JP6739380B2 - Terminal device, data management method, and computer program - Google Patents

Description

Embodiments of the present invention relate to a terminal device, an information management device, a data management method, and a computer program.

In many services, a person who wants to use the service can apply for the desired service from his/her own terminal device. Generally, when a user desires to use a service, a service application screen is transmitted from the service provider, and on the service application screen, the user information acquired by the service provider and acquired by the service provider is displayed. Consent to the privacy policy and terms of use (hereinafter, privacy policy etc.) that stipulate the handling is required. Here, the user information is, for example, personal information such as name, date of birth, address, telephone number, location information, service usage history, or personal information that can identify an individual by combining a plurality of information, or This refers to information about personal behavior or privacy information that is not desired to be disclosed. The handling of user information is, for example, whether or not the acquired user information is provided to a third party and the storage period. The user is required to understand the contents and then agree.
When the application for using the service is completed, the user ID and the service ID of the service for which the application has been completed are associated and stored.

Regarding a technique for accessing personal data, a technique for determining whether or not to permit access to a resource of the user based on the access policy of the user when detecting access to the resource of the user is known. (For example, see Patent Document 1).

JP, 2014-178727, A

The user can receive the service provided by the service provider by installing the application on the terminal device and starting the installed application. In this case, of the user information requested by the service provider, the user information permitted by the user is provided to the service provider. Then, the user can prohibit receiving the service by deleting the installed application.
Here, when the user repeatedly installs or deletes the application, it may not be known which application provided the user information to the service provider.

The present invention has been made to solve the above problems, and an object thereof is to record a history of user information provided to a service provider.

(1) According to one aspect of the present invention, for an application that can access user data, a recording unit that records application identification information, user data access history, and user consent to a privacy policy of the application, and the recording. The control unit for controlling access to user data from the application based on the record data of the unit, and the information management device for storing the record data of the terminal device, the record of the application for which the access to the user data is impossible. And a data storage requesting unit for transmitting recorded data of the unit.
(2) According to one aspect of the present invention, in the terminal device according to (1) above, for the application for which access to the user data has become possible again, the record data stored in the information management device is managed as the information management. The recording unit records the record data acquired from the information management device by the data acquisition unit, further comprising a data acquisition unit acquired from the device.
( 3 ) In one aspect of the present invention, a recording step in which a terminal device records application identification information, user data access history, and user consent to a privacy policy of the application for an application that can access the user data. And a control step in which the terminal device controls access to user data from an application based on the record data of the recording step, and the terminal device sends an information management device that stores the record data of the terminal device to a user. A data storage requesting step of transmitting the record data of the recording step for an application whose data cannot be accessed.
( 4 ) In one aspect of the present invention, in the data management method described in ( 3 ) above, the information management device stores the recording data received from the terminal device in association with the user identification information, and a data storage step, The information management device further includes a data providing step of providing the record data stored by the data storing step in association with the user identification information in response to a data browsing request including the user identification information.
( 5 ) According to one aspect of the present invention, a recording function of recording, in a computer, application identification information, user data access history, and user consent to a privacy policy of the application for an application that can access the user data. A control function for controlling access to user data from an application based on the record data of the record function, and an application in which access to the user data is impossible to an information management device that stores the record data of the terminal device Is a computer program for realizing a data storage request function for transmitting the recording data of the recording function.

According to the embodiment of the present invention, it is possible to record a history of user information provided to a service provider.

It is a figure showing an example of a communication system to which a terminal unit and a privacy protection device concerning an embodiment are applied. It is a functional block diagram of the privacy protection apparatus which concerns on embodiment. It is a figure which shows an example of a preset registration screen. It is a figure which shows an example of a preset table. It is a figure which shows an example of a data storage table. It is a figure which shows an example of a privacy policy consent inquiry screen. It is a functional block diagram of the terminal device which concerns on embodiment. It is a figure which shows an example of a provision history table. It is a figure which shows an example of operation|movement of the communication system which concerns on embodiment. It is a figure which shows an example of operation|movement of the communication system which concerns on embodiment. It is a figure which shows an example of operation|movement of the communication system which concerns on embodiment.

<Embodiment>
<Communication system configuration>
FIG. 1 is a diagram showing an example of a communication system to which the terminal device and the privacy protection device according to the present embodiment are applied.
The communication system includes terminal devices 101, 102,..., 10N (N is an integer of N>0), a privacy protection device 100, service providing devices T01, T02,..., T0M (M is M. >0). The privacy protection device 100 is connected to a communication network 20 such as a mobile communication network, and terminal devices 101, 102,..., 10N (N is an integer of N>0) are connected to the communication network 20. .. Further, the privacy protection device 100 is connected to a communication network 50 such as the Internet, and the service providing devices T01, T02,..., T0M are connected to the communication network 50.

The service providing device T0M is used by a service provider to provide various services to the terminal device 10N. Hereinafter, any terminal device among the terminal devices 101, 102,..., 10N will be referred to as a terminal device 10N. Further, of the service providing devices T01, T02,..., T0M, any service providing device is referred to as a service providing device T0M.
The terminal device 10N is used by a user who desires to use the service provided by the service providing device T0M, for setting operation as to whether or not the user information of the user may be provided to the service provider, and for using the service. By operating the terminal device 10N, the user can register the basic handling rule of user information in the privacy protection device 100 as preset. The preset registration is performed on the preset registration screen provided by the privacy protection device 100. On the preset registration screen, whether to provide the service information to the service provider is set for each type of user information.

In the privacy protection device 100, information for identifying the user who performed the setting operation (hereinafter referred to as “user ID”), information for identifying the type of user information (hereinafter referred to as “user information identification information”), and the above The content of the setting (setting information) is linked and managed as the preset information. The user installs the app by operating the terminal device 10N and activates the installed app to request the use of the service provided by the service providing device T0M. When the user newly requests the use of the service, a service use start application including information for identifying the service (hereinafter referred to as “service ID”) and the user ID is transmitted from the terminal device 10N to the privacy protection device 100. Sent to. Upon receiving the service use start application, the privacy protection device 100 transmits a transmission request for the privacy policy etc. defined by the service provider to the service providing device T0M that provides the service. The service providing apparatus T0M that has received the transmission request for the privacy policy and the like sends information to the privacy protection apparatus 100 that identifies the type of user information requested by the service provider along with the privacy policy of the service provider (hereinafter, “request user information identification”). It is called "information".

The privacy protection device 100 extracts the setting information corresponding to the user information identification information included in the received requested user information identification information from the preset information and reflects it on the privacy policy consent inquiry screen. The privacy policy consent inquiry screen also includes the privacy policy of the service provider received from the service providing apparatus T0M. The privacy protection device 100 transmits the created privacy policy agreement inquiry screen to the terminal device 10N used by the user who has requested the use of the service. By reflecting the preset information on the privacy policy consent inquiry screen, the user does not have to repeat similar settings when using multiple services, and the common settings facilitate easy management. To be

When the privacy policy agreement inquiry screen is received by the terminal device 10N used by the user who has requested the use of the service, the user refers to the privacy policy agreement inquiry screen and determines whether or not to agree to the privacy policy or the like. To do. Further, the privacy policy consent inquiry screen displays the contents of the preset information corresponding to the type information of one or more pieces of user information requested by the service provider. The user determines whether or not to provide each type of user information requested to be provided to the service provider, and then determines whether or not to agree with the privacy policy and the like. When agreeing to the content displayed on the privacy policy consent inquiry screen as it is, the user performs an agreeing operation. When the displayed content is partially changed and the user agrees, the user corrects the provision permission/prohibition setting for each type information of the user information and then performs the consent operation. If you do not agree, operate according to the contents of the privacy policy agreement screen. By performing any operation, the privacy policy agreement response is transmitted from the terminal device 10N to the privacy protection device 100.

The privacy protection device 100 receives the privacy policy agreement response from the terminal device 10N, and acquires the service ID, the user ID, and information indicating whether or not to provide each type of user information. When the user agrees to the privacy policy or the like, the privacy protection device 100 stores the user information identification information which is permitted to be provided to the service provider, as the authorization setting information. Then, the privacy protection device 100 transmits, to the service providing device T0M, the service ID, the user ID, the agreement/non-agreement to the privacy policy and the like, and in the case of the agreement, the user information identification information that the user has permitted to provide. .. The service providing device T0M determines whether or not to provide a service based on the information received from the privacy protection device 100.
When the user subscribes to the service, the privacy protection device 100 stores the user ID, the service ID, the user information identification information, and the setting information such as the basic handling rule in association with each other in a table format. Hereinafter, the table format information in which the user ID, the service ID, the user information identification information, and the setting information are associated with each other is referred to as a “setting table”.
After subscribing to the service, the user can receive the service provided by the service providing apparatus T0M by operating the terminal device 10N to start the application. When receiving the service provided by the service providing device T0M, the service providing device T0M requests the terminal device 10N to provide one or more pieces of user information. The privacy protection apparatus 100 refers to the setting table in response to the provision of the one or more user information requested by the service providing apparatus T0M, and provides the user information according to the setting information for the one or more user information.

When the terminal device 10N receives the service, the terminal device 10N stores the identification information of the started application (hereinafter, referred to as “app ID”) and the information indicating the date and time when the service providing device T0M is accessed (hereinafter, referred to as “access history”). The user information identification information set for the app corresponding to the app ID and the handling rule of the user information for the service (hereinafter referred to as “handling rule”) are stored in association with each other. Hereinafter, the information in the table format in which the application ID, the access history, the user information identification information, and the handling rule are stored in association with each other is referred to as a “provided history table”.
When there is an application whose use is prohibited due to the case where the user wants to be unable to access the user information, the user performs an operation such as deleting the application on the terminal device 10N. When an operation for deleting an application is performed on the terminal device 10N, the terminal device 10N determines the application ID of the application for which the deletion operation has been performed, the access history associated with the application ID, and the user information. The identification information and the handling rule are extracted from the provision history table. The terminal device 10N transmits, to the privacy protection device 100, a provision history record application including information in which the extracted application ID, access history, user information identification information, and handling rule are associated with each other.

The privacy protection device 100 receives the provision history record application transmitted by the terminal device 10N, associates the application ID, the access history, the user information identification information, and the handling rule included in the received provision history record application with the user ID. Remember. Hereinafter, the table format information in which the application ID, the access history, the user information identification information, and the handling rule included in the provision history record application transmitted by the terminal device 10N are stored in association with the user ID is referred to as a “data storage table”. ..
When referring to the history of the deleted application, the user performs an operation of referring to the history of the deleted application on the terminal device 10N. The terminal device 10N requests the privacy protection device 100 to refer to the history of the deleted application. Hereinafter, the request transmitted from the terminal device 10N to the privacy protection device 100 when referring to the history of the deleted application is referred to as a “provided history reference request”. The provision history reference request includes the user ID.
The privacy protection device 100 receives the provision history reference request transmitted by the terminal device 10N, and stores the application ID, the access history, the user information identification information, and the handling that are stored in association with the user ID included in the received provision history reference request. The rules and are obtained from the data storage table. The privacy protection device 100 creates a provision history reference response screen including the acquired application ID, access history, user information identification information, and handling rule, and transmits the created provision history reference response screen to the terminal device 10N. The terminal device 10N displays the provision history reference response screen transmitted by the privacy protection device 100.

Further, when the user reuses the erased application due to the fact that the user information can be accessed again, the user installs the reused application by operating the terminal device 10N, and installs the installed application. to start. The terminal device 10N inquires of the privacy protection device 100 whether or not the started application is the previously used application. Specifically, the terminal device 10N requests the access history, the user information identification information, and the handling rule that are stored in association with the combination of the application ID and the user ID (hereinafter, referred to as “provided history request”). To inquire whether or not the launched application is the previously used application.
The privacy protection device 100 acquires and acquires the access history, the user information identification information, and the handling rule stored in association with the combination of the application ID and the user ID included in the provision history request transmitted by the terminal device 10N. The provision history information including the access history, the user information identification information, and the handling rule is transmitted to the terminal device 10N.

<Privacy protection device>
An example of the hardware configuration of the privacy protection device 100 according to this embodiment will be described. The privacy protection device 100 includes a CPU, a memory, a non-volatile memory, a communication I/F, and an internal bus.
The CPU executes a program stored in, for example, a non-volatile memory, and uses the memory as a work memory to control each unit of the privacy protection device 100. The memory is composed of a RAM such as a volatile memory using a semiconductor element. The memory is used as a work memory for the CPU. The non-volatile memory is composed of, for example, a hard disk (HD) or ROM, and stores a program executed by the CPU. The communication I/F is an interface for communicating with an external device such as the terminal device 10N via the communication network 20 to transmit and receive data and the like. Further, the communication I/F communicates with the service providing apparatus T0M via the communication network 50. The internal bus connects the CPU, the memory, the non-volatile memory, and the communication I/F to each other. The respective units connected to the internal bus can exchange data with each other via the internal bus.

<Functional configuration of privacy protection device>
FIG. 2 is a functional block diagram of the privacy protection device according to the embodiment. The privacy protection device 100 includes a communication unit 152, a preset information setting unit 154, a service use request processing unit 156, a comparing unit 158, a screen information creating unit 162, a data storage unit 163, a data providing unit 165, and a storage unit 166. doing. The storage unit 166 stores a preset table 1662 and a data storage table 1666. Each of these units is a function realized by any one of the constituent elements shown in FIG. 2 being operated by an instruction from the CPU that executes a program loaded from the nonvolatile memory onto the memory.

<Functional configuration of privacy protection device>
Each functional configuration of the privacy protection device 100 will be described in detail with reference to FIG. In the following, in describing each functional configuration of the privacy protection device 100, among the components shown in FIG. 2, the main hardware for realizing each functional configuration of the privacy protection device 100 will be described. The relationship is also explained.
The communication unit 152 is realized by an instruction from the CPU and a communication I/F. The communication unit 152 transmits and receives various data to and from the terminal device 10N and other devices such as the service providing device T0M. For example, the communication unit 152 transmits the preset registration screen output by the preset information setting unit 154 to the terminal device 10N. In addition, for example, the communication unit 152 transmits the privacy policy agreement inquiry screen output by the screen information creation unit 162 to the terminal device 10N. Further, for example, the communication unit 152 receives the provision history record application transmitted by the terminal device 10N, and outputs the received provision history record application to the data storage unit 163. In addition, for example, the communication unit 152 receives the provision history reference request transmitted by the terminal device 10N, and outputs the received provision history reference request to the data provision unit 165. Further, for example, the communication unit 152 receives the provision history request transmitted by the terminal device 10N, and outputs the received provision history request to the data provision unit 165. In addition, for example, the communication unit 152 transmits the provision history reference response screen output by the data providing unit 165 to the terminal device 10N. In addition, for example, the communication unit 152 transmits the provision history information output by the data providing unit 165 to the terminal device 10N.

The preset information setting unit 154 is realized by an instruction from the CPU, and sets preset information in the privacy protection device 100 by a user operation. For example, each of the plurality of terminal devices 10N accesses the privacy protection device 100 and transmits a preset registration application including the user ID. When the preset information setting unit 154 acquires the preset registration application received by the communication unit 152, the preset information setting unit 154 transmits the preset registration screen from the communication unit 152 to the terminal device 10N. The terminal device 10N displays the preset registration screen transmitted from the privacy protection device 100.
The service use request processing unit 156 is realized by an instruction from the CPU. When the user operates the terminal device 10N to request the use of a certain service, and a service use start application is output from the terminal device 10N, the service use start application is received by the communication unit 152 of the privacy protection device 100. It The service use start application includes the user ID and the service ID. The communication unit 152 outputs the service use start application to the service use request processing unit 156.
When the service use request processing unit 156 acquires the service use start application from the communication unit 152, the service use request processing unit 156 requests the service providing apparatus T0M providing the service based on the service ID included in the service use start application. Send an inquiry for user information identification information. When the service providing apparatus T0M acquires the inquiry about the required user information identification information from the privacy protection apparatus 100, the service provision apparatus T0M transmits the requested user information identification information to the privacy protection apparatus 100. The requested user information identification information is transmitted together with the privacy policy of the service provider including the handling of user information collected from users. The requested user information identification information, the privacy policy, and the like are received by the communication unit 152 of the privacy protection device 100 and output to the service use request processing unit 156. The service use request processing unit 156 outputs the requested user information identification information to the comparing unit 158 and the screen information creating unit 162.
Further, the service use request processing unit 156, based on the privacy policy agreement response transmitted by the terminal device 10N, the service ID, the user ID, the user information identification information, and the user information provision setting information included in the privacy policy agreement response. A response to the service provider is created based on the presence or absence of consent to the privacy policy and the like, and is output to the communication unit 152. The communication unit 152 transmits the response to the service provider supplied from the service use request processing unit 156 to the service providing apparatus T0M.

The comparison unit 158 is realized by an instruction from the CPU. The comparing unit 158 compares the one or more user information identification information included in the requested user information identification information supplied from the service use request processing unit 156 and the one or more user information identification information included in the preset table 1662. The comparison is performed and the matching user information identification information is specified. The comparison unit 158 outputs the specified user information identification information to the screen information creation unit 162. The screen information creation unit 162 is realized by an instruction from the CPU. The screen information creation unit 162 identifies the user information in the preset table 1662 based on the requested user information identification information supplied from the service use request processing unit 156 and the user information identification information supplied from the comparison unit 158. Create a privacy policy consent inquiry screen that reflects the basic handling rules associated with information. The screen information creation unit 162 outputs the privacy policy inquiry screen to the communication unit 152.

The data storage unit 163 is realized by an instruction from the CPU. The provision history record application transmitted by the terminal device 10N is received by the communication unit 152. The communication unit 152 acquires the provision history record application, and outputs the acquired provision history record application to the data storage unit 163. The data storage unit 163 acquires the provision history record application output by the communication unit 152, associates the application ID, the access history, the user information identification information, and the handling rule included in the acquired provision history record application with the user ID. , Data storage table 1666.
The data providing unit 165 is realized by an instruction from the CPU. The providing history reference request transmitted by the terminal device 10N is received by the communication unit 152. The communication unit 152 acquires the provision history reference request and outputs the acquired provision history reference request to the data providing unit 165. The data providing unit 165 acquires the provision history reference request output by the communication unit 152, and acquires the application ID, the access history, the user information identification information, and the handling rule corresponding to the user ID included in the acquired provision history reference request. It is acquired from the data storage table 1666. The data providing unit 165 creates and creates a provision history reference response screen that includes the acquired application ID, access history, user information identification information, and handling rule and is addressed to the terminal device 10N that has transmitted the provision history reference request. The provided history reference response screen is output to the communication unit 152. The communication unit 152 transmits the provision history reference response screen output by the data providing unit 165.

Further, the provision history request transmitted by the terminal device 10N is received by the communication unit 152. The communication unit 152 acquires the provision history request, and outputs the acquired provision history request to the data providing unit 165. The data providing unit 165 acquires the provision history request output by the communication unit 152, and stores the user information identification information and the handling rule corresponding to the combination of the user ID and the application ID included in the obtained provision history request as data storage. Obtained from the table 1666. The data providing unit 165 creates the provided history information including the acquired user information identification information and the handling rule, and the destination is the terminal device 10N that has transmitted the provided history reference request. Output to.
The storage unit 166 is realized by a non-volatile memory. A preset table 1662 and a data storage table 1666 are stored in the storage unit 166.

<Pre-setting registration screen>
FIG. 3 is a diagram showing an example of the preset registration screen.
The preset registration screen displays a plurality of types of user information such as name information 502, telephone number 504, mail address 506, contractor detailed information 508, family information 510, address 512, and residence information 514. In addition, check boxes 501, 503, 505, 507, 509, 511, and 513 are displayed on the preset registration screen in association with each of a plurality of types of user information. Further, an OK button 515 indicating agreement or approval is displayed on the preset registration screen.

The name information 502 is information representing the user's name, the telephone number 504 is information representing the user's telephone number, the mail address 506 is information representing the user's mail address, and the contractor detailed information 508 is the contractor's detailed information. This is information indicating the name. The family information 510 is information indicating the user's family, the address 512 is information indicating the user's address, and the residence information 514 is information indicating the user's residence. In the example shown in FIG. 3, the check box 501 corresponds to the name information 502, the check box 503 corresponds to the telephone number 504, and the check box 505 corresponds to the mail address 506. Further, in the example shown in FIG. 3, the check box 507 corresponds to the contractor detailed information 508, the check box 509 corresponds to the family information 510, the check box 511 corresponds to the address 512, and the check box 513 corresponds to the residence information. Corresponding to 514.
The user may refer to the preset registration screen, determine whether or not the information is basically acceptable to be provided to the service provider for each type of a plurality of user information, and may provide it to the service provider. For the type of user information to be considered, a check mark is displayed by clicking on the corresponding check box. When the designation of the type of user information considered to be provided to the service provider is completed, the user presses the OK button 515. As a result, the preset registration response in which it is specified whether or not it may be provided to the service provider according to the type of user information is transmitted from the terminal device 10N to the privacy protection device 100.

The communication unit 152 of the privacy protection device 100 outputs the received preset registration response and the user ID of the user who has transmitted the preset registration response to the preset information setting unit 154. The preset information setting unit 154 associates the user ID of the user who has transmitted the preset registration response, a plurality of user information identification information, and a basic handling rule for each of the plurality of user information identification information. Stored in the preset table 1662.
Here, the preset table 1662 will be described. The preset table 1662 is a table in which a user ID is associated with preset information of a user corresponding to the user ID.

<Presetting table>
FIG. 4 is a diagram showing an example of the preset table.
The preset table 1662 includes a plurality of user IDs, one or more pieces of user information identification information about the user for each of the plurality of user IDs, and basic handling of each of the one or more user information identification information. This is table-format information associated with rules. In FIG. 4, for example, the user information identification information corresponding to the name information 502 in the preset registration screen of FIG. 3 is “info01”, the user information identification information corresponding to the telephone number 504 is “info02”, and the mail address The user information identification information corresponding to 506 is “info03”, and the user information identification information corresponding to the contractor detailed information 508 is “info04”. In the example shown in FIG. 4, the user ID “01aa”, the user information identification information “info01”, “info02”, “info03”,... And the basic handling rule “No”, “OK”, “ Yes”,... Are associated with each other. Here, “OK” indicates that the service can be provided to the service provider, and “NO” indicates that the service cannot be provided to the service provider.

<Data storage table>
FIG. 5 is a diagram showing an example of the data storage table. The data storage table 1666 includes a plurality of user IDs, an application ID of an application deleted by the user, an access history indicating the date and time when the application is used, user information identification information, and a handling rule for each of the plurality of user IDs. Is information in a table format in which In the example shown in FIG. 5, the user ID “01aa”, the application ID “app01”, the access history “20170112”, the user information identification information “info01” and “info06”, and the handling rule “no”, “no” Is associated with. Here, “OK” means that the service can be provided to the service provider, and “NO” means that the service cannot be provided to the service provider.

<Privacy policy consent inquiry screen>
FIG. 6 shows an example of a privacy policy agreement inquiry screen transmitted from the privacy protection device 100 to the terminal device 10N that has requested the use of the service.
The privacy policy consent inquiry screen includes the application service name 615, the privacy policy defined by the service provider, and user information that the service provider requests the user to provide. The user information requested to be provided includes, for example, name information 602, telephone number 604, mail address 606, contractor detailed information 608, family information 610, address 612, housing information 614, and the like. Further, on the privacy policy consent inquiry screen, check boxes 601, 603, 605, 607, 609, 611 and 613 are displayed corresponding to each type information of a plurality of user information. Furthermore, on the privacy policy consent inquiry screen, a button 620 indicating consent and a button 622 indicating disagreement are displayed. Similar to FIG. 3, the name information 602 is information representing the user's name, the telephone number 604 is information representing the user's telephone number, the mail address 606 is information representing the user's mail address, and the contractor details. The information 608 is information indicating the name of the contractor. The family information 610 is information indicating the user's family, the address 612 is information indicating the user's address, and the residence information 614 is information indicating the user's residence.

In the example shown in FIG. 6, the application service name is “xxx service”, the check box 601 corresponds to the name information 602, the check box 603 corresponds to the telephone number 604, and the check box 605 corresponds to the mail address 606. To do. In the example shown in FIG. 6, the check box 607 corresponds to the contractor detailed information 608, the check box 609 corresponds to the family information 610, the check box 611 corresponds to the address 612, and the check box 613 corresponds to the residence information 614. Correspond. Among the customer information, regarding the telephone number 604, the mail address 606, the contractor detailed information 608, the family information 610, the address 612, and the residence information 614, a check mark is displayed in the corresponding check box. By doing so, the user can recognize that the setting is such that the provision to the service provider is permitted.
The user refers to the privacy policy consent inquiry screen, presses the button 620 when agreeing as it is, and inputs the check mark in the check box or deletes the check mark input in the check box when not agreeing as it is. After that, the button 620 is pressed. The user also presses the button 622 when they do not agree.

<Terminal device configuration>
An example of the hardware configuration of the terminal device 10N according to the present embodiment will be described. The terminal device 10N includes a CPU, a memory, a non-volatile memory, a display, an operation unit, a communication I/F, and an internal bus.
The CPU executes a program stored in, for example, a non-volatile memory, and uses the memory as a work memory to control each unit of the terminal device 10N. The program includes a web browser, an application and the like. The memory is composed of a RAM such as a volatile memory using a semiconductor element, and is used as a work memory of the CPU. The non-volatile memory is composed of, for example, a hard disk (HD) or ROM. A program executed by the CPU is stored in the non-volatile memory. The display is controlled by the CPU and displays an image, a GUI (Graphical User Interface), and the like.
The CPU generates a control signal and a video signal representing an image displayed on the display by executing the program. The CPU outputs a video signal representing an image to the display. The display displays an image by processing the image signal output by the CPU. The operation unit is an input device that receives user operations.
The communication I/F is an interface for communicating with external devices, the privacy protection device 100 connected to the communication network 20, and the like to send and receive various contents such as video data. The internal bus connects the CPU, the memory, the non-volatile memory, the display, the operation unit, and the communication I/F to each other. The respective units connected to the internal bus can exchange data with each other via the internal bus.

<Functional configuration of terminal device>
FIG. 7 is a functional block diagram of the terminal device according to the present embodiment. The terminal device 10N includes a communication unit 252, a recording unit 254, an access control unit 256, a data storage requesting unit 258, and a storage unit 260. Each of these units is a function realized by any of the components shown in FIG. 7 being operated by a command from a CPU that executes a program or an application loaded on the memory from a nonvolatile memory. is there.

<Functional configuration of terminal device>
Each functional configuration of the terminal device 10N will be described in detail with reference to FIG. It should be noted that, in the following, in describing each functional configuration of the terminal device 10N, the relationship with the main hardware for realizing each functional configuration of the terminal device 10N among the components shown in FIG. explain.
The communication unit 252 is realized by a command from the CPU and a communication I/F. The communication unit 252 transmits/receives various data to/from other devices such as the privacy protection device 100 via the communication network 20. For example, when the communication unit 252 receives the preset registration screen transmitted by the privacy protection device 100, the communication unit 252 outputs the preset registration screen to the CPU. Further, for example, when the communication unit 252 receives the privacy policy agreement inquiry screen transmitted by the privacy protection device 100, the communication unit 252 outputs the privacy policy agreement inquiry screen to the CPU. In addition, for example, the communication unit 252 transmits the provision history recording application output by the CPU to the privacy protection device 100. In addition, for example, the communication unit 252 transmits the provision history reference request output by the CPU to the privacy protection device 100. Further, for example, the communication unit 252 transmits the provision history request output by the CPU to the privacy protection device 100. Further, for example, when the communication unit 252 receives the provision history reference response screen transmitted by the privacy protection device 100, the communication unit 252 outputs the provision history reference response screen to the CPU. Further, for example, when the communication unit 252 receives the provision history information transmitted by the privacy protection device 100, the communication unit 252 outputs the provision history information to the CPU.

The recording unit 254 is realized by an instruction from the CPU. When the operation of activating the application is performed on the operation unit and the service provided by the service providing apparatus T0M is provided, the recording unit 254 stores the application ID of the activated application, the access history, and the user information identification information. It is stored in the provision history table 2602 in association with the handling rule.
The access control unit 256 is realized by an instruction from the CPU. The access control unit 256 controls access to the application corresponding to the application ID based on the user information identification information and the handling rule stored in the provision history table 2602 of the storage unit 260. The access control unit 256 creates a provision history reference request including the user ID when the operation unit refers to the provision history. The access control unit 256 outputs the created provision history reference request to the communication unit 252. Further, the access control unit 256 creates a provision history request including the application ID of the reinstalled application and the user ID when an operation of re-installing the deleted application is performed on the operation unit. .. The access control unit 256 outputs the created provision history request to the communication unit 252.
The data storage request unit 258 is realized by an instruction from the CPU. When the operation to delete the application is performed on the operation unit, the data storage requesting unit 258 provides the access history, the user information identification information, and the handling rule associated with the application ID of the deleted application, the provision history table 2602. Get from The data storage requesting unit 258 creates an application history record application including the application ID, the acquired access history, the user information identification information, and the handling rule. The data storage requesting unit 258 outputs the created provision history record application to the communication unit 252.
The storage unit 260 is realized by a non-volatile memory. A provision history table 2602 is stored in the storage unit 260.

<Provision history table>
FIG. 8 is a diagram showing an example of the provision history table.
The provision history table 2602 is information in a table format in which an access history, user information identification information, and a handling rule are associated with a plurality of application IDs and each of the plurality of application IDs. In FIG. 8, for example, the application ID “app01”, the access history “20170112”, the user information identification information “info01” and “info06”, and the basic handling rules “no” and “no” are associated with each other. ing. Here, “OK” indicates that the service can be provided to the service provider, and “NO” indicates that the service cannot be provided to the service provider.

<Operation of Communication System According to this Embodiment>
9, 10, and 11 are diagrams showing an example of the operation of the communication system according to the present embodiment. FIG. 9 is a diagram showing a preset registration process, FIG. 10 is a diagram showing a process of requesting the use of a service, and FIG. 11 is a diagram showing a process of storing a use history.
<Pre-registration registration process>
The process of registering the preset will be described.
(Step S102) When the user performs an operation for requesting the registration of presetting on the operation unit, the web browser of the terminal device 10N creates a presetting registration application including the user ID. The web browser outputs the created preset registration application to the communication unit 252. The communication unit 252 transmits a preset registration application to the privacy protection device 100.
(Step S104) Upon receiving the preset registration application transmitted from the terminal device 10N, the communication unit 152 of the privacy protection device 100 outputs the preset registration application to the preset information setting unit 154. When the preset information setting unit 154 acquires the preset registration application from the communication unit 152, the preset information setting unit 154 outputs a preset registration screen to the communication unit 152. The communication unit 152 transmits the preset registration screen supplied from the preset information setting unit 154 to the terminal device 10N.
The preset registration screen transmitted from the privacy protection device 100 is received by the communication unit 252 of the terminal device 10N. The web browser outputs the preset registration screen to the display. The display displays the preset registration screen shown in FIG. The user of the terminal device 10N refers to the preset registration screen and operates the operation unit to determine whether or not to input a check mark for each of the type information items of the one or more pieces of user information, and thus the user information. Set the basic handling rules for. When the web browser detects that the OK button 515 in FIG. 3 has been pressed, it generates a preset registration response including information set by the user and outputs the preset registration response to the communication unit 252.

(Step S106) Upon acquisition of the preset registration response from the web browser, the communication unit 252 of the terminal device 10N transmits the preset registration response to the privacy protection device 100.
(Step S108) The preset registration response transmitted by the terminal device 10N is received by the communication unit 152 of the privacy protection device 100. The communication unit 152 outputs the preset registration response to the preset information setting unit 154. When the preset information setting unit 154 obtains the preset registration response supplied from the communication unit 152, the preset ID, the user ID included in the preset registration response, the user information identification information, and the basic handling rule of the user information, Are stored in the preset table 1662 of the storage unit 166 in association with each other. Here, in the case where the user ID, the user information identification information, and the information regarding the provision to the service provider are already stored in association with each other, the preset information setting unit 154 changes each time it is changed. The date and the setting information may be stored in association with each other. Through steps S102 to S108, the user can preset and register information regarding provision to the service provider for each of one or more pieces of user information in the privacy protection device 100.

<Process for requesting use of service>
Next, with reference to FIG. 10, a process when the user requests the use of the service will be described.
(Step S202) When the web browser of the terminal device 10N is notified that the operation requesting the use of the service is detected by the operation unit, the web browser creates a service use start application including the service ID and the user ID. Then, the web browser transmits the service use start application to the privacy protection device 100 via the communication unit 252. The service use start application is received by the communication unit 152 of the privacy protection device 100.
(Step S204) The communication unit 152 of the privacy protection device 100 outputs the received service use start application to the service use request processing unit 156. The service use request processing unit 156 identifies the service providing apparatus T0M that provides the service based on the service ID included in the service use start application, and requests transmission of the privacy policy or the like defined by the service provider of the service. Create a transmission request such as privacy policy. The service use request processing unit 156 transmits the created transmission request for the privacy policy etc. to the specified service providing apparatus T0M via the communication unit 152. The request to send the privacy policy or the like is received by the service providing apparatus T0M.

(Step S206) The service providing apparatus T0M transmits, to the privacy protection apparatus 100, the privacy policy etc. defined by the service provider who provides the service corresponding to the service ID included in the received transmission request for the privacy policy etc.
The privacy policy or the like transmitted to the privacy protection device 100 includes request user information identification information that identifies the type of user information that the service provider requests the service user to provide.
(Step S208) The communication unit 152 of the privacy protection device 100 outputs the received privacy policy and the like to the service use request processing unit 156. The service use request processing unit 156 is registered in the request user information identification information included in the privacy policy or the like requested by the service provider to the service user, and in the preset table 1662 stored in the storage unit 166. Of the user information identification information requested by the service provider, the user information identification information stored in the preset table 1662 is specified based on the user information identification information. The service usage request processing unit 156 outputs the specified user information identification information to the screen information creation unit 162.
(Step S210) The screen information creation unit 162 of the privacy protection device 100 displays the information stored in the preset table 1662 for the type information corresponding to the user information identification information specified by the service use request processing unit 156. Create a privacy policy consent inquiry screen. The screen information creation unit 162 outputs the created privacy policy consent inquiry screen to the communication unit 152.

(Step S212) When the privacy policy consent inquiry screen is supplied from the screen information creation unit 162, the communication unit 152 of the privacy protection device 100 displays the privacy policy inquiry consent screen on the terminal device 10N of the user who requests the use of the service. Send to. When the communication unit 252 receives the privacy policy agreement inquiry screen from the privacy protection apparatus 100, the web browser of the terminal device 10N outputs the privacy policy agreement inquiry screen to the display. When the privacy policy consent inquiry screen is supplied from the web browser, the display displays the privacy policy consent inquiry screen as shown in FIG. 6 by processing the privacy policy consent inquiry screen information.
The user who has requested the use of the service refers to the privacy policy consent inquiry screen and determines whether or not to consent to provide the service provider with each of the type information of one or more user information. The user who requests the use of the service performs an operation of agreeing by pressing the button 620 when agreeing, and corresponds to the type information of one or more user information when the content is partially changed and agreeing. After inputting the check mark in the check box or deleting the check mark input in the check box, the user presses the button 620 to perform the consent operation. When the operation unit detects that the button 620 is pressed, the web browser generates a privacy policy agreement response and outputs it to the communication unit 252. If the user who has requested the use of the service does not agree, he/she presses the button 622 to perform the disagreement operation.

(Step S214) When the privacy policy consent response screen information is supplied from the web browser, the communication unit 252 of the terminal device 10N transmits the privacy policy consent response to the privacy protection device 100.
(Step S216) The privacy policy agreement response transmitted by the terminal device 10N is received by the communication unit 152 of the privacy protection device 100. The communication unit 152 outputs the privacy policy agreement response to the service use request processing unit 156. When the service usage request processing unit 156 acquires the privacy policy consent response supplied from the communication unit 152, the service ID included in the privacy policy consent response, the user ID, the type information ID of the user information, and the service provider. It is stored in the storage unit 166 as authorization setting information in association with the setting information regarding the provision to the user.
(Step S218) The service use request processing unit 156 of the privacy protection device 100 creates a response to the service provider based on the information included in the privacy policy agreement response, and outputs the response to the communication unit 152. The communication unit 152 transmits the response to the service provider supplied by the service use request processing unit 156 to the service providing apparatus T0M.
When the service providing apparatus T0M receives the response to the service provider transmitted by the privacy protection apparatus 100, the service providing apparatus T0M stores the service ID, the user ID, and the setting information related to the provision to the service provider for each type of user information in association with each other. .. Then, when providing the service corresponding to the service ID to the user corresponding to the user ID, the service providing apparatus TOM provides the service according to the setting information stored in association with the user.
Through steps S202 to S218, the user can refer to the privacy policy agreement inquiry screen transmitted from the privacy protection device 100 and set whether to provide the user information to the service provider.

<Process of storing usage history>
(Step S302) An operation for activating an application is performed on the operation unit of the terminal device 10N. The application requests a service from the service providing device T0M. The service providing device T0M transmits the service provided to the terminal device 10N to the privacy protection device 100.
(Step S304) When the privacy protection device 100 acquires the service transmitted by the service providing device T0M, the privacy protection device 100 transmits the acquired service to the terminal device 10N.
(Step S306) When the user receives the service provided by the service providing device T0M, the recording unit 254 of the terminal device 10N associates the application ID of the started application, the access history, the user information identification information, and the handling rule with each other. Then, it is stored in the provision history table 2602.
(Step S308) An operation of deleting the application is performed on the operation unit of the terminal device 10N. The data storage requesting unit 258 of the terminal device 10N acquires the access history, the user information identification information, and the handling rule associated with the application ID of the deleted application from the provision history table 2602.
(Step S310) The data storage request unit 258 creates an application history record application including the application ID, the acquired access history, the user information identification information, and the handling rule. The data storage requesting unit 258 outputs the created provision history record application to the communication unit 252. The communication unit 252 transmits the provision history recording application output by the data storage requesting unit 258 to the privacy protection device 100.

(Step S312) The communication unit 152 of the privacy protection device 100 receives the provision history recording application transmitted by the terminal device 10N, and outputs the received provision history application to the data storage unit 163. The data storage unit 163 acquires the provision history record application output by the communication unit 152, associates the application ID, the access history, the user information identification information, and the handling rule included in the acquired provision history record application with the user ID. , Data storage table 1666.
(Step S314) The operation unit of the terminal device 10N is operated to refer to the user information identification information and the handling rule set for the application whose use is prohibited by deleting the application. The access control unit 256 of the terminal device 10N creates a provision history reference request including the user ID, and outputs the created provision history reference request to the communication unit 252. The communication unit 252 transmits the provision history reference request output by the access control unit 256 to the privacy protection device 100.
(Step S316) Upon receiving the provision history reference request transmitted by the terminal device 10N, the communication unit 152 of the privacy protection device 100 outputs the received provision history reference request to the data provision unit 165. The data providing unit 165 acquires the provision history reference request output by the communication unit 152, and the application ID, access history, user information identification information, and handling rule associated with the user ID included in the acquired provision history reference request. To get The data providing unit 165 creates a provision history reference response screen including the acquired application ID, access history, user information identification information, and handling rule, and outputs the created provision history reference response screen to the communication unit 152. The communication unit 152 transmits the provision history reference response screen output by the data providing unit 165 to the terminal device 10N. The communication unit 252 of the terminal device 10N receives the provision history reference response screen transmitted by the privacy protection device 100. The web browser outputs the provided history reference response screen to the display. The display displays a provision history reference response screen.
(Step S318) An operation of resuming the use is performed on the operation unit of the terminal device 10N by re-installing the application whose use is prohibited by deleting the application. The access control unit 256 of the terminal device 10N creates a provision history request including the user ID and the application ID, and outputs the created provision history request to the communication unit 252.
(Step S320) The communication unit 252 transmits the provision history request output by the access control unit 256 to the privacy protection device 100.

(Step S322) Upon receiving the provision history request transmitted by the terminal device 10N, the communication unit 152 of the privacy protection device 100 outputs the received provision history request to the data provision unit 165. The data providing unit 165 acquires the provision history request output by the communication unit 152, and the access history, the user information identification information, and the handling rule associated with the combination of the user ID and the application ID included in the obtained provision history request. And get.
(Step S324) The data providing unit 165 creates provision history information including the application ID, the acquired access history, the user information identification information, and the handling rule, and outputs the created provision history information to the communication unit 152. The communication unit 152 transmits the provision history information output by the data providing unit 165 to the terminal device 10N.
(Step S326) The communication unit 152 of the terminal device 10N receives the provision history information transmitted by the privacy protection device 100, and outputs the received provision history information to the recording unit 254. The recording unit 254 acquires the provision history information output by the communication unit 152, associates the application ID, the access history, the user information identification information, and the handling rule included in the acquired provision history information with each other, and provides the provision history of the storage unit 260. It is stored in the table 2602.
After the application ID, the access history, the user information identification information, and the handling rule are stored in association with each other in the provision history table 2602 of the storage unit 260, the operation unit of the terminal device 10N is operated by the application that has been resumed. Done. The access control unit 256 executes the activated application based on the information stored in the provision history table 2602.

In the above-described embodiment, the case where the communication network 20 and the communication network 50 are different has been described, but the present invention is not limited to this example. For example, the communication network 20 and the communication network 50 may be the same network.
Further, in the above-described embodiment, the privacy policy pre-registration registration application is transmitted from the terminal device 10N to the privacy protection device 100, and the privacy protection pre-configuration is set from the privacy protection device 100 to the terminal device 10N in response to the privacy policy pre-registration registration application. The case where the registration screen is transmitted has been described, but the present invention is not limited to this example. For example, the terminal device 10N may transmit to the privacy protection device 100 a privacy policy preset registration application including user information to be provided to the service provider.

Further, in the above-described embodiment, the name information, the telephone number, the mail address, the contractor detailed information, the family information, the address, and the residence information have been described as an example of the type information of the user information, but it is not limited to this example. For example, the type information of the user information may include information indicating whether or not the advertising material can be sent by direct mail or the like.
Further, in the above-described embodiment, a case has been described in which, on the preset registration screen, each type information of a plurality of user information is input, and the check boxes corresponding to the type information of the user information that can be provided to the service provider are input. However, it is not limited to this example. For example, a screen different from the preset registration screen may be entered for each of the plurality of types of user information.
Further, in the above-described embodiment, a case has been described in which “OK” or “NO” is set in advance in the permission/prohibition information of provision to a third party in the preset table 1662, but the present invention is not limited to this example. For example, in addition to “OK” or “NO”, information indicating confirmation to the user each time may be set.
Further, in the above-described embodiment, the case where the communication system includes one privacy protection device has been described, but the present invention is not limited to this. For example, the communication system may include a plurality of privacy protection devices. In this case, the plurality of privacy protection devices may have the same function or different functions.
Further, in the above-described embodiment, the case where the terminal device 10N inquires of the privacy protection device 100 whether or not the installed application is the previously used application has been described, but the present invention is not limited to this example. For example, the terminal device 10N may store the application ID of an application that has been deleted in the past and determine whether the installed application is the previously used application. Then, the terminal device 10N may transmit the provision history request when it is determined that the application is a previously used application. With this configuration, the provision history request is not transmitted when the application is not used before, so that the frequency of transmitting the provision history request can be reduced.

According to the embodiment, the user installs the app by operating the terminal device 10N and activates the installed app to request the use of the service provided by the service providing device T0M. When an operation to activate an application is performed on the terminal device 10N and the service provided by the service providing apparatus T0M is provided, the application ID of the activated application, the access history, the user information identification information, and the handling rule are displayed. The association is stored in the provision history table 2602. With this configuration, it is possible to record the history of the user information provided to the service provider.
In addition, when the user performs an operation such as erasing the application on the terminal device 10N when there is an application whose use is prohibited, the terminal device 10N uses the application ID of the application for which the erasing operation is performed. The access history, the user information identification information, and the handling rule associated with the application ID are extracted from the provision history table, and the extracted application ID, the access history, the user information identification information, and the handling rule are included. The provision history record application is transmitted to the privacy protection device 100. The privacy protection device 100 receives the provision history record application transmitted by the terminal device 10N, associates the application ID, the access history, the user information identification information, and the handling rule included in the received provision history record application with the user ID. Remember. With this configuration, the application ID, the access history, the user information identification information, and the handling rule can be recorded in the privacy protection device 100 for the prohibited application.

When the user uses the deleted application again, the user installs the application by operating the terminal device 10N and activates the installed application. The terminal device 10N accesses the privacy protection device 100 and makes a provision history request requesting the access history, the user information identification information, and the handling rule stored in association with the combination of the application ID of the activated application and the user ID. Send. The privacy protection apparatus 100 acquires the access history, the user information identification information, and the handling rule stored in association with the combination of the application ID and the user ID included in the provision history request transmitted by the terminal device 10N, and the acquired access. The provision history information including the history, the user information identification information, and the handling rule is transmitted to the terminal device 10N. The terminal device 10N acquires the provision history information transmitted by the privacy protection device 100, and records the acquired provision history information in the provision history table. With this configuration, the terminal device 10N can acquire the usage history of the application from the privacy protection apparatus 100 and set the usage history of the application when the erased application is reinstalled.

Although the embodiment of the present invention and its modified example have been described above, these embodiment and its modified example are presented as examples, and are not intended to limit the scope of the invention. These embodiments and their modifications can be implemented in various other forms, and various omissions, replacements, changes, and combinations can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and at the same time, are included in the invention described in the claims and the scope of equivalents thereof.

Each of the above devices has a computer inside. The process of each process of each device described above is stored in a computer-readable recording medium in the form of a program, and the above process is performed by the computer reading and executing the program. Here, the computer-readable recording medium refers to a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Further, the computer program may be distributed to the computer via a communication line, and the computer that receives the distribution may execute the program.
Further, the program may be for realizing a part of the functions described above.
Further, it may be a so-called difference file (difference program) that can realize the above-mentioned functions in combination with a program already recorded in the computer system.
In the embodiment described above, the privacy protection device 100 is an example of an information management device, the access control unit 256 is an example of a control unit and a data acquisition unit, the data storage requesting unit 258 is an example of a data storage requesting unit, The data storage unit 163 is an example of a data storage unit, and the data provision unit 165 is an example of a data provision unit. In the above-described embodiment, the user information is an example of user data, the application is an example of an application, the application ID is an example of application identification information, the user ID is an example of user identification information, and an access history. Is an example of a user data access history, and the provision history reference request is an example of a data browsing request.

20... Communication network, 50... Communication network, 101-10N... Terminal device, T01-T0M... Service providing device, 100... Privacy protection device, T01-T0M... Service providing device, 152, 252... Communication unit, 154... Pre-set Information setting unit, 156... Service use request processing unit, 158... Comparison unit, 162... Screen information creating unit, 163... Data storage unit, 165... Data providing unit, 166... Storage unit, 254... Recording unit, 256... Access control Part, 258... Data storage requesting part, 1662... Preset table, 1666... Data storage table, 2602... Provision history table, 168, 468... Bus line

Claims (5)

A recording unit that records application identification information, user data access history, and whether or not the user has consented to the privacy policy of the application for the application that can access the user data,
A control unit for controlling access from the application to the user data based on the recording data of the recording unit;
A data storage request unit that transmits the record data of the recording unit for an application for which access to user data is impossible to an information management device that stores the record data of the terminal device,
A terminal device including. For an application in which access to user data is made possible again, a data acquisition unit is further provided for acquiring, from the information management device, record data stored in the information management device,
The recording unit records the record data acquired by the data acquisition unit from the information management device,
The terminal device according to claim 1. A recording step in which the terminal device records application identification information, user data access history, and user's consent to the privacy policy of the application for the application capable of accessing the user data,
A control step in which the terminal device controls access to user data from an application based on the recording data in the recording step;
A data storage requesting step in which the terminal device transmits, to the information management device storing the record data of the terminal device, the record data of the recording step for an application for which access to user data is impossible;
Data management method including. A data storage step in which the information management device stores the record data received from the terminal device in association with the user identification information;
A data providing step in which the information management device provides record data stored by the data storing step in association with the user identification information in response to a data browsing request including the user identification information;
The data management method according to claim 3, further comprising: On the computer,
A recording function for recording application identification information, user data access history, and user consent to the privacy policy of the application for an application that can access the user data,
A control function for controlling access to user data from an application based on the recording data of the recording function,
It is impossible to access the user data to the information management device that stores the recorded data of the terminal device.
A data storage request function for transmitting the recording data of the recording function for the application that has become
A computer program for realizing.

Images