JP7288193B2 - Information processing program, information processing apparatus, and information processing method - Google Patents

Description

The present invention relates to an information processing program, an information processing apparatus, and an information processing method.

For example, a business operator that provides services to users (hereinafter simply referred to as a business operator) builds and operates an information processing system for providing services to users. Specifically, the business operator builds an information processing system using, for example, a DBMS (DataBase Management System) that manages a database.

Such a DBMS generally provides a platform that enables the development and execution of extended functions (plug-ins). By using this, the business operator can expand the function of the database at the necessary timing (see Patent Documents 1 and 2, for example).

JP 2009-146198 A JP-A-2000-137735

When various policy settings (meta-information) are required in the case of expanding the database functions as described above, for example, the operator creates a database table (hereinafter also referred to as a policy table) to set the policy. management. This enables the business operator to improve the productivity of extended functions, portability to different DBMS, and the like.

Here, when performing management using the policy table as described above, the operator must create a database table (hereinafter also referred to as a data table ) and the policy table must be made available for reference.

However, if all users are given access rights to the policy table, the contents of the policy table can be referenced by all users. Therefore, for example, if there is a malicious user, the provider cannot prevent leakage of policy settings.

On the other hand, if, for example, only the administrator of the DBMS (hereafter also referred to as the DB administrator) is granted access rights to the policy table, the operator can prevent malicious users from referring to the policy table. It becomes possible to prevent leakage of policy settings.

However, in this case, for example, many exchanges occur between the developer of the extended function and the DB administrator, and there is a possibility that flexible development of the extended function will not be carried out.

Accordingly, in one aspect, an object of the present invention is to provide an information processing program, an information processing apparatus, and an information processing method that enable efficient access control to a policy table.

In one aspect of the embodiment, when a first data table is accessed, it is determined whether there is a second data table upon which the first data table depends; exists, the computer executes a process of inheriting the access authority to the second data table as the access authority to the first data table.

According to one aspect, it is possible to efficiently perform access control to the policy table.

FIG. 1 is a diagram illustrating the configuration of an information processing system 10. As shown in FIG. FIG. 2 is a diagram for explaining the hardware configuration of the information processing device 1. As shown in FIG. FIG. 3 is a functional block diagram of the information processing apparatus 1. As shown in FIG. FIG. 4 is a flowchart for explaining the outline of access control processing in the first embodiment. FIG. 5 is a diagram illustrating a specific example of the first embodiment. FIG. 6 is a diagram illustrating a specific example of the first embodiment. FIG. 7 is a flowchart for explaining the details of access control processing according to the first embodiment. FIG. 8 is a flowchart for explaining the details of access control processing according to the first embodiment. FIG. 9 is a flowchart for explaining the details of access control processing according to the first embodiment. FIG. 10 is a flowchart illustrating details of access control processing according to the first embodiment. FIG. 11 is a flowchart for explaining the details of access control processing according to the first embodiment. FIG. 12 is a diagram illustrating a specific example of the anonymization policy table TB1. FIG. 13 is a diagram illustrating a specific example of the dependent information 131. As shown in FIG. FIG. 14 is a diagram explaining a specific example of the authority information 132. As shown in FIG. FIG. 15 is a diagram for explaining the outline of the second embodiment. FIG. 16 is a diagram for explaining the outline of the second embodiment. FIG. 17 is a diagram for explaining the outline of the second embodiment. FIG. 18 is a flowchart for explaining the details of access control processing according to the second embodiment. FIG. 19 is a flowchart for explaining the details of access control processing according to the second embodiment. FIG. 20 is a flowchart for explaining details of access control processing in the second embodiment. FIG. 21 is a flowchart for explaining the details of access control processing according to the second embodiment. FIG. 22 is a diagram illustrating a specific example of the statistical information table TB3.

[Configuration of information processing system]
First, the configuration of the information processing system 10 will be described. FIG. 1 is a diagram illustrating the configuration of an information processing system 10. As shown in FIG.

As shown in FIG. 1, an information processing system 10 includes, for example, an information processing device 1 configured by one or more physical machines or virtual machines, a database DB accessible by the information processing device 1, and various information for users. and an operation terminal 5 which is a PC (Personal Computer) for inputting, etc. In the following description, it is assumed that the DBMS operates in the information processing apparatus 1 and that the data concealment function of the data stored in the database DB is provided as an extended function.

The database DB stores, for example, a policy table TB1 (hereinafter also referred to as first data table TB1) and a data table TB2 (hereinafter also referred to as second data table TB2). In the following description, the policy table TB1 is a policy table (hereinafter also referred to as an anonymization policy table TB1) relating to anonymization policy settings (hereinafter also referred to as an anonymization policy).

For example, when the user inputs an access request (reference request) for data contained in the data table TB2 via the operation terminal 5, the information processing apparatus 1 acquires data corresponding to the access request from the database DB. Then, the information processing device 1 refers to the anonymization policy table TB1 to specify an anonymization policy corresponding to the acquired data. Furthermore, the information processing apparatus 1 performs anonymization corresponding to the identified anonymization policy on the acquired data. After that, the information processing device 1 outputs the anonymized data to the operation terminal 5 .

As a result, the information processing apparatus 1 can perform control so that the data to be anonymized is not viewed by the user.

Here, when managing policy settings using the anonymization policy table TB1 as described above, the operator uses the anonymization policy table TB1 and the policy It is necessary to make each of the tables TB2 and TB2 available for reference.

However, if all users are given access rights to the anonymization policy table TB1, the anonymization policy table TB1 becomes accessible to all users. Therefore, for example, if there is a malicious user, the provider cannot prevent leakage of policy settings.

On the other hand, the operator can prevent leakage of policy settings by granting access authority to the anonymization policy table TB1 only to the administrator of the DBMS, for example.

However, in this case, for example, many exchanges occur between the developer of the extended function and the DB administrator, and there is a possibility that flexible development of the extended function will not be carried out.

Therefore, when the anonymization policy table TB1 is accessed, the information processing apparatus 1 according to the present embodiment determines whether or not the data table TB2 to which the anonymization policy table TB1 depends exists. When the information processing apparatus 1 determines that there is a data table TB2 to which the anonymization policy table TB1 depends, the information processing apparatus 1 succeeds the access authority to the data table TB2 as the access authority to the anonymization policy table TB1.

That is, when the anonymization policy table TB1 is subordinate to the data table TB2, the information processing apparatus 1 determines that the access authority to the anonymization policy table TB1 can be applied as the access authority to the data table TB2. do. Therefore, in this case, the information processing device 1 uses the access authority for the data table TB2 as the access authority for the anonymization policy table TB1.

Specifically, for example, when the anonymization policy table TB1 is accessed via an extended function, the information processing apparatus 1 uses the access authority for the data table TB2 as the access authority for the anonymization policy table TB1. .

This eliminates the need for the information processing device 1 to grant access rights to the anonymization policy table TB1 to all users. Further, the information processing device 1 does not need to limit the access authority to the anonymization policy table TB1 to the DB administrator. Therefore, even when the information processing apparatus 1 manages the policy setting by using the anonymization policy table TB1, it is possible to realize flexible development of function expansion while preventing leakage of the policy setting. become.

[Hardware configuration of information processing system]
Next, the hardware configuration of the information processing system 10 will be described. FIG. 2 is a diagram for explaining the hardware configuration of the information processing device 1. As shown in FIG.

The information processing apparatus 1 has a CPU 101 as a processor, a memory 102, an external interface (I/O unit) 103, and a storage medium 104, as shown in FIG. Each unit is connected to each other via a bus 105 .

The storage medium 104 has, for example, a program storage area (not shown) that stores a program 110 for performing processing for controlling access rights to the anonymization policy table TB1 (hereinafter also referred to as access control processing). The storage medium 104 also has a storage unit 130 (hereinafter also referred to as an information storage area 130) that stores information used when performing access control processing, for example. Note that the storage medium 104 may be, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive).

The CPU 101 executes the program 110 loaded from the storage medium 104 to the memory 102 to perform access control processing.

Also, the external interface 103 communicates with, for example, the operation terminal 5 and the like.

[Functions of information processing system]
Next, functions of the information processing system 10 will be described. FIG. 3 is a functional block diagram of the information processing apparatus 1. As shown in FIG.

As shown in FIG. 3, the information processing apparatus 1 includes a request reception unit 111, a data access unit 112, and a subordinate unit 111, for example, through organic cooperation between hardware such as a CPU 101 and a memory 102 and a program 110. Various functions including determination unit 113, authority inheritance unit 114, authority determination unit 115, data secrecy unit 116, and data output unit 117 are implemented.

For example, the information processing apparatus 1 stores subordination information 131 and authority information 132 in the information storage area 130 as shown in FIG.

The request receiving unit 111 receives requests for access to the data table TB2 stored in the database DB. Specifically, the request receiving unit 111 receives an access request made by the user via the operation terminal 5, for example.

The data access unit 112 accesses the data table TB2 stored in the database DB and acquires data corresponding to the access request received by the request receiving unit 111. FIG.

When the anonymization policy table TB stored in the database DB is accessed, the subordination determination unit 113 determines whether or not there is a data table TB2 to which the anonymization policy table TB1 depends.

Specifically, when the data access unit 112 acquires data from the data table TB2, the subordination determination unit 113 needs to access the anonymization policy included in the anonymization policy table TB1. If so, it is determined whether or not there is a data table TB2 to which the anonymization policy that needs to be accessed depends.

If the dependency determination unit 113 determines that the data table TB2 to which the anonymization policy table TB1 depends, the authority inheritance unit 114 selects the data table determined by the dependency determination unit 113 as the access authority for the anonymization policy table TB1. Inherit the access right to TB2.

Specifically, the privilege inheritance unit 114, for example, among the anonymization policies included in the anonymization policy TB1, the data determined by the subordination determination unit 113 to exist as the access authority for the anonymization policy that needs to be accessed. Inherit the access right to the table TB2.

The authority determining unit 115 determines whether or not the access authority inherited by the authority inheriting unit 114 includes the access authority of the user who made the access request received by the request receiving unit 111 .

Then, when the authority determination unit 115 determines that the access authority of the user who made the access request is included, the data access unit 112 accesses the anonymization policy table TB1 stored in the database DB, and accesses the anonymization policy table TB1. is acquired (anonymization policy for the data table TB2 corresponding to the access request accepted by the request accepting unit 111).

The data anonymization unit 116 anonymizes the data that the data access unit 112 has obtained from the data table TB2 in accordance with the anonymization policy that the data access unit 112 has obtained from the anonymization policy table TB1.

The data output unit 117 outputs the data concealed by the data concealment unit 116 . Specifically, the data output unit 117 outputs, for example, the data anonymized by the data anonymization unit 116 to the operation terminal 5 that issued the access request accepted by the request acceptance unit 111 .

[Outline of the first embodiment]
Next, an outline of the first embodiment will be described. FIG. 4 is a flowchart for explaining the outline of access control processing in the first embodiment.

In the following example, a case where the anonymization policy table TB1 is stored in the database DB will be described. 130).

As shown in FIG. 4, the subordination determination unit 113 waits until it detects access to the anonymization policy table TB1 stored in the database DB (NO in S1). Specifically, dependency determination unit 113 waits until data access unit 112 acquires data corresponding to the access request received by request reception unit 111 .

When it is detected that the anonymization policy table TB1 is accessed (YES in S1), the subordination determination unit 113 determines the data table to which the anonymization policy table TB1 corresponding to the access request accepted in the process of S1 is dependent. It is determined whether or not TB2 exists (S2).

As a result, if it is determined that the data table TB2 exists (YES in S3), the authority inheritance unit 114 determines that the data table TB2 exists in the process of S2 as the access authority for the anonymization policy table TB1 corresponding to the access request received in the process of S1. The access right to the data table TB2 determined as such is inherited (S4).

On the other hand, when it is determined that the data table TB2 does not exist (NO in S3), the authority succession unit 114 does not perform the process of S4.

This eliminates the need for the information processing device 1 to grant access rights to the anonymization policy table TB1 to all users. Further, the information processing device 1 does not need to limit the access authority to the anonymization policy table TB1 to the DB administrator. Therefore, even when the information processing apparatus 1 manages the policy setting by using the anonymization policy table TB1, it is possible to realize flexible development of function expansion while preventing leakage of the policy setting. become.

In addition, the information processing device 1 can automatically manage access rights to the anonymization policy table TB1. Therefore, the information processing apparatus 1 can reduce the load associated with managing access rights to the anonymization policy table TB1.

[Specific example of the first embodiment]
Next, a specific example of the first embodiment will be described. 5 and 6 are diagrams for explaining a specific example of the first embodiment.

The database DB shown in FIG. 5 and the like stores an anonymization policy table TB1, a data table TB2-1, a data table TB2-2, and a data table TB2-3. In the example shown in FIG. 5 and the like, the anonymization policy table TB1 includes rows of anonymization policies PL1-1, anonymization policies PL1-2, and anonymization policies PL1-3. Furthermore, in the example shown in FIG. 5, etc., the anonymization policy PL1-1, anonymization policy PL1-2, and anonymization policy PL1-3 are data table TB2-1, data table TB2-2, and data table TB2-2, respectively. They are dependent on each of the 3.

Specifically, for example, when the user transmits an access request (for example, an access request by an SQL statement) to the data table 2-1 via the operation terminal 5, the information processing device 1 accesses the data table stored in the database DB. TB2-1 is accessed and data corresponding to the access request sent from the operation terminal 5 is obtained.

Then, as shown in FIG. 5, in order to anonymize the data corresponding to the access request transmitted from the operation terminal 5, the information processing apparatus 1 uses the anonymization policy PL1-1 included in the anonymization policy table TB1. , and specifies the data table TB2-1, which is the table to which the anonymization policy PL1-1 depends.

Further, as shown in FIG. 6, the information processing device 1 determines whether or not the access authority of the user who has made the access request is included in the access authority of the specified data table TB2-1. Specifically, for example, the information processing device 1 determines whether the access request is an access request from an extended function and whether the access authority of the user who has made the access request is included in the access authority of the data table TB2-1. make a determination as to whether As a result, when it is determined that the access authority of the user who made the access request is included, the information processing device 1 accesses the anonymization policy table TB1 to acquire the anonymization policy PL1-1.

After that, the information processing device 1 anonymizes the data (data corresponding to the access request) obtained from the data table TB2-1 according to the anonymization policy PL1-1, and outputs the anonymized data to the operation terminal 5. FIG.

[Details of the first embodiment]
Next, details of the first embodiment will be described. 7 to 11 are flowcharts for explaining the details of access control processing according to the first embodiment. 12 to 14 are diagrams for explaining details of access control processing in the first embodiment.

[Data access processing (1)]
First, the process of accessing data contained in the data table TB2 stored in the database DB (hereinafter also referred to as data access process) will be described. 7 and 8 are flowcharts for explaining data access processing.

As shown in FIG. 7, the request receiving unit 111 waits until receiving an access request for data included in the data table TB2 (NO in S101). Specifically, the request receiving unit 111 waits until the user transmits an access request via the operation terminal 5, for example.

Then, when an access request to the data contained in the data table TB2 is accepted (YES in S101), the data access unit 112 accesses the data table TB2 stored in the database DB, and accepts the access request in the process of S101. Data is acquired (S102).

Subsequently, the data access unit 112 identifies the anonymization policy corresponding to the data acquired in the process of S102 among the anonymization policies included in the anonymization policy table TB1 stored in the database DB (S103). A specific example of the anonymization policy table TB1 will be described below.

[Specific example of masking policy table]
FIG. 12 is a diagram illustrating a specific example of the anonymization policy table TB1.

The anonymization policy table TB1 shown in FIG. 12 includes a “item number” that identifies each anonymization policy, a “table ID” that identifies each data table TB2, and identifies data to be anonymized in each data table TB2. It has items of "target" and "anonymization policy" in which the content of the anonymization policy is stored.

Specifically, in the anonymization policy table TB1 shown in FIG. 12, "101" is stored as the "table ID" for the information whose "item number" is "1", and "column A" is stored as the "target". ' is stored, and 'change other than the area code to *' is stored as the 'anonymization policy'. In other words, the policy whose "item number" is "1", when there is an access request to column A of the table whose table ID is 101, is the data other than the area code among the data corresponding to the access request. It indicates that everything will be changed to * before being output.

Further, in the anonymization policy table TB1 shown in FIG. 12, "102" is stored as the "table ID" and "none" is stored as the "target" for the information whose "item number" is "2". and "none" is stored as the "anonymization policy". In other words, the policy whose "item number" is "2" indicates that, when there is an access request to the table whose table ID is 102, the data corresponding to the access request is output without being made confidential. . Description of other information included in FIG. 12 is omitted.

Then, for example, when the data table TB2 whose “table ID” is “101” contains the data acquired in the process of S102, the data access unit 112 performs the anonymization process shown in FIG. 12 in the process of S103. Among the anonymization policies included in the policy table TB1, the anonymization policy with the “table ID” of “101” (the anonymization policy with the “item number” of “1”) is specified.

Returning to FIG. 7, the information processing device 1 starts executing access control processing for the anonymization policy table TB1. Note that, in this case, the data access unit 112 may transmit an access request for the anonymization policy specified in the process of S103 to the subordination determination unit 113 . The access control processing will be described below.

[Access control processing]
9 to 11 are flowcharts for explaining access control processing.

As shown in FIG. 9, the subordination determination unit 113 waits until the access control timing (NO in S11). The access control timing may be, for example, the timing at which an access request for the anonymization policy specified in the process of S103 is received from the data access unit 112. FIG.

Then, when the access control timing comes (YES in S11), the subordination determination unit 113 refers to the subordination information 131 stored in the information storage area 130, and determines the data table to which the anonymization policy specified in the process of S103 is subordinate. It is determined whether or not TB2 exists (S12). A specific example of the dependent information 131 will be described below.

[Specific example of dependent information]
FIG. 13 is a diagram illustrating a specific example of the dependent information 131. As shown in FIG.

Dependent information 131 shown in FIG. 13 has items of "item number" for identifying each piece of information, "table ID" for identifying each table, and "subordinate destination" for identifying the table to which each table depends. ing. In the following description, the table with the table ID 101, 102, or 103 is the data table TB2, and the table with the table ID 201 is the anonymization policy table TB1.

Specifically, in the subordination information 131 shown in FIG. 13, for example, in the information whose "item number" is "1", "101" is stored as the "table ID" and "none" is stored as the "subordinate destination". remembered.

In addition, in the dependent information 131 shown in FIG. 13, for example, for the information whose "item number" is "4", "201" is stored as the "table ID" and "yes" is stored as the "subordinate destination". ing. Description of other information included in FIG. 13 is omitted.

That is, in the subordinate information 131 shown in FIG. 13, the subordinate destination exists in the "subordinate destination" of the information corresponding to the anonymization policy table TB1 (the information whose "item number" is "4"). "Yes" is stored.

Therefore, for example, in the process of S103, of the anonymization policy table TB1 described with reference to FIG. anonymization policy) is specified, in the process of S12, the subordination determination unit 113 selects the table whose "table ID" is "101" as the data table TB2 to which the anonymization policy specified in the process of S103 depends. is determined to exist.

Returning to FIG. 9, when it is determined that the data table TB2 to which the anonymization policy specified in the process of S103 depends exists (YES in S13), the authority succession unit 114 converts the authority information 132 stored in the information storage area 130 into By referring to it, it is determined whether or not the security of the anonymization policy table TB1 is valid (S14). A specific example of the authority information 132 will be described below.

[Specific example of authorization information]
FIG. 14 is a diagram explaining a specific example of the authority information 132. As shown in FIG.

The authority information 132 shown in FIG. 14 includes items of "item number" that identifies each piece of information, "table ID" that identifies each table, and "access authority" that indicates information of a user who has access authority to each table. have as The authority information 132 shown in FIG. 14 includes “security” indicating whether security for each table (for example, security for preventing unauthorized access by a malicious user) is effective, and It has items of "privilege succession" indicating whether or not the access rights of subordinate destinations are inherited, and "inheritance scope" indicating the range of access rights inherited from subordinate destinations in each table.

Specifically, in the authority information 132 shown in FIG. 14, for example, "101" is stored as the "table ID" for the information whose "item number" is "1", and "user A, User D, . . . ” is stored. Further, in the authority information 132 shown in FIG. 14, "NO" is stored as "security" for information whose "item number" is "1", "NO" is stored as "inheritance of authority", and "NO" is stored as "inheritance "range" is stored as "none".

That is, the information with the “item number” of “1” indicates that the table with the table ID of 101 can be accessed by the user A, the user D, and the like. Also, the information with the "item number" of "1" indicates that the security for the table with the table ID of 101 is invalid. Furthermore, the information with the “item number” of “1” indicates that the access authority for the table with the table ID of 101 has not been inherited.

Further, in the authority information 132 shown in FIG. 14, for example, "201" is stored as the "table ID" for the information whose "item number" is "4", and "table administrator" is stored as the "access authority". remembered. Further, in the authority information 132 shown in FIG. 14, "YES" is stored as "security", "YES" is stored as "privilege succession", and "inheritance "extended function" is stored as "range of

That is, the information with the “item number” of “4” indicates that the table with the table ID of 201 can be accessed by the table manager. Also, the information with the "item number" of "4" indicates that the security for the table with the table ID of 201 is valid. Furthermore, the information with the “item number” of “4” indicates that the access authority for the extended function is inherited for the table with the table ID of 201 .

Further, in the authority information 132 shown in FIG. 14, for example, "202" is stored as the "table ID" for the information whose "item number" is "5", and "table administrator" is stored as the "access authority". remembered. Further, in the authority information 132 shown in FIG. 14, "YES" is stored as "security", "YES" is stored as "privilege succession", and "inheritance "user" is stored as "range of

That is, the information with the “item number” of “5” indicates that the table with the table ID of 202 can be accessed by the table manager. Also, the information with the "item number" of "5" indicates that the security for the table with the table ID of 202 is valid. Furthermore, the information with the “item number” of “5” indicates that the access authority of the user who requests access to the table with the table ID of 202 is inherited. Description of other information included in FIG. 14 is omitted.

Therefore, in the processing of S14, the subordination determination unit 113 refers to, for example, the authority information 132 shown in FIG. Determine that there is.

Returning to FIG. 9, when it is determined that the security for each row of the anonymization policy table TB1 is valid (YES in S15), the authority succession unit 114 refers to the authority information 132 stored in the information storage area 130. , whether or not the anonymization policy table TB1 inherits access rights to the data table TB2 (S16).

Specifically, in the authority information 132 described with reference to FIG. 14, "YES" is set in the "authority succession" of the information whose "table ID" is "201" (information whose "item number" is "4"). remembered. Therefore, in the process of S16, the authority succession unit 114 determines that the anonymization policy table TB1 (the table whose "table ID" is "201") has inherited the access authority.

Note that the authority information 132 may include security for each row (anonymization policy) included in the anonymization policy table TB1. In this case, the authority succession unit 114 determines in the process of S14 whether or not the security of the anonymization policy specified in the process of S103 in the anonymization policy table TB1 is valid. good. Further, when the authority succession unit 114 determines that the security of the anonymization policy specified in the anonymization policy table TB1 in the process of S103 is valid, the privilege inheritance unit 114 determines that the security of the anonymization policy specified in the anonymization policy table TB1 in the process of S103 is effective. It may be determined whether or not the anonymization policy has inherited the access right to the data table TB2 (S15, S16).

As a result, as shown in FIG. 10, when it is determined that the access right to the data table TB2 has been inherited (YES in S21), the right inheritance unit 114 refers to the right information 132 stored in the information storage area 130. Then, it is determined whether or not the extended function is included in the range of access authority determined to be inherited in the process of S16 (S22).

Specifically, in the authority information 132 described with reference to FIG. 14, the "extended function ” is stored. Therefore, in the process of S22, the authority inheritance unit 114 determines that the anonymization policy table TB1 (the table whose "table ID" is "201") inherits the access authority of the extended function.

Then, if it is determined that the extended function is included in the scope of the access authority determined to be inherited in the process of S16 (YES in S23), the authority inheritance unit 114 acquires the authority stored in the information storage area 130. By referring to the information 132, the access authority for the data table TB2 that existed in the process of S12 is specified (S24).

Specifically, in the authority information 132 described with reference to FIG. 14, the "access authority" of the information whose "table ID" is "101" (information whose "item number" is "1") includes "user A, User D, . . . ” is stored. Therefore, in the processing of S24, the authority succession unit 114 identifies information including, for example, that the user A and the user D can access the table with the table ID 101. FIG.

Subsequently, the authority determination unit 115 determines whether or not the access authority specified in the process of S24 includes the access authority corresponding to the user who made the access request received in the process of S101 (S25).

Specifically, for example, if the user who made the access request received in the process of S101 is user D, the authority determination unit 115 adds user D It is judged that the access authority by is included.

As a result, when it is determined that the access authority corresponding to the user who made the access request received in the processing of S101 is included (YES in S26), the authority determination unit 115 performs the processing of S103 as shown in FIG. Access to the anonymization policy specified in the process is permitted (S34).

On the other hand, when it is determined in the process of S13 that the data table TB2 to which the anonymization policy specified in the process of S103 depends does not exist (NO in S13), the authority determination unit 115 stores information as shown in FIG. By referring to the authority information 132 stored in the area 130, the access authority for the anonymization policy identified in the process of S103 is identified (S31).

Then, the authority determination unit 115 determines whether or not the access authority specified in the process of S31 includes the access authority corresponding to the user who made the access request received in the process of S101 (S32).

As a result, when it is determined that the access authority corresponding to the user who made the access request received in the process of S101 is included (YES in S33), the authority determination unit 115 determines the anonymization policy specified in the process of S103. is permitted (S34).

Further, when it is determined that the access authority corresponding to the user who made the access request accepted in the process of S101 is not included (NO in S33), the authority determination unit 115 does not perform the process of S34. In this case, the information processing apparatus 1 may interrupt execution of the process. The business operator then investigates whether the access authority corresponding to the user who made the access request received in the process of S101 was not included in the access authority specified in the process of S31. good too.

Also, if it is determined that the row-by-row security for the anonymization policy specified in the process of S103 is invalid (NO in S15), or if the access authority to the data table TB2 that existed in the process of S12 has not been inherited, Similarly (NO in S21), the authority determination unit 115 performs the processes from S31 onward when it is determined. Furthermore, if it is determined that the extended function is not included in the range of access authority determined to be inherited in the process of S16 (NO in S23), or if the user who made the access request accepted in the process of S101 Likewise, when it is determined that the access authority to access the file is not included (NO in S26), the authority determination unit 115 performs the processes from S31 onward.

[Data access processing (2)]
Returning to FIG. 8, in the access control process, the data access unit 112 determines whether or not access to the anonymization policy specified in the process of S103 is permitted (S111).

As a result, when it is determined that access to the anonymization policy specified in the process of S103 is permitted (YES in S111), the data access unit 112 accesses the anonymization policy specified in the process of S103 (S112). .

Then, the data anonymization unit 116 anonymizes the data acquired in the process of S102 according to the anonymization policy accessed in the process of S112 (S113).

Thereafter, the data output unit 117 outputs the data anonymized in the process of S113 (S114). Specifically, the data output unit 117 outputs to the operation terminal 5 the data anonymized in the process of S113, for example.

On the other hand, when it is determined that access to the anonymization policy specified in the process of S103 is not permitted (NO in S111), the data access unit 112 and the like do not perform the processes after S112. In this case, the information processing apparatus 1 may interrupt execution of the process. Then, the business operator may investigate whether access to the anonymization policy specified in the process of S103 is not permitted.

As described above, when the anonymization policy table TB1 is accessed, the information processing apparatus 1 according to the present embodiment determines whether or not the data table TB2 to which the anonymization policy table TB1 depends exists. When the information processing apparatus 1 determines that the data table TB2 exists, it inherits the access authority to the data table TB2 as the access authority to the anonymization policy table TB1.

That is, when the anonymization policy table TB1 is subordinate to the data table TB2, the information processing device 1 determines that the access authority for the anonymization policy table TB1 is applicable as the access authority for the data table TB2. Therefore, in this case, the information processing device 1 uses the access authority for the data table TB2 as the access authority for the anonymization policy table TB1.

This eliminates the need for the information processing device 1 to grant access rights to the anonymization policy table TB1 to all users. Further, the information processing device 1 does not need to limit the access authority to the anonymization policy table TB1 to the DB administrator. Therefore, even when the information processing apparatus 1 manages the policy setting by using the anonymization policy table TB1, it is possible to realize flexible development of function expansion while preventing leakage of the policy setting. become.

In addition, the information processing device 1 can automatically manage access rights to the anonymization policy table TB1. Therefore, the information processing apparatus 1 can reduce the load associated with managing access rights to the anonymization policy table TB1.

Note that the data access unit 112 may access the anonymization policy table TB1 only when access to the policy table TB1 is permitted by the access control process, as described with reference to FIG. 8 and the like. On the other hand, for example, when an access request for direct access to the anonymization policy table TB1 is received, the data access unit 112 may not perform access corresponding to the access request.

Specifically, the information processing apparatus 1 may, for example, limit access authority to the anonymization policy table TB1 to a table administrator of the anonymization policy table TB1. When a user without access authority to the anonymization policy table TB1 executes the processing corresponding to the extended function (for example, the processing of S104 to S113 described with reference to FIGS. 7 and 8), the information processing apparatus 1 The user may be authorized to manage the anonymization policy table TB1.

As a result, the information processing device 1 can permit access to the anonymization policy table TB1 only when access to the anonymization policy table TB1 is performed via the extension function. Therefore, the information processing apparatus 1 can more accurately prevent malicious users from accessing the anonymization policy table TB1.

[Overview of Second Embodiment]
Next, the outline of the second embodiment will be described. FIG. 15 is a diagram for explaining the outline of the second embodiment.

The access control processing in the second embodiment is different from the processing performed when an access request to the anonymization policy table TB1 stored in the database DB occurs, like the access control processing in the first embodiment. , as shown in FIG. 15, is a process performed when an access request is issued to the statistical information table TB3 stored in the database DB.

The statistical information table TB3 is a table showing characteristics (attributes) of data included in each data table TB2, and is a table used for creating an access plan for each data table TB2, for example. Specifically, the statistical information table TB3 is a table that includes, for example, part of the data included in the data table TB2, a summary of the data, and the like. Also, the statistical information table TB3 is, for example, a table that includes tabulated data obtained by aggregating the data included in the data table TB2. A specific example of the second embodiment will be described below.

[Specific example of the second embodiment]
16 and 17 are diagrams for explaining a specific example of the second embodiment.

Statistical information table TB3, data table TB2-1, data table TB2-2 and data table TB2-3 are stored in database DB shown in FIG. 16 and the like. In the example shown in FIG. 16 and the like, the statistical information table TB3 includes rows of statistical information ST3-1, statistical information ST3-2, and statistical information ST3-3. Furthermore, in the example shown in FIG. 16, etc., the statistical information ST3-1, the statistical information ST3-2, and the statistical information ST3-3 are respectively stored in the data table TB2-1, the data table TB2-2, and the data table TB2-3. subordinate.

Specifically, for example, when the user transmits an access request (for example, an access request by an SQL statement) to the statistical information ST3-3 via the operation terminal 5, the information processing device 1 performs the statistical The data table TB2-3 is specified as the table to which the information TB3-3 depends.

Then, as shown in FIG. 17, the information processing apparatus 1 determines whether or not the access authority of the user who has made the access request is included in the access authority of the identified data table TB2-3. As a result, when it is determined that the access authority of the user who made the access request is included, the information processing device 1 accesses the statistical information table TB3 and acquires the statistical information ST3-3. After that, the information processing device 1 outputs the obtained statistical information ST3-3 to the operation terminal 5. FIG.

[Details of the second embodiment]
Next, details of the second embodiment will be described. 18 to 21 are flowcharts for explaining the details of access control processing in the second embodiment. FIG. 22 is a diagram for explaining details of access control processing in the second embodiment. In the following description, it is assumed that the table with the table ID 202 is the statistical information table TB3. Also, only points different from the first embodiment will be described below.

[Statistical access processing (1)]
First, the process of accessing the statistical information contained in the statistical information table TB3 stored in the database DB (hereinafter also referred to as statistical access process) will be described. FIG. 18 is a flowchart for explaining statistical access processing.

As shown in FIG. 18, the request receiving unit 111 waits until receiving an access request for the statistical information included in the statistical information table TB3 (NO in S201). Specifically, the request receiving unit 111 waits until the user transmits an access request via the operation terminal 5, for example.

Then, when the access request for the statistical information included in the statistical information table TB3 is received (YES in S201), the information processing device 1 starts executing access control processing for the statistical information table TB3. In this case, the data access unit 112 may transmit the access request accepted in the process of S201 to the subordination determination unit 113. FIG. The access control processing in the second embodiment will be described below.

[Access control processing]
19 to 21 are flowcharts for explaining access control processing in the second embodiment.

As shown in FIG. 19, the subordination determination unit 113 waits until the access control timing (NO in S41). The access control timing may be, for example, the timing at which the access request accepted in the process of S201 is received from the data access unit 112. FIG.

Then, when the access control timing has come (YES in S41), the subordination determination unit 113 refers to the subordination information 131 stored in the information storage area 130, and the statistical information for which the access request was received in the process of S201 is subordinate. It is determined whether or not the data table TB2 exists (S42). A specific example of the statistical information TB3 will be described below.

[Specific example of statistical information]
FIG. 22 is a diagram illustrating a specific example of the statistical information table TB3.

Statistical information table TB3 shown in FIG. 22 includes "item number" that identifies each statistical information, "table ID" that identifies each data table TB2, and "statistical information table" that stores statistical information about each data table TB2. ” as items.

Specifically, in the statistical information table TB3 shown in FIG. 22, the information whose “item number” is “1” stores “101” as the “table ID” and “1,000,000” as the “statistical information”. data” is stored.

In addition, in the statistical information table TB3 shown in FIG. 22, "102" is stored as the "table ID" for the information whose "item number" is "2", and "data stored page" is stored as the "statistical information". "10,000 pages" is stored. Description of other information included in FIG. 22 is omitted.

In the dependent information 131 described with reference to FIG. 13, the information corresponding to the statistical information table TB3 (information whose "item number" is "5") indicates that the dependent destination exists. "Yes" is stored.

Therefore, for example, in the processing of S201, among the statistical information table TB3 explained in FIG. ), the subordination determination unit 113 determines that a table whose “table ID” is “103” exists as the data table TB2 to which the statistical information for which the access request is received in the process of S201 is subordinate. do.

Returning to FIG. 19, when it is determined in the process of S201 that the data table TB2 to which the statistical information for which the access request is accepted exists (YES in S43), the authority succession unit 114 retrieves the authority information stored in the information storage area 130. 132, it is determined whether or not the security for the statistical information table TB3 is valid (S44).

Specifically, in the authority information 132 described with reference to FIG. 14, "YES" is set in the "authority succession" of the information whose "table ID" is "202" (information whose "item number" is "5"). remembered. Therefore, in the process of S44, the subordination determination unit 113 determines that the security of the statistical information table TB3 (the table whose "table ID" is "202") is valid.

Returning to FIG. 19, when it is determined in the process of S201 that the security for each row of the statistical information for which the access request has been received is valid (YES in S45), the authority inheritance unit 114 By referring to the authority information 132, it is determined whether or not the statistical information table TB3 inherits the access authority to the data table TB2 (S46).

Specifically, in the authority information 132 described with reference to FIG. 14, "YES" is set in the "authority succession" of the information whose "table ID" is "202" (information whose "item number" is "5"). remembered. Therefore, in the process of S46, the authority succession unit 114 determines that the statistical information table TB3 (the table whose "table ID" is "202") has inherited the access authority.

Note that the authority information 132 may include security for each row (statistical information) included in the statistical information table TB3. In this case, the authority succession unit 114 determines in the process of S44 whether or not the security of the statistical information for which the access request has been received in the process of S201 in the statistical information table TB3 is valid. you can Further, if the authority succession unit 114 determines that the security of the statistical information for which the access request is received in the process of S201 in the statistical information table TB3 is valid, the access request in the statistical information table TB3 in the process of S201 is effective. It may be determined whether or not the requested statistical information has inherited the access right to the data table TB2 (S45, S46).

As a result, as shown in FIG. 20, when it is determined that the statistical information table TB3 has inherited the access authority to the data table TB2 (YES in S51), the authority inheritance unit 114 By referring to the authority information 132, it is determined whether or not the user requesting access is included in the range of access authority determined to be inherited in the process of S46 (S52).

Specifically, in the authority information 132 explained with reference to FIG. is stored. Therefore, in the process of S52, the authority succession unit 114 determines that the statistical information table TB3 (the table whose "table ID" is "202") has inherited the access authority of the user making the access request.

If it is determined that the user requesting access is included in the range of access rights determined to be inherited in the process of S46 (YES in S53), the authority succession unit 114 stores the access rights in the information storage area 130. By referring to the obtained authority information 132, the access authority to the data table TB2 that existed in the process of S42 is specified (S54).

Specifically, in the authority information 132 described with reference to FIG. 14, the "access authority" of the information whose "table ID" is "103" (information whose "item number" is "3") includes "user A, User B, . . . ” is stored. Therefore, in the processing of S54, the authority succession unit 114 identifies information including, for example, that the user A and the user B can access the table whose table ID is 103. FIG.

Subsequently, the authority determination unit 115 determines whether or not the access authority specified in the process of S54 includes the access authority corresponding to the user who made the access request received in the process of S201 (S55).

Specifically, in the authority information 132 described with reference to FIG. 14, the "access authority" of the information whose "table ID" is "103" (information whose "item number" is "3") includes "user A, User B, . . . ” is stored. Therefore, for example, if the user who made the access request received in the process of S201 is user B, the authority determination unit 115 determines that the access authority for the table with the table ID of 103 is granted by user B in the process of S55. Determine that the authority is included.

As a result, when it is determined that the access authority corresponding to the user who made the access request received in the processing of S201 is included (YES in S56), the authority determination unit 115 performs the processing of S201 as shown in FIG. Access to the statistical information for which an access request has been accepted in the process is permitted (S64).

Further, when it is determined in the processing of S43 that the data table TB2 to which the statistical information for which the access request is received in the processing of S201 depends does not exist (NO in S43), the authority determination unit 115 performs the following as shown in FIG. By referring to the authority information 132 stored in the information storage area 130, the access authority for the statistical information for which the access request was received in the process of S201 is specified (S61).

Then, the authority determination unit 115 determines whether or not the access authority specified in the process of S61 includes the access authority corresponding to the user who made the access request received in the process of S201 (S62).

As a result, when it is determined that the access authority corresponding to the user who made the access request received in the process of S201 is included (YES in S63), the authority determination unit 115 determines that the access request has been received in the process of S201. Access to the statistical information is permitted (S64).

On the other hand, when it is determined that the access authority corresponding to the user who made the access request received in the process of S201 is not included (NO in S63), the authority determination unit 115 does not perform the process of S64. In this case, the information processing apparatus 1 may interrupt execution of the process. The business operator then investigates whether the access authority corresponding to the user who made the access request received in the process of S201 was not included in the access authority specified in the process of S61. good.

Also, if it is determined in the process of S201 that the security for each row of the statistical information for which the access request has been accepted is invalid (NO in S45), or if the access authority to the data table TB2 that existed in the process of S42 is inherited. Similarly (NO in S51), the authority determination unit 115 performs the processes from S61 onward when it is determined that there is no access. Furthermore, when it is determined that the user requesting the access is not included in the range of access authority determined to be inherited in the process of S46 (NO in S53), or when the access request received in the process of S201 is made Likewise, when it is determined that the access authority corresponding to the user is not included (NO in S56), the authority determination unit 115 performs the processing from S61 onward.

[Statistical access processing (2)]
Returning to FIG. 18, in the access control process, the data access unit 112 determines whether or not access to the statistical information for which the access request was received in the process of S201 is permitted (S203).

As a result, when it is determined that access to the statistical information for which the access request has been accepted in the processing of S201 is permitted (YES in S203), the data access unit 112 accesses the statistical information for which the access request has been accepted in the processing of S201. (S204).

On the other hand, if it is determined in the process of S201 that access to the statistical information for which the access request has been accepted is not permitted (NO in S203), the data access unit 112 does not perform the process of S204.

As a result, the information processing device 1 can prevent leakage of the statistical information included in the statistical information table TB3.

In addition, the information processing apparatus 1 can automatically manage access rights to the statistical information table TB3, and can reduce the load associated with managing access rights to the statistical information table TB3.

The above embodiments are summarized as follows.

(Appendix 1)
determining if there is a second data table upon which the first data table is dependent when a first data table is accessed;
if the second data table exists, succeeding the access authority to the second data table as the access authority to the first data table;
An information processing program characterized by causing a computer to execute processing.

(Appendix 2)
In Appendix 1,
In the determining process, it is determined whether or not the second data table inherits the data to be accessed among the data included in the first data table,
In the inheriting process, the access authority for the second data table is inherited as the access authority for the data to be accessed among the data included in the first data table.
An information processing program characterized by: (Claim 2, Figures 9 to 13)
(Appendix 3)
In Supplementary Note 1, further,
permitting access to the first data table by the requestor if the inherited access authority includes access authority to the first data table by the access requester;
An information processing program characterized by causing a computer to execute processing.

(Appendix 4)
In Appendix 1,
The access is an access that accompanies operation of a predetermined function of a database corresponding to the first data table and the second data table,
An information processing program characterized by:

(Appendix 5)
In Appendix 4,
The predetermined function is an extended function of the database,
An information processing program characterized by:

(Appendix 6)
In Appendix 1,
The first data table includes data indicating a method for identifying data to be anonymized contained in the second data table and a method for anonymizing the data to be anonymized.
An information processing program characterized by:

(Appendix 7)
In Appendix 1,
the first data table includes data indicating attributes of data included in the second data table;
An information processing program characterized by:

(Appendix 8)
In Appendix 7,
the first data table includes at least a portion of the data contained in the second data table;
An information processing program characterized by:

(Appendix 9)
In Appendix 7,
The first data table includes aggregated data obtained by aggregating the data contained in the second data table,
An information processing program characterized by:

(Appendix 10)
a dependency determination unit that determines whether or not a second data table to which the first data table depends exists when the first data table is accessed;
an authority inheritance unit that inherits the access authority to the second data table as the access authority to the first data table when the second data table exists,
An information processing device characterized by:

(Appendix 11)
In Appendix 10,
The dependency determination unit determines whether or not there is the second data inherited by the data to be accessed among the data contained in the first data table,
The authority inheritance unit inherits the access authority to the second data as the access authority to the data to be accessed among the data included in the first data table.
An information processing device characterized by:

(Appendix 12)
In Supplementary Note 10, further,
an authority determination unit that permits access to the first data table by the requester when the inherited access authority includes the access authority to the first data table by the access requester;
An information processing device characterized by:

(Appendix 13)
determining if there is a second data table upon which the first data table is dependent when a first data table is accessed;
if the second data table exists, succeeding the access authority to the second data table as the access authority to the first data table;
An information processing method characterized by causing a computer to execute processing.

(Appendix 14)
In Appendix 13,
In the determining process, it is determined whether or not there is the second data inherited by the data to be accessed among the data contained in the first data table,
In the inheriting process, the access authority for the second data is inherited as the access authority for the data to be accessed among the data contained in the first data table.
An information processing method characterized by:

(Appendix 15)
In Supplementary Note 13, further,
permitting access to the first data table by the requestor if the inherited access authority includes access authority to the first data table by the access requester;
An information processing method characterized by causing a computer to execute processing.

1: Information processing device 5: Operation terminal DB: Database TB1: Policy table TB2: Data table TB3: Statistical information table NW: Network 10: Information processing system

Claims (12)

When a first data table indicating whether or not to anonymize the specific data is accessed with access to the specific data included in the second data table, the first data table is determining whether it is dependent on the second data table;
If the first data table is subordinate to the second data table, the access authority to the second data table is inherited as the access authority to the first data table;
An information processing program characterized by causing a computer to execute processing. In claim 1,
In the determining process, it is determined whether or not the second data table inherits the data to be accessed among the data included in the first data table,
In the inheriting process, the access authority for the second data table is inherited as the access authority for the data to be accessed among the data included in the first data table.
An information processing program characterized by: In claim 1, further:
permitting access to the first data table by the requestor if the inherited access authority includes access authority to the first data table by the access requester;
An information processing program characterized by causing a computer to execute processing. In claim 1,
The access is an access that accompanies operation of a predetermined function of a database corresponding to the first data table and the second data table,
An information processing program characterized by: In claim 4,
The predetermined function is an extended function of the database,
An information processing program characterized by: When access to specific data included in a second data table is accompanied by access to a first data table indicating an attribute of the specific data, the first data table is the second data table. determine whether it is subordinate to
If the first data table is subordinate to the second data table, the access authority to the second data table is inherited as the access authority to the first data table;
An information processing program characterized by causing a computer to execute processing . In claim 6 ,
the first data table includes at least a portion of the data contained in the second data table;
An information processing program characterized by: In claim 6 ,
The first data table includes aggregated data obtained by aggregating the data contained in the second data table,
An information processing program characterized by: When a first data table indicating whether or not to anonymize the specific data is accessed with access to the specific data included in the second data table, the first data table is a subordination determination unit that determines whether or not the data table is subordinate to the second data table;
an authority succession unit that succeeds the access authority to the second data table as the access authority to the first data table when the first data table is subordinate to the second data table;
An information processing device characterized by: When access to specific data included in a second data table is accompanied by access to a first data table indicating an attribute of the specific data, the first data table is the second data table. a subordination determination unit that determines whether or not subordination to
an authority succession unit that succeeds the access authority to the second data table as the access authority to the first data table when the first data table is subordinate to the second data table;
An information processing device characterized by: When a first data table indicating whether or not to anonymize the specific data is accessed with access to the specific data included in the second data table, the first data table is determining whether it is dependent on the second data table;
If the first data table is subordinate to the second data table, the access authority to the second data table is inherited as the access authority to the first data table;
An information processing method characterized in that a computer executes processing. When access to specific data included in a second data table is accompanied by access to a first data table indicating an attribute of the specific data, the first data table is the second data table. determine whether it is subordinate to
If the first data table is subordinate to the second data table, the access authority to the second data table is inherited as the access authority to the first data table;
An information processing method characterized in that a computer executes processing .

Images