Information acquisition enabled/disabled inspection system

A technique for acquiring information. In response to receiving a request to read data stored in a database, said data is read from said database. In response to receiving a request to deliver particular data among said read data at a point in time when said particular data is to be used, it is determined whether said delivery request satisfies predetermined criteria. Said particular data is delivered in response to determining that said delivery request satisfies said predetermined criteria.

RELATED APPLICATIONS

This application is a National Stage filing under 35 U.S.C. §371 of International Application No. PCT/JP2004/011149, filed on Aug. 4, 2004, which claims the benefit under 35 U.S.C. 365(b) of Japan Application No. 2003/303908, filed on Aug. 28, 2003, which is incorporated herein in its entirety by this reference.

TECHNICAL FIELD

The present invention relates to a database system having the capability of determining whether or not access by an application program (hereinafter referred to as an “application”) to information stored in a database (hereinafter referred to as a “DB”) satisfies predetermined criteria.

BACKGROUND

For sensitive information such as personal information, a criteria such as personal information protection policy (for example a P3P policy, hereinafter simply referred to as a “policy”) may be established for the permission of disclosure of the information. If information stored in a DB is protected with such criteria, access from an application to the information is checked to see whether the access satisfies the criteria before the information can be provided to the application. The information is provided to the application only if the access satisfies the criteria. Conventionally, determination as to whether access satisfies criteria has been made at the point of time when information stored in a DB is physically accessed (for example see Non-patent literature 1).

Non-patent literature 1 describes a method for determining whether access to personal information complies with personal information protection policy. The specific procedure is as follows.

First, an application obtains a DB connection in a conventional manner and issues an SQL query to the DB. A logic for policy compliance is provided in the DB, where the SQL query is translated into a query compliant with a policy. That is, when the translated SQL query is executed, only the information that complies with the policy can be acquired as a result of the query. The result of the query is provided to the application as is, and personal information that does not comply with the policy is not provided to the application.

DISCLOSURE OF THE INVENTION

Problems to be Solved by the Invention

However, the technique described in Non-patent literature 1 requires that all items of information accessed be checked to determine whether the access complies with a policy before the result of the query can be provided to the application. For example, if access is attempted to 1,000 people's personal information, a policy compliance check for the 1,000 people must be performed before the result of the query can be provided to the application. Thus, the technique has the problem of slow response to DB access, since the application must wait until the policy compliance check on all of the personal information is completed.

Furthermore, the policy compliance checking may be performed on personal information that is not actually used by the application. For example, even though the application accesses 1,000 people's personal information, the application uses possibly only 100 people's information out of that information. This means that 900 people's personal information has been unnecessarily checked for compliance with the policy.

The present invention has been made in order to solve the technical problem described above and an object of the present invention is to efficiently determine whether or not access by an application to information stored in a DB satisfies predetermined criteria.

SUMMARY OF THE INVENTION

To achieve the object, according to the present invention, determination as to whether or not access by an application to information stored in a DB satisfies predetermined criteria is made at the point of time when a request to obtain the result of access is received from the application, rather than the time point at which the application physically accesses a record in the DB. That is, the database system according to the present invention includes: data storing means for storing data to be protected; data processing means for performing predetermine processing by using the data stored in the data storing means; and data protection means for, when receiving from the data processing means a request to read the data stored in the data storing means, reading the data from the data storing means and, when receiving from the data processing means a request to deliver particular data among the data, delivering the particular data to the data processing means if the delivery request satisfies predetermined criteria.

Furthermore, according to the present invention, determination as to whether or not access to information stored in a DB satisfies predetermined criteria is made by inquiring of a policy server, at the time point when the information is used. That is, a system of the present invention for checking whether or not information is permitted to be acquired includes a first computer using data stored in a DB and a second computer managing criteria for the use of the data, wherein: the first computer reads the data stored in the DB and, at the point of time when particular data among the data is used, sends information about the use of the particular data to the second computer; the second computer, when receiving the information about the use of the particular data, determines on the basis of the criteria whether or not the first computer is permitted to use the particular data, and returns the result of the determination to the first computer; and the first computer uses the data when receiving from the second computer information indicating that the first computer is permitted to use the particular data.

Furthermore, the present invention can be viewed as an information acquiring method for acquiring information from a DB. The method of the present invention for acquiring information includes the steps of: when receiving a request to read data stored in the DB from an application program, the reading data from a DB; when receiving a request to deliver particular data among the read data from the application program, determining whether or not the delivery request satisfies predetermined criteria; and delivering the particular data to the application program if it is determined that the delivery request satisfies the predetermined criteria.

In another aspect, the present invention can be viewed as a computer program for implementing functions for acquiring information from a DB. The program according to the present invention causes a computer to implement the functions of: when receiving a request to read data stored in the DB from an application program, the reading data from a DB; when receiving a request to deliver particular data among the read data from the application program, determining whether or not the delivery request satisfies predetermined criteria; and delivering the particular data to the application program if it is determined that the delivery request satisfies the predetermined criteria.

Advantages of the Invention

According to the present invention, determination can be efficiently made as to whether or not access by an application to information stored in a DB satisfies predetermined criteria.

PREFERRED EMBODIMENT

An embodiment of the present invention will be described below in detail with reference to the accompanying drawings. It is assumed in the present embodiment that “personal information” is information to be protected and “personal information protection policy” is criteria that access must satisfy.

Focusing attention on the fact that the timing at which access to personal information in a DB is made differ from the timing at which that personal information is used by the application, the present invention solves the problem by performing a policy compliance check at the latter timing (delayed evaluation).

In particular, instead of checking all personal information for compliance with a policy before returning the result of a query to an application, a “controlled query result”, which has the function of policy compliance checking, is returned to the application. The application requests personal information from the “controlled query result” at the point of time when the application actually uses the personal information. The “controlled query result” performs a policy compliance check at this point of time and returns the requested personal information depending on the result of the check.

FIG. 1shows an overall configuration of a database system according to the present embodiment.

As shown inFIG. 1, the database system includes an application10, a personal information DB20, a policy server30, and a privacy protection module40.

The application10is a program that uses personal information stored in the personal information DB20to perform various kinds of processing. For example, the application may be a program that searches the personal information DB20for personal information and displays the result on a display.

The personal information DB20is a DB that stores personal information. For example, data as shown inFIG. 2is stored in the personal information DB20.

The policy server30is a server that manages personal information protection policies and, in response to a policy compliance check request, performs a policy compliance check on the basis of a personal information protection policy and returns the result of the check. The policy server30manages personal information protection policies such as the one shown inFIG. 3, for example. The table inFIG. 3is used for policy compliance checking based on a P3P policy. Specifically, it shows that Tokyo-area sales personnel can access the names, addresses, and phone numbers of people whose addresses contain Tokyo, for the purpose of sales activities only.

The privacy protection module40is a program that retrieves personal information stored in the personal information DB20upon reception of a request for retrieval of the personal information from the application10, and requests the policy server30to perform a policy compliance check upon reception of a request for delivery of a particular subset of the retrieved personal information, and provides the particular personal information to the application10only if a response indicating that the request complies with the policy is returned. While the privacy protection module40is provided separately from the application10inFIG. 1, it may be a module that functions as an integral part of the application10.

The privacy protection module40includes a control section41, an access information storing section42, an SQL information storing section43, an SQL constructing section44, a column identifying section45, a database accessing section46, a policy compliance inquiry section47, and a inquiry result storing section48.

The control section41serves as an interface with the application10and controls overall flows. For example, the control section41acts as an application's-interface flow-control-logic in the privacy protection module40. The application10can access the personal information DB20only through the control section41.

The access information storing section42stores information required for accessing the personal information DB20(hereinafter referred to as “access information”). Examples of the access information include user IDs and passwords required for accessing the personal information DB20. The privacy protection module40manages these items of information to control access by the application10to the personal information DB20.

The SQL information storing section43stores information concerning SQL statements that can be issued to the personal information DB20(hereinafter referred to as “SQL information”) without causing problems. If the application10were allowed to construct SQL statements on its own and issue them to the personal information DB20, the application10could issue SQL statements that destroy information stored in the personal information DB20. To prevent this, the privacy protection module40manages information required for constructing SQL statements that can be issued to the personal information DB20without problems. If all SQL statements that can be issued to the personal information DB20without problems were to be provided in the SQL information storing section43, the number of the SQL statements would be enormous. Therefore, SQL statement templates containing variables that can be replaced with input parameters (hereinafter referred to as “SQL statement templates”) are managed.

FIG. 4shows an example of information stored in the SQL information storing section43. InFIG. 4, an SQL-ID, which is identification information that uniquely identifies each SQL statement template is assigned to the SQL statement template.

Also inFIG. 4, protected column information and data owner ID column information are associated with each SQL statement template. Here, the protected column information is information for identifying a column that is specified as a column to be protected among the columns retrieved by using an SQL statement constructed from an SQL statement template. The data owner ID column information is information for identifying a column that is to be referenced in order to know the owner of each item of data among the columns retrieved by using an SQL statement constructed from an SQL statement template.

The SQL constructing section44is a section that retrieves one of the SQL statement templates stored in the SQL information storing section43that is associated with an SQL-ID input by the application10and embeds parameters input by the application10in variables to construct an SQL statement. The SQL constructing section44is equivalent to an SQL construction logic, for example, in the privacy protection module40.

The column identifying section45is a section that identifies, on the basis of information stored in the SQL information storing section43, a protected column and data owner ID column associated with an SQL-ID input by the application10. The column identifying section45is equivalent to a column identifying logic, for example, in the privacy protection module40.

The database accessing section46is a section that accesses the DB and holds the result of the access. For example, it is equivalent to a DB connection which is a typical Java® class for accessing a DB. (Java® and all Java®-related trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries.)

The policy compliance inquiry section47is a section that issues an inquiry about policy compliance to the policy server30and receives and returns the result of the inquiry. In particular, the policy compliance inquiry section47is equivalent to a policy compliance inquiry logic in the privacy protection module40.

The inquiry result storing section48is provided for reducing costs for communicating with the policy server30and the load placed by policy compliance checks. The inquiry result storing section48serves as a cache memory for storing the results of inquires issued to the policy server30.

A hardware configuration of a typical computer system can be used as the hardware configuration of the database system in the present embodiment. In particular, any of the computer that executes the application10, the computer that manages the personal information DB20, the policy server30, and the computer that executes the privacy protection module40may be a computer that includes a central processing unit (CPU) and a main memory, which are connected to an external storage through a bus. The external storage may be a storage such as a hard disk, a flexible disk, an MO (Magneto-Optical disk), or CD-ROM, for example.

In the computer that executes the application10, the application10is stored in an external storage and is loaded and executed by the central processing unit (CPU) in the main memory to implement data processing means, not shown.

In the computer that manages the personal information DB20, an external storage implements the personal information DB20. The personal information DB20can be typically considered as data storage means.

In the policy server30, a computer program for performing policy compliance checking is stored in an external storage and the central processing unit (CPU) loads the computer program into the main memory to implement the functionality of policy compliance checking. Policies referenced in policy compliance checking may be contained in the computer program or may be stored in an external storage separately from the computer program.

In the computer that executes the privacy protection module40, the privacy protection module40is stored in an external storage and is loaded and executed by the central processing unit (CPU) in the main memory to implement privacy protection means, not shown. The control section41, access information storing section42, SQL information storing section43, SQL constructing section44, column identifying section45, database accessing section46, policy compliance inquiry section47, and inquiry result storing section48as program logics contained in the privacy protection module40implement the control section41, access information storing section42, SQL information storing section43, SQL constructing section44, column identifying section45, database accessing section46, policy compliance inquiry section47, and inquiry result storing section48, respectively, as functions of the computer.

The computer that executes the privacy protection module40may execute the application10or may manage the personal information DB20. Furthermore, the policy compliance checking function of the policy server30may be included in the policy compliance inquiry section47of the privacy protection module40or may be included as a separate program running on the computer that executes the privacy protection module40. It should be noted that if the policy compliance checking function is implemented by the policy server30, which is an independent server computer, modification to policies can be flexibly addressed.

Furthermore, each computer in the database system according to the present embodiment may have input devices such as a keyboard and a pointing device connected to it or have an output device such as a display connected to it.

Operation of the database system according to the present embodiment will be described below. In the following description of operation, the terms control section41, access information storing section42SQL information storing section43, SQL constructing section44, column identifying section45, database accessing section46, policy compliance inquiry section47, and inquiry result storing section48refer to components as functions of a computer.

FIG. 5is a flow chart of operation performed by the privacy protection module40for retrieving data from the personal information DB20in response to a request from the application10.

First, the privacy protection module40reads files used for the subsequent process (step501). In particular, the privacy protection module40reads access information stored in an external storage into an area in the main memory that is managed by the access information storing section42and reads SQL information stored in the external storage into an area in the main memory that is managed by the SQL information storing section43.

Then, the control section41in the privacy protection module40provides the SQL information read at step501to the application10in order to construct an SQL statement that can be issued to the personal information DB20without causing a problem (step502). In response to this, the application10displays the association between SQL-IDs and SQL statement templates on a display to prompt a user to select an SQL statement to be submitted to the personal information DB20.

When the user responds to this by inputting the SQL-ID of an SQL statement template from which an SQL statement the user wants to issue to the personal information DB20is constructed, parameters to be embedded in variables in the SQL statement template, and the purpose of the access, the application10provides the input SQL-ID, parameters, and purpose of the access to the privacy protection module40. The application10also identifies the accessing user by means of information such as a user ID input during login to the application10, and provides an accessor ID to the privacy protection module40.

In the privacy protection module40, the control section41receives these items of information (step503) and provides the SQL-ID and parameters to the SQL constructing section44.

Typically, SQL information is provided to an application10developer and the developer develops the application10on the basis of the SQL information. In that case, the application10can input the SQL-ID and the step502of providing SQL information can be omitted. According to such typical implementation, the privacy protection module40receives the SQL-ID and parameters from the application10and, if the SQL-ID is invalid (for example if a nonexistent SQL-ID is specified), returns an error to the application10. Only if the SQL-ID is valid, the privacy protection module40performs the following process.

The SQL constructing section44retrieves the SQL statement template associated with the provided SQL-ID from the SQL information storing section43and embeds the provided parameters in the SQL statement template to construct an SQL statement to be issued to the personal information DB20(step504), and then returns it to the control section41.

For example, if the SQL-ID “S001” and parameter “TDL” are provided, then the SQL constructing section44generates the SQL statement “SELECT id, name, tel, hobby FROM pii_table WHERE department=“TDL””.

The control section41also provides the SQL-ID to the column identifying section45.

The column identifying section45refers to the SQL information storing section43to identify a column to be protected among the columns retrieved by using the SQL statement associated with the SQL-ID provided (step505). For example, when the SQL statement associated with the SQL-ID “S001” is issued, the columns “id”, “name”, “tel”, and “hobby” are returned. The column identifying section45refers to the SQL information storing section43and knows that the columns “name” and “tel” among those columns are columns to be protected and therefore notifies the control section41that these columns are columns to be protected.

The column identifying section45refers to the SQL information storing section43to identify a column indicating the data owner ID in the columns retrieved by using the SQL statement associated with the provided SQL-ID (step506). For example, for the SQL statement associated with the SQL-ID “S001”, the columns “id”, “name”, “tel”, and “hobby” are returned. By referring to the SQL information storing section43, the column identifying section45can know that the column “id” is the ID column of the data owner and therefore indicates this to the control section41.

As a result of the process described above, the control section41holds information for determining whether a request for delivery of the retrieved data complies with a personal information protection policy, in addition to the access information required for accessing the personal information DB20and the SQL statement to be issued to the personal information DB20.

In particular, information indicating “who” accesses “whose information” and “what kind of information” for “what purpose” is required in order to protect personal information. Among these items of information, information indicating “who” accesses and for “what purpose” has been provided to the control section41at step503. Information indicating “whose information” is accessed will be specified by the application10as will be described later with reference to the flowchart inFIG. 6. Data owner ID column information used for determining whether or not the access to that person's information complies with the policy has been provided to the control section41at step506. In addition, “what kind of information” is accessed will also be specified by the application10as will be described later. Protected-column information used for determining whether or not the access to that information complies with the policy has been provided to the control section41at step505.

Then, the control section41generates database accessing section46(DB connection) (step507) and provides the held access information and SQL statement to the database accessing section46to instruct it to access the personal information DB20. In response to this instruction, the database accessing section46uses the access information to access the personal information DB20and issues the SQL statement (step508). Access from the application10to the personal information DB20is available only through the privacy protection module40. Thus, classes relating to database access are wrapped by the privacy protection module40, thereby preventing access by the application10to the personal information DB20without restraint.

Then, the database accessing section46obtains the result of the query and holds it (step509).

If the SQL statement “SELECT id, name, tel, hobby FROM pii_table WHERE department=“TDL”, for example, is issued to the personal information DB20, then the “ID”, “name”, “TEL” and “hobby” in the information of people whose “department” is “TDL” are obtained. In particular, items of information such as “0001, Taro Yamada, 03-xxxx-xxxx, yyy” and “0003, Hanako Sato, 090-xxxx-xxxx, YYY” are retrieved in the example shown inFIG. 2.

Then, the database accessing section46notifies the control section41that it has obtained the result of the query, and the control section41then notifies it to the application10(step510).

In Java®, information in a DB can be acquired by specifying the ordinal number of the record and the ordinal number of the column containing the information to be acquired and receiving the information from a class (ResultSet) that holds the result of a query. Therefore, the notified application10specifies a record and column to actually use, thereby requesting the privacy protection module40to deliver the data.

In particular, if the application10is a program that lists “name” information in the personal information included in the result of a query in order, the application10requests “name” information in the first record by the first delivery request and requests “name” information in the second record by the second delivery request. It repeats such a request until the user inputs an instruction to stop the listing of the information. The user may input an instruction to stop display before issuing requests for all information if the user find desired information in 50 people's information displayed on a display screen capable of displaying up to 50 people's information at a time.

Operation performed by the privacy protection module40for delivering data retrieved from the personal information DB20in response to a delivery request from the application10will be described below.

FIG. 6is a flowchart of the operation. As described above, after the application10is notified of the acquisition of the result of the query at step510, the application10requests the privacy protection module40to deliver the data, item by item. Operation of the privacy protection module40performed in response to one request from the application10for delivery of one particular item of data will be described here.

In the privacy protection module40, the control section41first receives the specification of a record and column from the application10(step601).

In response to this, the control section41acquires the information in the specified record in the specified column from the result of the query held by the database accessing section46(step602).

For example, if the query result acquired at step509is “0001, Taro Yamada, 03-XXXX-XXXX, YYY”, “0003, Hanako Sato, 090-XXXX-XXXX, YYY”, and so on, and the application10requests the information in the first record in the second column (“name”), then the control section41retrieves the information “Taro Yamada”.

Then, the control section41determines based on the protected column information identified at step505whether the requested column is to be protected (step603).

If the column requested is not a column to be protected, then the control section41returns the acquired information to the application10as is (step610). For example, if the columns “name” and “TEL” are specified as columns to be protected and the column “hobby” is requested, the control section41returns the retrieved information to the application10as is, because that column is not a column to be protected.

On the other hand, if the requested column is to be protected, control is passed to the policy compliance inquiry section47, which then determines whether an inquiry result is already stored in the inquiry result storing section48(step604). If the inquiry result is stored in the inquiry result storing section48, then the policy compliance inquiry section47retrieves the inquiry result from the inquiry result storing section48(step608); otherwise, the policy compliance inquiry section47inquires of the policy server30about the policy compliance (step605). For example, the columns “name” and “TEL” are specified as columns to be protected and the column “name” is requested, the policy sever30performs such policy compliance checking because the column “name” is a column to be protected.

Then, the policy server30performs policy compliance checking and returns the result to the policy compliance inquiry section47. The policy compliance inquiry section47receives the result of the inquiry and returns it to the control section41(step606) and, at the same time, caches it in the inquiry result storing section48(step607).

Specifically, the following process is performed. The assumption here is that the control section41holds the accessor ID “E0001” (Tokyo-area sales personnel) and the purpose of the access “sales activity” as a result of the processing at step503, and also holds information indicating that the columns “name” and “tel” are columns to be protected as a result of the processing at step505, and holds information indicating that the column “id” is the data owner ID column as a result of the processing at step506. It is also assumed that the following query result has been obtained at step509: “0001, Taro Yamada, 03-XXXX-XXXX, YYY” in the first record and “0003, Hanako Sato, 090-XXXX-XXXX, YYY in the second record. The policy server30holds the personal information protection policy shown inFIG. 3, which defines the condition “Only if address includes Tokyo”. It is assumed that the policy compliance inquiry section47therefore knows that it should send address information when requesting policy compliance checking. It is also assumed here that the inquiry result storing section48does not hold the result of check on compliance with this policy.

Suppose that delivery of the second column in the first record included in the result of the query is requested by the application10in the situation described above. The control section41then provides to the policy server30through the policy compliance inquiry section47the accessor ID “E0001” as the information indicating “who” is accessing, the purpose of access “For sales activities” as the information indicating “what purpose”, the data owner ID “S0001” as the information indicating “whose information”, and the column “name” as the information indicating “what kind of information”. It also provides “Tokyo” as the address of the data owner to the policy server30. In response to this, the policy server30returns “OK” as the result of the compliance check, because “E0001”, which indicates “Tokyo-area sales personnel”, is requesting delivery of the “name” of “S001” whose “address includes Tokyo” for the purpose of “sales activities” and hence the request complies with the policy inFIG. 3.

On the other hand, suppose that delivery of the second column in the second record in the result of the query is requested by the application10. Then, the control section41provides to the policy server through the policy compliance inquiry section47the accessor ID “E0001” as the information indicating “who” is accessing, the purpose of access “for sales activities” as the information indicating “what purpose”, the data owner ID “S0003” as the information indicating “whose information”, and the column “name” as the information indicating “what kind of information”. It also provides “Chiba” as the address of the data owner to the policy server30. In response to this, the policy server30returns “NG” as the result of the compliance check, because “E0001”, which indicates “Tokyo-area sales personnel”, is requesting delivery of the “name” of “S003” whose “address includes Chiba” for the purpose of “sales activities” and hence the request does not comply with the policy inFIG. 3.

While the address of the data owner is sent from the policy compliance inquiry section47to the policy server30in the specific example, the data owner ID alone may be sent for the policy compliance check if the policy server30holds the address of each individual owner.

If the request complies with the policy (YES at step609), then the control section41returns the personal information acquired at step602to the application10(step610). On the other hand, if the request does not comply with the policy (NO at step609), then the control section41does not return the personal information acquired at step602to the application10but returns an error message, for example, “Privacy Violation!”, indicating a privacy compliance exception to the application10(step611).

Thus, the operation according to the present embodiment ends.

If the present embodiment is implemented in Java®, a class that wraps an object, “java®.sql.ResultSet”, for holding the result of a query is created and a logic that performs a policy compliance check is implemented in the wrap class. Furthermore, java®.sql.ResultSet can be used as the interface for the wrap class to enable the application10to access privacy-protected personal information in exactly the same way as using a normal ResultSet.

While in the foregoing description SQL statement templates used as a basis for constructing SQL statements to be issued to the personal information DB20are provided as shown inFIG. 4such that input parameters can be embedded, SQL statements themselves may be provided so that they can be presented through the application10if the number of SQL statement patterns used are small.

While a column to be protected and data owner ID column are identified at steps505and506, respectively, by using SQL information as shown inFIG. 4in the present embodiment, the present invention is not so limited. That is, a column to be protected may be identified at any point of time before step603and may be identified based on any information. Also, the data owner ID column may be identified at any point of time before step605and may be identified based on any information.

Load concentration during access to a database can be prevented according to the present embodiment because information stored in the database is checked for compliance with a policy at the time when an application uses the information, as has been described above. For example, if an application is designed to display 50 people's information out of the information retrieved from a personal information DB on a display at a time, only the 50 people's information needs to be checked for compliance with a policy at a time.

Furthermore, unnecessary policy compliance checks can be avoided because a policy compliance check is performed at the time when the application uses information stored in the DB. For example, intended processing may be completed in effect after 50 people's information is scanned among 1,000 people's information that has been hit. In such a case, the benefits of avoiding unnecessary policy compliance checks is significant.

According to the conventional techniques, a special database must be provided that has a mechanism for transforming an SQL query received into an SQL for acquiring only the information that complies with a policy as the result of the query. In contrast, the present embodiment does not require such a special database.

Furthermore, according to the conventional techniques, an extended SQL must be used for a policy compliance check if information such as who accesses information for what purpose is used. According to the present embodiment, in contrast, an extended SQL does not need to be used because such information is addressed in the privacy protection module.

DESCRIPTION OF SYMBOLS