WO2022163741A1 - データ流通制御方法、データ流通制御システム及び認可サーバ - Google Patents
データ流通制御方法、データ流通制御システム及び認可サーバ Download PDFInfo
- Publication number
- WO2022163741A1 WO2022163741A1 PCT/JP2022/003015 JP2022003015W WO2022163741A1 WO 2022163741 A1 WO2022163741 A1 WO 2022163741A1 JP 2022003015 W JP2022003015 W JP 2022003015W WO 2022163741 A1 WO2022163741 A1 WO 2022163741A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- data
- authorization server
- distribution control
- evaluation value
- risk
- Prior art date
Links
- 238000013475 authorization Methods 0.000 title claims abstract description 130
- 238000009826 distribution Methods 0.000 title claims abstract description 58
- 238000000034 method Methods 0.000 title claims abstract description 47
- 238000011156 evaluation Methods 0.000 claims description 91
- 238000012544 monitoring process Methods 0.000 claims description 19
- 238000006243 chemical reaction Methods 0.000 description 42
- 238000012545 processing Methods 0.000 description 30
- 238000010586 diagram Methods 0.000 description 25
- 230000006870 function Effects 0.000 description 22
- 230000008901 benefit Effects 0.000 description 15
- 238000004891 communication Methods 0.000 description 15
- 230000008569 process Effects 0.000 description 14
- 238000004364 calculation method Methods 0.000 description 8
- 230000001629 suppression Effects 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 230000004931 aggregating effect Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 239000000470 constituent Substances 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000008676 import Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 238000012502 risk assessment Methods 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/604—Tools and structures for managing or administering access control systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
- G06F21/6254—Protecting personal data, e.g. for financial or medical purposes by anonymising data, e.g. decorrelating personal data from the owner's identification
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0281—Proxies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/105—Multiple levels of security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2101—Auditing as a secondary aspect
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2113—Multi-level security, e.g. mandatory access control
Definitions
- the present invention relates to data access control between data providers and data users, and data provision methods.
- City OS a data collaboration and distribution platform that can cross-link the data held by the government and the IoT data of infrastructure such as buildings and roads has been proposed.
- the City OS mediates the data from the provider (holder) to the data user, and the data user analyzes and processes the provided data to provide services. Data providers are reluctant to distribute valuable data among the data they possess.
- the data of the data provider when the data of the data provider includes personal information and sensitive information such as information on the movement of individuals, the data provider may be reluctant to provide or distribute such data, but the purpose of use Depending on the situation, the provision and distribution of data may be permitted.
- a data provider considers providing data to a data user, it is necessary to clarify the risks of providing data and the trust placed in the data user.
- Patent Document 1 is known as a technique for estimating risks when a data provider provides data to a data user.
- Patent Literature 1 describes a risk calculation device that calculates a risk when a data provider provides data to a data user. Based on the provided data and information on the data provider, the customer of the data provider, the data user, etc., the risk calculation device calculates risk factors related to the data itself, factors related to the data user, and Find the factors related to the relationship and calculate the risk index.
- access control is performed by calculating a risk index based on the risk factor of the data itself, the attributes of the data user, and the relationship between the data provider and the data user. There was a problem that the information about could not be calculated.
- data providers want to make decisions on data provision based not only on the risk of providing data, but also on the purpose of use of the provided data and the value of providing the data.
- the present invention has been made in view of the above problems, and it is an object of the present invention to control access to data based on the purpose of use of the data user and the level of data protection that creates value that satisfies the data owner. do.
- One aspect of the present invention is a data distribution control method in which an authorization server having a processor and a memory controls access to the data between a providing side computer that provides data and a using side computer that uses the data, a purpose achievement status notification step in which the user computer notifies the authorization server of the usage status of the data that has been authorized in the past; and protection level information regarding security measures when the user computer uses the data; a usage application step of applying a usage policy including the purpose of use of the data to the authorization server; and an access control step of controlling access of the user-side computer to the data of.
- the authorization server can calculate the reliability of the data user from the data owner's policy and the data user's policy, and can implement access control according to the reliability. For example, even if the data is personal information, data excluding sensitive information can be provided to data users by performing anonymization processing that the data owner can agree to provide.
- BRIEF DESCRIPTION OF THE DRAWINGS It is a block diagram which shows Example 1 of this invention and shows an example of a data distribution control system. It is a block diagram which shows Example 1 of this invention and shows an example of the connector by the side of a data provider. It is a block diagram which shows Example 1 of this invention and shows an example of the connector by the side of a data user. It is a block diagram which shows Example 1 of this invention and shows an example of an authentication authorization server.
- BRIEF DESCRIPTION OF THE DRAWINGS It is a figure which shows Example 1 of this invention and shows the concept of a data distribution control system. It is a graph which shows Example 1 of this invention and shows an example of the calculation model of reliability.
- FIG. 10 is a sequence diagram showing Embodiment 1 of the present invention and showing an example of processing from policy registration to data access authorization; It is a sequence diagram which shows Example 1 of this invention and shows an example of a data provision process. It is a figure which shows Example 1 of this invention and shows an example of an authorization table. It is a figure which shows Example 1 of this invention and shows an example of a risk evaluation table. It is a figure which shows Example 1 of this invention and shows an example of a protection level table. It is a figure which shows Example 1 of this invention and shows an example of a utilization purpose table. It is a figure which shows Example 1 of this invention and shows an example of a realization table. It is a figure which shows Example 1 of this invention and shows an example of a data conversion table. FIG.
- Example 3 is a diagram showing Example 1 of the present invention and showing an example of a provision policy; It is a figure which shows Example 1 of this invention and shows an example of a usage policy. It is a flowchart which shows Example 1 of this invention and shows an example of the calculation process of reliability. It is a block diagram which shows Example 2 of this invention and shows an example of a data distribution control system.
- FIG. 1 is a block diagram showing Embodiment 1 of the present invention and showing an example of a data distribution control system.
- the data distribution control system includes data provider sites OWN-1 to OWN-3 that provide data (original data 21), data user sites USR-1 to USR-3 that use data (converted data 31), Authentication and authorization server 200 for controlling data access from data provider sites OWN-1 to OWN-3 to data user sites USR-1 to USR-3, and data user site USR-1 according to the status of data usage. It includes a billing server 40 that calculates billing information for USR-3, and a network 70 that connects these sites and servers.
- the outline of the data distribution control system is used by data users such as individuals, companies, and organizations who want to create value from data only within the scope of the conditions (policies) permitted by the data providers such as individuals and corporations who own the data.
- the original data 21 to be used is used.
- the authentication authorization server 200 calculates the reliability (trust score) of the data user based on the policy of the data provider, the usage policy of the data user, and the operation status of the data in the policy determination unit 210 .
- the authentication authorization server 200 determines whether or not the original data 21 can be used according to the protection level of the data user. Determine the conversion policy (anonymization level) and notify the data provider site OWN.
- the data provider site OWN anonymizes the original data 21 according to the conversion policy (anonymization level) set by the authentication authorization server 200, generates converted data 31, and provides it to the data user site USR.
- the data provider site OWN includes a sensor system 60 that collects data from sensors attached to facilities and machines, a data provision system 20 that acquires data from the sensor system 60 and accumulates it as original data 21, and an authentication authorization server. 200 to register policies and provide original data 21.
- the sensor system 60 includes sensors (not shown) attached to equipment and machines, and computers (not shown) that collect and output data output by the sensors.
- the data providing system 20 stores data acquired from the sensor system 60 as the original data 21 in a storage device (not shown), and includes a computer that executes the work of the data provider. Also, the data providing system 20 outputs original data 21 in response to a request from the authentication authorization server 200 via the connector 12 .
- the connector 12 of the data provider site OWN includes a data communication unit 121 that communicates with the authentication authorization server 200, a data registration unit 122 that registers the data provider's policy etc. in the authentication authorization server 200, It includes a data conversion unit 123 that converts the original data 21 to generate converted data in response to a request. Details of the connector 12 will be described later.
- the authentication authorization server 200 includes a policy registration unit 220 that manages a provision policy when a data provider provides data and a usage policy when a data user uses data; It includes a policy determination unit 210 that determines whether or not access to the provided data is permitted based on a usage policy including the purpose of use of the data user and the level of data protection, based on an application. Details of the authentication authorization server 200 will be described later.
- the data user site USR uses a data utilization system 30 that analyzes or processes the converted data 31 acquired from the data provider site OWN and the converted data 31 processed by the data utilization system 30 to provide a predetermined service. It includes a service system 50 and a connector 11 that communicates with the authentication and authorization server 200 to register policies and apply for use of the conversion data 31 .
- the connector 11 of the data user site USR includes a data communication unit 111 that communicates with the authentication and authorization server 200, a usage application unit 112 that registers data user policies, usage applications, etc. in the authentication and authorization server 200, and a data usage system. It includes a usage monitoring unit 113 that monitors the usage status of the converted data 31 in 30 and notifies the authentication authorization server 200 . Details of the connector 11 will be described later.
- the data utilization system 30 is a computer that performs predetermined processing such as analysis or processing on the converted data 31 and provides the service system 50 with the processed data.
- the service system 50 is a computer that provides predetermined services based on the results of processing the conversion data 31 .
- the number of data provider sites OWN and data user sites USR is not limited to the above. Also, the data provider and the data user can be composed of different groups, organizations, or companies.
- the data user site USR and data provider site OWN can be configured by adding connectors 11 and 12 to existing sites.
- the connectors 11 and 12 function as interfaces for connecting the authentication authorization server 200 and existing sites.
- the authentication authorization server 200 instructs the connectors 11 and 12 to access data with a trust score based on the policy of the data provider and data user.
- FIG. 2 is a block diagram showing an example of the connector 12 on the data provider side.
- the connector 12 is a computer including a processor 71 , a memory 72 , a storage device 73 , a network interface 74 and an input/output device 75 .
- a data communication unit 121 , a data registration unit 122 , and a data conversion unit 123 are loaded into the memory 72 and executed by the processor 71 .
- the processor 71 operates as a functional unit that provides a predetermined function by executing processing according to the program of each functional unit.
- the processor 71 functions as the data converter 123 by executing processing according to a data conversion program. The same is true for other programs.
- the processor 71 also operates as a functional unit that provides functions of multiple processes executed by each program.
- Computers and computer systems are devices and systems that include these functional units.
- the network interface 74 is connected to the network 70 and the data providing system 20 for communication.
- the input/output device 75 includes an input device such as a keyboard, mouse or touch panel, and an output device such as a display.
- the data registration unit 122 transmits the data provider's policy received from the input/output device 75 to the authentication authorization server 200 .
- the data conversion unit 123 controls access by generating converted data 31 from the original data 21 specified by the authentication/authorization server 200 according to the conversion policy instructed by the authentication/authorization server 200 . Data conversion will be described later.
- FIG. 3 is a block diagram showing an example of the connector 11 on the data user side.
- the connector 11 is a computer including a processor 81 , a memory 82 , a storage device 83 , a network interface 84 and an input/output device 85 .
- the data communication unit 111 , the usage application unit 112 , and the usage monitoring unit 113 are loaded into the memory 82 and executed by the processor 81 .
- the processor 81 operates as a functional unit that provides a predetermined function by executing processing according to the program of each functional unit.
- the processor 81 functions as the usage monitoring unit 113 by executing processing according to a usage monitoring program. The same is true for other programs.
- the processor 81 also operates as a functional unit that provides functions of multiple processes executed by each program.
- Computers and computer systems are devices and systems that include these functional units.
- the network interface 84 is connected to the network 70 and the data utilization system 30 for communication.
- the input/output device 85 includes an input device such as a keyboard, mouse or touch panel, and an output device such as a display.
- the usage application unit 112 transmits the data user's policy received from the input/output device 85 to the authentication authorization server 200 .
- the usage monitoring unit 113 monitors how the data usage system 30 uses the converted data 31 and notifies the authentication authorization server 200 of it. Usage monitoring of the conversion data 31 will be described later.
- FIG. 4 is a block diagram showing an example of the authentication authorization server 200.
- the authentication authorization server 200 is a computer including a processor 201 , a memory 202 , a storage device 203 , a network interface 204 and an input/output device 205 .
- a policy determination unit 210 and a policy registration unit 220 are loaded into the memory 202 and executed by the processor 201 .
- the processor 201 operates as a functional unit that provides a predetermined function by executing processing according to the program of each functional unit.
- the processor 201 functions as the policy determination unit 210 by executing processing according to a policy determination program. The same is true for other programs.
- the processor 201 also operates as a functional unit that provides functions of multiple processes executed by each program.
- Computers and computer systems are devices and systems that include these functional units.
- the network interface 204 is connected to the network 70 and communicates with an external computer.
- the input/output device 205 includes an input device such as a keyboard, mouse or touch panel, and an output device such as a display.
- the storage device 203 has an authorization table 320, a risk evaluation table 330, a protection level table 340, a usage purpose table 350, a realization table 360, a data conversion table 370, a provision policy 410, and a usage policy 420. Stored.
- the authorization table 320 stores the result of judging whether or not access is permitted with respect to the data usage application from the data user site USR determined by the policy judgment unit 210 .
- the risk evaluation table 330 stores preset risks in the data user site USR and scores for the risks.
- the protection level table 340 stores the security level of data in the preset data user site USR and the score for the security level.
- the purpose of use table 350 stores preset purposes of use and scores for the purposes of use.
- the degree of realization table 360 stores preset scores regarding the possibility of achieving the purpose of use.
- the data conversion table 370 stores preset conversion processing.
- the provision policy 410 is information registered in the authentication authorization server 200 for the usage conditions of the original data 21 determined by the data provider site OWN.
- the usage policy 420 is information registered in the authentication authorization server 200 for usage conditions of the data of the data provider site OWN applied for by the data user site USR. The details of each of the above tables will be described later.
- All or part of the programs and data for realizing the processes of the connector 11, the connector 12, and the authentication authorization server 200 may be stored in advance in the storage devices 73, 83, and 203, or may be From a non-temporary storage device of another device connected to the network 70, or from a non-temporary storage medium, via the I/F provided in each of the connector 11, the connector 12, and the authentication authorization server 200, each storage It may be stored on the device.
- FIG. 9 is a diagram showing an example of the authorization table 320. As shown in FIG. Authorization table 320 stores the result of authorization by policy determination unit 210 for a usage application from data user site USR.
- Authorization table 320 includes authorization ID 321 , application ID 322 , data user 323 , data provider 324 , utilization system 325 , original data 326 , reliability 327 , converted data 328 , and provider system 329 . Include in one record.
- the authorization ID 321 is an identifier that permits the use of the original data 21 given by the policy determination unit 210 of the authentication authorization server 200 .
- the application ID 322 is an identifier of a data utilization application received by the authentication authorization server 200 from the data user site USR, and can be assigned by the authentication authorization server 200 .
- the data user 323 stores the identifier of the data user site USR that applied to use the data.
- the data provider 324 stores the identifier of the data provider site OWN that provides the original data 21 .
- the utilization system 325 stores the identifier of the data utilization system 30 that utilizes the converted data 31 obtained by converting the original data 21 .
- the original data 326 stores the file name or identifier of the original data 21 provided by the data provider site OWN.
- the reliability 327 stores the reliability TS calculated when the authorization ID is assigned, as will be described later.
- the type of anonymization applied to the field of the original data 21 may be stored instead of the reliability TS.
- the converted data 328 stores the name or identifier of the converted data 31 obtained by anonymizing the original data 21 .
- the providing system 329 stores the identifier of the data providing system 20 that manages the original data 21 .
- FIG. 10 is a diagram showing an example of the risk evaluation table 330.
- the risk evaluation table 330 is information in which an index (score) representing the risk of providing the original data 21 is preset by the data provider site OWN.
- the risk assessment table 330 includes occurrence events 331, assessment items 332, scores 333, and IDs 334 in one record.
- the event 331 is roughly classified into four types: loss of confidentiality (leakage), loss of integrity (falsification), loss of availability, and loss of ability to pursue accountability for the original data 21. is not limited to
- the evaluation item 332 stores the risk items identified by the data provider. Alternatively, an administrator or the like of the authentication authorization server 200 may set the evaluation items 332 .
- the score 333 stores a preset value for each evaluation item 332 .
- ID 334 stores the identifier of evaluation item 332 .
- the policy determination unit 210 aggregates scores 333 for each event 331 to calculate a risk evaluation value RD (Risk of Data).
- the risk evaluation value RD can be evaluated, for example, by calculating the maximum value of the scores 333 for each of the four occurrence events 331 and using a four-dimensional vector of the maximum values.
- FIG. 11 is a diagram showing an example of the protection level table 340.
- the protection level table 340 is information in which a protection level for data is preset based on context information in which the data user handles data (converted data 31).
- context information in which the data user handles data (converted data 31).
- the context information is composed of 4W1H related to data usage is shown, but the present invention is not limited to this.
- the context of this embodiment is about who (Who) accesses from where (Where), how often (When), how much volume (What), and how (How) to access data.
- An example of evaluation from a viewpoint (4W1H) is shown.
- the protection level table 340 includes context 341, evaluation item 342, score 343, and ID 344 in one record.
- a context 341 indicates a preset 4W1H classification.
- the evaluation item 342 stores protection items identified by the data provider, the administrator of the authentication authorization server 200, or the like.
- the score 343 stores a preset value for each evaluation item 342 .
- ID 344 stores the identifier of evaluation item 332 .
- the policy determination unit 210 aggregates the scores 343 for each context 341 to calculate a protection level evaluation value LP (Level of Protection).
- the protection level evaluation value LP can be calculated by the following formula, for example, when the values of the scores 343 for each of the five contexts 341 are represented by Who, Where, When, What, and How.
- FIG. 12 is a diagram showing an example of the usage purpose table 350.
- the purpose of use table 350 is information in which scores are set in advance with respect to two viewpoints of the social impact brought about by the use of the original data 21 and the return (benefit) to the data provider.
- the usage purpose table 350 is information registered in the policy registration unit 220 by the data user site USR.
- the purpose of use table 350 includes classification items 351, evaluation items 352, scores 353, and IDs 354 in one record.
- the classification item 351 stores the classification of the purpose of use, and in this embodiment, an example of classification into two categories, the magnitude of social impact and the benefits of the data provider, is shown, but it is not limited to this.
- the evaluation item 352 divides the magnitude of influence into four levels of small, medium, large, and extra-large, and the score 353 stores a preset value.
- the ID 354 stores an identifier for each evaluation item 352 .
- the policy determination unit 210 aggregates the score 353 for each classification item 351 to calculate a purpose of use evaluation value PD (Purpose of Data).
- the utilization purpose evaluation value PD can be evaluated by the following four-dimensional vector, for example, when the score of the classification item 351 is defined as PD_social as the degree of social influence and (PD_owner) as the benefit.
- PD (MAX (PD_social, PD_owner), MAX (PD_social, PD_owner), MAX (PD_social, PD_owner), MAX (PD_social, PD_owner)) ............(2)
- FIG. 13 is a diagram showing an example of the realization table 360.
- the realization table 360 is preset information for calculating the objective achievement level IAL (Impact Assurance Level), and stores preset scores regarding the possibility of achieving the usage purpose (utilization purpose evaluation value PD). .
- a realization table 360 includes a realization 361 and a score 362 in one record.
- a range of probability that the purpose of use is achieved is set.
- Score 362 stores a value corresponding to a range of probabilities.
- the connector 11 can acquire the realization degree table 360 from the authentication authorization server 200 .
- FIG. 14 is a diagram showing an example of the data conversion table 370.
- the data conversion table 370 is information in which details of processing for anonymizing the original data 21 are set in advance.
- the data conversion table 370 includes processing classification 371, technique 372, data type 373, application 374, and conversion ID 374 in one record.
- the processing classification 371 shows an example of three classifications of suppression processing, generalization processing, and disturbance processing, but is not limited to this.
- Suppression processing removes or replaces data.
- the generalization process transforms the data into representative values. Perturbation adds noise to the data.
- the technology 372 stores the technology that implements the processing classification 371.
- Application 374 stores the specific content of anonymization.
- the conversion ID 374 is used when the authentication authorization server 200 instructs the data provider site OWN to convert data.
- the authentication authorization server 200 refers to each table described above, calculates the reliability of the data user, and determines whether the data can be used. Calculation of reliability and the like will be described later.
- FIG. 15 is a diagram showing an example of the provision policy 410.
- the provision policy 410 is a usage condition of the original data 21 determined by the data provider site OWN.
- Offering Policy 410 combines Offering ID 411, Data Name 412, Data Provider 413, Offering System 414, Confidentiality 415, Integrity 416, Availability 417, Description Seeking 418, and Benefit 419 into one. Include in records.
- the provided ID 411 is an identifier set by the authentication authorization server 200 .
- the data name 412 stores the name or identifier of the original data 21 .
- the data provider 413 stores the identifier of the data provider site OWN.
- the providing system 414 stores the identifier of the data providing system 20 that stores the original data 21 .
- Confidentiality 415 to explanation pursuit 418 store an ID 334 corresponding to the evaluation item 332 for each event 331 in the risk evaluation table 330 .
- the confidentiality 415 "2" indicates that the evaluation item 332 of the risk evaluation table 330 is "personal information".
- the same is true for the values of completeness 416 to explanation pursuitability 418 .
- the benefit 419 is set with the data value expected by the data provider 413 .
- FIG. 16 is a diagram showing an example of the usage policy 420.
- the usage policy 420 is a data usage condition when the data user site USR applies for usage of the original data 21 .
- the usage policy 420 includes application ID 421, data name 422, data provider 423, data user 424, who 425, where 426, when 427, what 428, how 429, influence 430, and benefit 431 as one record. Included in
- the application ID 421 is an identifier set by the authentication authorization server 200.
- the data name 422 stores the name or identifier of the original data 21 desired by the data user site USR.
- Data provider 423 stores the identifier of the data provider site OWN.
- Data consumer 424 stores the identifier of the data consumer site USR.
- the impact 430 and the benefit 431 store IDs 354 corresponding to the evaluation items 352 for each classification item 351 of the purpose of use table 350 .
- the influence 430 "3" indicates that the influence of the purpose of use table 350 is "medium (enterprise, prefecture level)". The same is true for the benefit 431 value.
- FIG. 5 is a diagram showing the concept of the data distribution control system.
- the data distribution control system of this embodiment provides original data 21 to data users who want to create value from data within the scope of the conditions (policies) permitted by the data provider.
- the data provider In order to realize the concept of the data distribution control system, it is essential that the data provider has a willingness to provide data. To that end, the data provider must be able to trust that the data provider will benefit from the data provision and that the data user will use the data only within the scope of the conditions permitted by the data provider in providing the data. is important.
- the data distribution control system includes a PDP (Policy Decision Point) that determines whether or not access is permitted based on reliability, and a PEP (Policy Enforcement Point) that applies the determination result.
- PDP Policy Decision Point
- PEP Policy Enforcement Point
- the PDP in FIG. 5 corresponds to the policy determination unit 210 shown in FIG. 1, and the PEP to which the determination result is applied corresponds to the data conversion unit 123 in the connector 12 of the data provider site OWN.
- the policy determination unit 210 receives the risk evaluation value RD, evaluation value PD, evaluation value LP, and goal achievement level IAL via PIP (Policy Information Point).
- PIP Policy Information Point
- the MP (Monitoring Point) corresponds to the usage monitoring section 113 in the connector 11 of the data user site USR.
- the usage monitoring unit 113 (MP) monitors whether the data user is using the data usage system 30 in accordance with the usage purpose and usage conditions, and whether the value generated by the data usage is as promised. Record.
- the usage monitoring unit 113 of the connector 11 calculates the objective achievement level IAL based on the monitoring result and registers it in the policy registration unit 220 of the authentication authorization server 200 .
- the following procedure is assumed as a procedure for using the data distribution control system.
- the data provider data provider site OWN
- the data user data user site USR
- the data user site USR registers context information (4W1H information related to data usage) with the authentication authorization server 200 via the connector 11 .
- the authentication authorization server 200 acquires the terms of use (policy) agreed upon by the data provider and the data user, and determines whether or not the policy is satisfied.
- policy terms of use
- the authentication authorization server 200 acquires the policy of the data provider site OWN, the policy of the data user site USR, and the usage status of the conversion data 31 already in use, and obtains the aforementioned risk evaluation value RD, evaluation The reliability is calculated from the value PD, the evaluation value LP, and the goal achievement level IAL as described later.
- the authentication authorization server 200 sets a conversion policy (access policy) for anonymizing the original data 21 according to the calculated reliability, and notifies the connector 12 of the data provider site OWN.
- data converter 123 converts original data 21 based on the conversion policy received from authentication authorization server 200 to generate converted data 31, and converts data to data user site USR. 31 is provided.
- the authentication authorization server 200 determines that the value created by utilizing the data (converted data 31) acquired by the data user is the value linked to the purpose of use, and that the benefits provided to the data provider meet the agreed conditions. We will also continuously monitor whether the
- the authentication authorization server 200 notifies the billing server 40 of the value given to the data provider, and the billing server 40 pays the data user (data user site USR) for the value created by utilizing the converted data 31. to claim.
- FIG. 17 is a flow chart showing an example of reliability calculation processing performed by the authentication authorization server 200 . This process can be executed when an application for using the original data 21 is received from the data user site USR.
- the policy determination unit 210 of the authentication authorization server 200 determines the usage policy 420 of the usage application received from the data user site USR and the provision policy 410 of the data provider site OWN holding the data name 422 specified by the usage policy 420. (S41).
- the policy determination unit 210 acquires the values of confidentiality 415 to explanation pursuit 418 of the provision policy 410, and calculates the risk evaluation value RD from the risk evaluation table 330 (S42).
- the policy determination unit 210 calculates the maximum value of the score 333 for each of the four occurrence events (confidentiality 415 to explanation pursuit 418), and calculates the risk evaluation value RD as a four-dimensional vector of the maximum values.
- the policy determination unit 210 acquires the values of Who425 to Ho2429, which are the contexts of the usage policy 420, acquires the score 343 for each context from the protection level table 340, and calculates the protection level evaluation value LP ( S43).
- the protection level evaluation value LP can be calculated, for example, as shown in Equation (1) above.
- the policy determination unit 210 acquires the effect 430 and the benefit 431, which are the usage purposes of the usage policy 420, and calculates the usage purpose evaluation value PD (S44).
- the purpose-of-use evaluation value PD can be calculated, for example, as shown in the above equation (2).
- the policy determination unit 210 refers to the realization level table 360 from the monitoring status of the past conversion data 31 registered by the usage monitoring unit 113 of the connector 11 of the data user site USR, and calculates the objective achievement level IAL (S45). .
- the monitoring status of the converted data 31 in the past is, for example, the utilization rate of the converted data 31 in the data utilization system 30, the utilization rate is the realization degree 361 of the realization degree table 360, and the score 362 is calculated as the purpose achievement level IAL. can be done.
- the policy determination unit 210 calculates the reliability TS from the calculated risk evaluation value RD, protection level evaluation value LP, usage purpose evaluation value PD, and purpose achievement level IAL using the following equation.
- the policy determination unit 210 can calculate the reliability TS and notify the connector 12 of the data provider site OWN of access control according to the reliability TS. For example, when the reliability TS is positive, the policy determination unit 210 allows the data user site USR to use the original data 21 as it is without anonymizing it. On the other hand, when the reliability TS is negative, anonymization is performed according to the magnitude of the negative value to reduce the value of the protection level evaluation value LP, thereby realizing utilization of the data.
- FIG. 6 is a diagram showing an example of a reliability calculation model. In the illustrated example, the relationship between the protection level evaluation value LP, the purpose of use evaluation value PD, and the purpose achievement level IAL is shown with respect to the preset risk function R.
- FIG. 6 is a diagram showing an example of a reliability calculation model. In the illustrated example, the relationship between the protection level evaluation value LP, the purpose of use evaluation value PD, and the purpose achievement level IAL is shown with respect to the preset risk function R.
- the Current Risk in the figure is the value of the risk R calculated from the preset risk function from the protection level evaluation value LP of the usage policy 420 .
- a reliability TS is calculated from the utilization purpose evaluation value PD and the purpose achievement level IAL.
- a feature of the policy determination unit 210 is that the reliability TS is calculated by taking into account not only the risk on the data user site USR side, but also the purpose of use of the data user site USR and the past record of use of the converted data 31. be.
- ⁇ Access control> A function DAC that converts the original data 21 (data) into converted data 31 (data') that can be provided to the data user site USR based on the reliability TS,
- KL information amount As to how much the information amount of the transformed data 31 should be reduced with respect to the original data 21, the Kullback-Leibler information amount (hereinafter referred to as KL information amount), which is used to measure the distance in the probability distribution space, is used.
- Pi and Qi are the probabilities when the selected value is i according to the probability distributions P and Q, respectively.
- the data access control function DAC is based on the trust score (confidence) function TSF with respect to the distance function d, the vd labeled data data and its discrete probability distribution P, the protection level lp, the purpose of use pd, the transformed data For a discrete probability distribution Q of
- the authentication authorization server 200 can generate a conversion policy by using suppression, generalization, disturbance, and the like.
- a well-known or known method such as K-anonymization may be used.
- FIG. 7 is a sequence diagram showing an example of processing from policy registration to data access authorization.
- the connector 12 (12-1 in the figure) of the data provider site OWN transmits the provision policy 410 (FIG. 16) in which the data user sets the usage conditions of the original data 21 to the authentication authorization server 200, and requests registration. Make a request (S1).
- the policy registration unit 220 receives the provision policy 410 and stores it in the storage device 203 .
- the policy registration unit 220 registers the data name 412 specified by the provision policy 410 as information for calculating the risk evaluation value RD (Risk of Data) (S2).
- the usage monitoring unit 113 of the connector 11 monitors the usage status of the converted data 31 in the data usage system 30 (30-1 in the figure) (S3).
- the object whose usage status is monitored by the usage monitoring unit 113 is the converted data 31 that has already been authorized and is in use.
- the usage monitoring unit 113 acquires the realization degree table 360 from the authentication authorization server 200 and calculates the goal achievement level IAL (S4).
- the usage monitoring unit 113 registers the calculated goal achievement level IAL in the authentication authorization server 200 (S5).
- the goal achievement level IAL received by the policy registration unit 220 is registered in the storage device 203 as the goal achievement level IAL for each data user site USR (S6).
- the use application unit 112 of the connector 11 sends a use application to the authentication authorization server 200. Send (S7).
- the usage policy 420 shown in FIG. 16 including the protection level and purpose of use is attached to the usage application (S7).
- the policy registration unit 220 of the authentication authorization server 200 retrieves the purpose achievement level IAL of the data user 424 described in the usage policy 420 from the storage device 203, and searches the original data 21 corresponding to the data name 422 of the usage policy 420.
- a provisioning policy 410 is retrieved (410).
- the policy registration unit 220 acquires four occurrence events (confidentiality 415 to explanation pursuit 418) for calculating the risk evaluation value RD from the provision policy 410, and acquires the purpose achievement level IAL of the data user 424. It is output to the policy determination unit 210 (S9).
- the policy determination unit 210 calculates the risk evaluation value RD, the purpose of use evaluation value PD, and the protection level evaluation value LP from the four occurrence events, and then adds the purpose achievement level IAL to calculate the reliability TS. do. Then, if the protection level evaluation value LP (or context information) of the data user site USR satisfies a predetermined condition, the policy determination unit 210 permits access to the data user site USR (S10).
- the policy determination unit 210 determines the conversion policy (anonymization level) as described above and sends the authorization ID to the policy registration unit 220 in order to perform access control according to the value of the reliability TS. Notify (S11). Also, after determining the authorization ID, the policy judgment unit 210 adds a new record to the authorization table 320 and stores the superordinate method of the data user site USR and the data provider site OWN.
- the policy registration unit 220 of the authentication authorization server 200 notifies the connector 11 of the data provider site OWN of the authorization ID and the conversion policy to permit access to the original data 21 .
- the policy registration unit 220 notifies the connector 11 of access denial.
- FIG. 8 is a sequence diagram illustrating an example of data provision processing. This process is executed when the data user site USR transmits an acquisition request for the original data 21 . At the data user site USR, the data utilization system 30 transmits an acquisition request for the original data 21 to the connector 11 (S21).
- the data communication unit 111 of the connector 11 determines whether or not the authorization ID has been acquired for the original data 21 requested by the data utilization system 30 (S22). Since the authorization ID received from the authentication authorization server 200 is stored in the storage device 73 of the connector 11, it can be retrieved from the file name of the original data 21 or the like.
- the data communication unit 111 of the connector 11 transmits the data acquisition request and the authorization ID to the connector 12 of the data provider site OWN (S23).
- the data communication section 121 of the connector 12 transfers the authorization ID to the data conversion section 123 (S24).
- the data conversion unit 123 transmits the authorization ID to the authentication authorization server 200 and inquires about the presence or absence of authorization (S25).
- the authentication authorization server 200 searches the authorization table 320 with the authorization ID received by the policy determination unit 210 and acquires the reliability 327 (S26).
- the policy determination unit 210 generates a conversion policy (anonymization policy) in order to perform access control according to the obtained value of the reliability 327 (S27).
- the policy determination unit 210 of the authentication authorization server 200 transmits a conversion policy indicating that authorization has been completed to the connector 12 of the data provider site OWN (S28). If the policy determination unit 210 does not correspond to the authorization ID 321, the policy determination unit 210 notifies the connector 12 that it is not authorized, and terminates the process.
- the data conversion unit 123 of the connector 12 When the data conversion unit 123 of the connector 12 receives the conversion policy indicating that it has been authorized, it notifies the data communication unit 121 that the use of the original data 21 specified by the authorization ID is authorized (S29).
- the data communication unit 121 of the connector 12 requests the data providing system 20 to acquire the original data 21 (S30).
- the data providing system 20 transmits the specified original data 21 to the connector 12 (S31).
- the data communication section 121 receives the original data 21 and transfers it to the data conversion section 123 (S32).
- the data conversion unit 123 anonymizes the original data 21 using the conversion policy received from the authentication authorization server 200 to generate converted data 31 (S33), and transmits the converted data 31 to the data communication unit 121 (S34). When the reliability 327 is positive, the original data 21 may be output as the converted data 31 without being anonymized.
- the data communication unit 121 of the connector 12 transmits the converted data 31 to the connector 11 of the data user site USR that uses the converted data 31 (S35).
- the data communication unit 111 of the connector 11 transmits the converted data 31 received from the data provider site OWN to the data utilization system 30 (S36).
- the data utilization system 30 can analyze or process the acquired converted data 31 and provide it to the service system 50 to obtain value as consideration for providing the service.
- the data distribution control system of this embodiment determines whether or not access to the provided data is permitted based on the purpose of use of the data user who creates value that satisfies the data owner and the level of data protection. becomes possible.
- the authentication authorization server 200 calculates the data user's reliability TS from the data owner's policy (providing policy 410) and the data user's policy (usage policy 420), and sets a conversion policy according to the reliability TS. is generated, access control to the original data 21 can be realized.
- the usage conditions of the original data 21 are not subjectively predetermined by the data provider, but the risk (RD) of the original data 21 from which the usage conditions are derived.
- the usage conditions (policy) can be dynamically derived from the purpose of use (PD) presented by the data user.
- the rights of data providers can be protected and harmless by anonymizing the original data 21 and introducing a mechanism that protects and detoxifies the data to the extent that it does not interfere with the use of the data. Protection and free circulation of the original data 21 can revitalize the industry.
- FIG. 18 is a block diagram showing an example of the data distribution control system of the second embodiment.
- the authentication authorization server 2000 stores the conversion data 31 and provides it as a database to the data user sites USR-1 and USR-2.
- Other configurations are the same as those of the first embodiment.
- the data user site USR can access the conversion data 31 of the authentication authorization server 2000 as needed, so that the storage device of the data utilization system 30 can be saved.
- the data distribution control system of the above embodiment can be configured as follows.
- An authorization server (authentication authorization server 200) having a processor (201) and a memory (202) exchanges data (original data 21) with a providing side computer (data providing system 20) that provides data (original data 21) and data (converted data 31).
- a goal achievement status notification step (usage monitoring unit 113) of notifying the authorization server (200) of the usage status of (31), and security measures when the user computer (30) uses the data (31).
- usage application unit 112 of applying to the authorization server (200) a usage policy 420 including protection level information (340) regarding the data usage purpose (350); , the user computer (30 ), and an access control step (policy determination unit 210) for controlling access to the data distribution control method.
- the authentication authorization server 200 can calculate the reliability of the data user from the policy of the data provider (holder) and the policy of the data user, and can implement access control according to the reliability. For example, even if the data is personal information, data excluding sensitive information can be provided to data users by performing anonymization processing that the data owner can agree to provide.
- the providing side computer (20) approves the risk information (providing policy 410) regarding the risk of the data to be provided (risk evaluation table 330).
- a provision policy registration step (data registration unit 122) for registering in the server (200) is further included. wherein the risk information (410) is added to the purpose of use (350) of the above to control the access of the user computer (30) to the data (21) of the provider computer (20). control method.
- the access control step (210) is a step of calculating a risk evaluation value RD indicating the magnitude of risk from the risk information (410) (S42 ), calculating a protection level evaluation value LP indicating the degree of security measures from the protection level information (340) (S43), and calculating a use purpose evaluation value PD from the use purpose (350) of the data (21).
- a data distribution control method comprising: a step (S46) of calculating a reliability TS from LP, a utilization purpose evaluation value PD, and a purpose achievement level IAL; and a step of generating an access policy based on the reliability.
- the policy determination unit 210 calculates the reliability TS by including the purpose of use evaluation value PD and the purpose achievement level IAL in addition to the risk evaluation value RD and protection level evaluation value LP, so that the data provider site It is possible to obtain the trust of the data provider site OWN for the data user site USR to use the converted data 31 only within the scope of the conditions (provision policy 410) permitted by OWN in providing the original data 21.
- the purpose achievement level IAL is determined based on the utilization record of the data (31) that the user computer (30) has used in the past.
- the data user site USR sets the degree of social influence included in the usage policy 420 promised by the data user site USR and the realization rate of benefits to the data provider site OWN as the objective achievement level IAL. It is possible to define the expected value of the social impact promised for the use of the data 21 and the benefit to the data provider site OWN. By using the objective achievement level IAL when calculating the acceptable risk, it becomes possible to correct the risk evaluation value RD.
- the risk information (410) includes confidentiality (415), integrity (416) and availability (417) of the data (21). and a score (333) is set for each of the explanation pursuit (418).
- the data provider site OWN can define the value of the original data 21 to be provided by confidentiality 415, completeness 416, availability 417, and explainability 418.
- the present invention is not limited to the above-described embodiments, and includes various modifications.
- the above embodiments are described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the described configurations.
- addition, deletion, or replacement of other configurations for a part of the configuration of each embodiment can be applied singly or in combination.
- each of the above configurations, functions, processing units, processing means, etc. may be implemented in hardware, for example, by designing a part or all of them in an integrated circuit.
- each of the above configurations, functions, etc. may be realized by software by a processor interpreting and executing a program for realizing each function.
- Information such as programs, tables, files, etc. that implement each function can be stored in recording devices such as memory, hard disks, SSDs (Solid State Drives), or recording media such as IC cards, SD cards, and DVDs.
- control lines and information lines indicate what is considered necessary for explanation, and not all control lines and information lines are necessarily indicated on the product. In practice, it may be considered that almost all configurations are interconnected.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Automation & Control Theory (AREA)
- Medical Informatics (AREA)
- Storage Device Security (AREA)
Abstract
Description
データ流通制御システムは、データ(元データ21)を提供するデータ提供者サイトOWN-1~OWN-3と、データ(変換データ31)を利用するデータ利用者サイトUSR-1~USR-3と、データ提供者サイトOWN-1~OWN-3からデータ利用者サイトUSR-1~USR-3へのデータアクセスを制御する認証認可サーバ200と、データの利用状況に応じてデータ利用者サイトUSR-1~USR-3への課金情報を算出する課金サーバ40と、これらのサイト及びサーバを接続するネットワーク70を含む。
図9は、認可テーブル320の一例を示す図である。認可テーブル320は、ポリシ判定部210がデータ利用者サイトUSRからの利用申請について認可した結果を格納する。
図5は、データ流通制御システムのコンセプトを示す図である。本実施例のデータ流通制御システムは、上述したように、データ提供者が許可した条件(ポリシ)の範囲で、データから価値を生み出したいデータ利用者に、元データ21を提供する。
図17は、認証認可サーバ200で行われる信頼度の算出処理の一例を示すフローチャートである。この処理は、データ利用者サイトUSRから元データ21の利用申請を受け付けた場合に実行することができる。
信頼度TSに基づいて元データ21(data)をデータ利用者サイトUSRへ提供可能な変換データ31(data')に変換する関数DACを、
また、H(Q)=nであるとき、
図7は、ポリシ登録からデータアクセス認可までの処理の一例を示すシーケンス図である。
図8は、データ提供処理の一例を示すシーケンス図である。この処理は、データ利用者サイトUSRが元データ21の取得要求を送信した場合に実行される。データ利用者サイトUSRでは、データ利用システム30が元データ21の取得要求をコネクタ11に送信する(S21)。
以上のように、上記実施例のデータ流通制御システムは、以下のような構成とすることができる。
Claims (15)
- プロセッサとメモリを有する認可サーバが、データを提供する提供側計算機とデータを利用する利用側計算機の間で前記データのアクセスを制御するデータ流通制御方法であって、
前記利用側計算機が、過去に認可された前記データの利用状況を前記認可サーバへ通知する目的達成状況通知ステップと、
前記利用側計算機が、前記データを利用する際のセキュリティ対策に関する保護レベル情報と、前記データの利用目的を含む利用ポリシを前記認可サーバに申請する利用申請ステップと、
前記認可サーバが、前記データの利用状況と前記保護レベル情報と前記データの利用目的に基づいて、前記提供側計算機の前記データに対する前記利用側計算機のアクセスを制御するアクセス制御ステップと、を含むことを特徴とするデータ流通制御方法。 - 請求項1に記載のデータ流通制御方法であって、
前記提供側計算機が、提供する前記データのリスクに関するリスク情報を前記認可サーバに登録する提供ポリシ登録ステップを、さらに含み、
前記アクセス制御ステップは、
前記データの利用状況と前記保護レベル情報と前記データの利用目的に、前記リスク情報を加えて前記提供側計算機の前記データに対する前記利用側計算機のアクセスを制御することを特徴とするデータ流通制御方法。 - 請求項2に記載のデータ流通制御方法であって、
前記アクセス制御ステップは、
前記リスク情報からリスクの大きさを示すリスク評価値RDを算出するステップと、
前記保護レベル情報からセキュリティ対策の程度を示す保護レベル評価値LPを算出するステップと、
前記データの利用目的から利用目的評価値PDを算出するステップと、
前記データの利用状況から利用目的を実現可能なスコアとして目的達成レベルIALを算出するステップと、
前記リスク評価値RDと保護レベル評価値LPと利用目的評価値PDと目的達成レベルIALから信頼度を算出するステップと、
前記信頼度に基づいてアクセスポリシを生成するステップを含むことを特徴とするデータ流通制御方法。 - 請求項3に記載のデータ流通制御方法であって、
目的達成レベルIALは、
前記利用側計算機が過去に利用したデータの利用実績に基づいて、前記データの利用目的を実現する可能性の評価値として算出されることを特徴とするデータ流通制御方法。 - 請求項3に記載のデータ流通制御方法であって、
前記リスク情報は、
前記データの機密性と、完全性と、可用性と、説明追求性のそれぞれについてスコアが設定されたことを特徴とするデータ流通制御方法。 - プロセッサとメモリを有する認可サーバと、データを提供する提供側計算機と、前記データを利用する利用側計算機と、を有するデータ流通制御システムであって、
前記利用側計算機は、
過去に認可された前記データの利用状況を前記認可サーバへ通知する監視部と、
前記データを利用する際のセキュリティ対策に関する保護レベル情報と、前記データの利用目的を含む利用ポリシを前記認可サーバに申請する利用申請部を有し、
前記認可サーバは、
前記データの利用状況と前記保護レベル情報と前記データの利用目的に基づいて、前記提供側計算機の前記データに対する前記利用側計算機のアクセスを制御するポリシ判定部と、を有することを特徴とするデータ流通制御システム。 - 請求項6に記載のデータ流通制御システムであって、
前記提供側計算機は、
提供する前記データのリスクに関するリスク情報を前記認可サーバに登録するポリシ登録部を、有し、
前記ポリシ判定部は、
前記データの利用状況と前記保護レベル情報と前記データの利用目的に、前記リスク情報を加えて前記提供側計算機の前記データに対する前記利用側計算機のアクセスを制御することを特徴とするデータ流通制御システム。 - 請求項7に記載のデータ流通制御システムであって、
前記ポリシ判定部は、
前記リスク情報からリスクの大きさを示すリスク評価値RDを算出し、
前記保護レベル情報からセキュリティ対策の程度を示す保護レベル評価値LPを算出し、
前記データの利用目的から利用目的評価値PDを算出し、
前記データの利用状況から利用目的を実現可能なスコアとして目的達成レベルIALを算出し、
前記リスク評価値RDと保護レベル評価値LPと利用目的評価値PDと目的達成レベルIALから信頼度を算出し、
前記信頼度に基づいてアクセスポリシを生成することを特徴とするデータ流通制御システム。 - 請求項8に記載のデータ流通制御システムであって、
目的達成レベルIALは、
前記利用側計算機が過去に利用したデータの利用実績に基づいて、前記データの利用目的を実現する可能性の評価値として算出されることを特徴とするデータ流通制御システム。 - 請求項8に記載のデータ流通制御システムであって、
前記リスク情報は、
前記データの機密性と、完全性と、可用性と、説明追求性のそれぞれについてスコアが設定されたことを特徴とするデータ流通制御システム。 - プロセッサとメモリを有する認可サーバであって、
前記プロセッサは、利用側計算機から過去に認可されたデータの利用状況を受信し、
前記プロセッサは、前記利用側計算機から前記データを利用する際のセキュリティ対策に関する保護レベル情報と、前記データの利用目的を含む利用ポリシを受け付けて、
前記プロセッサは、前記データの利用状況と前記保護レベル情報と前記データの利用目的に基づいて、提供側計算機の前記データに対する前記利用側計算機のアクセスを制御することを特徴とする認可サーバ。 - 請求項11に記載の認可サーバであって、
前記プロセッサは、提供側計算機から、提供する前記データのリスクに関するリスク情報を受け付けて、
前記プロセッサは、
前記データの利用状況と前記保護レベル情報と前記データの利用目的に、前記リスク情報を加えて前記提供側計算機の前記データに対する前記利用側計算機のアクセスを制御することを特徴とする認可サーバ。 - 請求項12に記載の認可サーバであって、
前記プロセッサは、前記リスク情報からリスクの大きさを示すリスク評価値RDを算出し、前記保護レベル情報からセキュリティ対策の程度を示す保護レベル評価値LPを算出し、前記データの利用目的から利用目的評価値PDを算出し、前記データの利用状況から利用目的を実現可能なスコアとして目的達成レベルIALを算出し、前記リスク評価値RDと保護レベル評価値LPと利用目的評価値PDと目的達成レベルIALから信頼度を算出し、前記信頼度に基づいてアクセスポリシを生成することを特徴とする認可サーバ。 - 請求項13に記載の認可サーバであって、
目的達成レベルIALは、
前記利用側計算機が過去に利用したデータの利用実績に基づいて、前記データの利用目的を実現する可能性の評価値として算出されることを特徴とする認可サーバ。 - 請求項14に記載の認可サーバであって、
前記リスク情報は、
前記データの機密性と、完全性と、可用性と、説明追求性のそれぞれについてスコアが設定されたことを特徴とする認可サーバ。
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2022578463A JP7520159B2 (ja) | 2021-01-28 | 2022-01-27 | データ流通制御方法、データ流通制御システム及び認可サーバ |
US18/031,973 US20230388306A1 (en) | 2021-01-28 | 2022-01-27 | Data circulation control method, data circulation control system, and approval server |
EP22745960.9A EP4287056A1 (en) | 2021-01-28 | 2022-01-27 | Data distribution control method, data distribution control system, and authorization server |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2021012363 | 2021-01-28 | ||
JP2021-012363 | 2021-01-28 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2022163741A1 true WO2022163741A1 (ja) | 2022-08-04 |
Family
ID=82654703
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2022/003015 WO2022163741A1 (ja) | 2021-01-28 | 2022-01-27 | データ流通制御方法、データ流通制御システム及び認可サーバ |
Country Status (4)
Country | Link |
---|---|
US (1) | US20230388306A1 (ja) |
EP (1) | EP4287056A1 (ja) |
JP (1) | JP7520159B2 (ja) |
WO (1) | WO2022163741A1 (ja) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2024004254A1 (ja) * | 2022-06-28 | 2024-01-04 | 株式会社日立製作所 | データ提供仲介システム及びデータ提供仲介方法 |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2014229039A (ja) * | 2013-05-22 | 2014-12-08 | 株式会社日立製作所 | プライバシ保護型データ提供システム |
JP2018142284A (ja) * | 2017-02-28 | 2018-09-13 | 日本電信電話株式会社 | リスク算出装置、リスク算出装置を搭載するリスク判定装置及びリスク算出方法 |
JP2021012363A (ja) | 2019-07-05 | 2021-02-04 | シャープ株式会社 | 液晶パネルの製造方法および液晶パネルの製造装置 |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP4622514B2 (ja) | 2004-12-28 | 2011-02-02 | 日本電気株式会社 | 文書匿名化装置、文書管理装置、文書匿名化方法及び文書匿名化プログラム |
WO2013121739A1 (ja) | 2012-02-17 | 2013-08-22 | 日本電気株式会社 | 匿名化装置及び匿名化方法 |
JP6084895B2 (ja) | 2013-05-17 | 2017-02-22 | 日本電信電話株式会社 | データ開示度制御装置、データ開示度制御方法及びデータ開示度制御プログラム |
JP5893197B1 (ja) | 2015-06-22 | 2016-03-23 | ニフティ株式会社 | 判定方法、判定装置及び判定プログラム |
JP7070994B2 (ja) | 2018-06-01 | 2022-05-18 | 日本電気株式会社 | 処理装置、処理方法及びプログラム |
-
2022
- 2022-01-27 EP EP22745960.9A patent/EP4287056A1/en active Pending
- 2022-01-27 US US18/031,973 patent/US20230388306A1/en active Pending
- 2022-01-27 WO PCT/JP2022/003015 patent/WO2022163741A1/ja active Application Filing
- 2022-01-27 JP JP2022578463A patent/JP7520159B2/ja active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2014229039A (ja) * | 2013-05-22 | 2014-12-08 | 株式会社日立製作所 | プライバシ保護型データ提供システム |
JP2018142284A (ja) * | 2017-02-28 | 2018-09-13 | 日本電信電話株式会社 | リスク算出装置、リスク算出装置を搭載するリスク判定装置及びリスク算出方法 |
JP2021012363A (ja) | 2019-07-05 | 2021-02-04 | シャープ株式会社 | 液晶パネルの製造方法および液晶パネルの製造装置 |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2024004254A1 (ja) * | 2022-06-28 | 2024-01-04 | 株式会社日立製作所 | データ提供仲介システム及びデータ提供仲介方法 |
Also Published As
Publication number | Publication date |
---|---|
EP4287056A1 (en) | 2023-12-06 |
JP7520159B2 (ja) | 2024-07-22 |
US20230388306A1 (en) | 2023-11-30 |
JPWO2022163741A1 (ja) | 2022-08-04 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Hu et al. | Dynamic, context-aware access control for distributed healthcare applications | |
Yimam et al. | A survey of compliance issues in cloud computing | |
Alshehri et al. | Secure access control for health information sharing systems | |
Viriyasitavat et al. | A survey of trust in workflows and relevant contexts | |
US9519799B2 (en) | Dynamic determination of access rights | |
Powers et al. | Privacy promises, access control, and privacy management. Enforcing privacy throughout an enterprise by extending access control | |
Mon et al. | The privacy-aware access control system using attribute-and role-based access control in private cloud | |
Casassa Mont | Dealing with privacy obligations: Important aspects and technical approaches | |
She et al. | Role-based integrated access control and data provenance for SOA based net-centric systems | |
US11182499B2 (en) | Method of integrating an organizational security system | |
Alam et al. | xDAuth: a scalable and lightweight framework for cross domain access control and delegation | |
JP2008112284A (ja) | 資源管理方法、資源管理システム、およびコンピュータプログラム | |
Choi et al. | A Framework for Context Sensitive Risk‐Based Access Control in Medical Information Systems | |
US20120159566A1 (en) | Access control framework | |
Semantha et al. | A conceptual framework to ensure privacy in patient record management system | |
WO2022163741A1 (ja) | データ流通制御方法、データ流通制御システム及び認可サーバ | |
Zeng et al. | Linux auditing: Overhead and adaptation | |
US8931048B2 (en) | Data system forensics system and method | |
Hafner et al. | Modeling and enforcing advanced access control policies in healthcare systems with sectet | |
WO2020004137A1 (ja) | サービス支援システム、及びサービス支援方法 | |
Abdallah et al. | Formal Z specifications of several flat role-based access control models | |
Canfora et al. | A three-layered model to implement data privacy policies | |
Salji et al. | Trust-based Access Control Model with Quantification Method for Protecting Sensitive Attributes | |
Chou et al. | An extended XACML model to ensure secure information access for web services | |
KR20050070520A (ko) | 워크플로우 기반의 그리드 사용자 권한 위임과 인증시스템 및 그 방법 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 22745960 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 2022578463 Country of ref document: JP Kind code of ref document: A |
|
WWE | Wipo information: entry into national phase |
Ref document number: 18031973 Country of ref document: US |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2022745960 Country of ref document: EP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 2022745960 Country of ref document: EP Effective date: 20230828 |