JPH06110762A - Method and device for controlling information access - Google Patents

Abstract

PURPOSE:To provide information access control method and device where a loss caused by the mutual user information leakage minimized even if the multiple indirect leakage routes of information exist and the utilization of a database system is enhanced. CONSTITUTION:An information access controller 8, through the use of a transmission route judging equiopment 16, retrieves an information transmission route at every required two users within the plural users from access permission request information and security information transmitted by respective terminals 11, selects the route where the gains of the both users are balanced from the retrieved routes through the use of a selecting equipment 14, permits the dismissal of information writing, which is caused by the indirect leakage route, to be mitigated, controls an information storing device 9 so as to permit information designated by security information to be followed and reduces the loss caused by the mutual indirect leakage routes of the two users.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and apparatus for controlling information access to a database system in which a plurality of users read and write information in an information storage means such as a memory or a magnetic storage device.

[0002]

2. Description of the Related Art Various database systems have been constructed in which a plurality of users can write and read required information to and from a predetermined information storage means via a terminal such as a computer to exchange information with each other. In some cases, a security system that prevents information leakage may be important. For example, a database system for sharing a part of customer information owned by a plurality of banks is often used by a plurality of banks, and a user who allows access to the information written in the information storage means is specified. There is a need. Therefore, conventionally, each time each user makes a request to read desired information from the information storage means, it is determined whether or not to read the information as requested, that is, by checking the so-called access authority, the information owned by each user is stored. It is general to provide an information access control device for controlling the information storage means so as to prevent leakage to a third party.

Conventionally, such a database system has an information storage device 1 for storing information of users s1 to s4 and an information access control device 2 in a center 3 as shown in FIG. The information access control device 2 is provided with an S-O matrix creation determining unit 6 connected to the terminals 4, 4, ... Used by each user, and the input / output of the information storage device 1 is provided. The end is S-O
It was connected to the input / output terminal of each terminal 4 via the matrix creation determination unit 6.

In this database system, the users s1 to s4 each send access permission request information indicating that they desire to access the information of the required file name to the information storage device 1 via the terminal 4 to the S / O matrix creation judging device. 6 and the S-O matrix creation decision unit 6 based on the result, for example, the following equation (1)

[Equation 1] The S-O determinant as shown in (1) is created and stored in the evaluation file. Here, O1 of the S-O determinant (1)
The symbol rw in the row s1 column is for the user s1 to read and write the information of the file name O1, and the symbol r in the row O1 and the column s2 is for the user s2 to read the information of the file name O1 and O.
The symbol w in the 3rd row and s3th column represents the access permission request information indicating that the user s3 wished to write the information of the file name O3, and the other symbols also represent the same access permission request information.

In the database system configured as described above, when each user requests access, an instruction sequence representing the user's own user name, the file name desired to be accessed, and the distinction between reading and writing is sent via the terminal 4 through the S- When it is transmitted to the O-matrix creation determiner 6, if the symbol r or w corresponding to the supporting sequence is written in the S-O determinant (1) by the S-O determinant creation determiner 6. limit,
By controlling the information storage device 1 so as to permit the information access request of each user, a plurality of users can exchange information with each other.

[0006] Further, if this is left as it is, there is an inconvenience that information is accessed by users who do not want it. Therefore, when the access permission request information is transmitted from each user, for example, a file that the user s1 wishes to write. The security information indicating that only the specific users s1 and s2 are allowed to access the information of the name O1 is transmitted, and the user S3 who is not permitted to access the information of the file name O1 requests the security information based on the security information.
-The symbol r in the O1 row and s3 column of the O determinant (1) is deleted, and the following equation (2) is newly added.

[Equation 2] By changing to the S-O determinant as shown in (4), information access to unwanted users was prevented.

However, even if the third party's access to the information of a specific user is restricted on the basis of the security information of each user, information leakage will occur indirectly.
For example, even if the S-O determinant (2) is used as described above, after the user s2 reads the information of the file name O1, this information can be accessed by the file name O of the user s2.
When written as 2, the user s3 who is not allowed to access the information of the file name O1 has the file name O2.
The file name O1 is indirectly read by reading
Information can be read. Therefore, information exchange between users cannot be completely limited to a specific user, and each user suffers damage due to indirect leakage of information depending on access permission request information and security information of other users. There was a problem to say.

Therefore, in recent years, a database system using an information access control device capable of reliably preventing the indirect leakage of information as described above has been proposed. That is, this database system connects the route information creation determiner 7 between the information storage device 1 and the SO matrix creation determiner 6 as shown in FIG. The first user who connects the end to the evaluation file 5 and uses the path information creation / determination unit 7 to read the information of the file name that one of the users wishes to write, the first user Any one of the second user who has permitted the reading of the information of the file name that the user wishes to write, ..., The same third user, ..., And the nth user is the file name that the user desired. In the case of a user who is not allowed to access the above information, it is judged that the indirect leakage of information as described above will occur,
An information writing request corresponding to the monitoring pointer information stored in the evaluation file 5 by each user is stored in the evaluation file 5 by storing a monitoring pointer indicating that the writing of the information is prohibited in the evaluation file 5. If you do
By controlling the information storage device 1 so as to prohibit this request, indirect leakage of information can be surely prevented.

However, in such an information access control device, since the above-mentioned indirect leakage of information occurs according to the access permission request information and security information of each user, when there are many such leakage paths. All the write requests for the information corresponding to the leakage were rejected, and there was a new problem that each user could hardly use the database system.

[0010]

SUMMARY OF THE INVENTION The present invention has been made in order to solve the problems of the conventional information access control apparatus as described above. Even if there are many indirect leak paths of information, the mutual information of users is An object of the present invention is to provide an information access control method and device capable of minimizing the damage caused by leakage and enhancing the utilization of the database system.

[0011]

SUMMARY OF THE INVENTION In order to achieve the above object, the information access control method of the present invention includes access permission request information indicating that each of a plurality of users desires to access required information to the information storage means, and the above-mentioned desired information. A first user who is permitted to read information written by one of two users of the plurality of users based on security information indicating that a specific user is permitted to access the information; The second user permitted to read the information written by one user, ..., The (n-1) user permitted to read the information written by the (n-2) user, and the (n-1) ) There is one of the nth users who is permitted to read the information written by the user, and the other of the two users is permitted to access the information written by any of the users. If it is determined that the information written by one of the two users is indirectly transmitted to the other, the route indirectly connecting the two users is used as a transmission route among the plurality of users. Of the required two users are obtained for each combination of the transmission paths that form a pair that bidirectionally connects the required two users. The information storage means is controlled so that the user can make a judgment, and the reading or writing by the required user is prohibited so that the information does not follow the transmission path other than the transmission path where the interests and benefits are balanced. Further, the information access control device of the present invention allows access to a specific user to the desired information, and access permission request information indicating that each of a plurality of users desires to access required information to the information storage means. A first user permitted to read information written by one of two users of the plurality of users based on security information indicating permission, and a permission of reading information written by the first user. The second user, ..., Allowed to read the information written by the (n-2) user, and the read of the information written by the (n-1) user. If any one of the n-th users who have been accessed exists and the other of the two users is permitted to access the information written by the one of the two users, the two users can be accessed. It is determined that the information written by one of the users is indirectly transmitted to the other, and the required two users of the plurality of users are bidirectionally set using the route indirectly connecting the two users as a transmission route. Means for obtaining a pair of transmission paths to be connected for each combination of users, and means for allowing the two users to judge the profit and loss of each of the required two users when the obtained transmission path pair is selected, And a means for controlling the information storage means so as to prohibit reading or writing by a required user so that the information does not follow any transmission path other than the transmission path where the interests and benefits are balanced.

[0012]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below in detail based on the embodiments shown in the drawings. FIG. 1 is a block diagram showing an embodiment in which an information access control device according to the present invention is applied to a database system. In the figure, 8 is an information access control device according to the present invention, which is provided with a data access control device 8 and an information storage device 9 for storing information of users s1 to s6 in a center 10 of a database system, The external input terminals of the center 10 are connected to the users s1 to s6.
The information access control device 8 is connected to the terminals 11, 11, ... Used by each and the evaluation file 12 is connected to the controller 13, the selector 14, the payment queue creator 15,
The transfer path determiner 16 and the S-O matrix creation determiner 17 are provided, and the input / output ends of the controller 13, the payment matrix creator 15 and the S-O matrix creation determiner 17 are connected to the input / output ends of the plurality of terminals 11. Further, the other input / output terminals of the controller 13 are connected to the information storage device 9, respectively.

The database system configured as described above controls and operates as follows. First, prior to the operation of this database system, as in the above-described conventional information access control device, the SO matrix creation / determination unit 17 is used.
Causes the terminal 11 of each of the users s1 to s6 to transmit the access permission request information and the security information, and based on the access request information and the security information, access of the information of the file name that each user wants to write is performed by each user. The following formula (3) that can be limited to specific users according to their interests

[Equation 3] Create an S-O determinant as shown in. Where S-O
In the determinant (3), only the users s2 and s3 have security information, that is, the user s2 reads the file name O1 to the users s1 and s2, and the user s3 has the file name O2.
7 shows a case in which security information indicating that the reading of is limited to the users s3 and s4 is transmitted.

Next, the information access control device 8 refers to the S-O determinant (3) stored in the evaluation file 12 by using the transmission route judgment device 16, and the users s2 and s3 who have transmitted the security information. And a path for indirectly transmitting the information of the file names O1 and O2 to and from each other via other users, as will be described later,
The transmission route information representing the route is stored in the evaluation file 12. That is, the transmission path determiner 16 uses the following equation (4)

[Equation 4] As indicated by the arrow, the user s1 who has permitted the reading of the information of the file name O1 that the user s2 desires to write.
Exists and the user s1 permits the user s3 to read the information of the file name O3 that the user s1 wishes to write, the information of the file name O1 is indirectly transmitted from the user s2 to s3 through the user s1. Presence of a route Rg1 to be detected, and a sequence O1 {s2 representing the route is detected.
(Rw), s1 (r), s3 (r)} is the transfer path information g
The evaluation file 12 is stored as 1. Similarly, the transmission path determiner 16 uses the following equation (5).

[Equation 5] The information of the file name O1 as shown by the arrow in FIG.
From s3 to s3 via the users s1 and s5, the sequence O1 {s2 (rw), s1 representing the route Rg2.
(R), s5 (r), s3 (r)} is the transfer path information g2
Also, the following equation (6)

[Equation 6] Next to the file name O2 as indicated by the arrow in FIG.
Route s indirectly transmitted from user to s2 via user s4
Sequence O2 representing h1 {(s3 (rw), s4 (r),
Using s2 (r)} as the transfer route information h1, the following equation (7)

[Equation 7] The information of the file name O2 as indicated by the arrow in FIG.
Sequence s2 (s3 (rw), s4) representing a route Rh2 that is indirectly transmitted from s2 to s2 via users s4 and s6.
(R), s6 (r), s2 (r)} is the transfer route information h2
Are stored in the evaluation file 12, respectively.

Further, the information access control device 8 uses the payment matrix creator 15 to inform the users s2 and s3 of the existence of the routes Rg1, Rg2, Rh1 and Rh2 via the terminal 11, respectively, and to select any of these routes. The payout matrix creator 15 determines the gain (profit or loss value) when each of the users s2 and s3 selects it through the terminal 11 from each of the users.
To generate a payment matrix as described later and store it in the evaluation file 12. Here, the gain for each user means, for example, that the users s2 and s3 each have a higher probability of information being read by a user other than the specific user as the number of users passing through the route to be selected increases. In addition to determining that the profit value will increase, the smaller the number of users that the other user transits along the route that should be selected, the higher the probability that the other user's information can be read, and the profit value will be determined to increase. It is a value obtained by subtracting the loss value. In this case, the payment matrix creator 15 uses the following equation (8).

[Equation 8] A payment matrix Ps2 as shown in FIG.

[Equation 9] The payment matrix Ps3 as shown in (3) is created for the user s3, and these payment matrices are stored in the evaluation file 12.

Further, the information access control device 8 includes the selector 1
4, the payment matrices Ps2 and Ps3 stored in the evaluation file 12 are referred to, and as will be described later, a path in which mutual gains are balanced for each of the users s2 and s3 is selected and the path is selected. Is stored in the evaluation file 12 as the equilibrium point information.
That is, when the mutual profit values are written like the value 1 in the g1 row and the h1 column of each of the payment determinants Ps2 and Ps3, the selector 14 transmits the transmission path information indicated by the row name and the column name. g1 and h1 are the equilibrium point information Cg1 and Ch, respectively.
The evaluation file 12 is stored as 1. The above is the preparatory process before operating the database system.

In the state where the above-mentioned preparation process is completed, a support sequence indicating that each user requests the information storage device 9 to write the information of the desired file name to the controller 13 via the terminal 11. When sent, the user name and file name included in the support sequence will be evaluated file 1
If it is included in the equilibrium point information stored in 2, even if the information of the file name is transmitted to a third party via the leakage route due to the writing of the above-mentioned information, The information storage device 9 is used by using the controller 13 so as to allow writing of the information of the file name requested by the user.
To control. Considering the case where the user s2 requests writing of information of the file name O1 in the example shown in FIG. 1, the equilibrium point information C is stored in the evaluation file 12 as described above.
g1 = O1 {s2 (rw), s1 (r), s3 (r)}
Is stored, and the user name s2 with the symbol w attached to the file name O1 exists in the information, the user s2
Of the history information Pg1.
= (S2) and the equilibrium point information Cg1 are attribute information Zg1
The attribute information Zg1 is added to the information of the file name O1 written by the user s2. Further, the evaluation file 12 includes the equilibrium point information Ch1 = O2 {s3 (rw), s4 (r),
Since s2 (r)} is also stored, user s3
Request the writing of the information of the file name O2, the controller 13 creates the history information Ph1 = (s3) and the equilibrium point information Ch1 as the attribute information Zh1, and the file requested by the user s3 to write. Attribute information Zh1 is added to the information of the name O2.

When each user requests reading of the information written in the information storage device 9 as described above, the attribute information exists in the information of the file name of the instruction series indicating that, and the attribute information of the attribute information exists. The same user name as the last user name in the history information is added with the symbol r to the user name to the right of the user name in the equilibrium point information of the attribute information, and the user name matches the user name in the instruction series. In this case, the information storage device 9 is used to permit the reading of the information of the file name requested by the user using the controller 13 as described later.
To control. For example, the history information Pg1 = (s2) and the equilibrium point information Cg1- {s2 (rw), s1 (r), s.
The information of the file name O1 added with the attribute information Zg1 including 3 (r)} is the last user name s in the history information Pg1.
Since the user name s1 to the right of the user name in the same equilibrium point information Cg1 as 2 is marked with the symbol r, the user s1 who matches the user name requests reading of the information of the file name O1. The controller 13 adds the user name s1 to the end of the history information Pg1 only when the instruction sequence of
After adding "," the information of the file name O1
No. 1 is read from the information storage device 9, and after the user s1 reads the information of the file name O1,
When this information is written in the information storage device 9 as the information of the file name O3 according to the SO matrix equation (3), the information of the file name O3 is the history information Pg1 = (s2, s
1) and equilibrium point information Cg1 = O1 {s2 (rw), s1
(R), s3 (r)}, and the user name s3 to the right of the user name in the equilibrium point information Cg1 that is the same as the last user name s1 in the history information Pg1 is marked with the symbol r. Therefore, the controller 13 controls the history information Pg1 only when the user s3 who matches the user name transmits the instruction sequence requesting the reading of the information of the file name O3.
After adding the user name s3 to the end of the file, the information of the file name O3 is stored in the information storage device 9 as requested by the user s3.
Read from. That is, the controller 13 controls the equilibrium point information Cg1 = O1 {s2 (rw), s1 (r), s3 as described above.
The information storage device 9 is controlled so that the information of the file name O1 in (r)} is permitted to be read in the order of the users s1 and s3, and the information of the file name O1 is stored in the S-O determinant (4). Only the path g1 indicated by the arrow can be followed.

In the above-mentioned embodiment, the case where the leakage path is extremely simple is shown for simplification of explanation, so that the equilibrium point information is Cg1 = O1 {s2 (rw), s1 (r), s3.
(R)} or Ch1 = O2 {s3 (rw), s4
(R), s2 (r)} is a relatively simple one, but in many cases, a symmetric user is often reached via a large number of users. Cgi
= O1 {s2 (rw), s1 (r), ..., S3
(R)} and the user name passing through (r) or (r
Any pair with w) will be listed. The information with such equilibrium point information is controlled so that only the route indicated by the equilibrium point information can be traced.

Therefore, according to this information access control device, even if a large number of indirect leakage routes exist in accordance with the access permission request information and the security information of each user as described above, the two users associated with that route can be used. When the mutual interests and benefits are balanced, the writing of the information of the file name caused by the indirect leakage is permitted, and the information of the file name for which the writing is permitted is a path through which the mutual interests of the two users are balanced. Since the information storage device is controlled so as to trace only the information, it is possible to minimize the damage to each user and enhance the utilization of the database system.

In the above embodiment, the payment matrices Ps2 and Ps3 stored in the evaluation file 12 are compared with each other,
Although the routes in which the mutual gains are balanced are selected for the users s2 and s3, respectively, the present invention is not limited to this, and the routes are selected by the procedure described below to further enhance the utilization of the database system. You may do it. First, prior to the operation of the database system, after the payment matrices Ps2 and Ps3 are stored in the evaluation file 12 as described above, the information access control device 8 uses the selector 14 to allow the users s2 and s3 respectively At what probability should the route be selected to balance the interests of both users as a whole, in other words, when selecting a pair of routes that bidirectionally connect two users in a certain combination of two users It is calculated how to allocate the probability of being selected to make the profit and loss account uniform as a whole. That is, in the payment determinants (8) and (9), the probabilities x1 ^* , x2 ^* that the routes Rg1, Rg2 are selected for the user s2 ^.
And the probabilities y1 ^* and Y2 ^* that the routes Rh1 and Rh2 are selected for the user s3, respectively, first, the probability sequences (x1 ^* , x2 ^* ) and (y1 ^* , y2 ^* ) are calculated.
And x ^* and Y ^{* respectively,} and the probabilities x1 ^* , x2 ^* ,
Let the random variables of Y1 ^* and y2 ^{* be} x1, x2, y1 and y2, and their series (x1, x2) and (y1, y
2) is X and Y, respectively, the selector 14 selects the user s
2 and s3 are paths gi and hj (where i and j are positive numbers indicating the row number and column number in the payment determinant, respectively,
In this embodiment, it is 1 or 2. ) Is selected, the product of the gain a _ij of the user s2 and the random variables x _i and y _j is obtained for all combinations of the two paths, and the sum of them is calculated for the user s2 in the series (X, Y). Expected value E
The following equation (10) is used as s2 (X, Y).

[Equation 10] Ask according to. Similarly, for the expected value Es3 (X, Y) of the user s3 in the series (X, Y), the gain of the user s3 is b _ij and the following equation (11) is used.

[Equation 11] Ask according to.

Next, the selector 14 calculates the following equation (12) from the equations (10) and (11).

[Equation 12] And the following equation (13)

[Equation 13] X ^* and Y ^* for satisfying both equations are obtained. Here, the above formulas (12) and (13) are the same as those in December 1981.
This is a conditional expression for obtaining a probability value based on the Nash equilibrium point known in “Game Theory” (author: Mitsuo Suzuki) of Kyoritsu Shuppan, on the 5th. This conditional expression is used for two games if, for example, the method of moving a plurality of chess pieces that each player can take in order to play a game, for example, chess, is selected by the probability value of each of the hands of a plurality of games. This is to determine whether or not the game player can balance the superiority and inferiority of the game, or the probability value for that purpose. In this embodiment, the two players, the users s2 and s3, use the route Rg as a game hand.
As a means for obtaining probability values X ^* and Y ^* for determining whether each of 1, Rg2, Rh1 and Rh2 is selected with a probability, the superiority or inferiority of the game, that is, the interests can be balanced as a whole for both users. This is an example of the case of use. In this embodiment, X ^* and Y ^* are respectively X ^*.
= (1,0) and Y ^* = (1,0), the above formula (1
Since 2) and (13) can be established, the probability that the user s2 should select the routes Rg1 and Rg2 is 1,
0, and the probability that s3 should select the routes Rh1 and Rh2 can be calculated as 1 and 0. Therefore, as the probability values 1, 0, 1 and 0, the transmission path information g1,
Add to g2, h1 and h2 respectively. Such processing is performed for each combination of two users or for each user related to security information, and a probability value is added to necessary transmission route information. The above is the preparation before the start of operation.

In the state where the above-mentioned preparation is completed, an instruction sequence indicating that the user requests the information storage device 9 to write the information of the desired file name is given to the terminal 11.
When the user name and the file name included in the instruction sequence are included in the transmission path information stored in the evaluation file 12 when transmitted to the controller 13 via the, the information of the file name is described above. Even when such information is transmitted to a third party through a leakage path due to writing, information is stored using the controller 13 so as to allow writing of information of the file name requested by the user. While controlling the device 9, the selector 14 is used to select any one of the transmission route information according to the probability value included in each of all the transmission route information corresponding to the instruction series, and to select it as the equilibrium point information. Is stored in the evaluation file 12.

That is, considering the case where the user s2 requests the writing of the information of the file name O1 after performing the above-mentioned preparation, the evaluation file 12 has the user name s2 and the file name O1 with the symbol w. Since the transmission route information g1 and g2 including the above are stored, and they include the probability values 1 and 0, respectively, the selector 14 selects one of the transmission route information g1 and g2 according to the probability, for example. In the case of this embodiment, the transmission path information g1 having a probability of 1 is selected using a random number generator (not shown), and this is selected as the equilibrium point information D.
It is stored in the evaluation file 12 as g1 and the controller 13 determines that the user s2 because the equilibrium point information Dg1 exists.
Of the transmission path information g1 and history information Pg1 = (s2) as attribute information Zg1 and the attribute information Zg is written in the information of the file name O1 written by the user s2.
Add 1. Further, the evaluation file 12 also stores the transmission path information h1 and h2 including the user name s3 and the file name O2 with the symbol w, and since these contain probability values 1 and 0, respectively. Similarly, when the user s3 requests the writing of the information of the file name O2, the transmission route information h1 is selected according to the probability, and this is selected as the equilibrium point information D.
It is stored in the evaluation file 12 as h1, and the write request of the user s3 is permitted due to the existence of the equilibrium point information Dh1, and the transmission path information h1 and the history information Ph1 =
(S3) is used as the attribute information Zh1 and the attribute information Zh1 is added to the information of the file name O2 written by the user s3. In the above-described embodiment, the selection target routes of the users s2 and s3 are small and simple in order to simplify the description, but in reality, a large number of selection target routes may exist for each user. Many of them have a probability value of less than 1.

Therefore, when each user requests reading of the information written in the information storage device 9 as described above, the information of the file name O1 is obtained by using the controller 13 as in the above-described embodiment. Only the route Rg1 indicated by the arrow in the SO determinant (4) and the information of the file name O2 are S
If the information storage device 9 is controlled so as to follow only the route Rh1 indicated by the arrow of the -O determinant (6), each of these two routes is written every time the user writes the information of the file name related to the security information. In this embodiment, the probability of selecting each of the two routes is selected from a plurality of routes connecting the two users to each other, and the condition for balancing the gains of the two users is satisfied. Then, the use of the database system can be further enhanced as compared with the embodiment in which the route is fixed as described above while minimizing the damage to each user.

In the above embodiment, the probability based on the Nash equilibrium point was found to find the path where the required gains between the two users are balanced, but the present invention is not limited to this, but based on the Stackelberg equilibrium point. It will be obvious that various game theory means such as probability calculation means can be applied. Further, in the above-mentioned embodiment, when each user requests the reading of the information in which the attribute information exists, the user name in the equilibrium point information which is the same as the last user name in the history information of the attribute information is a symbol. Only when r is added and the user name matches the user name that has requested the information reading, the controller controls the information storage device to perform the selected path so that the information reading is performed as requested. Although the information is traced, the present invention is not limited to the above-mentioned means as long as it is a means for controlling the information storage device so that the information in which the attribute information exists follows the selected route. For example, the controller has the attribute The user name in the equilibrium point information that is the same as the last user name in the history information of the information and the user name to the right of the user name to the right of it are marked with the symbol r, and Any one reads the information Only if it matches the user name who requested the, it will be obvious that may perform information reading as requested. Further, in the above embodiment, the center of the database system is configured to have all the functions of the information access control device, but the present invention is not limited to this, and at least part of the functions may be provided in the terminal. Of course, this would be convenient in reducing the burden on the function of processing the information of the center.

Further, in the above-mentioned embodiment, when each user desires to limit the users who are allowed to read the information by the security information and there is a path in which the gains of the users and other users are balanced, the security is set. Although the information storage device is controlled so as to allow the writing of the information of the file name designated by the information, the present invention uses the conventional route information creation / determining device to write the information of the indirect leakage route for each user. The information storage device may be controlled so as to be prohibited according to the wishes of the above, and if the means for creating the transmission path information is the means for creating based on the access permission request information and the security information, It will be appreciated that the example need not be limited.

Further, the above-mentioned evaluation file and information storage device are not limited to being provided separately, but any storage means having at least one required storage capacity may be used.
Further, although the six terminals are connected to the center in the above-mentioned embodiment, the present invention can be applied to a database system in which a plurality of users access required information to the information storage means and exchange information with each other. It is not limited to this, and for example, as shown in FIG. 4, at least one of the plurality of terminals 18, 18, ... Is provided with an information storage means, and each terminal can access any of the information storage means. The present invention may be applied to a database system or a database system in which these terminals are combined with at least one of the centers, and the means for connecting these terminals and centers to each other may be wired or wireless. Would be obvious.

[0029]

As described above, according to the present invention, based on the access permission request information and the security information transmitted by each of a plurality of users through the terminal, the information transmission path for every two required users among the plurality of users. And permit writing of information related to a path in which gains are balanced when both users of the path select each of them to mitigate rejection of information writing due to multiple indirect leakage paths. , If there is a path whose gain is balanced with respect to the information specified by the security information, the information storage means is controlled so that the information follows only that path, which results from the indirect leakage path between the two users. Information access control method and device capable of increasing the utilization of information possessed by a plurality of users in a database system because the damage caused by It achieved remarkable effects on offer.

[0030]

[Brief description of drawings]

FIG. 1 is a configuration diagram showing an embodiment of the present invention.

FIG. 2 is a configuration diagram of a database system including a conventional information access control device.

FIG. 3 is a configuration diagram of a database system including a conventional information access control device.

FIG. 4 is an explanatory diagram showing a modified example of the present invention.

[Explanation of symbols]

 8 Information Access Control Device 12 Evaluation File 13 Controller 14 Selector 15 Payment Matrix Creator 16 Transfer Path Judge 17 SO Matrix Creation Judge

Claims (4)

[Claims] 1. An access permission request information indicating that each of a plurality of users desires to access required information to an information storage unit, and a fact that a specific user is permitted to access the desired information. Reading information written by one of two users of the plurality of users in a unit that controls the information storage unit so that the plurality of users exchange information with each other based on the security information. The first user who is permitted to read, the second user who is permitted to read the information written by the first user,
... Any one of the (n-1) th user who is permitted to read the information written by the (n-2) th user and the nth user who is permitted to read the information written by the (n-1) th user. Exists, and the information written by one of the users is permitted to be accessed by the other of the two users, the information written by one of the two users is indirectly transmitted to the other. It is judged as one,
For each combination of users, a pair of transmission paths that bidirectionally connect two required two users among the plurality of users is set as a transmission path that indirectly connects the two users,
Let the two users judge the profit and loss of each of the required two users when the obtained transmission route pair is selected, and make sure that the information does not follow other than the transmission route where the interests are balanced. An information access control method characterized in that the information storage means is controlled so that reading or writing is prohibited. 2. After the two users are made to judge the profit and loss, a probability that the interest and profit of the two users are balanced is calculated for each of the transfer routes by game theory, and the transfer route other than the selected transfer route is selected according to the probability. 2. The information access control method according to claim 1, wherein the information storage means is controlled so as to prohibit reading or writing by a required user so that the information is not traced. 3. The access permission request information indicating that each of a plurality of users desires to access the required information to the information storage means, and that the specific user is permitted to access the desired information. Reading information written by one of two users of the plurality of users in a unit that controls the information storage unit so that the plurality of users exchange information with each other based on the security information. The first user who is permitted to read, the second user who is permitted to read the information written by the first user,
... Any one of the (n-1) th user who is permitted to read the information written by the (n-2) th user and the nth user who is permitted to read the information written by the (n-1) th user. Exists, and the information written by one of the users is permitted to be accessed by the other of the two users, the information written by one of the two users is indirectly transmitted to the other. It is judged as one,
Means for determining, for each combination of users, a transmission path that forms a pair that bidirectionally connects two required users out of the plurality of users, using a path that indirectly connects the two users as a transmission path, and the obtained transmission A means for causing the two users to judge the interests and benefits of each of the two required users when a route pair is selected, and reading of the required user so that the information does not follow other than a transmission route in which the interests and benefits are balanced. An information access control device comprising means for controlling the information storage means so as to prohibit writing. 4. The means for controlling the information accumulating means controls the reading or writing by a necessary user so that the information does not follow any transmission path other than the transmission path selected according to the probability that the interests of the two users are balanced by game theory. 4. The information access control device according to claim 3, which is means for controlling the information storage means so as to be prohibited.