Database system, distributed processing apparatus, database apparatus, distributed processing method and distributed processing program

A database system includes: a distributed processing apparatus 1; and a plurality of database apparatuses 2, in which the distributed processing apparatus 1 includes: a generation unit 12 that generates an execution plan for a query related to the database apparatuses 2 based on a security policy; a transmission unit 13 that divides the query in accordance with the execution plan and transmits instructions to the corresponding database apparatuses 2, the instructions including divided queries obtained by dividing the query and transfer destinations of execution results of the divided queries; and an output unit 14 that receives the execution result of the query, from the database apparatus 2, and outputs the execution result, the database apparatuses 2 each include an execution unit 22 that executes the divided query included in the instruction received from the distributed processing apparatus 1, and transmits the execution result to another database apparatus or the distributed processing apparatus serving as the transfer destination included in the instruction, and at least one of the output unit 14 and the execution unit 22 encrypts the execution result in accordance with the security policy.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a National Stage application under 35 U.S.C. § 371 of International Application No. PCT/JP2019/042120, having an International Filing Date of Oct. 28, 2019. The disclosure of the prior application is considered part of the disclosure of this application, and is incorporated in its entirety into this application.

TECHNICAL FIELD

The present invention relates to a database system, a distributed processing apparatus, a database apparatus, a distributed processing method, and a distributed processing program.

BACKGROUND ART

As a technique of processing a query across databases distributed via a network, a method of virtually integrating external databases has been known (Non-Patent Literatures 1 and 2).

According to Non-Patent Literatures 1 and 2, data items in the databases distributed via the network are integrated into a single server, and then the query is processed.

CITATION LIST

SUMMARY OF THE INVENTION

Technical Problem

In the case of integrating the data items in the databases distributed via the network into the single server and then processing the data items, the data items are transferred on the network. Accordingly, in the network, information intended not to be disclosed is unintentionally leaked, or viewed by a malicious third party, in some cases. In other cases, after data is transferred, information is unintentionally leaked by inappropriate management of authority and the like.

In a case where information intended not to be disclosed is not transferred via the network in order to prevent such information leakage, database matching using a member ID may not be performed, for example.

The present invention has been devised in view of the situations described above, and an object of the present invention is to provide a technique that does not integrate, into a single device, data items in a plurality of databases via a network, avoids leakage of information intended not to be disclosed, and processes a query related to the databases.

Means for Solving the Problem

To achieve the object described above, an aspect of the present invention provides a database system including: a distributed processing apparatus; and a plurality of database apparatuses, in which the distributed processing apparatus includes: a generation unit that generates an execution plan for a query related to the database apparatuses, based on a security policy; a transmission unit that divides the query in accordance with the execution plan and transmits instructions to the corresponding database apparatuses, the instructions including divided queries obtained by dividing the query and transfer destinations of execution results of the divided queries; and an output unit that receives the execution results of the queries from the database apparatuses, and outputs the execution results, the database apparatuses each include an execution unit that executes the divided query included in the instruction received from the distributed processing apparatus, and transmits the execution result to another database apparatus or the distributed processing apparatus serving as the transfer destination included in the instruction, and at least one of the output unit and the execution unit encrypts the execution result in accordance with the security policy.

An aspect of the present invention provides a distributed processing apparatus that includes: a generation unit that generates an execution plan for a query related to a plurality of database apparatuses based on a security policy; a transmission unit that divides the query in accordance with the execution plan and transmits instructions to the corresponding database apparatuses, the instructions including divided queries obtained by dividing the query and transfer destinations of execution results of the divided queries; and an output unit that receives the execution result of the query from the database apparatus and outputs the result, in which the output unit encrypts the execution result of the query in accordance with the security policy.

An aspect of the present invention provides a database apparatus that includes: an execution unit that receives, from a distributed processing apparatus, an instruction that includes a divided query obtained by dividing a query related to this database apparatus and one or more other database apparatuses in accordance with an execution plan for the query, and a transfer destination of an execution result of the divided query, executes the divided query, and transmits the execution result to another database apparatus or the distributed processing apparatus serving as the transfer destination; and a registration unit that accepts a registration request for the security policy, and transmits the security policy to the distributed processing apparatus, in which the execution unit encrypts the execution result of the divided query in accordance with the security policy, and transmits the encrypted execution result.

An aspect of the present invention provides a distributed processing method of a database system that includes a distributed processing apparatus and a plurality of database apparatuses, in which the distributed processing apparatus performs: a generation step of generating an execution plan for a query related to the database apparatuses based on a security policy; a transmission step of dividing the query in accordance with the execution plan and transmitting instructions to the corresponding database apparatuses, the instructions including divided queries obtained by dividing the query and transfer destinations of execution results of the divided queries; and an output step of receiving the execution results of the queries from the database apparatuses, and outputting the execution results, and the database apparatuses each perform an execution step of executing the divided query included in the instruction received from the distributed processing apparatus, and transmitting the execution result to another database apparatus or the distributed processing apparatus serving as the transfer destination included in the instruction, and at least one of the output step and the execution step encrypts the execution result in accordance with the security policy.

An aspect of the present invention provides a distributed processing program causing a computer to function as the distributed processing apparatus described above.

An aspect of the present invention provides a distributed processing program causing a computer to function as the database apparatus described above.

Effects of the Invention

According to the present invention, a technique can be provided that does not integrate, into a single device, data items in a plurality of databases via a network, avoids leakage of information intended not to be disclosed, and processes a query related to the databases.

DESCRIPTION OF EMBODIMENT

Hereinafter, an embodiment of the present invention is described with reference to the drawings.

(Configuration of Distributed DB System)

FIG.1shows a configuration example of a distributed DB system (database system) of the present embodiment. The distributed DB system shown in the diagram includes a distributed processing apparatus1and a plurality of DB apparatuses2A,2B and2C. The DB apparatus2A is an apparatus that stores member data on a department store. The DB apparatus2B is an apparatus that stores purchase data on a certain hair salon that is a tenant of the department store. The DB apparatus2C is an apparatus that stores purchase data on a drugstore that is a tenant of the department store. Note that in a case where the DB apparatuses2A,2B and2C are not distinguished one another, the devices may be sometimes described as DB apparatuses2.

The distributed processing apparatus1and the DB apparatuses2are connected to each other in a manner communicable with the other apparatuses via a network. In the shown example, the number of DB apparatuses is three. However, the number of DB apparatuses is not limited to three. It is sufficient if the number of DB apparatuses2is at least two.

The distributed processing apparatus1processes a query (search condition) across the distributed DB apparatuses via the network on the basis of a security policy (hereinafter called “policy”). The distributed processing apparatus1shown in the diagram includes a query analysis unit11, an execution plan generation unit12, an instruction transmission unit13, an output unit14, a collection unit15, and a storage unit16.

The query analysis unit11analyzes an input query5. The query5in the present embodiment is a query that relates to the plurality of DB apparatuses2, that is, a query across the DB apparatuses2.

The execution plan generation unit12(generation unit) generates an execution plan of the query5related to the DB apparatuses2on the basis of the policy. For example, suppose that a DB apparatus2is present in which a policy that prohibits predetermined data from being transferred to the other DB apparatuses2and the distributed processing apparatus1is registered. In the above case, the execution plan generation unit12generates an execution plan that adopts this DB apparatus2as a transfer destination of execution results of divided queries in the other DB apparatuses2.

The instruction transmission unit13(transmission unit) causes the DB apparatuses2to process the query5in a distributed manner in accordance with the generated execution plan. Specifically, the instruction transmission unit13divides the query5in accordance with the execution plan, and transmits instructions that include divided queries obtained by dividing the query and transfer destinations of execution results of the divided queries, to the corresponding DB apparatuses2.

The output unit14receives the execution result of the query5from the DB apparatus2, and outputs the result as a query result6. The output unit14may encrypt the execution result of the query5in accordance with the policy and output the result. The encryption process includes, for example, processes of masking, deleting, and encrypting data on a column (item) intended not to be disclosed.

The collection unit15collects policies registered in the individual DB apparatuses2from these DB apparatuses2, and stores the policies in the storage unit16. The storage unit16stores the policies transmitted from the individual DB apparatuses2.

Each DB apparatus2includes a registration unit21, an execution unit22, and a distributed DB23. The registration unit21accepts a policy registration request issued by a user, stores the policy in a storage unit (not shown) of the own device, and transmits the policy to the distributed processing apparatus1.

The execution unit22executes the divided query included in the instruction received from the distributed processing apparatus1, and transmits the execution result to the other DB apparatus2or the distributed processing apparatus1serving as the transfer destination included in the instruction. The execution unit22may encrypt the execution result of the divided query in accordance with the policy of the own DB apparatus2or another DB apparatus2. The execution unit may encrypt the execution result of the divided query in accordance with the policy that prohibits predetermined data from being transferred to the other apparatuses, and transmit the encrypted execution result to the apparatus that is the transfer destination. The encryption process includes, for example, processes of masking, deleting, and encrypting data on a column (item) intended not to be disclosed. The distributed DB23stores at least one database.

FIGS.2to4show examples of data stored in the individual distributed DBs23shown inFIG.1.FIG.2shows member data stored in the distributed DB23of the DB apparatus2A of the department store. The member data (member table) inFIG.2is tabular form data that associates the member ID, name, age, and gender with one another. In this embodiment, the member ID and the name are data (immobile data) prohibited from being transferred to the other DB apparatuses2B and2C and the distributed processing apparatus1.

FIG.3shows purchase data stored in the distributed DB23of the DB apparatus2of the hair salon. The purchase data (purchase table) ofFIG.3is data indicating products sold in the hair salon or services provided therein. The shown purchase data is tabular form data that associates the department store member ID, purchase date and time, purchased product name code, and purchased product name with one another.

FIG.4shows purchase data stored in the distributed DB23of the DB apparatus2of the drugstore. The purchase data (purchase table) ofFIG.4is data indicating products sold in the drugstore or services provided therein. The shown purchase data is tabular form data that associates the department store member ID, purchase date and time, purchased product name code, and purchased product name with one another.

(Operation of Distributed DB System)

Hereinafter, the operation of the distributed DB system in this embodiment is described.

FIG.5is a flowchart showing the operation of the distributed DB system in this embodiment. The registration unit21of each DB apparatus2accepts a policy input by a user, such as a system administrator, for the distributed DB23included in the own device2, registers the policy in a storage unit (not shown), and transmits the policy to the distributed processing apparatus1(S11). The collection unit15of the distributed processing apparatus1collects policies from the individual DB apparatuses2, and stores the policies in the storage unit16(S12).

Note that processes in S11and S12are not necessarily performed every time the processes in or after S13are performed. For example, in a case where the policies have already been stored in the storage unit16, S11and S12are not performed, and the distributed processing apparatus1uses the policies stored in the storage unit16. That is, transmission of the policy from the DB apparatus2serves as a trigger, which executes S11and S12.

Next, the distributed processing apparatus1accepts the query input from the user (S13). The distributed processing apparatus1analyzes the input query and generates an execution plan that can execute the query on the basis of the policy stored in the storage unit16(S14). Suppose that immobile data, such as a policy (no-transfer policy) “the member ID and name are not allowed to be externally disclosed” is present in the department store DB apparatus2A. In the above case, the distributed processing apparatus1generates an execution plan for collecting pieces of data required for analysis in the DB apparatus2holding the immobile data.

The distributed processing apparatus1divides the input query in accordance with the generated execution plan, and generates divided queries for the individual DB apparatuses2. The distributed processing apparatus1then generates instructions that include divided queries and transfer destinations of execution results of the divided queries, individually for the DB apparatuses2, and transmits the instructions corresponding to the individual DB apparatuses2(S15). The divided queries are obtained by dividing the input query into execution items in the individual DB apparatuses2. The DB apparatuses2execute the divided queries in accordance with the instructions, and transfer execution results to the transfer destinations in the instructions (S16). The DB apparatus2may edit and encrypt the execution result of the divided query in accordance with the policy.

The distributed processing apparatus1receives the execution results from the DB apparatuses2, and outputs the results (S17). The distributed processing apparatus1may edit and encrypt the execution results received from the DB apparatuses2in accordance with the policy. The encryption includes, for example, processes of masking, deleting, and encrypting data on the column (item) intended not to be disclosed. The encryption includes processes of performing an operation allowed for a column or table intended not to be disclosed, and of securing that the edit result is a search of a group.

FIG.6illustrates the operation of a distributed DB system in an exemplary embodiment 1. Here, a case is described in which a marketer (user) of the department store executes a query as described below in order to run a campaign of pleasing customers visiting the hair salon. That is, a query related to the three DB apparatuses2shown inFIG.1is a query for checking what the customer visiting the hair salon buys in the drugstore.

The department store issues rewards cards. Therefore, the department store can apprehend who is the customer using a rewards card. However, in order to know “what is bought?”, it is required to check the distributed DB23held by each tenant.

It is herein assumed that the department store has a policy “the member ID and name are not allowed to be externally disclosed”. Such a policy is a no-transfer policy that prohibits predetermined data from being transferred to the other apparatuses, that is, a policy for presence of data immobile to another apparatus. For the sake of safe data management, an analysis result of the query in conformity with the policy described above is required.

The system administrator of the department store preliminarily inputs and sets a policy “the member ID and name are not allowed to be externally disclosed” in the registration unit21of the DB apparatus2A of the department store. It is assumed that each tenant has no policy, and no policy is registered in the DB apparatuses2B and2C of the tenants. In this case, only the DB apparatus2A of the department store transmits the own policy to the distributed processing apparatus1. The distributed processing apparatus1obtains the policy from the DB apparatus2A of the department store, and stores the policy in the storage unit16.

The distributed processing apparatus1accepts the query input by the user (S21). It is herein assumed that the user who is a marketer of the department store inputs a query for obtaining an analysis result, such as the attributes of customers visiting both the hair salon and the drugstore on a predetermined day, and purchase histories of behaviors in certain purchase orders.

The distributed processing apparatus1analyzes the input query and generates an execution plan that can execute the query on the basis of the policy of the DB apparatus2A of the department store registered in the storage unit16. Here, a policy for presence of no-transfer data immobile to the other apparatuses, that is, the department store's “member ID and name are not allowed to be externally disclosed” is present. If such a policy of no-transfer data is present, the distributed processing apparatus1generates an execution plan for collecting pieces of data required for analysis this time in the DB apparatus2A of the department store that stores the no-transfer data. That is, the distributed processing apparatus1generates an execution plan for adopting the DB apparatus2A of the department store as the transfer destination of the execution results of divided queries in the other DB apparatuses2B and2C.

The distributed processing apparatus1then divides a query to generate divided queries for the individual DB apparatuses in accordance with the execution plan, and transmits instructions that include divided queries and transfer destinations of execution results of the divided queries to the DB apparatuses2A,2B and2C (S22A, S22B and S22C).

In S22B, the divided query to be transmitted to the DB apparatus2B of the hair salon, which is a tenant, is obtained by extracting purchase data on a predetermined day designated by the query from the distributed DB23. The transfer destination of the execution result of the divided query is the DB apparatus2A of the department store. The DB apparatus2B of the hair salon extracts purchase data on the predetermined day from the distributed DB23of this apparatus in accordance with the instruction in S22B, and transfers the extracted purchase data62to the DB apparatus2A of the department store (S23B).

In S22C, the divided query to be transmitted to the DB apparatus2C of the drugstore, which is a tenant, is obtained by extracting purchase data on a predetermined day designated by the query from the distributed DB23. The transfer destination of the execution result of the divided query is the DB apparatus2A of the department store. The DB apparatus2C of the drugstore extracts purchase data on the predetermined day from the distributed DB23of this apparatus in accordance with the instruction in S22C, and transfers the extracted purchase data61to the DB apparatus2A of the department store (S23C).

In S22A, the divided query to be transmitted to the DB apparatus2A of the department store is as follows. The transfer destination of the execution result of the divided query is the distributed processing apparatus1.

(1) Member IDs common to the purchase data62transmitted from the DB apparatus2B of the hair salon, and the purchase data61transmitted from the DB apparatus2of the drugstore are extracted.

(2) Only records with the common member IDs are extracted from the two pieces of purchase data61and62.

(3) The attribute information (age and gender) on member data63that has the corresponding member ID and is stored in the distributed DB23of the department store is added, with respect to the member ID adopted as a key, to each of the two pieces of purchase data (not shown) obtained by extracting only the records with the common member ID.

The DB apparatus2A of the department store executes the divided queries (1) to (3) described above, edits the execution results in accordance with the policy registered in this apparatus2A, encrypts the data prohibited from being disclosed, and transmits the data to the distributed processing apparatus1, which is the transfer destination (S23A).

The execution result of the divided query by the DB apparatus2A of the department store is the purchase data on the hair salon to which the attribute information on the predetermined day is added, and the purchase data on the drugstore to which the attribute information on the predetermined day is added.

The execution results include the member ID specified in accordance with the policy “the member ID and name are not allowed to be externally disclosed”. Therefore, the DB apparatus2A of the department store encrypts the member ID. Here, the DB apparatus2A of the department store converts (anonymizes) the member IDs in the purchase data on the hair salon and the purchase data on the drugstore into fictional anonymous member IDs in accordance with a predetermined conversion rule. Note that the member IDs and the anonymous member IDs are associated with each other on a one-to-one basis. The same conversion rule is applied to the purchase data on the hair salon and the purchase data on the drugstore. Therefore, the purchase data on the hair salon and the purchase data on the drugstore can be associated with each other using the anonymous member IDs.

The execution result of the divided query and the policy by the DB apparatus2A of the department store is the purchase data for the hair salon and the purchase data64for the drugstore, as shown in the diagram. That is, each of the two pieces of purchase data is tabular form data that includes columns (items) of the anonymous member ID, age, gender, purchase date and time, purchased product name code, and incorporated product name.

The distributed processing apparatus1receives the execution result64from the DB apparatus2A of the department store, and outputs the result to a user terminal3(S24). Here, the DB apparatus2A of the department store has performed the member ID encryption process in accordance with the policy. Accordingly, the distributed processing apparatus1is not required to perform the encryption process in accordance with the policy.

The distributed processing apparatus1may analyze the execution result received from the DB apparatus2A of the department store in accordance with the query, and output the analysis result to the user terminal3. For example, the distributed processing apparatus1analyzes statistical information on the attributes of customers having visited both the hair salon and the drugstore on a certain day, and purchase behaviors (purchase histories) in the order of purchase in the hair salon and the drugstore, and output the analysis result to the user terminal3.

As described above, in this exemplary embodiment, the analysis result that includes the attributes of the customers having visited both the hair salon and the drugstore on a certain day, and the order of purchase behaviors can be output in accordance with the policy.

In the exemplary embodiment 1, the case where only the department store has the policy has been described. In an exemplary embodiment 2, a case is described where not only the department store but also the drugstore, which is a tenant, has the policy.

FIGS.7and8illustrate the operation of a distributed DB system in the exemplary embodiment 2. Here, the analysis result on what the customers visiting both the hair salon and the drugstore on a certain day purchased in the drugstore is output in accordance with the policy.

It is herein assumed that likewise with the exemplary embodiment 1, the department store has the policy “the member ID and name are not allowed to be externally disclosed” (no-transfer policy). The drugstore further has policies “processing results where customers are visible are not allowed to be displayed” and “only the number of purchasers with respect to each product name and each gender are allowed to be displayed”. The hair salon has no policy. For the sake of safe data management, an analysis result in conformity with the policy described above is required.

The system administrator of the department store preliminarily inputs and sets the policy “the member ID and name are not allowed to be externally disclosed” in the DB apparatus2A of the department store. The DB apparatus2A of the department store transmits the own policy to the distributed processing apparatus1.

Likewise, a system administrator of the drugstore preliminarily inputs and sets, in the DB apparatus2B of the drugstore, the policies “processing results where customers are visible are not allowed to be displayed” and “only the number of purchasers with respect to each product name and each gender are allowed to be displayed”. The DB apparatus2B of the drugstore transmits the own policy to the distributed processing apparatus1. The distributed processing apparatus1obtains the policies from the DB apparatus2A of the department store and the DB apparatus2C of the drugstore, and stores the policies in the storage unit16.

As shown inFIG.7, the distributed processing apparatus1accepts the query input by the user (S31). The user who is a marketer of the department store inputs, in the distributed processing apparatus1, a query for analyzing which items the customers visiting both the hair salon and the drugstore on a predetermined day purchase in the drugstore.

The distributed processing apparatus1analyzes the input query, and generates an execution plan that can execute the input query on the basis of the policies of the department store and the drugstore registered in the storage unit16. Here, likewise with the exemplary embodiment 1, the department store has the policy of no-transfer data (the member ID and name are not allowed to be externally disclosed). Therefore, the distributed processing apparatus1generates an execution plan for collecting pieces of data required for analysis this time, in the DB apparatus2A of the department store holding the no-transfer data. That is, the distributed processing apparatus1generates an execution plan for adopting the DB apparatus2A of the department store as the transfer destination of the execution results of divided queries in the other DB apparatuses2B and2C.

The distributed processing apparatus1then divides a query to generate divided queries for the individual DB apparatuses in accordance with the execution plan, and transmits instructions that include divided queries and transfer destinations of execution results of the divided queries to the DB apparatuses (S32A, S32B and S32C). Transmission of the divided query for the DB apparatus2A of the department store (S32A) is described later with reference toFIG.8.

In S32B, the divided query to be transmitted to the DB apparatus2B of the hair salon is obtained by extracting the member IDs of purchase data on a predetermined day designated by the query from the purchase data71of the distributed DB23. The transfer destination of the execution result of the divided query is the distributed processing apparatus1. The DB apparatus2B of the hair salon transfers the member ID73of the customer having purchased on a predetermined day in accordance with the instruction in S32B, to the distributed processing apparatus1(S33B).

In S32C, the divided query to be transmitted to the DB apparatus2C of the drugstore is obtained by extracting the member IDs of purchase data on a predetermined day designated by the query from the purchase data72of the distributed DB23. The transfer destination of the execution result of the divided query is the distributed processing apparatus1. The DB apparatus2C of the drugstore transfers the member ID74of the customer having purchased on a predetermined day in accordance with the instruction in S32C, to the distributed processing apparatus1(S33C).

InFIG.8, the distributed processing apparatus1extracts the member ID81common among the member IDs received from the DB apparatus2B of the hair salon and the member IDs received from the DB apparatus2C of the drugstore. The common member ID81is the member ID of the customer who purchased services or products both in the hair salon and the drugstore on the predetermined day.

The distributed processing apparatus1then transmits the divided query that includes the common member ID81to the DB apparatus2C of the drugstore, for the sake of analyzing the gender of the customer having the common member ID81, and the items purchased in the drugstore (S34).

In S34, the divided query to be transmitted to the DB apparatus2C of the drugstore is for extracting purchase data on the predetermined day having the common member ID81, from the purchase data82in the distributed DB23, and for deleting purchase dates and times unnecessary for analysis from the extracted purchase data. The transfer destination of the execution result83of the divided query is the DB apparatus2A of the department store.

The DB apparatus2C of the drugstore transfers the purchase data83extracted in accordance with the instruction in S34to the DB apparatus2A of the department store (S35). The purchase data83that is the execution result of the DB apparatus2C of the drugstore is tabular form data that includes the member ID, purchased product name code, and purchased items.

As described above, the distributed processing apparatus1transmits an instruction that includes the divided query and the transfer destination of the execution result of the divided query, to the DB apparatus2A of the department store (S32A). In S32A, the divided query to be transmitted to the DB apparatus2A of the department store is as follows. The transfer destination of the execution result of the divided query is the distributed processing apparatus1.

(1) The gender of the member ID corresponding to the member data84stored in the distributed DB of the department store is added to the purchase data83transmitted from the DB apparatus2C of the drugstore, with respect to the member ID as the key.

The DB apparatus2A of the department store executes the divided query (1) described above, edits the execution results in accordance with the policy registered in this apparatus2A, encrypts the data prohibited from being disclosed, and transmits the data to the distributed processing apparatus1, which is the transfer destination (S36).

The execution result of the divided query by the DB apparatus2A of the department store is purchase data on the drugstore (not shown) obtained by adding the corresponding gender to the purchase data83transmitted from the DB apparatus2C of the drugstore. The execution results include the member ID specified in accordance with the policy “the member ID and name are not allowed to be externally disclosed”. Therefore, the DB apparatus2A of the department store encrypts the member ID. Encryption of the member ID is similar to that in the exemplary embodiment 1. Therefore, the description thereof is omitted.

The execution result of the divided query and the policy by the DB apparatus2A of the department store is purchase data85on the drugstore shown in the diagram. The purchase data85is tabular form data that includes columns of the anonymous member ID, purchased product name code, purchased product name, and gender.

The distributed processing apparatus1receives the execution result85from the DB apparatus2A of the department store, edits the execution result in accordance with the policy of the drugstore registered in the storage unit16, and outputs the result to the user terminal3(S37). The policies of the drugstore are “processing results where customers are visible are not allowed to be displayed” and “only the number of purchasers with respect to each product name and each gender are allowed to be displayed”.

The distributed processing apparatus1edits and analyzes the execution result85in accordance with the policy of the drugstore, and outputs an analysis result86indicating the number of purchasers with respect to each purchased item and each of the genders of customers who purchased the items in both the hair salon and the drugstore on a predetermined day. The analysis result86shown in the diagram is tabular form data that includes columns of the purchased product name code, purchased product name, gender, and the number of purchasers.

Note that this modified example assumes that the distributed processing apparatus1edits and encrypts the execution result85received from the DB apparatus2A of the department store in accordance with the policy of the drugstore, and generates the analysis result86. Alternatively, the DB apparatus2A of the department store may edit and encrypt the execution result85of the divided query in accordance with the policy of the drugstore, and transmit the edited and encrypted execution result86to the distributed processing apparatus1. In this case, it is assumed that an instruction that is transmitted by the distributed processing apparatus1to the DB apparatus2A of the department store in S32A includes the policy of the drugstore besides the divided query and the transfer destination.

As described above, in this exemplary embodiment, the analysis result that includes which product the customer having visited both the hair salon and the drugstore on a certain day purchased in the drugstore with respect to each gender can be output in accordance with the policy.

Effects of this Embodiment

In the distributed DB system of this embodiment described above, the distributed processing apparatus1includes: the generation unit12that generates an execution plan for a query related to the DB apparatuses2based on a security policy; the transmission unit13that divides the query in accordance with the execution plan and transmits instructions to the corresponding DB apparatuses2, the instructions including divided queries obtained by dividing the query and transfer destinations of execution results of the divided queries; and the output unit14that receives the execution result of the query from the DB apparatus2, and outputs the execution result, and the DB apparatuses2each include the execution unit22that executes the divided query included in the instruction received from the distributed processing apparatus1, and transmits the execution result to another DB apparatus2or the distributed processing apparatus1serving as the transfer destination included in the instruction, and at least one of the output unit14and the execution unit22encrypts the execution result in accordance with the security policy.

Accordingly, in this embodiment, data items in the plurality of DB apparatuses2via a network are not integrated into a single apparatus, leakage of information intended not to be disclosed can be avoided, and a query related to the DB apparatuses2can be processed.

In this embodiment, data items are not required to be integrated into a single apparatus. Accordingly, leakage via the network and the induction of an operational mistake can be minimized. In this embodiment, the query related to data items distributed among the DB apparatuses2can be processed while strictly conforming to the data disclosure policy.

In this embodiment, the execution results are transmitted and received between the apparatuses1and2and the query is executed without integrating the data items in the DB apparatuses2into a single apparatus. Therefore, even in the case of presence of the policy prohibiting data from being transferred to the outside, the query related to the DB apparatuses2can be executed. That is, the query can be executed without transferring the no-transfer data in a predetermined DB apparatus2to another apparatus. Specifically, in this embodiment, even in the case of presence of the policy prohibiting classified data, such as personal information, from being transferred, the query related to the distributed DBs including data prohibited from being transferred can be executed. Accordingly, in this embodiment, data items prohibited from being transferred to the outside can be analyzed.

(Hardware Configurations of Distributed Processing Apparatus and DB Apparatuses)

The distributed processing apparatus1and the DB apparatuses2described above can be achieved using, for example, a general-purpose computer system as shown inFIG.9. The shown computer system includes a CPU (a Central Processing Unit, a processor)901, a memory902, a storage903(HDD: Hard Disk Drive, SSD: Solid State Drive), a communication device904, an input device905, and an output device906. The memory902and the storage903are storage devices. In this computer system, the CPU901executes a predetermined program loaded on the memory902, thereby achieving each function of each apparatus. For example, each of the functions of the distributed processing apparatus1and the DB apparatuses2is achieved through execution of a program by the CPU of the distributed processing apparatus1in the case of the program for the distributed processing apparatus1, and through execution of a program by the CPU of the corresponding DB apparatus2in the case of the program for the DB apparatus2.

The distributed processing apparatus1and the DB apparatuses2may be implemented in a single computer or in a plurality of computers. The distributed processing apparatus1and the DB apparatuses2may be virtual machines implemented in one or more computers.

The program for the distributed processing apparatus1and the programs for the DB apparatuses2may be stored in computer-readable recording media, such as HDDs, SSDs, USB (Universal Serial Bus) memories, CDs (Compact Discs) and DVDs (Digital Versatile Discs), or be distributed via a network.

Note that the present invention is not limited to the embodiment and modified examples described above, and can be variously modified in a range of the gist thereof.

REFERENCE SIGNS LIST