JP7485455B2 - Secondary use management device, secondary use management method, and program - Google Patents

Description

The present invention relates to a secondary use management device and a secondary use management method, and further to a computer-readable recording medium having recorded thereon a program for realizing these.

In recent years, digital content data has been managed via networks. It is routine to set passwords or access rights for data to prevent unauthorized use of the data. For example, Patent Literature 1 discloses a system that restricts the use of electronic documents by applying a security policy to the electronic document. The system described in Patent Literature 1 is configured to grant usage authority to a user when it receives an application for permission to use an electronic document from the issuer of the electronic document from a user who does not have the usage authority for the electronic document.

Furthermore, Patent Document 2 discloses a system that can promote secondary use while preserving the right to preserve the integrity of a work. Patent Document 3 discloses a system that can promote secondary use while preserving the right to preserve the integrity of a work. Patent Document 4 discloses a system that allows greater freedom in setting the scope of disclosure in a system that allows secondary content created by secondary use of primary content to be made available to the public.

JP 2012-212356 A Japanese Patent Application Laid-Open No. 10-55389 Japanese Patent Application Laid-Open No. 8-227672 JP 2008-262280 A

According to Patent Document 1, it is possible to restrict the free use of electronic documents and manage the distribution of electronic documents. However, in Patent Document 1, when a user generates secondary data using an electronic document for which he has usage authority, even though the secondary data contains the contents of the used electronic document, when the secondary data is used, the used electronic document is also used, which is a problem. The same is true for Patent Document 4. Furthermore, in Patent Documents 2 and 3, it is possible to process the primary content in accordance with the access rights, but it is not possible to set the rights for the completed content, and there is a risk that the completed content will be used freely.

Therefore, an example of an object of the present invention is to provide a secondary use management device, a secondary use management method, and a program that can restrict the secondary use of data.

In order to achieve the above object, a secondary use management device according to one aspect of the present invention comprises:
an access information acquisition unit that acquires access information related to an access right to the first data;
a generating unit that generates an access right to the second data generated by using the first data based on the acquired access information;
a setting unit that sets, in the second data, an access right to the generated second data;
Equipped with.

In order to achieve the above object, a secondary use management method according to one aspect of the present invention includes:
obtaining access information relating to an access right to the first data;
generating an access right to second data generated by utilizing the first data based on the acquired access information;
setting, in the second data, an access right to the generated second data;
Equipped with.

In order to achieve the above object, a program according to one aspect of the present invention comprises:
On the computer,
obtaining access information relating to an access right to the first data;
generating an access right to second data generated by utilizing the first data based on the acquired access information;
setting, in the second data, an access right to the generated second data;
The instruction to execute the command is included.

As described above, the present invention makes it possible to restrict secondary use of data.

FIG. 1 is a diagram for explaining secondary use of data. FIG. 2 is a block diagram showing the configuration of the secondary use management device according to the first embodiment. FIG. 3 is a block diagram showing a specific configuration of the secondary use management device according to the first embodiment. FIG. 4 is a diagram for explaining access rights set to data. FIG. 5 is a flow diagram showing the operation of the secondary use management device of the first embodiment. FIG. 6 is a diagram for explaining access rights set to data in the modified example. FIG. 7 is a diagram for explaining a data distribution state in the second embodiment. FIG. 8 is a block diagram showing a specific configuration of a secondary use management device according to the second embodiment. FIG. 9 is a flow diagram showing the operation of the secondary use management device of the second embodiment. FIG. 10 is a block diagram showing an example of a computer that realizes a secondary use management device according to an embodiment of the present invention.

(Embodiment 1)
The secondary use management device is a device that restricts the secondary use of data. First, the secondary use of data will be described with reference to FIG.

Figure 1 is a diagram for explaining secondary use of data. Figure 1 shows a state in which user A generates data 1, user B generates data 2, user C generates data 3, and user D generates data 4 using data 1, 2, and 3. Data 1 to 4 are digital content, and there is no particular limit to the type. Furthermore, the number of pieces of data used by user D may be just one, for example data 1, or it may be three or more.

In this case, user E's access to data 4 generated by user D is referred to as secondary use of data. Access to data includes viewing and modifying data. User D's sending of data 4 to user E is also referred to as secondary use of data.

The secondary use management device of this embodiment is a device that, when making secondary use of this data, sets access rights based on the access rights of data 1, 2, and 3 for data 4 generated by user D, and permits or denies user E's access to data 4 depending on whether user E has the access rights to data 1, 2, and 3.

[Device configuration]
2 is a block diagram showing the configuration of the secondary use management device 101. The secondary use management device 101 includes an access information acquisition unit 2, a generation unit 3, and a setting unit 4.

The access information acquisition unit 2 acquires access information relating to the access rights to the first data. The first data corresponds to "Data 1, 2, 3" in Figure 1.

The generation unit 3 generates an access right to the second data generated using the first data based on the access information acquired by the access information acquisition unit 2. The second data corresponds to "data 4" in Figure 1.

The setting unit 4 sets access rights to the generated second data in the second data.

The secondary use management device 101 generates access rights to the second data by reflecting the access rights to the first data. Therefore, if a user who attempts to access the generated second data does not have access rights to the first data, the user is denied access to the second data. In this way, the secondary use management device 101 can restrict the secondary use of the first data.

To explain using the example of Figure 1, the secondary use management device 101 generates the access right to data 4 based on the access right to data 1, 2, and 3. If user E has the access right to the first data, user E is able to access data 4. On the other hand, if user E does not have the access right to the first data, user E is denied access to data 4. In this way, the secondary use management device 101 can restrict the secondary use of data 1, 2, and 3.

Next, we will explain in detail the configuration of the secondary use management device 101.

Figure 3 is a block diagram showing the specific configuration of the secondary use management device 101. Figure 4 is a diagram for explaining the access rights set to data. Below, the specific configuration of the secondary use management device 101 will be explained with reference to Figure 4.

In the example shown in Figure 4, user A generates data 1, granting access rights to user D, user E, and user F. User B generates data 2, granting access rights to user D, user E, and user G. User C generates data 3, granting access rights to user D, user E, user F, and user G. Under this premise, Figure 4 shows the state in which user D has generated data 4 using data 1, data 2, and data 3.

The secondary use management device 101 includes an access information acquisition unit 2, a generation unit 3, and a setting unit 4, as well as an authentication unit 5, a determination unit 6, a usage permission unit 7, a data generation unit 8, a change unit 9, a data storage unit 10, an access authority storage unit 11, and a key storage unit 12. In this embodiment, the secondary use management device 101 is described as being connected to a thin client terminal via a network, accepting operations from the thin client terminal, and performing processing according to the accepted operations.

The data storage unit 10 is a storage device that stores data generated by a user. The data storage unit 10 stores encrypted data.

The access authority memory unit 11 is a storage device that stores access information related to the access rights set for the generated data. The access information is information about users who are permitted to access the data.

The key memory unit 12 is a storage device that stores keys used when encrypting data or when decrypting encrypted data.

In addition, the data, access rights and keys may be stored in the same storage device, or in a storage device external to the secondary use management device 101.

The authentication unit 5 authenticates the user who generates the data. When generating data, the user performs a login operation to the secondary use management device 101 from a thin client terminal. The authentication unit 5 performs the login authentication at this time. In the login authentication, the authentication unit 5 refers to user information stored in a storage device provided in the secondary use management device 101 or an external storage device, and authenticates whether the user is allowed to use the secondary use management device 101. The authentication method used by the authentication unit 5 is not particularly limited, and may be password authentication or biometric authentication.

The access information acquisition unit 2 acquires the access information stored in the access authority storage unit 11. When user D declares that he/she will use data 1, 2, and 3, the access information acquisition unit 2 acquires the access information corresponding to the data 1, 2, and 3 from the access authority storage unit 11.

The determination unit 6 determines whether the authenticated user is granted access rights to the data declared for use, based on the access information acquired by the access information acquisition unit 2. When user D declares that he/she will use data 1, 2, and 3, the determination unit 6 determines whether user D has access rights to data 1, 2, and 3.

When a user has the right to access data to be used, the usage permission unit 7 makes the data available. Specifically, data 1, 2, and 3 used by user D are encrypted and stored in the data storage unit 10, and the usage permission unit 7 decrypts the encrypted data 1, 2, and 3.

The usage permission unit 7 has a decryption key acquisition unit 71 and a decryption unit 72.

The decryption key acquisition unit 71 acquires a decryption key. The decryption key acquisition unit 71 acquires from the key memory unit 12 the decryption key to be used to decrypt data 1, 2, and 3 that user D has declared to use.

The decryption unit 72 decrypts the data using the decryption key acquired by the decryption key acquisition unit 71. This allows the user to use the data.

The data generation unit 8 generates data by accepting user operations from the thin client terminal. The data generation unit 8 stores the generated data in the data storage unit 10. At this time, the data generation unit 8 obtains a key associated with the user authenticated by the authentication unit 5 from the key storage unit 12, encrypts the generated data using the obtained key, and stores the data in the data storage unit 10.

The generation unit 3 generates access rights to the data generated by the data generation unit 8 based on the access information acquired by the access information acquisition unit 2. When data 4 is generated using data 1, 2, and 3, the generation unit 3 generates access rights to data 4 by the logical product of the access rights set for each data 1, 2, and 3. Specifically, data 1 is granted access rights to users D, E, and F. Data 2 is granted access rights to users D, E, and G. Data 3 is granted access rights to users D, E, F, and G. The generation unit 3 grants access rights to data 4 to users D and E by the calculation of (D, E, F) ∧ (D, E, G) ∧ (D, E, F, G). As a result, users D and E are permitted to access data 4 generated using data 1, 2, and 3. As shown in FIG. 4, users F and G are denied access to data 4.

The setting unit 4 associates the access rights generated by the generation unit 3 with the generated data and stores them in the access authority memory unit 11.

The modification unit 9 modifies the access rights generated by the generation unit 3. For example, the modification unit 9 revokes the access rights set for data 4 or grants new access rights to data 4 in response to an operation by user D. This allows exceptional management to be performed when data 1, 2, and 3 are used for secondary purposes.

In this embodiment, the secondary use management device 101 generates data in response to user operations from a thin client terminal, but this is not limited to the above. For example, the data may be generated by an external device connected directly to the secondary use management device 101 or via a network.

[Operation description]
Next, the operation of the secondary use management device 101 will be described with reference to Fig. 5. Fig. 5 is a flow diagram showing the operation of the secondary use management device 101. In the following description, the example shown in Fig. 4 will be used for the description. In addition, in the first embodiment, the secondary use management method is implemented by operating the secondary use management device 101. Therefore, the description of the secondary use management method in this embodiment will be replaced with the following description of the operation of the secondary use management device 101.

As a premise, it is assumed that, as shown in Figure 4, data 1, 2, and 3 are stored in the data storage unit 10 of the secondary use management device 101, access information is stored in the access authority storage unit 11, and a key is stored in the key storage unit 12. It is also assumed that user D is attempting to generate data.

Under this premise, when user D logs in to the secondary use management device 101 from a thin client terminal, the authentication unit 5 performs an authentication judgment for user D (S1). If the authentication fails (S1: NO), the secondary use management device 101 ends this process. If the authentication is successful (S1: YES), the secondary use management device 101 judges whether a usage declaration has been accepted by user D (S2). A usage declaration is a declaration by a user that he or she will use data. If a usage declaration has not been accepted (S2: NO), the secondary use management device 101 waits until it is accepted.

When the declaration of use is received (S2: YES), the secondary use management device 101 determines whether the specification of the data to be used has been received (S3). If the specification of the data to be used has not been received (S3: NO), the secondary use management device 101 executes the process of S10 described below.

If the designation of the data to be used is accepted (S3: YES), the secondary use management device 101 executes the processes of S4 to S7 for the accepted data. Here, it is assumed that the secondary use management device 101 accepts the designation of data 1, 2, and 3 shown in FIG.

The secondary use management device 101 executes processes S4 to S7 for each of data 1, 2, and 3. First, the access information acquisition unit 2 acquires access information related to the access rights to data 1 (S4). Next, the determination unit 6 determines whether user D has access rights to data 1 based on the access information (S5).

If user D does not have the access right (S5: NO), the secondary use management device 101 executes the process of S8. If user D has the access right (S5: YES), the usage permission unit 7 decrypts the data 1 (S6). In detail, the decryption key acquisition unit 71 acquires the decryption key from the key storage unit 12, and the decryption unit 72 decrypts the data 1 using the decryption key.

The generating unit 3 generates an access right to be set to the generated data 4 based on the acquired access information (S7). In the first embodiment, the generating unit 3 calculates the logical product of the access information each time the generating unit 3 acquires the access information to generate the access right. For example, when the generating unit 3 acquires the access information of data 1 (access rights are granted to users D, E, and F) in the first execution of S7, and acquires the access information of data 2 (access rights are granted to users D, E, and G) in the second execution of S7, it performs the operation (D, E, F) ∧ (D, E, G). Next, when the generating unit 3 acquires the access information of data 3 (access rights are granted to users D, E, F, and G) in the third execution of S7, it performs the operation (D, E) ∧ (D, E, F, G). As a result, the generating unit 3 generates an access right that allows users D and E to access data 4.

The secondary use management device 101 determines whether the processes S4 to S7 have been executed for all of the data 1, 2, and 3 specified in S3 (S8). If the processes have not been executed for all of the data 1, 2, and 3 (S8: NO), the secondary use management device 101 executes the processes again from S4.

If the processes of S4 to S7 have been executed for all of data 1, 2, and 3 (S8: YES), the data generation unit 8 generates data 4 according to the operation of user D and stores it in the data storage unit 10 (S9). At this time, the data generation unit 8 obtains a key associated with the user authenticated in S1 from the key storage unit 12, encrypts the data using the key, and stores it in the data storage unit 10.

It is determined whether a termination declaration has been received from user D (S10). A termination declaration is a declaration that user D will terminate the use of data. If a termination declaration has not been received (S10: NO), the secondary use management device 101 returns to the processing of S3. If a termination declaration is received (S10: YES), the setting unit 4 sets the access rights to the data 4 by storing the access information related to the access rights generated in S7 in the access authority storage unit 11 in association with the data 4 generated by user D (S11). This ends the processing.

Note that after data 4 has been generated and access rights have been set, if user D stops using any of data 1, 2, or 3 and regenerates the data, the generation unit 3 will regenerate the access rights. For example, if the use of data 2 is stopped, the generation unit 3 will generate new access rights that allow users D, E, and F to access the data generated using data 1 and 3. In this way, dynamic generation of access rights is possible.

[Effects of the First Embodiment]
The secondary use management device 101 configured as above can restrict the secondary use of data used when generating data. In the case of Fig. 4, data 4 generated by user D is set with access rights reflecting the access rights for data 1, 2, and 3. As a result, for example, if user B does not want user F to access (view, use) data 2 generated by user B, user B can deny user F access to data 4 generated using data 2. In this way, the secondary use of data 1, 2, and 3 is restricted.

[program]
The program in the first embodiment may be a program that causes a computer to execute steps S1 to S11 shown in Fig. 5. By installing and executing this program in a computer, the secondary use management device 101 and the secondary use management method in the present embodiment can be realized. In this case, the processor of the computer also functions as the access information acquisition unit 2, the generation unit 3, the setting unit 4, the authentication unit 5, the determination unit 6, the usage permission unit 7, the data generation unit 8, and the change unit 9, and performs processing.

In addition, the program in the first embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the access information acquisition unit 2, the generation unit 3, the setting unit 4, the authentication unit 5, the determination unit 6, the usage permission unit 7, the data generation unit 8, and the change unit 9.

[Modification]
In the present embodiment, the access information has been described as information about users who are permitted to access data, but is not limited thereto. The access information may be information about users who are denied access to data.

Figure 6 is a diagram illustrating the access rights set to data in a modified example.

In this example, user A creates data 1, denying access to user E and granting access rights to other users. User B creates data 2, denying access to user F and granting access rights to other users. User C creates data 3, granting access rights to all users.

When generating an access right for the generated data, the generation unit 3 calculates the logical product of the access information to generate an access right that permits access, as described above. On the other hand, to generate a denial authority that denies access, the generation unit 3 calculates the logical sum of the access information. In the case of Fig. 6, the generation unit 3 generates an access right that denies access to users E and F and permits access to other users. As a result, as shown in Fig. 6, users E and F are denied access to data 4, and user G is permitted to access data 4. Note that when an access right that permits access and a denial authority that denies access are generated, the denial authority that denies access is applied preferentially.

According to this variant, it is only necessary to specify only those users to whom access should be denied, making it easier to set up access when generating data 1, 2, and 3 when there are a large number of users.

(Embodiment 2)
Next, a secondary use management device, a secondary use management method, and a program according to a second embodiment of the present invention will be described with reference to FIGS.

In this embodiment, when a user uses data to generate data and sends it to another user, the data is regenerated based on the access rights to the data used for generation, and the regenerated data is sent. This point will be described in detail below, and the description of the same configuration as in embodiment 1 will be omitted.

First, we will explain the distribution of data in this embodiment. Figure 7 is a diagram for explaining the data distribution state in embodiment 2.

In FIG. 7, user A generates data 1, granting access rights to users D, E, and F. User B generates data 2, granting access rights to users D and F. User C generates data 3, granting access rights to users D, E, and F. User D generates data 4 using data 1, 2, and 3. Data 4 is generated by the method described in embodiment 1. Data 4 has access rights set that allow access by users D and F.

Based on this premise, in this embodiment, user D sends the generated data 4 to user E. User E does not have access rights to data 4. Therefore, of the data 1, 2, and 3 used to generate data 4, data 5 is generated again using data 1 and 3 to which user E has access rights. The regenerated data 5 is transmitted from user D to user E.

Furthermore, user E sends data 5 to user F. User F has access rights to data 4 to be sent to user E. Data 6 is then generated again using data 1, 2, and 3 that were used to generate data 4. This data 6 is considered to be the same as data 4. The regenerated data 6 is then transmitted from user E to user F.

In this manner, in this embodiment, when data 4 generated using data 1, 2, and 3 is distributed to user E who does not have access to data 2, data 5 is generated and distributed with data 2 removed. Thereafter, when data 5 is distributed to user F who has access to data 2, data 6 is generated and distributed with the removed data 2 again included. In this way, even if user E, to whom user B wishes to deny access to data 2, is present in the middle of the data distribution, data 6 including data 2 can be distributed to user F.

[Device configuration]
FIG. 8 is a block diagram showing a specific configuration of the secondary use management device 102.

The secondary use management device 102 includes a transmission determination unit 13 and a transmission unit 14 in addition to the units described in the secondary use management device 101 of Fig. 3. In the following explanation, the example shown in Fig. 7 will be used.

The transmission determination unit 13 determines whether the user to whom data is to be sent has access rights to the data. For example, when user D sends data 4 to user E, the transmission determination unit 13 determines whether user E has access rights to data 4. When user E sends data 5 to user F, the transmission determination unit 13 determines whether user F has access rights to data 5.

The transmission determination unit 13 also determines whether the data to be transmitted is regenerated data. The regenerated data is data 5 and 6 described in FIG. 7.

The data generation unit 8 generates data (third data) by using data to which the destination user has access rights, among the data used to generate the data to be sent. In the example of Figure 7, when user D sends data 4 to user E, the data generation unit 8 generates data 5 by using data 1 and 3 to which user E has access rights, among the data 1, 2, and 3 used to generate data 4.

Furthermore, when the data to be transmitted is regenerated data, the data generation unit 8 generates the data by using, of the data used for the data that was originally to be transmitted, data to which the destination user has access rights. When user E transmits data 5 to user F, the data generation unit 8 generates data 6 by using, of the data 1, 2, and 3 used to generate data 4, data 1, 2, and 3 to which user F has access rights.

The generation unit 3 generates the access right to the regenerated data based on the access right to the data used for the generation. The generation unit 3 generates the access right to data 5 based on the access rights to data 1 and 3. The generation unit 3 also generates the access right to data 6 based on the access rights to data 1, 2, and 3.

The transmission unit 14 transmits specified data to a specified user in accordance with user operation from the thin client terminal. When transmitting data, if the data generation unit 8 regenerates the data, the transmission unit 14 transmits the regenerated data instead of the data specified for transmission. When user D transmits data 4 to user E, the transmission unit 14 transmits data 5 generated by the data generation unit 8 instead of data 4. When user E transmits data 5 to user F, the transmission unit 14 transmits data 6 generated by the data generation unit 8 instead of data 5.

[Device Operation]
Next, the operation of the secondary use management device 102 in this embodiment will be described with reference to Fig. 9. Fig. 9 is a flow diagram showing the operation of the secondary use management device 102. In this embodiment, the secondary use management method is implemented by operating the secondary use management device 102. Therefore, the explanation of the secondary use management method in this embodiment will be replaced with the explanation of the operation of the secondary use management device 102 below.

Figure 9 shows the operation of the secondary use management device 102 when distributing data generated by using multiple data.

When the secondary use management device 102 receives an instruction to transmit data from a user, the transmission determination unit 13 determines whether the specified data to be transmitted (hereinafter referred to as transmission data) is regenerated data (hereinafter referred to as regenerated data) (S21). If the data is not regenerated data (S21: NO), the transmission determination unit 13 determines whether the destination user has access rights to the transmitted data (S22). For example, when user D transmits data 4 to user E, in S21 it is determined whether data 4 is regenerated data, and in S22 it is determined whether user E has access rights to data 4.

If the destination user has the access right to the transmission data (S22: YES), the transmission unit 14 transmits the specified transmission data (S25). If the destination user does not have the access right to the transmission data (S22: NO), the data generation unit 8 regenerates the regenerated data by using the data 1, 2, and 3 used to generate the specified transmission data to which the destination user has the access right (S23). Then, the transmission unit 14 transmits the regenerated data to the destination user instead of the transmission data (S24). For example, when user D transmits data 4 to user E, if user E has the access right to data 4, data 4 is transmitted to user E. On the other hand, if user E does not have the access right to data 4, data 5 generated by using data 1 and 3 to which user E has the access right among data 1, 2, and 3 used to generate data 4 is transmitted to user E.

In S21, if the transmission data is regenerated data (S21: YES), the data generation unit 8 regenerates the regenerated data using data 1, 2, and 3 that was used to generate the data that was originally to be transmitted and that the destination user has access to, which was specified when the data distribution started (S23). Then, the transmission unit 14 transmits the regenerated data to the destination user instead of the transmission data (S24). For example, when user E transmits data 5 to user F, data 5 is regenerated data, so data 6 is transmitted, which was generated using data 1, 2, and 3 that user F has access to, which was used to generate data 4 that was originally to be transmitted.

[Effects of the second embodiment]
In this embodiment, when data is generated using multiple data and the generated data is distributed, even if a user who does not have access rights to some of the data used is present during the distribution, the distribution of the data can be prevented from being blocked.

[program]
The program in the second embodiment may be a program that causes a computer to execute each step shown in Fig. 9. By installing and executing this program in a computer, the secondary use management device 102 and the secondary use management method in the second embodiment can be realized. In this case, the processor of the computer functions as the access information acquisition unit 2, the generation unit 3, the setting unit 4, the authentication unit 5, the judgment unit 6, the use permission unit 7, the data generation unit 8, the change unit 9, the transmission judgment unit 13, and the transmission unit 14, and performs processing.

The program in the second embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the access information acquisition unit 2, the generation unit 3, the setting unit 4, the authentication unit 5, the judgment unit 6, the usage permission unit 7, the data generation unit 8, the change unit 9, the transmission judgment unit 13, and the transmission unit 14.

(Physical configuration)
Here, a computer that realizes the secondary use management device by executing the program in the first and second embodiments will be described with reference to Fig. 10. Fig. 10 is a block diagram showing an example of a computer that realizes the secondary use management device in the first and second embodiments of the present invention.

10, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader/writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other. Note that the computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to or instead of the CPU 111.

The CPU 111 expands the code groups constituting the programs in the first and second embodiments stored in the storage device 113 into the main memory 112 and executes the codes in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). The programs in the first and second embodiments are provided in a state stored in a computer-readable recording medium 120. The programs in the first and second embodiments may be distributed over the Internet connected via the communication interface 117.

Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

The data reader/writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads programs from the recording medium 120, and writes the results of processing in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and other computers.

Specific examples of recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

The secondary use management device in the embodiment can be realized not by a computer on which a program is installed, but by using hardware corresponding to each part. Furthermore, the secondary use management device may be realized in part by a program and the remaining part by hardware.

The configurations of the above-mentioned embodiments 1 and 2 can be combined as appropriate. In addition, some or all of the above-mentioned embodiments 1 and 2 can be expressed by (Appendix 1) to (Appendix 27) described below, but are not limited to the following descriptions.

(Appendix 1)
an access information acquisition unit that acquires access information related to an access right to the first data;
a generating unit that generates an access right to the second data generated by using the first data based on the access information;
a setting unit that sets, in the second data, an access right to the generated second data;
A secondary use management device comprising:

(Appendix 2)
2. The secondary use management device according to claim 1,
an authentication unit that authenticates a first user who uses the first data;
a determination unit that determines whether the authenticated first user is allowed to access the first data based on the access information;
a usage permission unit that allows the first data to be used when it is determined that the first data is accessible;
A secondary use management device comprising:

(Appendix 3)
3. The secondary use management device according to claim 2,
The first data is encrypted;
The usage permission unit,
a decryption key acquisition unit for acquiring a decryption key;
a decryption unit that decrypts the first data by using the acquired decryption key;
A secondary use management device having the above configuration.

(Appendix 4)
4. A secondary use management device according to claim 1,
a modification unit that modifies the access right generated by the generation unit;
Further equipped with
The setting unit sets the access right changed by the change unit to the second data.
Secondary use management device.

(Appendix 5)
5. A secondary use management device according to claim 1,
The second data is generated by using a plurality of the first data,
the access information acquisition unit acquires the access information for each of the plurality of first data;
the generating unit generates an access right to the second data based on all of the acquired access information.
Secondary use management device.

(Appendix 6)
6. The secondary use management device according to claim 5,
a data generating unit that generates third data by using the first data;
a transmission unit that transmits the second data or the third data to a second user;
Equipped with
The generation unit generates an access right to the third data based on the access information.
Secondary use management device.

(Appendix 7)
7. The secondary use management device according to claim 6,
a transmission determination unit that determines whether the second user is allowed to access the second data;
Equipped with
the data generation unit generates the third data when the second user is not able to access the second data;
When the third data is generated, the transmission unit transmits the third data to the second user.
Secondary use management device.

(Appendix 8)
8. A secondary use management device according to claim 1,
The access information is information about a user who is permitted to access the first data.
Secondary use management device.

(Appendix 9)
9. A secondary use management device according to any one of claims 1 to 8,
The access information is information about a user who is denied access to the first data.
Secondary use management device.

(Appendix 10)
obtaining access information relating to an access right to the first data;
generating an access right to second data generated by utilizing the first data based on the acquired access information;
setting, in the second data, an access right to the generated second data;
A secondary use management method comprising:

(Appendix 11)
11. The secondary use management method according to claim 10,
authenticating a first user who uses the first data;
determining whether the authenticated first user is allowed to access the first data based on the access information;
making the first data available if it is determined that the first data is accessible;
A secondary use management method comprising:

(Appendix 12)
12. The secondary use management method according to claim 11,
The first data is encrypted;
The step of making the first data available includes:
obtaining a decryption key;
decrypting the first data using the obtained decryption key;
A method for managing secondary use, including:

(Appendix 13)
13. The secondary use management method according to claim 10, further comprising:
modifying the generated access rights;
Equipped with
In the step of setting an access right to the second data,
setting the changed access right to the second data;
Secondary use management methods.

(Appendix 14)
14. A secondary use management method according to any one of claims 10 to 13, comprising:
The second data is generated by using a plurality of the first data,
When acquiring the access information, acquiring the access information for each of the plurality of first data;
generating an access right to the second data based on all of the acquired access information;
The secondary use management method includes:

(Appendix 15)
15. The secondary use management method according to claim 14,
generating third data using the first data;
transmitting the second data or the third data to a second user;
the generating unit generating an access right to the third data based on the access information;
The secondary use management method includes:

(Appendix 16)
16. The secondary use management method according to claim 15,
determining whether the second user is allowed to access the second data;
Equipped with
In the step of generating the third data, if the second user is not able to access the second data, the third data is generated;
In the step of transmitting the second data or the third data, when the third data is generated, the third data is transmitted to the second user.

(Appendix 17)
17. A secondary use management method according to any one of claims 10 to 16, comprising:
The access information is information about a user who is permitted to access the first data.
Secondary use management methods.

(Appendix 18)
18. A secondary use management method according to any one of claims 10 to 17,
The access information is information about a user who is denied access to the first data.
Secondary use management methods.

(Appendix 19)
On the computer,
obtaining access information relating to an access right to the first data;
generating an access right to second data generated by utilizing the first data based on the acquired access information;
setting, in the second data, an access right to the generated second data;
A program that contains instructions to execute a program.

(Appendix 20)
20. The program of claim 19,
A step of authenticating a first user who uses the second data to the computer;
determining whether the authenticated first user is allowed to access the first data based on the access information;
making the first data available if it is determined that the first data is accessible;
A program that contains instructions to execute a program.

(Appendix 21)
21. The program of claim 20,
The first data is encrypted;
The step of making the first data available includes:
obtaining a decryption key;
decrypting the first data using the obtained decryption key;
Including, the program .

(Appendix 22)
22. The program according to any one of Supplementary Note 19 to Supplementary Note 21,
The computer includes:
modifying the generated access rights;
[0023]
In the step of setting an access right to the second data,
setting the changed access right to the second data;
program .

(Appendix 23)
23. The program according to claim 19, further comprising:
The second data is generated by using a plurality of the first data,
The computer includes:
When the access information is acquired, the access information is acquired for each of the plurality of first data;
generating an access right to the second data based on all of the acquired access information;
A program that contains instructions to execute a program.

(Appendix 24)
24. The program according to claim 23,
causing the computer to generate third data using the first data;
transmitting the second data or the third data to a second user;
generating an access right to the third data based on the access information;
A program that contains instructions to execute a program.

(Appendix 25)
25. The program according to claim 24,
The computer includes:
determining whether the second user is allowed to access the second data;
[0023]
In the step of generating the third data, if the second user is not able to access the second data, the third data is generated;
In the step of transmitting the second data or the third data, when the third data is generated, the third data is transmitted to the second user.
program .

(Appendix 26)
26. The program according to any one of claims 19 to 25,
The access information is information about a user who is permitted to access the first data.
program .

(Appendix 27)
27. The program according to claim 19, further comprising:
The access information is information about a user who is denied access to the first data.
program .

Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

This application claims priority based on Japanese Patent Application No. 2020-034016, filed on February 28, 2020, the disclosure of which is incorporated herein in its entirety.

2 Access information acquisition unit 3 Generation unit 4 Setting unit 5 Authentication unit 6 Judgment unit 7 Utilization permission unit 8 Data generation unit 9 Change unit 10 Data storage unit 11 Access authority storage unit 12 Key storage unit 13 Transmission judgment unit 14 Transmission unit 71 Decryption key acquisition unit 72 Decryption unit 101 Secondary use management device 102 Secondary use management device 110 Computer 111 CPU
112 Main memory 113 Storage device 114 Input interface 115 Display controller 116 Data reader/writer 117 Communication interface 118 Input device 119 Display device 120 Recording medium 121 Bus

Claims (24)

an access information acquiring means for acquiring access information related to an access right to each of the plurality of first data ;
a generating means for generating an access right to a second data set generated by using a plurality of the first data sets based on the access information;
a setting means for setting, in the second data, an access right to the generated second data;
Equipped with
the generating means obtains a logical product of the access rights in all of the acquired access information, generates an access right to the second data from the obtained logical product, and further obtains a logical sum of the access rights, and generates a denial authority to the second data from the obtained logical sum .
Secondary use management device. The secondary use management device according to claim 1,
an authentication means for authenticating a first user who uses the first data;
a determination means for determining whether the authenticated first user is allowed to access the first data based on the access information;
a usage permission means for allowing the first data to be used when the first data is determined to be accessible;
A secondary use management device comprising: The secondary use management device according to claim 2,
The first data is encrypted;
The usage permission means is
A decryption key acquisition means for acquiring a decryption key;
a decryption means for decrypting the first data by using the acquired decryption key;
A secondary use management device having the above configuration. The secondary use management device according to claim 1,
a modification means for modifying the access right generated by the generation means;
Further equipped with
the setting means sets the access right changed by the changing means to the second data.
Secondary use management device. The secondary use management device according to claim 1,
a data generating means for generating third data by utilizing the first data;
a transmitting means for transmitting the second data or the third data to a second user;
Equipped with
The generating means generates an access right to the third data based on the access information.
Secondary use management device. The secondary use management device according to claim 5,
a transmission determination means for determining whether the second user is allowed to access the second data;
Equipped with
the data generating means generates the third data when the second user is not able to access the second data;
When the third data is generated, the transmitting means transmits the third data to the second user.
Secondary use management device. The secondary use management device according to claim 1,
The access information is information about a user who is permitted to access the first data.
Secondary use management device. The secondary use management device according to claim 1,
The access information is information about a user who is denied access to the first data.
Secondary use management device. 1. A computer-implemented method comprising:
acquiring access information related to an access right to each of the plurality of first data items;
generating an access right to a second data set generated by utilizing a plurality of the first data sets based on the acquired access information;
setting an access right to the generated second data in the second data;
In generating the access right to the second data , a logical product of the access rights in all of the acquired access information is obtained, and an access right to the second data is generated from the obtained logical product ; and further, a logical sum of the access rights is obtained, and a denial right to the second data is generated from the obtained logical sum .
Secondary use management methods. The secondary use management method according to claim 9,
authenticating a first user who uses the first data;
determining whether the authenticated first user is allowed to access the first data based on the access information;
If it is determined that the first data is accessible, the first data is made available.
Secondary use management methods. The secondary use management method according to claim 10,
The first data is encrypted;
When making the first data available,
Get the decryption key,
decrypting the first data using the obtained decryption key;
Secondary use management methods. The secondary use management method according to claim 9,
Modifying the generated access rights;
When setting an access right to the second data,
setting the changed access right to the second data;
Secondary use management methods. The secondary use management method according to claim 9,
generating third data using the first data;
Transmitting the second data or the third data to a second user;
When generating the access right, the access right to the third data is generated based on the access information.
The secondary use management method includes: The secondary use management method according to claim 13,
determining whether the second user is allowed to access the second data;
When generating the third data, if the second user does not have access to the second data, generate the third data;
In the case of transmitting the second data or the third data, when the third data is generated, the third data is transmitted to the second user.
Secondary use management methods. The secondary use management method according to claim 9,
The access information is information about a user who is permitted to access the first data.
Secondary use management methods. The secondary use management method according to claim 9,
The access information is information about a user who is denied access to the first data.
Secondary use management methods. On the computer,
obtaining access information related to an access right to each of the plurality of first data items;
generating an access right to a second data set based on the plurality of first data sets based on the acquired access information;
setting an access right to the generated second data in the second data;
Includes instructions,
In generating the access right to the second data , a logical product of the access rights in all of the acquired access information is obtained, and an access right to the second data is generated from the obtained logical product ; and further, a logical sum of the access rights is obtained, and a denial right to the second data is generated from the obtained logical sum .
program. 18. The program of claim 17,
having the computer authenticate a first user who uses the second data;
determining whether the authenticated first user is allowed to access the first data based on the access information;
If it is determined that the first data is accessible, making the first data available.
A program containing instructions. 20. The program of claim 18,
The first data is encrypted;
When making the first data available,
Get the decryption key,
decrypting the first data using the obtained decryption key;
program. 18. The program of claim 17,
The computer includes:
Modifying the generated access rights;
Includes instructions,
When the access right to the second data is set, the changed access right is set to the second data.
program. 18. The program of claim 17,
causing the computer to generate third data using the first data;
transmitting the second data or the third data to a second user;
generating an access right to the third data based on the access information;
A program containing instructions. 22. The program of claim 21,
The computer includes:
determining whether the second user is allowed to access the second data;
Includes instructions,
When the third data is generated, if the second user is not able to access the second data, the third data is generated;
In the case where the second data or the third data is to be transmitted, when the third data is generated, the third data is transmitted to the second user.
program. 18. The program of claim 17,
The access information is information about a user who is permitted to access the first data.
program. 18. The program of claim 17,
The access information is information about a user who is denied access to the first data.
program.

Images