WO2022264470A1

WO2022264470A1 - Information processing system, information processing method, and information processing program

Info

Publication number: WO2022264470A1
Application number: PCT/JP2022/001508
Authority: WO
Inventors: 貴晴藤井; 洋平金澤; 淳益子; 開浅井
Original assignee: 株式会社ファーストスクリーニング
Priority date: 2021-06-17
Filing date: 2022-01-18
Publication date: 2022-12-22
Also published as: JP2023000212A

Abstract

An information processing system for exchanging data between a user terminal 10, a host server 20, and a cooperation server 30 in a network, the information processing system having: an ID management unit 21 that hashes a user ID unique to a user using the user terminal 10 and obtaining an irreversible user ID; a user ID usage region 40 that exchanges data using the user ID; and an irreversible user ID usage region 50 that exchanges data using the irreversible user ID. The user ID usage region 40 is for exchanging data with the host server 20, and the irreversible user ID usage region 50 is for exchanging data with the coordination server 30.

Description

Information processing system, information processing method and information processing program

The present invention relates to an information processing system, an information processing method, and an information processing program.

In recent years, some information processing systems have been configured to provide information processing services to users by linking multiple computers (server devices) existing on a network. In such an information processing system, it is common to manage various data (personal information, etc.) related to the user using an ID unique to the user (user ID). In this case, it is known to ensure the security of user IDs by encryption (see, for example, Patent Document 1).

JP 2012-222414 A

However, in an information processing system, since various data in the system are linked with user IDs, for example, if a data leak occurs at a linked party, based on the content of the leak, the various data in the system are identified by which user There is a risk that it will be identified whether it is related to Even if the user ID is encrypted, this cannot be prevented if the leaked content includes the encryption key.

For example, even if data leakage occurs at a partner, the management side that manages various data in the system does not specify which user the various data belongs to, thereby improving security in the system. Provide technology that can be sufficiently secured.

According to one aspect of the present disclosure,
An information processing system configured to exchange data between a user terminal, a host server, and a link server existing on a network,
an ID management unit that obtains an irreversible user ID by hashing a user ID unique to the user using the user terminal;
a user ID usage area for exchanging data using the user ID;
a irreversible user ID usage area for exchanging data using the irreversible user ID;
The user ID usage area is for exchanging data with the host server,
The information processing system is provided, wherein the irreversible user ID usage area is for exchanging data with the linking server.

According to another aspect of the present disclosure,
An information processing method used in an information processing system configured to exchange data between a user terminal, a host server, and a link server existing on a network,
obtaining an irreversible user ID by hashing a user ID unique to the user using the user terminal;
setting a user ID usage area for exchanging data using the user ID for exchanging data with the host server;
There is provided an information processing method for setting a non-reversible user ID usage area for data transfer using the non-reversible user ID for data transfer with the link server.

According to yet another aspect of the present disclosure,
computer on the network,
a function of exchanging data among user terminals, host servers, and cooperation servers existing on the network;
a function of hashing a user ID unique to the user using the user terminal to obtain an irreversible user ID;
a function of setting a user ID usage area for exchanging data using the user ID as one for exchanging data with the host server;
a function of setting an irreversible user ID usage area for exchanging data using the irreversible user ID as a range for exchanging data with the linking server;
An information processing program for realizing

According to the present disclosure, by clearly distinguishing the user ID usage area and the irreversible user ID usage area while coexisting the user ID and the irreversible user ID in the system, for example, the irreversible user ID is leaked, the user ID cannot be elucidated because it is irreversible. Therefore, it is not possible to specify which user the management data on the host server side belongs to, thereby ensuring sufficient security within the system.

1 is a schematic diagram showing a schematic configuration of an information processing system according to a first embodiment of the present disclosure; FIG. 1 is a block diagram showing a functional configuration of an information processing system according to a first embodiment of the present disclosure; FIG. FIG. 4 is an explanatory diagram showing a processing operation example when data is exchanged in the information processing system according to the first embodiment of the present disclosure; FIG. 4 is an explanatory diagram showing one specific example of information management status in the information processing system according to the first embodiment of the present disclosure; 1 is a schematic diagram showing a schematic configuration of an information processing system according to a second embodiment of the present disclosure; FIG. FIG. 7 is an explanatory diagram showing one specific example of information management status in the information processing system according to the second embodiment of the present disclosure;

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

<1. First Embodiment>
First, a first embodiment of the present disclosure will be described.

(1) System Configuration Example FIG. 1 is a schematic diagram showing a schematic configuration of an information processing system exemplified in this embodiment. FIG. 2 is a block diagram showing the functional configuration of an information processing system exemplified in this embodiment.

(overall structure)
As shown in FIG. 1, the information processing system according to this embodiment has at least a user terminal 10, a host server 20, and a link server 30 existing on a network (not shown), and exchanges data among them. configured to do so. A plurality of user terminals 10 may exist on the network. Similarly, a plurality of cooperation servers 30 may exist on the network. In this case, each of the plurality of user terminals 10 can individually exchange data with the host server 20, and each can individually exchange data with any of the plurality of link servers 30. can be done.

A wide area network (WAN) can be used as a network, but it is not particularly limited as long as it is possible to exchange data. There are no particular restrictions on the type, format, etc. of the data exchanged over the network.

In this embodiment, the data exchanged over the network includes data related to the biometric information of the user who uses the user terminal. In other words, the information processing system according to the present embodiment is configured to perform predetermined processing on data relating to user's biometric information. Details of the predetermined processing referred to here will be described later.

(user terminal)
The user terminal 10 is a terminal device used by the user to access the system, and is composed of a smart phone, a tablet terminal, a notebook computer, or the like having a function as a computer. If there are multiple user terminals 10 on the network, multiple users will be able to access the system.

As shown in FIG. 2, an electrochemical sensor 11 is connected to the user terminal 10 via wireless communication or wired communication.
The electrochemical sensor 11 measures biological information of the user using the user terminal 10 and outputs the measured data to the user terminal 10 . Biological information includes, for example, information on the concentration of uric acid contained in urine collected from a user (that is, a subject). The concentration of uric acid in urine can be measured, for example, by electrolyzing a substance contained in urine under specific conditions and utilizing an electrochemical reaction (eg, redox reaction) that occurs at that time. As described above, the electrochemical sensor 11 is configured to electrochemically measure a specific component (eg, uric acid) in a test fluid (eg, urine) collected from a subject. However, the test fluid may be body fluid such as blood, saliva, runny nose, sweat, tears, etc., in addition to urine. In addition to uric acid, urinary sugar, arginine, albumin, and the like may be used as the specific component in the test solution.
It should be noted that the specific configuration of the electrochemical sensor 11 may be based on a known technique, and the description thereof will be omitted here.

The user terminal 10 functions as an application unit (hereinafter simply referred to as an “application unit”) 12 in order to acquire measurement data from such an electrochemical sensor 11 and process the acquired measurement data. .
The application unit 12 is a function realized by an application program installed in the user terminal 10, and processes measurement data obtained from the electrochemical sensor 11 while controlling the processing operation of the electrochemical sensor 11. . For this purpose, the application unit 12 includes an operation instruction unit 13 operated by the user using the user terminal 10 to give an operation instruction, a communication control unit 13 for controlling communication with the host server 20 and with the cooperation server 30. unit 14, information storage unit 15 for storing and holding various kinds of information in the memory of user terminal 10 as necessary, and sensor control for controlling the processing operation of electrochemical sensor 11 while following instructions from operation instruction unit 13. It has a function as the part 16 .

(host server)
The host server 20 is for providing a predetermined service to the user using the user terminal 10, and is configured by, for example, a cloud server existing on the network. However, the host server 20 does not necessarily have to be a cloud server, and may be configured by a server device connected to a network.

The predetermined services provided by the host server 20 include, for example, a management service related to user registration within the system and a management service for various data (including personal information) related to users.
In order to provide such services, the host server 20 functions as an ID management unit 21, a key management unit 22, an encryption unit 23, a decryption unit 24, a first database unit 25, and a second database unit 26. have. Each of these functions is realized by a predetermined program installed in the host server 20 or a predetermined program accessible by the host server 20 .

The ID management unit 21 manages user IDs that are uniquely determined within the system. Specifically, in response to a request from a user who uses the user terminal 10, the ID management unit 21 gives the user a unique ID (original user ID). there is Furthermore, the ID management unit 21 obtains an irreversible user ID by hashing the user ID. A specific hashing method is not particularly limited, and any known method may be used. The same applies to specific aspects of user IDs and irreversible user IDs, and they are not limited to specific aspects.

The key management unit 22 manages keys used when the encryption unit 23 performs encryption and when the decryption unit 24 performs decryption. The keys managed by the key management unit 22 include at least one of a common key unique to the host server 20, or a set of a public key and a private key unique to the host server 20, and a key unique to the cooperation server 30 existing on the network. There is a public key of Note that when a plurality of cooperation servers 30 exist on the network, the key management unit 22 manages different keys for each cooperation server 30 .

The encryption unit 23 encrypts user IDs and irreversible user IDs. Specifically, the encryption unit 23 encrypts the user ID with a common key or public key unique to the host server 20, and encrypts the irreversible user ID with a public key unique to the link server 30. there is Hereinafter, the user ID encrypted by the encryption unit 23 will be referred to as "encrypted user ID". The irreversible user ID encrypted by the encryption unit 23 is called an "encrypted irreversible user ID". The encrypted user ID and the encrypted irreversible user ID obtained by the encryption unit 23 are temporarily sent to the user terminal 10 .

The decryption unit 24 decrypts the encrypted user ID sent from the outside. Specifically, the decryption unit 24 decrypts the encrypted user ID using a common key or secret key unique to the host server 20 .

The first database unit 25 stores and retains data to be managed locally by the host server 20, among various data related to users. Data to be locally managed by the host server 20 includes, for example, personal information of each user (information that can identify an individual such as name, address, credit card information, personal information regarding payment, etc.). The first database unit 25 stores such personal information in association with the user ID of each user. Thereby, the personal information of each user is locally managed by the host server 20 .

The second database section 26 stores and holds data other than the data stored and held by the first database section 25 among various data regarding users. The data stored and held by the second database unit 26 are items other than the personal information of each user. For example, information on analysis results from the link server 30 described later, lifestyle information that is information on lifestyle habits of each user, and the like. included.
The second database unit 26 can be arranged in the host server 20 as shown in the figure, but it is not limited to this. , the link server 30) in the irreversible user ID usage area 50, which will be described later.
When arranged in the host server 20, the second database section 26 stores and holds data relating to the user in association with the user's user ID. However, if the irreversible user ID usage area 50 is provided in another device instead of the host server 20, the second database unit 26 stores and stores data related to the user in association with the user's irreversible user ID. do. As a result, various data other than personal information about the user are managed in a state accessible by the host server 20 .

Neither the irreversible user ID nor the encrypted irreversible user ID is stored in the first database unit 25. Moreover, neither the irreversible user ID nor the encrypted irreversible user ID is stored in the second database unit 26 when it is arranged in the host server 20 . Therefore, neither the irreversible user ID nor the encrypted irreversible user ID remains in the host server 20 after the encrypted irreversible user ID is sent from the encryption unit 23 to the user terminal 10 . In other words, the host server 20 is configured not to save the irreversible user ID.

(Collaboration server)
The cooperation server 30 is for providing a user using the user terminal 10 with a service different from that provided by the host server 20, and is configured by, for example, a cloud server existing on the network. However, like the host server 20, the cooperation server 30 does not necessarily have to be a cloud server, and may be configured by a server device connected to a network.

Another service provided by the linking server 30 is, for example, a service that analyzes data measured by the electrochemical sensor 11 and notifies the user of information about the analysis results. When a plurality of link servers 30 exist on the network, each link server 30 may provide different services. In other words, in the system, the host server 20 and the link server 30 work together to provide users with information processing services that could not have been achieved by a single server.

In order to provide such services, the cooperation server 30 has functions as a key management unit 31, a decryption unit 32, a user authorization unit 33, an analysis algorithm unit 34, and a database unit 35. Each of these functions is realized by a predetermined program installed in the link server 30 or a predetermined program accessible by the link server 30 .

The key management unit 31 manages keys used when the decryption unit 32 performs decryption. Keys managed by the key management unit 31 include a set of a public key and a private key unique to the cooperation server 30 existing on the network. Also, the key managed by the key management unit 31 may be a common key specific to the cooperation server 30 . When a plurality of cooperation servers 30 exist on the network, the key management unit 31 in each cooperation server 30 manages different keys.

The decryption unit 32 decrypts the encrypted irreversible user ID sent from the outside. Specifically, the decryption unit 32 decrypts the encrypted irreversible user ID using a secret key or common key unique to the cooperation server 30 .

Based on the irreversible user ID after decryption by the decryption unit 32, the user authorization unit 33 determines whether or not the user identified by the irreversible user ID is a user who can provide services in the cooperation server 30. That is, it is determined whether the user is authenticated by the host server 20 or not.

The analysis algorithm unit 34 performs predetermined analysis processing on measurement data obtained by the electrochemical sensor 11 for the user in response to a request from the user using the user terminal 10, and outputs information about the analysis result. It is something to do. The predetermined analysis processing includes, for example, processing for analyzing changes over time in measurement data, processing for determining disease risk from changes over time, and the like. In other words, the analysis algorithm unit 34 is configured to output information about the result of such analysis processing to the user terminal 10 upon request as result information of the service provided by the link server 30 . The output to the user terminal 10 may be performed via another device (for example, the host server 20) within the system. Specifically, for example, after information about the analysis result by the analysis algorithm unit 34 is once transmitted to the user terminal 10, it is transferred from the user terminal 10 to the host server 20, and the display layout is specified by the host server 20. After creating the information, it may be returned to the user terminal 10 together with the layout information, so that the user terminal 10 can perform display output.

The database unit 35 stores and holds various data including information on the analysis results by the analysis algorithm unit 34. Various data stored in the database unit 35 include, in addition to information on analysis results, for example, an irreversible user ID unique to each user, measurement data sent from the user terminal 10, and data sent from the host server 20. This includes information on lifestyle habits, etc.

(User ID usage area and irreversible user ID usage area)
In the information processing system according to this embodiment configured as described above, between the user terminal 10 and the host server 20, between the user terminal 10 and the link server 30, and between the host server 20 and the link server 30 Data can be exchanged in each of the intervals. In that case, at least between the user terminal 10 and the host server 20, and between the user terminal 10 and the cooperation server 30, the communication data is protected by encrypted communication, such as SSL (Secure Sockets Layer). will be

Further, in the information processing system according to the present embodiment, when exchanging data, the user ID use area 40, which is an area for exchanging data using a user ID or an encrypted user ID, and an irreversible user ID or encrypted irreversible There is an irreversible user ID use area 50, which is an area for exchanging data using a user ID.

The user ID usage area 40 is mainly for exchanging data with the host server 20. More specifically, the user ID usage area 40 is used for exchanging data between the user terminal 10 and the host server 20 . In addition, the irreversible user ID usage area 50 is mainly for exchanging data with the cooperation server 30 . More specifically, the irreversible user ID usage area 50 is used for exchanging data between the user terminal 10 and the link server 30 and between the host server 20 and the link server 30 .

In other words, the information processing system according to the present embodiment has a user ID usage area 40 and an irreversible user ID usage area 50, and a user ID usage area 40 between the user terminal 10 and the host server 20. An irreversible user ID usage area 50 is defined between the user terminal 10 and the link server 30 and between the host server 20 and the link server 30 . Thus, in the information processing system according to the present embodiment, the original user ID (encrypted user ID) and the irreversible user ID (encrypted irreversible user ID) coexist as IDs used in the system. , the range of use of each of these IDs is clearly distinguished.

(program)
Each function in the information processing system as described above is realized by the user terminal 10, the host server 20, or the link server 30 executing a predetermined program (including an application program). That is, the predetermined program that implements each function described above corresponds to an embodiment of the "information processing program" according to the present disclosure.

In that case, if the predetermined program that implements each function can be installed on the user terminal 10, the host server 20, or the cooperation server 30 as a computer, it can be stored on a computer-readable recording medium (e.g., a magnetic disk, An optical disk, a magneto-optical disk, a semiconductor memory, etc.) may be stored and provided, or it may be provided from the outside through a network such as the Internet or a dedicated line.

(2) Example of Processing Operation Next, in the information processing system according to the present embodiment configured as described above, an example of processing operation when exchanging data among the user terminal 10, the host server 20, and the link server 30, That is, one embodiment of the "information processing method" according to the present disclosure will be described.
FIG. 3 is an explanatory diagram showing an example of processing operations when data is exchanged in the information processing system according to this embodiment.

In the information processing system according to the present embodiment, in order for the user using the user terminal 10 to receive the services provided by the host server 20 and the link server 30, the user first operates the user terminal 10 to open the application unit 12. A request for user registration (that is, ID assignment) is made from the operation instruction unit 13 to the host server 20 (step 101, hereinafter step is abbreviated as "S").

Upon receiving a request for user registration from the user terminal 10, in the host server 20, the ID management unit 21 assigns a unique user ID to the requesting user and hashes the user ID to obtain an irreversible user ID. . Then, the encryption unit 23 encrypts them to obtain an encrypted user ID and an encrypted irreversible user ID. The encrypted user ID and the encrypted irreversible user ID are sent from the host server 20 to the requesting user terminal 10 (S102).

When the request source user terminal 10 receives the encrypted user ID and the encrypted irreversible user ID from the host server 20, the information storage unit 15 of the application unit 12 stores and holds them. As a result, in the user terminal 10, the communication control unit 14 uses either the encrypted user ID or the encrypted irreversible user ID for subsequent data transmission within the system. More specifically, the communication control unit 14 uses the user ID usage area 40 to transmit data to the host server 20 using the encrypted user ID. In addition, since the irreversible user ID use area 50 is used for the linking server 30, data transmission is performed using the encrypted irreversible user ID.

For example, consider a case where the user inputs personal information and lifestyle information on the user terminal 10 . The user's personal information should be managed by the first database unit 25 of the host server 20 , and the user's lifestyle information should be managed by the second database unit 26 of the host server 20 . Therefore, when the personal information and lifestyle information are input, the communication control unit 14 sends them to the host server 20 (S103). At this time, since the user ID usage area 40 is between the user terminal 10 and the host server 20, the communication control unit 14 sends personal information and lifestyle information to the host server 20 using the encrypted user ID. Send data. That is, the communication control unit 14 sends the personal information and lifestyle information to the host server 20 together with the encrypted user ID stored in the information storage unit 15 (S103).

When the encrypted user ID, personal information, and lifestyle information are received from the user terminal 10, the host server 20 decrypts the sent encrypted user ID by the decryption unit 24 and returns it to the user ID before encryption. If the user ID has been officially issued by the ID management unit 21 in response to the request for user registration, the personal information received from the user terminal 10 is stored in the first database while being associated with the user ID. While storing and holding in the unit 25, the second database unit 26 stores and holds the lifestyle information received from the user terminal 10 in association with the user ID. That is, the first database unit 25 stores and holds the personal information of the user specified by the user ID in a state where the user ID can be used as a search key, and the second database unit 26 uses the user ID as a search key. The lifestyle information of the user identified by the user ID is stored and held in a usable state. As a result, the user's personal information and lifestyle information are managed by the host server 20 .

After that, for example, consider a case where the user uses the electrochemical sensor 11 to measure biological information. Measurement of biological information is generally performed periodically at a predetermined timing, such as once a day. When the biometric information is measured by the electrochemical sensor 11 at such timing, measurement data is output from the electrochemical sensor 11 to the sensor control unit 16 of the user terminal 10 each time (S104).

The measurement data from the electrochemical sensor 11 corresponds to so-called raw data, and as such, it cannot necessarily be said to be effective in promoting the user's health. Therefore, in the user terminal 10, when the measurement data is output from the electrochemical sensor 11, the measurement data is analyzed by the link server 30 to contribute to the health promotion of the user. The communication control unit 14 sends the measurement data to the cooperation server 30 according to the instruction or automatically according to the output of the measurement data (S105). At this time, since the irreversible user ID usage area 50 is between the user terminal 10 and the link server 30, the communication control unit 14 uses the encrypted irreversible user ID for the measurement data output from the electrochemical sensor 11. is used to transmit data to the cooperation server 30 . That is, the communication control unit 14 sends the measurement data output from the electrochemical sensor 11 to the cooperation server 30 together with the encrypted irreversible user ID stored in the information storage unit 15 (S105).

When the encrypted irreversible user ID and the measurement data are received from the user terminal 10, the linking server 30 decrypts the sent encrypted irreversible user ID by the decryption unit 32 and converts the irreversible user ID before encryption into back to Then, the user authorization unit 33 determines whether or not the user specified by the irreversible user ID is a user who can provide services in the cooperation server 30 . As a result, the link server 30 provides services only to users authenticated by the host server 20 . As a result, if the user is authenticated by the host server 20, the linking server 30 analyzes the sent measurement data by the analysis algorithm unit 34, and provides information on the analysis result to the service provided by the linking server 30. As result information, it is output to the user terminal 10 that transmitted the measurement data (S106). Further, in the linking server 30, the database section 35 stores and retains the information on the analysis result by the analysis algorithm section 34 together with the irreversible user ID and the measurement data on which it is based, if necessary.

Upon receiving information about the analysis result from the link server 30, the user terminal 10 displays and outputs the content of the received information to the user using the user terminal 10. The display output to the user may be performed via another device (for example, the host server 20) in the system, as described above. As a result, the user who has referred to the display output content can take action that contributes to the health promotion of the user, such as changing his or her lifestyle, based on the analysis result by the link server 30 .

The information on the analysis result from the link server 30 can contribute to the health promotion of the user by itself, but it should be managed together with the lifestyle information stored and held by the second database unit 26 of the host server 20. This can further contribute to health promotion of the user. Therefore, in the user terminal 10, when the information about the analysis result is received from the cooperation server 30, the communication control unit 14 sends the information about the analysis result to the host server 20 separately from the display output for the user (S107). At this time, since the user ID usage area 40 is between the user terminal 10 and the host server 20, the communication control unit 14 uses the encrypted user ID to transmit data about the analysis result to the host server 20. I do. That is, the communication control unit 14 sends the information about the analysis result to the host server 20 together with the encrypted user ID stored in the information storage unit 15 (S107).

Upon receiving the encrypted user ID and the information on the analysis result from the user terminal 10, the host server 20 decrypts the sent encrypted user ID by the decryption unit 24 and returns it to the user ID before encryption. If the user ID is officially issued by the ID management unit 21, the information on the analysis result received from the user terminal 10 is stored in the database unit 25 in association with the user ID. . In other words, the database unit 25 stores and holds information about the analysis results regarding the user identified by the user ID in a state where the user ID can be used as a search key. As a result, the information on the analysis result of the user is managed by the host server 20, like the lifestyle information of the user.

By the way, in the linking server 30, when analyzing the measurement data performed by the analysis algorithm unit 34, the use of the user's lifestyle information may be useful for the analysis. Therefore, prior to analysis processing by the analysis algorithm section 34, the host server 20 sends the user's lifestyle information to the linkage server in response to a request from the linkage server 30 or when the database section 25 stores and retains the lifestyle information. 30 (S108). Data transmission at this time is performed without going through the user terminal 10, but considering that the link server 30 is the irreversible user ID usage area 50, the host server 20 encrypts the user's lifestyle information. data transmission to the cooperation server 30 using the irreversible user ID. That is, when data is transmitted from the host server 20 to the link server 30, the user's lifestyle information is sent to the link server 30 together with the encrypted irreversible user ID (S108). Although the host server 20 does not store the irreversible user ID or the encrypted irreversible user ID, each time data is transmitted to the cooperation server 30, the ID management unit 21 and the encryption unit 23 to obtain an encrypted irreversible user ID.

The lifestyle information sent in this way is stored and held in the database unit 35 of the link server 30, and is provided for analysis processing of the measurement data performed by the analysis algorithm unit 34.

(3) Specific Example of Security Protection Next, a specific example of security protection in the information processing system according to the present embodiment will be described.
FIG. 4 is an explanatory diagram showing a specific example of information management status in the information processing system according to this embodiment.

The information processing system according to the present embodiment cooperates with a plurality of computers existing on the network (specifically, the host server 20 and the cooperation server 30) to provide an information processing service to the user using the user terminal 10. is configured to In providing the information processing service, the user terminal 10, the host server 20, and the link server 30 perform processing operations related to data exchange, as described above.

As a result, within the system, as shown in FIG. 4, the personal information of each user is managed in the first database unit 25 of the host server 20 using the user's unique user ID. Furthermore, in the host server 20 or other devices that can be accessed by the host server 20, in the second database unit 26, using the user ID unique to the user, various kinds of information other than personal information such as information related to analysis results and lifestyle information etc. data will be managed. In addition, in the link server 30, the database unit 35 manages information about the analysis results using the irreversible user ID unique to the user.

In such an information processing system, the host server 20 and the cooperation server 30 are often managed by different entities (for example, by a company that manages them). In this case, from the perspective of the management body of the host server 20, the cooperation server 30 is not under the authority of management (in particular, security management), and there is a risk of data leakage.

Now, let's consider, for example, the case where a data leak occurs at a partner.

In the information processing system according to this embodiment, a user ID usage area 40 and an irreversible user ID usage area 50 are set in the system. The encrypted user ID is used in the user ID use area 40, and the encrypted irreversible user ID is used in the irreversible user ID use area 50. The scope of use is clearly distinguished.

Therefore, if data leakage occurs at the cooperation destination, for example, the encrypted irreversible user ID used in the irreversible user ID usage area 50 and the secret key unique to the cooperation server 30 will be leaked to the outside. As a result, the confidentiality of the irreversible user ID may be lost. However, even if the confidentiality of the irreversible user ID is lost, since the irreversible user ID is hashed and irreversible, the association with the user ID is one-way. Therefore, the original user ID on which it is based cannot be clarified from the irreversible user ID.

In addition, since the user ID usage area 40 and the irreversible user ID usage area 50 are clearly distinguished, even if there is a data leak at the cooperation destination, the encrypted user ID used in the user ID usage area 40 It never leaks outside.

As described above, in the information processing system according to the present embodiment, while clearly distinguishing between the user ID usage area 40 and the irreversible user ID usage area 50, the non-reversible user ID usage area 50 is defined as the cooperation destination. By using a user ID (encrypted irreversible user ID), even if there is a data leak at the partner, the original user ID cannot be clarified.

Therefore, in the information processing system according to the present embodiment, even if there is a data leak at the cooperation destination, the original user ID cannot be clarified. (personal information) is never identified to whom it belongs. In addition, since it is not associated with personal information managed on the host server 20 side, various data managed on the link server 30 side will not be identified as to which individual user belongs.

In other words, even if there is a data leak on the link server 30 side, information that is locally managed on the host server 20 side and specifically identifies the individual user (for example, information that identifies the individual user) information) cannot be reached. This means that the cooperation server 30 does not need information that specifically identifies the individual user in providing services to each user.

As described above, in the information processing system according to the present embodiment, when a plurality of services provided by a plurality of computers (specifically, the host server 20 and the linking server 30) existing on the network are linked, personal information leakage can be prevented. It localizes (minimizes) security risks. Therefore, the link server 30 is freed from the risk of specific identification of the individual user.

On the other hand, data leakage may occur on the host server 20 side, for example. Even in that case, since the user ID usage range 40 and the irreversible user ID usage range 50 are clearly distinguished, even if the confidentiality of the user ID is lost due to data leakage, the irreversible user ID can be immediately There is no linking, and it is not possible to identify which individual user the various data managed by the distributed link servers 30 belong to.

Further, by encrypting the user ID and the irreversible user ID in the user ID use area 40 and the irreversible user ID use area 50, security can be further improved. In other words, the host server 20 in the user ID usage area 40 accepts only encrypted user IDs, and the cooperation server 30 in the irreversible user ID usage area 50 accepts only encrypted irreversible user IDs. User IDs and encrypted irreversible user IDs are not centrally managed by either the host server 20 or the link server 30, but are distributed and managed only by each user terminal 10, thereby improving the security of the entire system.
In order to further improve security, the user ID is also used for various data exchanged between the user terminal 10, the host server 20 and the link server 30, specifically measurement data, information on analysis results, lifestyle information, etc. Encryption may be performed according to the usage area 40 or the irreversible user ID usage area 50, respectively.

Various data other than the personal information of each user locally managed in the first database unit 25 of the host server 20 are stored in the second database unit 26 of the host server 20 and the database unit 35 of the cooperation server 30. If the information is distributed and stored in each area, the security of the entire system can be improved by this distributed management.

(4) Effects of this embodiment According to this embodiment, one or more of the following effects can be obtained.

(a) In the present embodiment, the user ID use area 40 and the irreversible user ID use area 50 are set in the information processing system. In the reversible user ID usage area 50, the usage range of the user ID and the non-reversible user ID within the system is clearly distinguished, such that data exchange is performed using the encrypted non-reversible user ID. Therefore, for example, even if there is a data leak at the cooperation destination and the confidentiality of the irreversible user ID is lost, the user ID cannot be clarified from there because it is irreversible. As a result, when the host server 20 manages various data related to users (in particular, personal information of each user), even if data leakage occurs on the link server 30 side, the various data in the system can be It is not possible to specify which user the personal data belongs to, and sufficient security within the system can be ensured.

(b) In this embodiment, the user ID is encrypted with a key unique to the host server 20 and used for data transfer in the user ID usage area 40, and the irreversible user ID is encrypted with a key unique to the link server 30. data exchange in the irreversible user ID use area 50. By encrypting the user ID and the irreversible user ID in this way, security can be further improved. At that time, since the user ID and the irreversible user ID are encrypted with different keys, even if there is a data leak on the side of the cooperation server 30, for example, the encrypted user ID can be decrypted with the contents of the leak. can't Moreover, even if the irreversible user ID encrypted by the leaked contents can be decrypted, the user ID cannot be clarified from there because it is irreversible. In addition, by encrypting the user ID and the irreversible user ID, it becomes possible to avoid the risk of data leakage at the user terminal 10 and data leakage during data communication on the network.

(c) In this embodiment, the host server 20 is configured not to store non-reversible user IDs. In other words, neither the irreversible user ID nor the encrypted irreversible user ID remains in the host server 20 after the encrypted irreversible user ID is sent to the user terminal 10 . In this way, by not leaving traces of the irreversible user ID on the host server 20, even if the host server 20 is illegally accessed, the irreversible user ID can be prevented from being traced. It is very preferable in terms of sufficiently ensuring internal security.

(d) In this embodiment, when a plurality of cooperation servers 30 exist in the system, encryption and decryption are performed using different keys for each cooperation server 30 . Therefore, when a system is constructed so that a variety of services are provided by a plurality of linking servers 30, even if a data leak occurs at one linking destination, it is possible to prevent the impact from spreading to other linking destinations. , which is highly desirable for ensuring sufficient security within the system.

<2. Second Embodiment>
Next, a second embodiment of the present disclosure will be described. However, differences from the above-described first embodiment will be mainly described here.

FIG. 5 is a schematic diagram showing a schematic configuration of an information processing system exemplified in this embodiment. FIG. 6 is an explanatory diagram showing a specific example of information management status in the information processing system according to this embodiment.

As shown in FIG. 5, the information processing system according to this embodiment has at least a user terminal 10, a host server 20, and a link server 30 in common with the first embodiment described above. Unlike the case of one embodiment, the user terminal 10 and the host server 20 exchange data, and the host server 20 and the cooperation server 30 exchange data.

In the information processing system with such a configuration, the user ID usage area 40 is between the user terminal 10 and the host server 20, and the irreversible user ID usage area 50 is between the host server 20 and the cooperation server 30.

The functional configurations of the user terminal 10, the host server 20, and the cooperation server 30 are the same as in the first embodiment described above.

In the information processing system configured as described above, the example of the processing operation when exchanging data is performed in the same manner as in the case of the first embodiment described above.

As a result, within the system, as shown in FIG. 6, the personal information of each user is managed in the first database unit 25 of the host server 20 using the user's unique user ID. Furthermore, in the host server 20 or other devices that can be accessed by the host server 20, in the second database unit 26, using the user ID unique to the user, various kinds of information other than personal information such as information related to analysis results and lifestyle information etc. data will be managed. In addition, in the link server 30, the database unit 35 manages information about the analysis results using the irreversible user ID unique to the user.

Therefore, also in this embodiment, one or more of the effects described in the first embodiment can be obtained, as in the case of the first embodiment described above.

<3. Variation>
Although the first embodiment and the second embodiment of the present disclosure have been specifically described above, the present disclosure is not limited to the above-described embodiments, and can be variously modified without departing from the gist thereof. be.

In each of the above-described embodiments, an information processing system that performs predetermined processing on data related to user's biometric information has been described as an example, but the present disclosure is not limited to such aspects. In other words, the content of the present disclosure can be applied in exactly the same way as the above-described embodiments, as long as it is a system in which a plurality of servers work together to provide services.
However, the information processing system in each of the above-described embodiments handles data related to user's biometric information. Therefore, security is very important for various data (personal information, etc.) related to the user, including the data. Even in such a case, the application of the contents of the present disclosure can ensure sufficient security within the system, which is very useful in that respect.

Further, in each of the above-described embodiments, a case where an encrypted user ID is used in the user ID usage area 40 and an encrypted irreversible user ID is used in the irreversible user ID usage area 50 has been described as an example, but the present disclosure is not limited to such an embodiment. For example, even if an unencrypted user ID is used in the user ID use area 40 and an irreversible user ID is used in the irreversible user ID use area 50, the user ID use area 40 and the irreversible user ID use By clearly distinguishing from the area 50, sufficient security can be ensured against data leakage at the cooperation destination.

In each of the above-described embodiments, personal information of each user is managed in the first database unit 25 of the host server 20, and various data other than the personal information of each user are stored in the second database unit 26 of the same host server 20. Although the case of managing has been described as an example, the present disclosure is not limited to such an aspect. For example, if the host server 20 is provided with the first database section 25 and the second database section 26, these may be provided as one database section. Moreover, the second database unit 26 that manages lifestyle information other than personal information may be constructed not in the host server 20 but in another computer that can be accessed by the host server 20 .

In each of the above-described embodiments, the information managed by the second database unit 26 of the host server 20 includes service result information provided from the link server 30 via the user terminal 10 (that is, (information about the result of the analysis processing of ) has been described as an example, but the present disclosure is not limited to such an aspect. For example, the second database unit 26 of the host server 20 does not store the service result information provided by the cooperation server 30, and each time the service result information is required, the host server 20 stores the irreversible user ID (non-encrypted (reversible user ID) may be used to inquire of the link server 30 about the result information of the service. With such a configuration, since a copy of the data provided by the link server 30 is not saved on the host server 20 side, it is possible to localize (minimize) the security risk of data leakage. Security within the system can be improved.

<4. Preferred Embodiment of the Present Disclosure>
Preferred aspects of the present disclosure will be added below.

(Appendix 1)
According to one aspect of the present disclosure,
An information processing system configured to exchange data between a user terminal, a host server, and a link server existing on a network,
an ID management unit that obtains an irreversible user ID by hashing a user ID unique to the user using the user terminal;
a user ID usage area for exchanging data using the user ID;
a irreversible user ID usage area for exchanging data using the irreversible user ID;
The user ID usage area is for exchanging data with the host server,
The information processing system is provided, wherein the irreversible user ID usage area is for exchanging data with the linking server.

(Appendix 2)
Preferably,
The user ID is encrypted with a key unique to the host server and used for data exchange in the user ID usage area, and the irreversible user ID is encrypted with a key unique to the cooperation server and the irreversible user ID There is provided an information processing system according to appendix 1, which has an encryption unit for data transfer in a usage area.

(Appendix 3)
Preferably,
When exchanging data in the user ID usage area, the user ID is encrypted with a common key or public key unique to the host server, and the encrypted user ID is decrypted common to the host server. There is provided an information processing system according to appendix 2, performed with a key or a private key.

(Appendix 4)
Preferably,
When exchanging data in the irreversible user ID usage area, the irreversible user ID is encrypted with a common key or public key unique to the cooperation server, and the encrypted irreversible user ID is decrypted with the There is provided an information processing system according to appendix 2 or 3, which uses a common key or a secret key unique to the cooperation server.

(Appendix 5)
Preferably,
The information processing system according to any one aspect of Supplementary Notes 2 to 4 is provided, which includes a plurality of cooperation servers, and performs encryption and decryption using a different key for each cooperation server.

(Appendix 6)
Preferably,
The information processing system according to any one aspect of appendices 1 to 5 is provided, wherein the host server is configured to not store the irreversible user ID.

(Appendix 7)
Preferably,
The information processing system according to any one aspect of Supplements 1 to 6, wherein the user terminal acquires measurement data from an electrochemical sensor that measures biological information of a subject, and has an application unit that processes the acquired measurement data. provided.

(Appendix 8)
Preferably,
Provided is the information processing system according to any one aspect of Appendices 1 to 7, wherein the linking server has an analysis algorithm unit that performs predetermined analysis processing on measurement data of biological information of a subject and outputs the analysis results. be done.

(Appendix 9)
Preferably,
The information processing system according to any one aspect of Appendices 1 to 8 is provided, wherein the host server has a database unit that manages personal information of subjects.

(Appendix 10)
Preferably,
The information processing system according to appendix 9 is provided, wherein the information managed by the database unit includes service result information provided from the cooperation server via the user terminal.

(Appendix 11)
Preferably,
The database unit does not store service result information provided from the cooperation server via the user terminal,
The information processing system according to appendix 9 is provided, wherein the host server is configured to use the irreversible user ID to inquire of the link server about the result information each time the result information is required.

(Appendix 12)
According to another aspect of the present disclosure,
An information processing method used in an information processing system configured to exchange data between a user terminal, a host server, and a link server existing on a network,
obtaining an irreversible user ID by hashing a user ID unique to the user using the user terminal;
setting a user ID usage area for exchanging data using the user ID for exchanging data with the host server;
There is provided an information processing method for setting a non-reversible user ID usage area for data transfer using the non-reversible user ID for data transfer with the link server.

(Appendix 13)
According to yet another aspect of the present disclosure,
computer on the network,
a function of exchanging data among user terminals, host servers, and cooperation servers existing on the network;
a function of hashing a user ID unique to the user using the user terminal to obtain an irreversible user ID;
a function of setting a user ID usage area for exchanging data using the user ID as one for exchanging data with the host server;
a function of setting an irreversible user ID usage area for exchanging data using the irreversible user ID as a range for exchanging data with the linking server;
An information processing program for realizing

10 user terminal 11 electrochemical sensor 12 application unit 13 operation instruction unit 14 communication control unit 15 information storage unit 16 sensor control unit 20 host server 21 ID management unit 22 encryption unit 23 key management unit 24 decryption unit 25 first database unit 26 Second database unit 30 Cooperation server 31 Key management unit 32 Decryption unit 33 User authorization unit 34 Analysis algorithm unit 35 Database unit 40 User ID usage area 50 Irreversible user ID usage area

Claims

An information processing system configured to exchange data between a user terminal, a host server, and a link server existing on a network,
an ID management unit that obtains an irreversible user ID by hashing a user ID unique to the user using the user terminal;
a user ID usage area for exchanging data using the user ID;
a irreversible user ID usage area for exchanging data using the irreversible user ID;
The user ID usage area is for exchanging data with the host server,
The information processing system, wherein the irreversible user ID usage area is for exchanging data with the linking server.
The user ID is encrypted with a key unique to the host server and used for data exchange in the user ID usage area, and the irreversible user ID is encrypted with a key unique to the cooperation server and the irreversible user ID 2. The information processing system according to claim 1, further comprising an encryption unit for data transmission/reception in a usage area.
When exchanging data in the user ID usage area, the user ID is encrypted with a common key or public key unique to the host server, and the encrypted user ID is decrypted common to the host server. The information processing system according to claim 2, wherein the information processing is performed using a key or a secret key.
When exchanging data in the irreversible user ID usage area, the irreversible user ID is encrypted with a common key or public key unique to the cooperation server, and the encrypted irreversible user ID is decrypted with the 4. The information processing system according to claim 2, wherein the common key or secret key unique to the cooperation server is used.
5. The information processing system according to any one of claims 2 to 4, comprising a plurality of said cooperation servers, wherein encryption and decryption are performed using a different key for each cooperation server.
The information processing system according to any one of claims 1 to 5, wherein the host server is configured not to save the irreversible user ID.
The information processing system according to any one of claims 1 to 6, wherein the user terminal acquires measurement data from an electrochemical sensor that measures biological information of a subject, and has an application unit that processes the acquired measurement data. .
The information processing system according to any one of claims 1 to 7, wherein the linking server has an analysis algorithm section that performs predetermined analysis processing on measurement data of biological information of a subject and outputs the analysis result.
The information processing system according to any one of claims 1 to 8, wherein the host server has a database unit that manages personal information of subjects.
10. The information processing system according to claim 9, wherein information managed by said database unit includes service result information provided from said cooperation server via said user terminal.
The database unit does not store service result information provided from the cooperation server via the user terminal,
10. The information processing system according to claim 9, wherein the host server is configured to use the irreversible user ID to inquire of the link server about the result information each time the result information is required.
An information processing method used in an information processing system configured to exchange data between a user terminal, a host server, and a link server existing on a network,
obtaining an irreversible user ID by hashing a user ID unique to the user using the user terminal;
setting a user ID usage area for exchanging data using the user ID for exchanging data with the host server;
An information processing method, wherein an irreversible user ID usage area for exchanging data using the irreversible user ID is set for exchanging data with the linking server.
computer on the network,
a function of exchanging data among user terminals, host servers, and cooperation servers existing on the network;
a function of hashing a user ID unique to the user using the user terminal to obtain an irreversible user ID;
a function of setting a user ID usage area for exchanging data using the user ID as one for exchanging data with the host server;
a function of setting an irreversible user ID usage area for exchanging data using the irreversible user ID as a range for exchanging data with the linking server;
Information processing program for realizing