmission request data having the tag format data structure. That is, the prohibition information is replaced with other information or deleted.
For example, the registered character string currently read from the tag dictionary is “password”, and in the transmission request data, the character string “password” corresponding to the password that is the prohibited item and the prohibited information associated with it When there is "1111111a", the prohibition information "1111111a" corresponding to the prohibition item is deleted, or "1111111a" is replaced with other information that is not recognized as a password.

In step S55, it is checked whether the last registered character string stored in the tag dictionary has been read.
If the last registered character string has not been read yet, the process proceeds to step S56.
In step S56, the next registered character string in the tag dictionary is read out, the process returns to step S52, and the processes of steps S52 to S55 are repeated.
If the last registered character string has already been read, the processing of this flowchart is terminated and the processing subsequent to step S32 in FIG. 5 is performed.

Through the above process, even with regard to transmission request data having a tag format data structure, the prohibition information corresponding to the prohibited items preset for each type information of the transmission destination is deleted or replaced by other information, and transmission is performed. It is possible to prevent leakage of prohibited information and ensure sufficient security without hindering the processing performed by the information device.

<Other embodiments>
In the above-described embodiment, the case has been described in which the security is ensured by setting the prohibition item for each type information of the information device of the other party to which the transmission request data is transmitted.
Even if the destination name of the information device of the other party is different, the information devices belonging to the same type information convert the prohibition information corresponding to the prohibition items preset in the prohibition information list 21.
For example, the same prohibited items (password, file name) are set for all information devices for which “history management server” is set as the type information.
However, the method of setting the prohibited item is not limited to this, and the following setting method may be used.

(Other Embodiment 1)
As a method of setting other prohibited items, the whitelist method may be used.
The whitelist method is a method of individually setting and storing in advance information devices of transmission destinations for which prohibited items are not set. A list in which such information devices are preset and stored is called a white list.
In the white list, the destination names of information devices for which prohibited items are not set may be set and stored. Since prohibited items are not set, prohibited items are not stored.
For example, the destination names of the information devices belonging to the authentication server as described above are individually set and stored in the white list.
Also, even if the type information is an information device that belongs to the information analysis server, if there is an information device that does not want to set prohibited items or an information device that should not set prohibited items, the destination name of the information device is Settings are individually stored in the white list. When storing the settings in the white list, they may be set individually, or if there is a central database that collectively manages the trust relationship regarding communication of information terminals, dynamically acquires the information devices to be added to the list from the central database. You can also do

If the destination name of the information device included in the transmission request data output from the function module of the function execution unit 14 is the destination name set and stored in the white list, the communication unit directly transmits the transmission request data to the destination information. The data is transmitted to the device, or the transmission request data is encrypted and transmitted to the information device of the transmission destination.
If the destination name of the transmission request data output from the function module of the function executing unit 14 is a destination name that is not set and stored in the white list, for example, the prohibited items such as personal information that is set and stored in advance are included. After performing a predetermined conversion on the corresponding prohibition information, the converted data may be transmitted to the destination.

(Other Embodiment 2)
As a method of setting other prohibited items, the blacklist method may be used.
The blacklist method is a method of individually setting and storing individually the information devices of the transmission destination to which the prohibited items are always set. A list in which such information devices are stored in advance is called a black list.
In the blacklist, the destination name of the information device for which the prohibited item is set is set and stored, and the prohibited item is stored in association with each destination name.
For example, if the destination information device is an information device that has a prohibited item to be set, the destination name of the information device is individually set and stored in the blacklist, and the prohibited name to be set in association with the destination name. Memorize items as well.
Even if the destination information device is an information device that belongs to the authentication server, if you want to set prohibited items in the data content to be sent to that information device, set the destination name of the information device individually to the blacklist. The prohibited items to be stored and set in association with the destination name are also stored.

If the destination name of the transmission request data output from the function module of the function execution unit 14 is the destination name set and stored in the blacklist, the transmission content included in the transmission request data is associated with the destination name. The prohibition information corresponding to the stored prohibited items is converted and transmitted to the destination.
If the destination name of the transmission request data output from the function module of the function execution unit 14 is a destination name that is not set and stored in the blacklist, the transmission request data is encrypted as it is and transmitted to the destination. Good.

(Other Embodiment 3)
The same domain permission method may be used as a method of setting other prohibited items.
With the same domain permission method, in a network to which multiple information devices are connected, when sending request data to an information device to which the same domain as the sender's information processing device is assigned, set prohibited items. It is a method that does not.
In this case, it is assumed that the domain name to which the information device belongs is preset and stored in each information device.
A plurality of information devices to which the same domain is assigned may be, for example, reliable information devices installed in one department and connected by a LAN.

When performing information communication between such reliable information devices, it is considered that it is not necessary to set prohibited items. Therefore, the destination name of the transmission request data is the domain to which the information processing device of the transmission source belongs. If the same domain is included, the transmission request data is encrypted as it is and transmitted to the destination.
If the destination name of the transmission request data includes a domain different from the domain to which the information processing apparatus of the transmission source belongs, for example, the prohibition information corresponding to the prohibition item such as personal information that is set and stored in advance is specified. After conversion of the above, it may be transmitted to the destination.

(Other Embodiment 4)
In the above-described embodiment, the prohibition information of the transmission request data is converted using the prohibition information list 22 in which the prohibition items are set in advance for each type information of the transmission destination. However, the prohibited items may be set by the user individually, may be changed, added, or deleted later, and may be individually changed for each information device of the transmission destination.
Therefore, the prohibition information list 22 may be stored in a rewritable non-volatile storage device so that the user can independently change the prohibition items of the prohibition information list 22 at any time.

Further, as the prohibition information list 22, as illustrated in FIG. 3B, the prohibition item is set in advance for each type information of the transmission destination, but the prohibition information list 22 is set for each function module of the function executing unit 14. The prohibited items may be set.
For example, when the functional module is a dedicated module for user authentication, the prohibited item may be set to none. Further, when the functional module is a dedicated module for performing a predetermined information analysis and the information analysis result is transmitted to a specific analysis server, a unique prohibition item corresponding to the functional module is set in the prohibition information list 22. You may.

1 Information processing device,
2 Authentication server,
3 history management server,
4 Information analysis server,
5 networks,
11 control unit,
12 Communications department,
13 Prohibited Information Processing Department,
14 Function execution unit,
15 Transmission request acceptance section,
16 destination determination unit,
17 Prohibited information detector,
18 Prohibited Information Converter,
20 memory,
21 destination list,
22 Prohibited information list,
23 Transmission request data,
24 converted data

Claims (4)

A function execution unit that executes a specific function,
When the transmission data to be transmitted from the function executing unit to the predetermined information device is received, and the transmission data includes prohibition information corresponding to a predetermined prohibition item that should not be transmitted to the information device, A prohibition information processing unit that creates converted data obtained by converting the prohibition information included in the transmission data,
A communication unit for transmitting the created converted data to the information device via a network ;
And a storage unit that stores a prohibition information list in which the type information of the device to which the information device that is the transmission destination of the transmission data belongs and the prohibition item set in advance for each of the type information are associated with each other,
The storage unit stores a destination list in which identification information of an information device that is a destination of the transmission data is stored in advance,
In the destination list, the identification name of the information device of the destination and the type information indicating the function of the information device are stored in association with each other,
The transmission data includes the destination name of the information device that is the transmission destination,
The prohibited information processing unit,
A transmission request reception unit that receives transmission data from the function execution unit,
Whether the transmission data includes prohibition information corresponding to the prohibition item stored in the prohibition information list in association with the type information to which the information device that is the transmission destination of the received transmission data belongs. A prohibition information detection unit that confirms whether or not, and detects prohibition information from the transmission data,
A prohibition information conversion unit that creates converted data by converting the detected prohibition information from transmission data,
Using the destination list, a destination determination unit that determines type information associated with the identification name of the information device that matches the destination name included in the received transmission data,
The information processing apparatus, wherein the prohibition information detection unit detects, from the transmission data, prohibition information corresponding to a prohibition item stored in the prohibition information list in association with the determined type information . The information processing apparatus according to claim 1, wherein the communication unit transmits, to the information device, transmission information in which the created converted data is encrypted. The converted data from the transmission data, data to remove the prohibition information included in the transmission data or the prohibition information to Claim 1, characterized in that the data is replaced with other information The information processing device described. In the storage unit, a whitelist in which destination names of information devices for which prohibited items are not set are stored in advance is stored,
When the destination name of the information device included in the transmission data is a destination name set and stored in the white list, the communication unit transmits the transmission data to the information device. The information processing device described.