WO2006137117A1

WO2006137117A1 - Information access control system and method thereof

Info

Publication number: WO2006137117A1
Application number: PCT/JP2005/011271
Authority: WO
Inventors: Hidenori Shimizu
Original assignee: Hewlett-Packard Development Company, L.P.
Priority date: 2005-06-20
Filing date: 2005-06-20
Publication date: 2006-12-28
Also published as: JPWO2006137117A1

Abstract

An authentication process is performed between an information use device (3) and an information access control server (4). The authenticated information use device (3) requests an AP server (6) to provide a service. An authentication process is performed between the AP server (6) and the information access control server (4). The information access control server (4) is requested to transmit personally identifiable data (entity) to the information use device (3). In response to the request, general information required for realization of a service but unable to identify a person is transmitted from the information access control server (4) to the AP server (6). The AP server (6) transmits the service process result to the information use device (3). The information access control server (4) transmits an identifier (entity) corresponding to the service requested by the information use device (3) to the information use device (3).

Description

Specification

Information access control system and method

Technical field

[0001] The present invention relates to an information access control system and method for controlling access to specific information separately from other information forces.

Background art

[0002] Currently, legal systems are in place around the world to protect personal information.

For example, in Japan, it is obliged to explain the use of personal information, prohibit its use for purposes other than the use of personal information, and notify the principal when personal information is leaked. For example, Patent Documents 1 to 6 disclose various methods for protecting specific information, for example, personal information.

However, these methods, when performing information processing related to personal information, may cause personal information to go out to the device that performs the processing, or to perform specific types of information processing. I do it.

Patent Document 1: JP 2005-051671 A

Patent Document 2: JP 2005-004714 A

Patent Document 3: Japanese Patent Laid-Open No. 2004-363732

Patent Document 4: Japanese Patent Application Laid-Open No. 2004-282657

Patent Document 5: Japanese Unexamined Patent Application Publication No. 2004-068869

Patent Document 6: Japanese Unexamined Patent Publication No. 2002-135004

Disclosure of the invention

Problems to be solved by the invention

[0003] The present invention has been made with the background described above, and by appropriately controlling access to specific information, the information access control improved so that this information can be reliably protected. It is an object to provide a system and method.

Further, the present invention provides an information access control system and method improved so that specific information can be reliably protected and can be applied to various information processing in a general purpose. The purpose is to provide.

Means for solving the problem

[0004] In order to achieve the above object, an information access control system according to the present invention is information relating to a predetermined presence, and includes first information that can be used to identify the presence, and information other than the first information. An information access control system having an information providing device that provides the second information, an information access control device, and an information processing device, wherein the information processing device First rule presenting means for presenting an access rule for the first information, and information processing means for processing the second information provided in association with an identifier corresponding to the first information are provided. The information providing apparatus includes information providing means for providing the first information and second information, and first permission means for permitting the presented rules, and the information access control apparatus Generates the identifier In accordance with the permitted rules, the identifier generating means, the information providing means for providing the generated identifier to the information processing apparatus in association with the second information corresponding to the identifier, Information access control means for controlling whether or not to permit access to the first information corresponding to this rule.

[0005] The information access control apparatus according to the present invention is an information access control apparatus that performs information access control on the first information that is information related to a predetermined presence and that can be used to identify the presence. The information related to the presence includes second information other than the first information, a rule for access to the first information is presented, and permission is granted for the presented rule. Predetermined information processing is performed on the second information provided in association with the identifier corresponding to the first information, and identifier generation means for generating the identifier is generated. The identifier is associated with the second information corresponding to the identifier, the information providing means for providing the information processing, and the access to the first information corresponding to the rule according to the permitted rule. Control Information access control means.

[0006] Preferably, a method for presenting a rule for access to the first information, and definition data creating means for creating definition data for defining the contents of the information processing in association with each predetermined presence , How to present the access rules included in the created definition data According to the law, the information processing device further includes an access rule presenting unit for presenting a rule for accessing the first information from the information processing device to the information providing device.

[0007] Preferably, the information processing is performed according to a content of a process included in the created definition data, and the information access control means corresponds to the requested information processing. The access to the first information to which the access is permitted is permitted.

[0008] Preferably, the processing result is used in association with the identification information corresponding to the processing result, and the identification information permitted for the access is provided for the use. It further has means.

[0009] Preferably, the information processing apparatus further includes first authentication means for authenticating a user who uses the first information permitted to access, wherein the processing result providing means provides the authenticated user with respect to the authenticated user. And providing a processing result corresponding to the identification information.

[0010] Preferably, the information access control means further includes first authentication means for authenticating the presence, and information storage means for storing the first information related to the authenticated existence. The stage controls access to the stored first information.

[0011] Preferably, the information storage unit deletes the stored first information after a set time has elapsed.

[0012] Preferably, the information processing apparatus further includes history means for taking a history of access to the first information.

[0013] Preferably, the information processing apparatus further includes rule presenting means for presenting the rule, and permission accepting means for accepting permission for the presented rule, wherein the information access control means includes the presented rule; Access to the first information is controlled based on permission to this rule.

[0014] Preferably, it further includes image definition means for defining a display image used for displaying the rule to the licensee who performs the license, and the rule presentation means includes the rule, Using the defined display image, the image is displayed to the licensee.

[0015] Preferably, the rule presenting means interactively displays the rule to a licensee who performs the license. [0016] Preferably, the predetermined presence is an individual, the first information is identification information capable of identifying the individual, and the second information is general information related to the individual.

[0017] Further, the information processing apparatus according to the present invention is an information processing apparatus that processes information on a predetermined presence, and the information on the presence includes first information that can be used to identify the presence, Rule presenting means for presenting a rule of access to the first information, the first information being accessed according to a rule, and second information other than the first information; Information processing means for processing the second information corresponding to the information.

[0018] Also, the information access control method according to the present invention is an information access control method for performing information access control on the first information that is information related to a predetermined presence and that can be used to identify the presence. The information related to the presence includes second information other than the first information, a rule for access to the first information is presented, and permission is granted for the presented rule. Predetermined information processing is performed on the second information provided in association with the identifier corresponding to the first information, and an identifier generation step for generating the identifier is performed. The identifier is associated with the second information corresponding to the identifier, the information providing step provided for the information processing, and the access to the first information corresponding to the rule according to the rule permitted in advance. The And an information access control step for controlling.

[0019] The information processing method according to the present invention is an information processing method for processing information related to an individual, wherein the information related to the individual includes identification information that can be used for identifying the individual, and information other than the identification information. The identification information is accessed according to a rule, and a rule presentation step for presenting a rule for access to the identification information, and an information processing step for processing the general information corresponding to the identification information. Have.

[0020] Further, an information access control program according to the present invention is a program for performing information access control on first information that is information related to a predetermined presence and that can be used to identify the presence, The information related to existence includes second information other than the first information, a rule of access to the first information is presented, permission is given to the presented rule, and the first Predetermined information processing is performed on the second information provided in association with an identifier corresponding to the information to generate an identifier for generating the identifier. In accordance with the rule according to the permitted rule generation step, the information providing step of associating the generated identifier with the second information corresponding to the identifier and providing it for the information processing, and the permitted rule. And causing the computer to execute an information access control step for controlling access to the corresponding first information.

[0021] Further, the information processing program according to the present invention is a program for processing information relating to an individual, and the information relating to the individual includes identification information that can be used for identifying the individual and general information other than the identification information. The identification information is accessed according to a rule, and a rule presentation step for presenting a rule for access to the identification information and an information processing step for processing the general information corresponding to the identification information are stored in a computer. Let it run.

The invention's effect

[0022] According to the present invention, this information can be reliably protected by appropriately controlling access to the specific information.

Further, the present invention can reliably protect specific information and can be applied to various information processing in a general purpose.

Brief Description of Drawings

FIG. 1 is a diagram illustrating a configuration of an information access control system according to the present invention.

2 is a diagram exemplifying hardware of an information providing device, an information using device, an information access control server, and an AP server included in the information access control system shown in FIG.

FIG. 3 is a diagram illustrating an identification information object model that defines a service defined in the information access control system shown in FIG. 1.

4 is a diagram illustrating the contents of an identification information UI object defined in the identification information object model shown in FIG. 3.

FIG. 5 is a diagram showing information used for service provision and information access control in the information access control system shown in FIG. 1.

FIG. 6 is a diagram showing a configuration of an information providing program executed in the information providing apparatus 2 shown in FIGS. 1 and 2.

[FIG. 7] An information utilization program executed in the information utilization apparatus shown in FIG. 1 and FIG. It is a figure.

FIG. 8 is a diagram showing a configuration of an information access control program executed in the information access control server shown in FIGS. 1 and 2.

FIG. 9 is a diagram showing a configuration of a service definition unit shown in FIG.

10 is a diagram showing a configuration of an information access control unit shown in FIG.

[11] It is a diagram showing information provider information stored in the information provider master DB shown in FIG.

FIG. 12 is a diagram showing node information stored in the node DB shown in FIG. 8, where (A) shows node information about the AP server, and (B) shows node information about the information utilization device. (C) shows node information about the information providing apparatus.

[FIG. 13] A diagram showing general information received by the UI processing unit shown in FIG. 8 and transmitted to the AP server. (A) shows the general information receiving unit of the UI processing unit. Information providing device capability General information to be accepted is shown, and (B) shows general information transmitted by the general information transmission unit of the UI processing unit.

[14] FIG. 14 is a diagram illustrating an identification information object model stored in a repository structure in the identification information object DB shown in FIG.

[15] FIG. 15 is a diagram showing identification information (substance) stored in the identification information DB shown in FIG.

16 is a diagram showing information included in each row of the ACL stored in the ACL storage unit (FIG. 10) of the access control processing unit shown in FIG.

FIG. 17 is a diagram showing a configuration of an AP server program executed by! / In the AP server shown in FIGS. 1 and 2.

FIG. 18 is a diagram showing order number information stored in the order number DB of the AP server program shown in FIG. 17.

[FIG. 19] A first diagram showing the flow of information in the information access control system (FIG. 1), in which the identification information object model is created by the service definition unit (eg, FIG. 8) of the information access control program, and the identification information The settings for the information access control program of the information contained in the object model (Fig. 5) and the components of the AP server program (Fig. 17) are shown. 20 is a diagram showing the flow of information in the identification information processing unit and information access control unit (FIGS. 8 and 10) of the information access control program in the information flow shown in FIG.

FIG. 21 is a second diagram showing the flow of information in the information access control system (FIG. 1). The information access control program authenticates the user (information provider) of the information providing device and creates an anonymous ID. Show.

FIG. 22 is a third diagram illustrating the flow of information in the information access control system (FIG. 1). The service request from the information providing apparatus to the AP server is used to determine whether the user of the information providing apparatus 2 ( Policy presentation to (information provider) and its permission.

FIG. 23 is a diagram showing the flow of information inside the identification information processing unit and the information access control unit (FIGS. 8 and 10) of the information access control program in the information flow shown in FIG.

FIG. 24 is a fourth diagram showing the flow of information in the information access control system (FIG. 1), and shows the registration of identification information (entity) from the information providing device to the information access control server.

FIG. 25 is a diagram showing the flow of information inside the identification information processing unit and the information access control unit (FIGS. 8 and 10) of the information access control program in the information flow shown in FIG. 24.

FIG. 26 is a fifth diagram showing the flow of information in the information access control system (FIG. 1), and shows the transmission of identification information (substance) from the information access control server to the information using device.

FIG. 27 is a diagram showing the flow of information inside the identification information processing unit and information access control unit (FIGS. 8 and 10) of the information access control program in the information flow shown in FIG. 26.

FIG. 28 is a first communication sequence diagram showing the overall operation of the information access control system shown in FIG. 1, and authentication of the information providing device user (information provider) with respect to the information access control server; To processing (S 10) from registration of identification information (entity).

FIG. 29 is a second communication sequence diagram showing the overall operation of the information access control system shown in FIG. 1, and transmission of identification information (actual) from the information access control server to the information use device. The process up to (S14) is shown.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described.

[0025] [Information access control system 1]

FIG. 1 is a diagram illustrating the configuration of an information access control system 1 according to the present invention. As shown in FIG. 1, each of the information access control systems 1 has n (n is an integer of 1 or more, but not always the same number) information providing devices 2-l to 2-n, information Equipment 3—1 to 3—n, information access control server 4 1 to 4 n and AP server (information processing equipment) 6—1 to 6—n are connected via a network 100 such as a LAN, WAN or the Internet. The configuration is taken.

With these components, the information access control system 1 separates information that can identify a certain entity, such as an individual (PID: Personally Identifiable Data) from general information about the individual. Management and control access to the identification information to protect the identification information.

In the following description, when referring to any of a plurality of possible components such as the information providing devices 2-1 to 2-n, the information providing device 2 may be simply abbreviated.

In addition, in the information access control system 1 such as the information providing device 2, components that can be the subject of information communication and information processing are sometimes collectively referred to as nodes.

In the following drawings, substantially the same components are denoted by the same reference numerals.

[0026] [Hardware]

FIG. 2 is a diagram illustrating hardware of the information providing device 2, the information using device 3, the information access control Sano, and the AP server 6 included in the information access control system 1 shown in FIG.

As shown in FIG. 2, these nodes include a main body 120 including a CPU 122 and a memory 124, an input / output device 126 such as a display device and a keyboard, a communication device 128 for communicating with other nodes, and a CD. It consists of recording devices 130 such as devices, HDD devices, and flash memory devices.

That is, these nodes have components as computers capable of information processing and information communication.

[0027] [identification information · general information · identification information object model]

Hereinafter, identification information, general information, and an identification information object model to be processed in the information access control system 1 shown in FIG. 1 will be described.

[0028] [Identification information 'General information] Information access control in the information access control system 1 can be applied to identification information of various entities (whether individuals or natural persons, organisms, inanimate objects, movables, real estate, etc.). Unless otherwise specified, a case where the information access control system 1 processes personal (natural person) identification information is a specific example.

As personal identification information, for example, all digits of a zip code or detailed address, telephone number

Examples include the current location, name, and date of birth and address combination obtained from a driver's license number, health insurance card number, GPS, and the like.

Further, the general information is information other than identification information related to an individual, and for example, the contents of responses to general questionnaires (preferences and hobbies) can be exemplified.

[0029] [Identification Information Object Model (PID Object Model)]

FIG. 3 is a diagram illustrating an identification information object model that defines a service defined in the information access control system 1 shown in FIG.

As shown in Fig. 3, in the information access control system 1, the services provided to the users (information provider, information user) of the information providing device 2 and the information using device 3 correspond to the information provider at the time of execution. Attached.

A service is defined as a set of one or more applications (described later with reference to FIG. 18) executed by the AP server 6 and the configuration thereof in order to realize the service.

[0030] For an application, a policy, identification information (P ID), and identification information UI object corresponding to the application are defined.

A licensor, a display policy, and a permission type are associated with the policy, and an information access control list (ACL) is further associated with the permission type.

An information provider identifier (information provider ID) is defined for the information provider. Among these objects defined in the identification information object model, services are service identifiers (service IDs), applications are application identifiers (APID; Application ID), and identification information (PID) is Its identifier (LPID; Logical Pers onally Identifiable Data) is defined. [0031] This LPID is a name indicating specific identification information (PID) handled in the AP server 6, and is generated as a force symbol table 46 (described later with reference to FIG. 8).

In practice, the LPID is created and used as a data name by a user of the SDT 460 included in the service definition unit 46, for example, a developer who develops a service in the AP server 6.

The LPID is processed as a code corresponding to the identification information in the AP server 6 and used as a data symbol (actually a member of an object class).

FIG. 4 is a diagram illustrating the contents of the identification information UI object defined by the identification information object model shown in FIG.

The application configuration defines information input to the service, information output as a processing result from the service, and information passed between multiple applications.

The policy defines policies and rules for handling the identification information associated through the application.

The identification information UI object is a means used to interact with information users in the service, such as the image shown in Figure 4 that is used to present policies to information providers (still images, text , Audio, video, etc.).

The identification information indicates which identification information is added to the processing result of the corresponding application.

[0033] The licenser indicates whether the corresponding information provider has licensed the corresponding policy.

The display policy defines policies and rules for displaying identification information associated with the processing result of the application to information users.

The permission type is a template for defining settings related to the use of LPID (information access control), and is valid only for information providers who have licensed the corresponding policy.

An information access control list (ACL) is used to control access to identification information according to the settings defined for the permission type (template). FIG. 5 is a diagram showing information used for service provision and information access control in the information access control system 1 shown in FIG.

In order to realize the control of access to the identification information by the service defined in the identification information object model shown in Fig. 5 and the service, as shown in Fig. 5, the service usage identification information (identification information (entity) ), Identity policy, identity UI object and application IF (APIF).

Service usage identification information defines the identification information that is required and used for service realization.

The identity information policy defines policies and rules for the service to handle identity information, sets management methods in ACL, and uses license information for identity information corresponding to the policy presented to the information provider. Used for storing and storing.

[0035] The identification information UI object defines information such as still images, text, audio, and moving images for information providers and information users to interact with services. Including parts used for the purpose.

The data model included in this identification information policy is used to process general information acquired by the information access control server 4.

The UI components are still images, texts, sounds, moving images, and the like, and are used to create a UI image as shown in FIG. 4, for example.

APIF defines the services defined in the identity object model that defines the service, the applications included in this service, the identification information corresponding to this application, and the configuration of the application. The service ID, APID, Contains configuration information indicating the configuration of the LPID and application.

[0036] [Software]

Hereinafter, the software of each node of the information access control system 1 will be described.

[0037] [Information provision program 20]

FIG. 6 is a diagram showing a configuration of the information providing program 20 executed in the information providing apparatus 2 shown in FIGS.

As shown in FIG. 6, the information providing program 20 includes an interface control unit (IF control unit). 22), a policy presentation unit 240, a policy permission unit 242, an identification information creation unit 244, an authentication unit 246, a general information creation unit 248, a session processing unit 250, and a communication processing unit 260.

The information providing program 20 is supplied to the information providing apparatus 2 via the recording medium 132 (FIG. 2) and the network 100 (communication apparatus 128), loaded into the memory 124, and installed in the information providing apparatus 2, for example. It is executed on the OS (not shown) by specifically using the hardware of the information providing device 2 (hereinafter the same applies to each program).

[0038] With these components, the information providing program 20 creates identification information that can identify a certain existence and general information (general information) related to this existence, and information access control Sano. Provided for 4 and AP server 6.

In addition, the information providing program 20 receives a policy for access to the identification information, and grants a permission for the presented policy.

For example, when the entity of the information providing program 20 is a browser, in order to realize the information providing device 20, the functions provided by the information access control server 4 side rather than the functions provided in the information providing device 2 are provided. Is used more often.

In such a case, in order to realize the UI in the information providing apparatus 2, the part that performs UI object processing and the part that performs the UI adapter process perform processing on the information access control server side, A dynamically configured Web screen is transmitted to the information providing apparatus 2 on the information access control Sano side.

Such processing can also be realized by WebObject (registered trademark) of Apple Corporation.

[0039] In the information providing program 20, the IF 'control unit 22 accepts the operation of the user (information provider) with respect to the input / output device 126 (Fig. 2) of the information providing device 2, and receives the data indicating the accepted operation. Output to each component of the information provision program 20.

Further, the IF ′ control unit 22 outputs data input from each component of the information providing program 20 to the input / output device 126 for display.

Further, the IF ′ control unit 22 controls the processing of each component of the information providing program 20 according to the input data. [0040] As shown in FIG. 4, the policy presentation unit 240 uses the identification information (in FIG. 4, “name, address, phone number, credit card number”) Policy for ordering, shipping, and responding to inquiries by the customer ”), and the user's (information provider) permission operation (“ Permission ” The GUK Graphic User Interface) image used to accept the “press button” is displayed on the input / output device 126 (FIG. 2), and the policy is presented to the information provider.

In this policy, as shown in Fig. 4, items for indicating additional information of policy, items for managing identification information, and processing of identification information and information provider information are processed as necessary. Power for items etc. May be included as appropriate.

As will be described later, the policy is provided from the information access control server 4 and is used as a rule for controlling access to the personal information (identification information) of the information user by the information user.

The policy permission unit 242 accepts an operation indicating whether or not the information provider permits the policy displayed by the policy presentation unit 240.

Furthermore, the policy permission unit 242 transmits information indicating whether or not the information provider has permitted the policy to the information access control server 4.

The identification information creation unit 244 creates the identification information of the information provider in response to an operation on the input / output device 126 and transmits it to the information access control server 4.

The authentication unit 246 performs processing necessary for authentication of the information provider, such as transmitting authentication information to the information access control server 4 in response to an operation on the input / output device 126.

The general information creation unit 248 creates the general information of the information provider in response to an operation on the input / output device 126, and transmits the created general information to the AP server 6 via the information access control server 4. .

The session processing unit 250 performs authentication between the AP server 6, the information providing device 2, and the information access control server 4 that have also performed authentication to the information access control server 4 after authentication to the information access control server 4. Processes required for session management. The communication processing unit 260 controls the communication device 128 (FIG. 2) of the information providing device 2 and performs processing necessary for communication with other nodes.

[0042] [Information Use Program 30]

FIG. 7 is a diagram showing an information use program 30 executed in the information use apparatus 3 shown in FIGS.

As shown in FIG. 7, the information utilization program 30 includes an IF ′ control unit 22, an authentication unit 246, a service request unit 300, a processing result utilization unit 302, a session processing unit 250, and a communication processing unit 260.

With these components, the information utilization program 30 requests a service for general information from the AP server 6 via the information access control server 4, receives the processing result of the requested service from the AP server 6, and Identification information corresponding to the processing result is received from the information access control server 4 and provided for use by the user (information user) of the information use device 3.

In the information use program 30, the service request unit 300 requests the AP server 6 for a service related to the general information of the information provider.

The service result utilization unit 302 receives the processing result of the requested service from the AP server 6 and sends the identification information (substance) corresponding to the processing result of this service via the session used to receive the processing result. Then, the result of these services received and received from the information access control server 4 is associated with the identification information.

Further, the service result utilization unit 302 displays the associated information on the input / output device 126 (FIG. 2) of the information utilization device 3 to the user (information user) of the information utilization device 3. Perform the process to use.

[0044] The following processes (1) and (2) can be exemplified as processes requested by the information utilization apparatus 3 to the AP server 6.

(1) From the product number, use the anonymous ID of the user (information provider) of the information provider 2 who purchased the product and use the anonymous ID of the information provider to send a recall email to correct the product defect. Processing to retrieve the address from the access control server 4, and

(2) At the time of order processing, order processing that manages anonymous ID and order items, etc. is performed. Is used to perform post-processing such as delivery processing.

At the time of this post-processing, it is possible to check the inventory and the delivery date, so these check results are combined with the name and address of the information provider retrieved from the access control server 4 (for delivery destination confirmation). , Processing used to respond to information providers.

[0045] [Information Access Control Program 40]

FIG. 8 is a diagram showing a configuration of the information access control program 40 executed in the information access control server 4 shown in FIGS.

As shown in FIG. 8, the information access control program 40 includes a session processing unit 250, a communication processing unit 260, an authentication processing unit 400, an information provider master database (DB) 402, a node management unit 404, a node DB 406, an anonymous ID. It consists of a processing unit 42, a UI processing unit 44, a service definition unit 46, an identification information processing unit 52, and an information access control unit 54.

[0046] The anonymous ID processing unit 42 includes an anonymous ID creation unit 420 and an anonymous ID management unit 422.

The UI processing unit 44 includes a general information receiving unit 440, a general information transmitting unit 442, a UI object processing unit 444, and a UI adapter processing unit 446.

The identification information processing unit 52 includes an identification information management unit 522, an identification information DB 524, a usage history creation unit 526, and a usage history DB 528.

FIG. 9 is a diagram showing a configuration of the service definition unit 46 shown in FIG.

As shown in FIG. 9, the service definition unit 46 includes a service definition tool (SDT) 460, an identification information object creation unit 462, an identification information object management unit 464, an identification information object DB 466, a service / ΑΡ configuration management Part 468, APIF creation / management part 470, APID'LPID creation part 472, AP specific process creation part 474, identification information UI object creation part 476, ACL creation part 478, policy creation part 480, policy presentation part 482 and And an identification information (entity) definition section 484.

FIG. 10 is a diagram showing a configuration of the information access control unit 54 shown in FIG.

As shown in FIG. 10, the information access control unit 54 includes an identification information policy management unit 540, an ACL management unit 542, an ACL storage unit 544, an AP specific processing unit 546, and an APIF management unit 548. [0049] The information access control program 40 performs information access control for the identification information using these components.

That is, the information access control program 40 authenticates the information providing device 2 and the information using device 3 and establishes a communication session between the information providing device 2, the information access control server and the AP server 6.

The information access control program 40 receives a set of information (service ID, APID, LPID) and a processing request (identification information request) necessary for processing from the AP Sano 6. When the information set and the processing request exist in the APIF (FIG. 5) defined by the identification information object model, the information access control program 40 follows the identification information policy corresponding to this APIF to provide the information providing device. Present the policy to the second user (information provider)! 求める Ask the information provider to grant the policy and provide identification information

[0050] The reason why an information set (service ID, APID, LPID) other than an anonymous ID is sent from the AP server 6 to the information access control program 40 is as follows (1) and (2). It is.

(1) For example, service (service A) 1S has multiple APIDs, and any one of these APIDs (Appl) may be used by other service B that is not just service A. .

In such a case, processing using a set of information (service ID, APID, LPID) is necessary to allow Appl to perform operations on a specific LPID only when it is used from service A. Is needed.

(2) “Anonymous ID” is an identifier indicating an anonymous customer (information provider, service user), and there can be a correspondence between multiple services and multiple anonymous IDs. Anonymous ID has a relationship of M to N (M and N are integers of 1 or more).

For example, a customer's power given a certain anonymous ID may be given a specific LPID license for a specific service, and another service may be granted a LPID license.

In this way, there can be a correspondence between an anonymous ID and multiple LPIDs. For a given anonymous ID, there can be a plurality of identification information corresponding to a plurality of LPIDs corresponding to the anonymous ID.

Therefore, in order to obtain identification information about a specific application power specific LPID that is activated from a specific service ID, a request that uses an information set (service ID, APID, LPID) is required. The

FIG. 11 is a diagram showing information provider information stored in the information provider master DB 402 shown in FIG.

In the information access control program 40, the communication processing unit 260 operates as, for example, an HTTP server or a Web server.

As shown in FIG. 11, the information provider master DB 402 is created by the information provider identifier (information provider ID), the anonymous ID processing unit 42, and the information provider name and anonymous ID indicating the information provider. The authentication information (information provider authentication ID, authentication key (key)) required for authentication is associated and stored as information provider information.

When the authentication processing unit 400 receives an authentication request from the information providing apparatus 2, the authentication processing unit 400 uses the authentication information stored in the information provider master DB 402 to perform processing necessary for authentication of the information provider and is authenticated. The information provider information is used for processing of other components of the information access control program 40 such as the anonymous ID processing unit 42.

Further, the authentication processing unit 400 performs an authentication process on the information utilization apparatus 3 according to the authentication from the user (information user) and the AP sensor 6.

FIG. 12 is a diagram showing node information stored in the node DB 430 shown in FIG. 8, wherein (A) shows node information about the AP server 6, and (B) shows an information utilization device. 3 shows node information for 3, and (C) shows node information for the information providing apparatus 2.

The node management unit 428 of the anonymous ID processing unit 42 stores and manages the node information input via the recording medium 132 (FIG. 2) or the like in the node DB 430.

Information stored in the node DB430 is used for processing of each component of the information access control program 40, such as session management processing by the session processing unit 250 as necessary (hereinafter the same applies to each DB). .

[0053] As shown in FIG. 12A, the node information about the AP server 6 includes the AP server 6 Each of them includes an identifier (AP sano ID), an address (AP server address), and an identifier (APID) of an application (AP626; Fig. 17) used for realizing the service.

Also, as shown in FIG. 12B, the node information about the information utilization device 3 is associated with an identifier (utilization device ID) and an address (utilization device address) for each information utilization device 3. Included.

Also, as shown in FIG. 12C, the node information about the information providing device 2 is associated with an identifier (providing device ID) and an address (providing device address) for each information providing device 2. Included.

The anonymous ID creation unit 420 creates, for example, an anonymous ID by converting authentication information of an authenticated information provider using a hash function, and outputs the anonymous ID to the anonymous ID management unit 422. The anonymous ID is used in place of the identification information of the information provider corresponding to this anonymous ID, and this information provider is concealed so that the side power of AP Sano 6 cannot be identified, while the general information of this information provider is hidden. Used to identify information.

As shown in FIG. 11, the anonymous ID management unit 422 stores the anonymous ID in the information provider master DB 402 as part of the information provider information including the information provider ID corresponding to the anonymous ID. to manage.

The anonymous ID management unit 422 associates the stored anonymous ID information with this communication session every time a communication session is established between the information use device 3, the information access control Sano, and the AP server 6. The information access control program 40 is used for processing in other components.

FIG. 13 is a diagram showing general information that is received from the information providing apparatus 2 by the UI processing unit 44 shown in FIG. 8 and transmitted to the AP server 6, and (A) is a UI process. General information of the unit 44 The general information received by the receiving unit 440 from the information providing apparatus 2 is shown, and (B) shows the general information transmitted by the general information transmitting unit 442 of the UI processing unit 44.

The general information receiving unit 440 of the UI processing unit 44 accepts the general information (FIG. 13A) of the authenticated information provider from the information providing device 2 and outputs it to the general information transmitting unit 442. As shown in FIG. 13 (B), the general information transmission unit 442 receives the input general information and the anonymous ID. The information utilization device 3 associates the order number used for requesting the service to the AP server 6 and transmits it to the AP server 6 in response to the request.

[0056] The UI adapter processing unit 446 processes the identification information UI object (FIG. 5) input from the UI object processing unit 444, and creates a UI image or the like as shown in FIG.

The UI adapter processing unit 446 transmits the created UI image or the like to the information providing apparatus 2 via the communication processing unit 260 and displays it.

Also, the UI adapter processing unit 446 accepts an operation on the UI image displayed on the information providing apparatus 2 and outputs information indicating this operation to the UI object processing unit 444.

The UI object processing unit 444 operates in cooperation with the session processing unit 250 and performs the following processing.

(1) Presentation of policy for information provider 2

(2) Acceptance of permission for the presented policy from information providing device 2,

(3) Creating new identification information

(4) Accepting identification information from the information providing device 2,

(5) Acceptance of identification information pointer (identification information pointer) by ACL management department and preparation for appropriate identification information,

(6) Correspondence between the received identification information and the identification information pointer,

(7) Search for identification information into the identification information processing unit, and

(8) Transmission of the identification information obtained as a result of the search to the information utilization apparatus 3.

[0057] The SDT 460 (Fig. 9) of the service definition unit 46 provides a user interface for operating the service definition unit 46 to the developer who develops the service in the AP server 6.

The SDT 460 accepts operations from the developer and controls the processing of each component of the service definition unit 46 according to the contents of the operations.

In addition, the SDT 460 uses the information (FIG. 5) used for information access control created by the other components of the service definition unit 46, the other components of the information access control program 40, and the AP. Set to server 6 (component part of AP server program 60; Fig. 17) The

[0058] The service / ΑΡ configuration management unit 468 creates a template of the identification information object model shown in FIG. 3 and outputs the template to the identification information object creation unit 462 and the SDT 460.

The identification information object creation unit 462 creates the identification information object model shown in FIG. 3 according to the developer's operation and outputs it to the other components of the service definition unit 46.

FIG. 14 is a diagram illustrating an identification information object model stored in the repository structure in the identification information object DB 466 shown in FIG.

The service / 図 configuration management unit 464 stores and manages the identification information object model created by the identification information object creation unit 462 in the identification information object DB 466 in a repository structure as shown in FIG.

The service / ΑΡ configuration management unit 464 outputs the identification information object model stored in the identification information object DB 466 to the other components of the service definition unit 46.

[0060] The identification information object model stored in the repository structure shown in FIG.

It is positioned below the ID information object model shown in Fig. 3 and defines the implementation of the ID information object model.

The object of each element that constitutes the identification information object model stored in the repository structure shown in Fig. 14 is opened to the outside in order to identify itself, like the identification information object model shown in Fig. 3. The identifier (ID) to be used.

The ACL confirmation table used by! / In the information access control unit 54 includes the service ID, APID, LPID, and anonymous ID in this repository.

The ACL confirmation table is a table of information included in the identification information policy of the object repository shown in FIG. 14, and is a template (class definition) of individual ACL setting conditions.

[0061] In the ACL confirmation table, the storage location of the anonymous ID exists as a structure. An anonymous ID does not exist as a specific entity.

The identification information policy management unit 540 uses the ACL confirmation table to set ACL setting conditions. Is generated for a specific anonymous ID and output to the ACL management unit 542. Incidentally, the service usage identification information object (LPID) is just a template (class definition) in the object repository, and the service usage identification information object stores the data type and access type.

[0062] Of the identification information object model shown in FIG.

When a class is created as an entity, it is created and stored in the information management function associated with the entity.

Therefore, there is no specific permission from the provider of identification information in the object repository where the class definition is stored.

In practice, the existence of a license is justified when an identity provider-specific identity entity is created.

Specifically, as information indicating permission by the information provider, data indicating evidence of permission (data such as time stamps and electronic signatures depending on the system implementation) force Information provider specific lines in the ACL Put inside.

[0063] The APID'LPID creation unit 472 includes the application program of the AP server 6 (AP626 of the AP server program 60; FIG. 17) and the identifier of the identification information (entity) included in the identification information object model (FIGS. 3 and 14). Create (APID).

The APID'LPID creation unit 472 outputs the created APID and LPID to the APIF creation'management unit 470.

The AP specific process creation unit 474 is used to cause the application program to perform a process specific to the service in order to realize the service (identification information filtering process, etc.) defined by the identification information object model. Create configuration information.

The AP specific process creation unit 474 outputs the created settings to the APIF creation 'management unit 470.

[0064] The APIF creation / management unit 470 associates the service ID of the service defined by the identification information object model with the APID, LPID, and configuration information necessary to realize the service, and stores them as APIF information (Fig. 5). And manage. The APIF creation 'management unit 470 provides the stored APIF information for processing by other components of the service definition unit 46 such as the ACL creation unit 478.

[0065] When a service from the information utilization device 3 is requested, the identification information UI object creation unit 476 receives the identification information UI object (Fig. 4, Fig. 4) included in the identification information object model of the service (Figs. 3 and 14). Figure 5) is created and output to the UI object processing unit 444. The policy creation unit 480 is used by the service designer / developer and creates an identification information policy (FIG. 5) related to the LPID used by a specific service according to the operation via the SDT 460.

The policy presenting unit 482 outputs the identification information policy received from the policy creating unit 480 to the UI object processing unit 444, and as shown in FIG. 4, to the user of the information providing apparatus 2 (information provider). Let them present.

[0066] The ACL creation unit 478 generates an ACLL setting condition definition including an APID, a service ID, an LPID, an (user type in the option), and processing information for specifying processing options for the identification information from the identification information policy. It is generated as an ACL class definition below the identity information policy object that it contains, and stored in the object repository.

The identification information (entity) definition unit 484 creates the identification information (entity; FIGS. 4 and 5) included in the identification information object model (FIGS. 3 and 14) and outputs the identification information to the information access control unit 54.

FIG. 15 is a diagram showing identification information (substance) stored in the identification information DB 524 shown in FIG.

As shown in FIG. 15, the identification information management unit 522 receives the anonymous ID of the provider who provided the identification information, and the identification information (UI object processing unit 444 received from the information providing device 2 and associated with the identification information pointer ( (Entity) and its management information (identification information (entity) expiration date, etc.) are associated with each other and stored in the identification information DB 524 for management.

The identification information management unit 522 receives the identification information pointer from the UI object processing unit 444, reads the identification information (substance) corresponding to this pointer from the identification information DB 524, and returns it to the UI object processing unit 444.

In addition, the identification information management unit 522 performs identification according to the management information associated with the identification information. Manage other information.

In other words, for example, when the management information indicates the expiration date of the identification information, the identification information management unit 522 deletes the identification information whose expiration date has expired.

At this time, the identification information pointer of the ACL management unit 542 is also invalidated.

In this way, by setting an expiration date for the ACL along with the identification information, it is possible to easily perform processing for explicitly notifying the expiration date of the identification information to information users and information providers. become able to.

[0068] The usage history creation unit 526 creates an access history for the identification information stored in the identification information DB 524, and stores and manages the history in the usage history DB 528.

Usage history The access history stored in the DB 528 is used, for example, to verify the correctness of the operation of the information access control server.

[0069] The identification information policy management unit 540 of the information access control unit 54 (Figs. 8 and 10) receives the identification information policy from the service definition unit 46 and presents the identification information policy for presentation to the information providing device 2. Is output to the UI processing unit 44.

In addition, the identification information policy management unit 540 includes an ACL class definition created by the ACL creation unit 478 of the service definition unit 46, an anonymous ID from the anonymous ID processing unit 42, and permission from the information provider for the presented policy. The ACL setting conditions in which the permission information indicating the contents of the information and the identification information pointer of the identification information to be processed are associated with each other are output to the ACL management unit 542.

It should be noted that the identification information policy management unit 540 supervises overall processing related to policies.

For the ACL management unit 542, not only when the ACL setting conditions are output at the time of new registration, but also when the service user as the information provider cancels the contract and deletes the registration of the identification information. The information policy management unit 540 first receives a request from the information provider from the UI processing unit 44 (UI object processing unit 444) or the APIF management unit 548, and issues an instruction to the ACL management unit 542.

The identification information policy management unit 540 not only reads the ACL class definition but also has a processing function corresponding to the definition of the policy object class. The function can be expanded along with the function extension of the policy object class. Type, user type, Including permission type condition judgment (rule engine function, etc.).

However, since this determination requires a long execution time, the determination result is fixed as an ACL setting, passed to the ACL management unit 542, which is the execution environment, and used for access management.

ACL management unit 542 can receive the ACL setting ACL class definition, which is a subclass of the policy object class, and the ACL management unit 542 and the identification information policy management unit 540 are independent of each other. Since the setting of these processing functions can be selected according to the load, function, and development cost of the system, runtime responsiveness and development's implementation cost can be adjusted.

FIG. 16 is a diagram showing information included in each row of the ACL stored in ACL storage unit 544 (FIG. 10) of access control processing unit 54 shown in FIG.

The ACL management unit 542 receives the ACL setting condition from the service definition unit 46 and creates a line to be registered in the ACL.

In other words, as shown in Fig. 16, each line of the ACL created by the ACL management unit 542 includes an anonymous ID, service ID, APID, LPID and processing information included in the ACL confirmation table, an identification information pointer, and a permission. Information is included in a format according to the permission type.

This permission information is used by the information provider to prove the validity of the actual permission for the policy.

[0072] The initial setting of the permission type itself is performed by the ACL creating unit 478 in advance according to the intention of the service developer. In the information access control system 1, permission for the policy is performed by the information provider. Therefore, it is preferable that the use of the identification information, the expiration date, the correction confirmation method, the type of application used, and the like can be specified as options from the UI image displayed on the information providing apparatus 2.

In order to deal with such cases, the permission type is set when the information provider creates a specific ACL entry with the permission type via the identification information UI object.

The reason why it is preferable to be able to specify the type of application used as an option is that multiple licenses may exist simultaneously for a normal policy (for example, information Even if the information provider permits the use of identification information for delivery and user support, the identification mail may not be permitted for the option of sending direct mail, so each information provider (anonymous ID) is not permitted. ACL lines containing different types of APIDs and service IDs can be registered).

[0073] The access control processing unit 542 links an application program (AP626; FIG. 17) running on the AP server 6 and the AP specific processing unit 546 when a service is requested from the information utilization device 3, Perform processing corresponding to the APIF (Fig. 5) of the service.

The linkage processing between the application program and the AP specific processing unit 546 by the ACL management unit 542 is monitored by the identification information policy management unit 540 and executed only under appropriate conditions defined by the service definition unit 46.

In response to the identification information request from the information utilization device 3, the APIF management unit 548 requests the ACL management unit 542 to perform processing necessary for obtaining the identification information, and obtains the identification information pointer of the requested identification information. Output to UI object processing unit 444 (Fig. 9).

[0074] [AP server program 60]

FIG. 17 is a diagram showing a configuration of the AP server program 60 executed in the AP server 6 shown in FIGS.

As shown in FIG. 17, the AP server program 60 includes a session processing unit 250, a communication processing unit 260, an authentication processing unit 400, a general service processing unit 62, an APIF processing unit 64, an order number management unit 66, and a general information management unit 68. Consists of

The general service processing unit 62 includes an execution control unit 620, a processing result transmission unit 622, and applications (8?) 626-1 to 626-11.

The order number management unit 66 includes an order number management unit 660 and an order number DB 662.

The general information management unit 68 includes a general information receiving unit 680, a general information storage unit 682, and a general information DB 684.

With these components, the AP server program 60 performs a process for realizing a service for general information defined by the information access control server 4 in response to a request from the information utilization device 3, and the processing result is Return to Information Use Device 3. [0076] The APIF processing unit 64 receives a service request of the user (information user) of the information using device 3 and uses the configuration information included in the APIF (Fig. 5) to the general service processing unit 62. Set the information (APIF service ID, APID and LPID) necessary to realize the requested service.

The APIF processing unit 64 manages the APIF service ID, APID, and LPID used to realize the requested service, and uses these pieces of information to make an identification information request to the information access control server 4. Do.

In addition, the APIF processing unit 64 provides the managed information for processing of other components of the AP server program 60.

[0077] The processing of the APIF processing unit 64 is illustrated.

In the process of using a specific AP626, for example, when the LPID indicates a residence, the APIF processing unit 64 is an information provider who registers an address in a specific area in addition to the permission type at the time of policy object creation. Request an anonymous ID or request the number of anonymous IDs.

This is a force that can be realized as one of the search functions of the identification database. AP626 receives only anonymous IDs, and AP626 further sells them to the target area using the acquired anonymous IDs. Services that have been licensed in advance by the information provider, such as market research on product types and sales promotion plans, can be performed.

[0078] As an actual mechanism, when defining identification information (entity) of “address” that can be specified by LPID, at the same time as type definition, permission type options and possible uses (application type APID) Since it can be assumed, such a search request can be sent to the identification information management unit 52 via the ACL, and the result can be obtained.

Normally, an ACL is not accepted unless an anonymous ID is specified, but for anonymous ID entries licensed by information providers cooperating with such regional market research, service ID, APID, LPID, and permission type Since multiple identification information pointers can be obtained from this set, the partial information comparison of the address and a list of anonymous IDs matching it can be obtained from the center of this set.

[0079] However, in the first question !, the “specific area” setting used in combination is specific to one individual. A relatively wide area that does not have to be a personal address that is a definable identification information entity may be set when creating an AP-specific process.

This setting can be confirmed at an arbitrary timing by using SDT460 or the like. In order to avoid personal identification by so-called “name identification”, each AP626 and the services configured by each AP626 are identified by unique LPID processing, and the combination of information that has a risk of being synthesized is managed by SDT460. The status of personal identification information in the operating system can always be grasped.

[0080] The execution control unit 620 of the general service processing unit 62 sets the A set by the APIF processing unit 64.

According to the configuration information of the PIF, the execution control of the AP 626 is performed, the general information is processed by combining the functions of the AP 626, and the service requested by the information utilization device 3 is realized.

The AP 626 provides a function for realizing the requested service under the control of the execution control unit 620.

The processing result transmission unit 622 requests the service result realized by the combination of the functions of the AP 626 through a session established between the information use device 3, the information access control server 4, and the AP server 6. Sent to information utilization device 3

FIG. 18 is a diagram showing order number information stored in the order number DB 662 of the AP server program 60 shown in FIG.

The order number management unit 660 of the order number management unit 66 associates the order number to which the input / output device 126 of the AP server 6 is input with the anonymous ID input from the information access control server 4, and is shown in FIG. Create the order number information shown.

The order number management unit 660 stores the created order number information in the order number DB 662, manages it, and provides it for processing by other components of the AP server program 60.

The general information receiving unit 680 of the general information managing unit 68 receives the general information (FIG. 13A) from the information access control server 4 and outputs it to the general information storage unit 682.

As shown in FIG. 13 (B), the general information storage unit 682 associates the input general information with the anonymous ID corresponding to the general information, and further displays the order number corresponding to the anonymous ID. In addition, it is stored and managed in the general information DB 684.

The general information storage unit 682 processes the stored general information by the general service processing unit 62. Served for use.

[0083] [Information flow in information access control system 1]

The information flow in the information access control system 1 (FIG. 1 etc.) will be described below.

FIG. 19 is a first diagram showing the flow of information in the information access control system 1 (FIG. 1), and the identification information object by the service definition unit 46 (eg, FIG. 8) of the information access control program 40. The model creation and the settings for the components of the information access control program 40 and AP server program 60 (Fig. 17) of the information (Fig. 5) included in the identification information object model are shown.

FIG. 20 is a diagram showing the flow of information inside the identification information processing unit 52 and the information access control unit 54 (FIGS. 8 and 10) of the information access control program 40 in the information flow shown in FIG.

As shown in FIG. 19, authentication is performed between the information access control server 4 and the AP server 6, and a communication session is established between them.

The service definition unit 46 of the information access control program 40 (Fig. 8) creates a model outside the identification information object (Figs. 3 and 14) according to the operation of the developer who develops the service by the AP server 6.

Further, the service definition unit 46 creates service use identification information, an identification information policy, an identification information UI object, and an APIF (FIG. 5) from the created identification information object model.

As shown in FIG. 19 and FIG. 20, service usage identification information is set in the ACL management unit 542 of the information access control unit 54, and the identification information policy is the identification information policy. Set in the management unit 540, the identification information UI object is set in the UI object processing unit 444, and the APIF is set in the APIF management unit 548 and the APIF processing unit 64 of the AP server program 60.

The APIF processing unit 64 sets information included in the APIF for the general service processing unit 62.

[0087] Specifically, the general service processing unit 62 performs a series of processes composed of one or more general (anonymity business) information processing applications. When processed as a symbol (for example, the address is LPID. Addr), this must be the symbol held by the APIF processing unit 64 first, so it is set at the time of system implementation 'configuration.

In addition, the service itself is set on the infrastructure including APIF when this system is implemented.

[0088] At this time, the information power general service processing unit 6 included in the APIF at the above timing.

Set to 2.

However, development of each application itself is performed based on separately published LPID and APID, and after each application is completed, service settings using this are set on the actual system. , APIF processor 64 and A

Settings for object access are made with the PIF processing unit 64 while confirming the consistency of the service ID, APID, and LPID.

FIG. 21 is a second diagram showing the flow of information in the information access control system 1 (FIG. 1). The user of the information providing apparatus 2 (information provider) by the information access control program 40

) Authentication and anonymous ID creation.

As shown in FIG. 21, a communication session is established between the information providing device 2, the information access control server 4, and the AP server 6, and the information providing device 2 is connected to the information access control program 4

Authentication is requested to 0 information access control program 400 (FIG. 8).

[0090] Upon authenticating the information provider, the authentication processing unit 400 of the information access control program 40 outputs information provider information to the anonymous ID processing unit 42.

The anonymous ID processing unit 42 creates an anonymous ID from the information provider information, and outputs it to the UI processing unit 44, the access control processing unit 54, and the order number management unit 66 of the AP server program 60 (Fig. 17). To do.

The order number management unit 66 of the AP server program 60 (Fig. 17) associates the order number input from the input / output device 126 of the AP server 6 with the anonymous ID input from the anonymous ID processing unit 42, The order number information shown in Fig. 18 is created, and the created order number information is stored and managed.

[0091] The anonymous ID is processed so as to maintain consistency with the information and processing shown in the following (1) to (3). It is done.

In other words, anonymous ID is managed for each transaction in conjunction with the results of UI processing and APIF processing.

(1) General information acquired by UI object processing unit 444,

(2) Processing in the APIF management unit 548 of the access control processing unit 54 (Fig. 10), and

(3) Session processing section Session information used for processing by 250.

FIG. 22 is a third diagram showing the flow of information in the information access control system 1 (FIG. 1). Information is obtained from a service request made from the information providing device 2 to the AP server 6. Indicates the policy presentation and permission for the user (information provider) of providing device 2.

FIG. 23 is a diagram showing the flow of information inside the identification information processing unit 52 and the information access control unit 54 (FIGS. 8 and 10) of the information access control program 40 in the information flow shown in FIG.

As shown in FIGS. 22 and 23, a communication session is established between the information providing device 2, the information access control server 4, and the AP server 6.

The user (information provider) of the information providing device 2 specifies the service ID by operating the UI image for service provision to the general service processing unit 62 of the AP server program 60 (Fig. 17), and shopping. Request new services such as

In response to this request, the general service processing unit 62 executes processing for realizing the requested service, and returns the processing result to the information providing apparatus 2.

The general service processing unit 62 notifies the APIF processing unit 64 of a new service request, its service ID, and LPID.

When a service request is sent from the information providing device 2 to the AP server 6, the service ID is not directly pointed to, and the UI object processing unit 444 of the UI processing unit 44, which is user interaction processing, is linked with the AP server 6. A service ID is specified.

In other words, links to menus and information on the UI screen can be described as links to process calls (HREF) as well as general Web service screens (HTML), so the UI adapter responsible for screen control Processing unit 446, UI object processing unit 444, and actual processing The AP server 6 that activates itself determines the service ID to be used.

[0094] The APIF processing unit 64 creates a new identification information required for the newly requested service from the APIF management unit 548 of the access control processing unit 54, and creates a service ID and LPID. Request by specifying etc.

The APIF management unit 548 requests the identification information policy management unit 540 to present a policy for the information providing apparatus 2 by designating a service ID, LPID, and the like.

The identification information policy management unit 540 outputs a policy to be presented to the information provider to the UI processing unit 44.

As shown in FIG. 4, the UI processing unit 44 requests the information providing device 2 to input identification information, and further, the policy input from the identification information policy management unit 540 is sent to the information providing device 2. It is displayed and presented to the information provider.

Please provide the information to be specified when APIF processing unit 64 requests APIF management unit 548 to create new identification information.

Note that when the APIF processing unit 64 requests creation of new identification information, the service ID, APID, LPID, and processing request (new acquisition Z creation) are sent to the APIF management unit 548.

Further, when the APIF management unit 548 requests the identification information policy management unit 540 to submit a policy, it sends a service ID, APID, and LPID.

However, when APID for new service subscription etc. is sent, LPID is specified as a set, so it is possible to decide the policy presented by service ID alone, service ID and APID set.

[0096] When the information provider performs an operation for permitting the presented policy to the information providing apparatus 2, the information providing apparatus 2 performs the identification information policy management unit 5 40 of the access control processing unit 54. (Fig. 10) is notified of permission for the presented policy.

Upon receiving this permission, the identification information policy management unit 540 outputs an ACL setting condition to the ACL management unit 542.

The ACL management unit 542 creates a new ACL row (FIG. 16), and stores it in the access control processing unit 544. Further, the ACL management unit 542 outputs the identification information pointer included in the new ACL to the UI processing unit 44.

The ACL management unit 542 requests the identification information management unit 522 to create new identification information.

The UI processing unit 44 outputs the identification information pointer from the ACL management unit 542 to the identification information management unit 522.

The identification information management unit 522 stores the new identification information in the identification information DB 524 in response to the identification information pointer from the UI processing unit 44 and the request for creating new identification information from the ACL management unit 542. Create a region.

FIG. 24 is a fourth diagram showing the flow of information in the information access control system 1 (FIG. 1), and registration of identification information (entity) from the information providing device 2 to the information access control server 4 is performed. Show.

FIG. 25 is a diagram showing a flow of information inside the identification information processing unit 52 and the information access control unit 54 (FIGS. 8 and 10) of the information access control program 40 in the information flow shown in FIG.

As shown in FIGS. 24 and 25, a communication session is established between the information providing apparatus 2 and the information access control server 4.

When the information provider who has granted the identification information policy inputs the identification information (substance) to the information providing device 2, the information providing device 2 sends the identification information to the UI object processing unit 444 of the identification information processing unit 52 ( Entity).

UI object processing unit 444 outputs the identification information (entity) received from information providing apparatus 2 to identification information management unit 522, and identification information management unit 522 receives the identification information received from UI object processing unit 444. Information (entity) is stored and managed in an area provided in the identification information DB 524.

FIG. 26 is a fifth diagram showing the flow of information in the information access control system 1 (FIG. 1). The transmission of identification information (entity) from the information access control server 4 to the information using device 3 is performed. Show.

FIG. 27 shows the identification of the information access control program 40 in the information flow shown in FIG. FIG. 11 is a diagram showing a flow of information inside the information processing unit 52 and the information access control unit 54 (FIGS. 8 and 10).

As shown in FIGS. 26 and 27, the information utilization device 3, the information access control server 4,

A communication session is established with the AP server 6.

The UI processing unit 44 acquires general information (FIG. 13A) from the UI processing unit 44.

The general information acquired by the UI processing unit 44 is the data model included in the UI processing unit 44.

Processing is performed based on (FIG. 5), and is output to the AP server 6 together with the anonymous ID as shown in FIG. 13 (B).

[0100] As with the general service processing unit 62, the service ID need not be sent directly to the information use device 3 displaying the information user's screen.

When an information user logs on and his / her session is set, an information user can request a predetermined service by clicking on a menu or an information item link on the screen. It is sent as service designation information to AP Sano 6 via object processing or directly.

Further details will be described.

[0101] When the service is provided via the Web server, the menu selection information is sent to the UI adapter processing unit 446 via the Web (httpsano for communication), which is the communication processing function (device). It accepts that a service selection event has occurred on the Web screen of a specific service user whose session has been confirmed.

This service request event is sent as a service request to the AP server 6 by the UI object processing unit 444 combined with the following attached information as necessary.

If the HTML file etc. of the service selection screen is registered in advance on the Web server and the corresponding CGI is set, the service request may be sent directly to the AP server 6.

In other words, this depends on the judgment of the person in charge of system implementation.

[0102] When the user (information user) of the information utilization device 3 specifies the order number and requests the AP server 6 for the service for the general information, the general service processing unit 62 uses the order number as the order number. Output to manager 66 and request anonymous ID corresponding to order number In response to this request, the order number management unit 66 returns an anonymous ID corresponding to the order number to the general service processing unit 62.

The general service processing unit 62 obtains general information (FIG. 13 (B)) from the general information management unit 68 using the obtained anonymous ID.

[0103] The general service processing unit 62 performs a service corresponding to the order number on the general information obtained from the general information transmitting unit 68, and the processing result obtained by the processing of the service is used as the information utilization device 3, The information is returned to the information utilization device 3 through a session established between the information access control Sano and the AP server 6.

Furthermore, the general service processing unit 62 requests the APIF processing unit 64 to acquire identification information by specifying the LPID and anonymous ID corresponding to the provided service.

The general service processing 62 deals with general business processing with high anonymity, and various processing can be assumed as the processing performed by the general service processing unit 62.

[0104] Here, as the processing of the general service processing unit 62, in addition to the power exemplified in order processing, in addition to the customer (information provider) such as inventory confirmation, delivery processing and product customer support, etc. Can be processed based on general information such as “Product Number”, “Order Number”, “Due Date”, and “Region”.

In general, the processing of business information using a computer is generally a general-purpose repetitive process that can handle any customer, even if the branching of processing depending on conditions Z is selected. However, the information access control system 1 is further devised so that personally identifiable data (identification information) is isolated from the data to be processed.

That is, the information access control system 1 can perform general information processing similar to that in a general information processing system in addition to information processing that involves isolation of identification information.

The APIF processing unit 64 requests the APIF management unit 548 to transmit identification information to the information using device 3.

The APIF management unit 548 returns to the APIF processing unit 64 result information indicating whether or not the processing for this request has been successfully completed.

[0106] The APIF management unit 548 sends the information utilization device 3 to the AP server 6 with respect to the ACL management unit 542. Requests the ACL management unit 542 to perform processing for transmitting the identification information corresponding to the requested service, specifying the service ID and LPID.

The ACL management unit 542 acquires the identification information pointer of the identification information to be transmitted to the information using apparatus 3 from the ACL using the specified information, and outputs it to the UI processing unit 44.

[0107] Note that the AP specific processing unit 546 performs filtering processing on identification information to be transmitted to the information using device 3 as necessary (for example, when the identification information is the address of the information provider, The process of taking out all prefectures within the address that is not included) is performed.

When processing by the AP specific processing unit 546 is performed, the ACL management unit 542 acquires the identification information pointer of the identification information from the ACL according to the processing result, and outputs it to the UI processing unit 44.

The information specified at the time of request to ACL management unit 542 varies depending on the conditions of the request (ACL search).

In order to create (register) a new identification information pointer, a full set of processing information such as a service ID, APID, LP ID, anonymous ID, and permission information is normally specified.

However, depending on the processing executed by the APIF processing unit 64, ACL search may be performed by partial specification.

The information access control system 1 normally promises identification information processing that reflects the information provider's intention (to achieve compliance), so a set of service ID, APID, LPID, and anonymous ID processing information is sent. And a pointer to identification information that conforms to this will be output.

Also, multiple anonymous IDs that match these can be extracted from the service ID, APID, and LPID.

[0109] For example, an anonymous list of customers who are currently receiving a specific service and who have a predetermined LPID can be created.

Based on this, for example, if the LPID is an address, an address confirmation target person list can be created. If an extended direct mail flag is added to the processing information area, an anonymous list can be created. A mail delivery list can be created. Specifically, when direct mail is sent, it is possible to request a pointer to identification information other than just an anonymous ID. In this case, the information user type or user ID option is required for the processing information option. It is said.

[0110] The UI processing unit 44 outputs the identification information pointer obtained from the ACL management unit 542 to the identification information management unit 522, and the identification information management unit 522 displays the identification information indicated by the identification information pointer. (Substance) is output to the information utilization device 3.

The information utilization device 3 associates the processing result of the general service returned from the information access control server 4 in the same communication session with the identification information (substance), and the input / output device 126 of the information utilization device 3 (FIG. 2). For use by information users.

[0111] [Overall operation of information access control system 1]

The overall operation of the information access control system 1 (FIG. 1) will be described below.

First, identification information registration processing from the information providing apparatus 2 to the information access control server 4 will be described.

FIG. 28 is a first communication sequence diagram showing the overall operation of the information access control system 1 shown in FIG. 1. The user (information provider) of the information providing device 2 for the information access control server 4 This shows the processing (S10) from authentication to registration of identification information (entity). As shown in FIG. 28, in step lOO (SlOO), the information provider 2 requests the information access control server 4 to authenticate the information provider.

In step 102 (S102), the information access control server 4 authenticates the information provider.

[0113] In step 104 (S104), the information provider requests the AP server 6 for a new service such as shopping.

In step 106 (S106), the AP server 6 performs an authentication process with the information access control server 4, and further requests the information access control server 4 to create new identification information. Send.

In step 108 (S108), the information access control server 4 requests the information providing apparatus 2 (information provider) to input identification information and presents an identification information policy.

[0114] In step 110 (S110), the information providing apparatus 2 (information provider) Grant Shi.

In step 112 (S112), the information providing apparatus 2 (information provider) transmits identification information (substance) to the information access control server 4.

The information access control server 4 stores and manages the identification information (entity) from the information providing device 2.

In step 114 (S114), the information providing apparatus 2 registers general information in the information access control server 4 as necessary.

In step 116 (S116), the AP server 6 provides the requested new service to the information providing apparatus 2 (information provider).

Next, a process for transmitting identification information (substance) from the information access control server 4 to the information using device 3 will be described.

FIG. 29 is a second communication sequence diagram showing the overall operation of the information access control system 1 shown in FIG. 1, and the identification information (entity) from the information access control server 4 to the information using device 3 The processing up to the transmission of (S14) is shown.

As shown in FIG. 29, in step 140 (S140), the information use device 3 (information user) requests the information access control server 4 for authentication.

In step 142 (S142), the information access control server 4 authenticates the information use device 3 (information user).

[0116] In step 144 (S144), the information utilization device 3 requests the AP server 6 for a service such as a shipping fee for the ordered item or a notification of a delivery date.

In step 146 (S 146), the AP server 6 performs an authentication process for the information access control server 4 and requests transmission of identification information (substance) to the information use device 3. In step 148 (S 148), the AP server 6 requests the general information necessary for realizing the service from the information access control server 4, and the information access control server 4 requests the general information in response to this request. Sent to AP server 6.

In step 150 (S 150), the AP server 6 transmits the processing result of the service (shipping fee, information indicating a shipping date, etc.) to the information utilization apparatus 3.

In step 152 (S152), the information access control server 4 Sends the identification information (entity) corresponding to the requested service to the information utilization device 3 Industrial applicability

[0118] The present invention can be used to control access to specific information.

Explanation of symbols

[0119] 1 · · · † Blueprint access control system,

100 · “Network,

2. Information providing device,

120 ·· 'Main body,

122 •• CPU,

124 · “Memory,

126 · Input / output devices,

128 ... 'Communication device,

130. • Recording device,

132 · Recording media,

20 ··· ί Blue Bulleting Program,

22 · IF, control unit,

240 ... Policy presentation section,

242 ... Policy Authorization Department,

244 ... Identification information generator,

246 ··· Authentication Department,

248 ... General Information Creation Department,

250 ··· Session processing part,

260 ··· Communication processing unit,

3. Information usage equipment,

30… Information usage program,

300 ... Service request section

302 ... Processing result utilization department, · · · Information access control server,

0 ·· 'Information access control program,

400- Authentication processing part,

402- Information provider master DB,

428- Node Management Department,

430- node, DB,

42 ... Anonymous ID processing part

420 · 'Anonymous ID creation department,

422'Anonymous ID Management Department,

44 ...

440 · • General information receiving department,

442 · General information transmitter,

444 · UI object processing part

446 · • UI adapter processing part,

46 ··· Service definition section,

460 · SDT,

462, identification information object creation unit,

464 · 'Service · ΑΡ Configuration Management Department,

466 'DB outside identification information object,

468 · 'Service · ΑΡ Configuration Management Department,

470 · APIF creation, management department,

472 • APID'LPID creation part,

474 • AP specific process creation part,

476 · 'Identification information UI object creation part,

478 • ACL creation section,

480 · Policy creation department,

482 · 'Policy presentation section,

• Identification information entity definition section, 52 Information identification section, 522 Identification information management section, 524 Identification information DB, 526 Usage history creation section, 528 ',' Usage history 08, ΑΡ server,

60 · · · ΑΡ server program,

62 General Service Processing Department

620 ... Execution control part, 622 ... Process result transmission part, 626 ...

68 General Information Management Department,

680 General Information Department,

682 General information storage unit,

684 General Information DB,

Claims

The scope of the claims

[1] Information providing apparatus that provides first information that can be used for identification of the presence and second information other than the first information, and information access control apparatus. And an information access control system having an information processing device,

The information processing apparatus includes:

First rule presenting means for presenting a rule of access to the first information to the information providing device;

Information processing means for processing the second information provided in association with an identifier corresponding to the first information;

Have

The information providing apparatus includes:

Information providing means for providing the first information and the second information;

A first licensing means for authorizing the presented rules;

Have

The information access control device includes:

Identifier generating means for generating the identifier;

An information providing means for providing the generated identifier in association with second information corresponding to the identifier and providing the information processing apparatus;

Information access control means for controlling whether or not to permit access to the first information corresponding to the rule according to the permitted rule;

Have

Information access control system.

[2] The information access control device includes:

Definition data creating means for creating definition data for defining a method of presenting an access rule for the first information and processing contents in the processing device in association with each predetermined existence;

According to the method for presenting the access rule included in the created definition data, the information providing device provides the access rule for the first information from the information processing device. The second rule presentation means presented to

The information access control system according to claim 1, further comprising:

[3] An information use device that requests processing to the information processing device according to the content of processing included in the created definition data, and uses the first information corresponding to the requested processing

Further comprising

The information access control means transmits the first information permitted for the access to the information utilization apparatus.

The information access control system according to claim 2.

[4] The predetermined presence is an individual,

The first information is identification information that can identify an individual,

The second information is general information related to an individual,

An information use device that uses the processing result and the identification information corresponding to the processing result.

Further comprising

The information access control device includes:

Processing result providing means for providing identification information permitted to access to the information using apparatus

Further have

The information access control system according to claim 1 or 2.

[5] An information access control apparatus that performs information access control on the first information that is related to a predetermined presence and that can be used to identify the presence, wherein the information related to the presence Including the second information other than the first information, the rules of access to the first information are presented, permission is given to the presented rules, and the identifier corresponds to the first information Predetermined information processing is performed on the second information provided with the attached information,

Identifier generating means for generating the identifier;

The generated identifier is associated with the second information corresponding to the identifier, Information providing means provided for information processing;

Information access control means for controlling access to the first information corresponding to the rule according to the permitted rule;

An information access control device.

[6] Definition data creating means for creating definition data for defining a method of presenting an access rule for the first information and the content of the information processing in association with each predetermined presence;

An access rule presenting means for presenting an access rule for the first information from the information processing device to the information providing device according to a method for presenting an access rule included in the created definition data;

6. The information access control device according to claim 5, further comprising:

[7] The information processing is performed according to the content of the process included in the created definition data,

7. The information access according to claim 6, wherein the information access control means permits access to the first information that is the first information corresponding to the requested information processing and to which the access is permitted. Control device.

[8] The processing result is used in association with the identification information corresponding to the processing result,

Processing result providing means for providing the identification information permitted to be accessed for the use

The information access control device according to claim 5, further comprising:

[9] First authentication means for authenticating a user who uses the first information for which the access is permitted

Further comprising

The processing result providing means provides a processing result corresponding to the identification information to the authenticated user.

The information access control device according to claim 8.

[10] a first authentication means for authenticating the existence; Further comprising information storage means for storing the first information relating to the authenticated presence,

The information access control means controls access to the stored first information.

The information access control device according to claim 5.

[11] The information storage means deletes the stored first information after a set time has elapsed.

The information access control device according to claim 10.

[12] History means for taking a history of access to the first information

The information access control device according to claim 5, further comprising:

[13] rule presenting means for presenting the rules;

Permission accepting means for accepting permission for the presented rules;

Further comprising

The information access control means controls access to the first information based on the presented rule and permission for the rule.

The information access control device according to claim 5.

[14] Image defining means for defining a display image used for displaying the rule to the licensee who performs the license

Further comprising

The rule presenting means displays the rule to the licensee using the defined display image.

The information access control device according to claim 13.

[15] The rule presenting means interactively displays the rule to the licensee who performs the license.

The information access control device according to claim 13 or 14.

[16] The predetermined entity is an individual,

The second information is general information related to an individual. The information access control device according to any one of claims 5 to 15.

[17] An information processing apparatus for processing information relating to a predetermined presence, wherein the information relating to presence includes first information that can be used to identify the presence, and second information other than the first information. The first information is accessed according to rules,

A rule presenting means for presenting a rule of access to the first information;

An information processing apparatus comprising: information processing means for processing the second information corresponding to the first information.

[18] The predetermined entity is an individual,

The second information is general information related to an individual.

The information processing apparatus according to claim 17.

[19] An information access control method for performing information access control on first information that is information related to a predetermined presence and can be used to identify the presence, wherein the information related to the presence is the first information Including the second information other than the first information, the rules of access to the first information are presented, permission is given to the presented rules, and the identifier corresponding to the first information is supported Predetermined information processing is performed on the second information provided attached thereto,

An identifier generating step for generating the identifier;

An information providing step of providing the generated identifier in association with second information corresponding to the identifier and providing the information for the information processing;

An information access control step for controlling access to the first information corresponding to the rule according to the permitted rule;

An information access control method comprising:

[20] An information processing method for processing information about an individual, wherein the information about the individual includes identification information that can be used for identifying the individual and general information other than the identification information, and the identification information is Accessed according to the rules,

A rule presentation step for presenting a rule of access to the identification information; an information processing step for processing the general information corresponding to the identification information; An information processing method comprising:

[21] A program for performing information access control on first information that is related to a predetermined presence and can be used to identify the presence, wherein the information related to the presence is the first information Including the second information other than the above, the rule of access to the first information is presented, permission is given to the presented rule, and the rule is associated with the identifier corresponding to the first information. Predetermined information processing is performed on the provided second information,

An identifier generating step for generating the identifier;

Information access control program that causes a computer to execute.

[22] A program for processing information relating to an individual, wherein the information relating to an individual includes identification information that can be used for identification of the individual and general information other than the identification information. Accessed according to

An information processing program for causing a computer to execute a rule presentation step for presenting a rule for access to the identification information, and an information processing step for processing the general information corresponding to the identification information.