Communication system, communication apparatus, communication method, and storage medium

The data server stores, data and user identification information, and transmits to the analysis server the data and first identification information associated with the user identification information. The analysis server analyzes the data and stores an analysis result in association with the first identification information. When the communication apparatus transmits the analysis-result obtainment request to the analysis server, the analysis server transmits, to the communication apparatus, second identification information associated with the analysis-result obtainment request. The communication apparatus transmits the second identification information and the user identification information to the data server. The data server transmits the second identification information and the first identification information associated with the user identification information to the analysis server. The analysis server transmits the analysis result and the second identification information to the communication apparatus. The communication apparatus transmits the analysis result to a requestor that has made the analysis-result obtainment request.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2012-202526, filed on Sep. 14, 2012, the entire contents of which are incorporated herein by reference.

FIELD

The embodiments discussed herein are related to a communication performed between a plurality of communication apparatuses.

BACKGROUND

In recent years, analysis agents have provided a service to analyze data obtained from a client via, for example, a Virtual Private Network (VPN), and to provide the client with results obtained from the analyzing. When the client requests, for each user, an analysis result on data obtained from each individual user, data to be analyzed is associated with personal information to identify the user. Accordingly, in many cases, in order to prevent personal information from leaking from data given to the analysis agent, clients perform a process of replacing the personal information with, for example, pseudonym, which can uniquely specify an individual, and then give the processed data to the analysis agent. The analysis agent analyzes the data obtained from the client and associates an analysis result for each user with pseudonym. In addition, the analysis agent associates the obtained analysis result with pseudonym and then provides the client with this result. The client replaces the pseudonym associated with the analysis result obtained from the analysis agent with personal information of a user. Meanwhile, the user requests an analysis result obtained for this user from the client. Accordingly, the client provides the user who has requested an analysis result with the analysis result associated with this user.

As a related art, a single sign-on system is known that includes: a user terminal; a service server; and an authentication server for performing authentication when the user terminal logs in the service server. When authentication is successful, the authentication server connects a user ID with an identifier unique to the service server which has made a request for authentication, and generates an encrypted new ID, and transmits it to the user terminal. When a service use is requested together with a new ID, the service server obtains user information from the authentication server by using the new ID. A system is also known wherein, when a line ID corresponding to an address specified by inquiring with a network management device is identical with a registered line ID specified based on a link ID, encrypted information for presentation information corresponding to the link ID and the registered link ID is transmitted to a user terminal.

PRIOR ART DOCUMENTS

Patent Documents

As described above in “BACKGROUND”, when a user wishes to obtain, via the client, an analysis result obtained for the user, the analysis result is sent from the analysis agent to the client and is then sent from the client to the user. Allowing individual users to directly request the analysis result obtained for data on them from the analysis agent will improve user convenience and, in addition, decrease the processing load on a data server. However, in order to access a server of the analysis agent, a user obtains pseudonym which substitute as personal information of the user, and then makes a request for the server of the analysis agent to allow an analysis result corresponding to the obtained pseudonym to be referenced. However, there is a risk of leakage of information of pseudonym in reporting of pseudonym to a terminal used by the user. When information of pseudonym is leaked, the pseudonym need to be changed, thereby making the process complicated and incurring a cost.

SUMMARY

According to an aspect of the embodiments, a communication system includes a data server, an analysis server, and a communication apparatus that communicates with the data server and the analysis server. The data server stores, in association with each other, data obtained by the data server and user identification information that identifies a user, and transmits to the analysis server the data and first identification information associated with the user identification information. The analysis server analyzes the data obtained from the data server and stores an analysis result in association with the first identification information. Upon receipt of the user identification information and an analysis-result obtainment request, the communication apparatus transmits the analysis-result obtainment request to the analysis server. Upon receipt of the analysis-result obtainment request, the analysis server generates and transmits, to the communication apparatus, second identification information associated with the analysis-result obtainment request. Upon receipt of the second identification information, the communication apparatus transmits the second identification information and the user identification information to the data server. Upon receipt of the second identification information and the user identification information, the data server transmits the second identification information and the first identification information associated with the user identification information to the analysis server. Upon receipt of the first identification information and the second identification information, the analysis server transmits the analysis result and the second identification information to the communication apparatus. Upon receipt of the analysis result and the second identification information, the communication apparatus transmits the analysis result to a requestor that has made the analysis-result obtainment request received by the communication apparatus.

DESCRIPTION OF EMBODIMENTS

FIG. 1illustrates an exemplary communication method in accordance with an embodiment.FIG. 1depicts an example of communication performed between a communication apparatus60of user A, a data server10, and an analysis server30. User A belongs to group G. Examples of group G include a company, a school, a hospital, a municipality, and so on. The data server10holds data on users belonging to group G.

(1) The data server10stores data on each user belonging to group G and a pseudonym ID (a pseudonym) for each user. The data server10extracts, from data on each user, concealed information for each user and generates substituted data obtained by replacing the concealed information with a pseudonym ID associated with the user. The concealed information includes one or more other pieces of privacy information of the user such as an ID, a name, an address, sex, and age for user identification. Information provided in place of concealed information will hereinafter be referred to as a “pseudonym ID” or “pseudonym”. In the example illustrated inFIG. 1, the concealed information related to user A is replaced with the pseudonym a.

Optionally, substituted data may include information obtained by encrypting or masking concealed information in an arbitrary format such that the analysis server30does not obtain the concealed information. Accordingly, in the following descriptions, replacing concealed information with a pseudonym ID includes, in addition to deleting the concealed information from data on a user and adding the pseudonym ID, adding a pseudonym ID to data obtained by encrypting or masking concealed information included in the data on the user.

(2) The data server10transmits substituted data to the analysis server30.

(3) The analysis server30analyzes data included in the substituted data and holds an analysis result. An analysis result for each user, which is associated with a pseudonym of each user, is held. As an example, an analysis result related to data on user A is associated with pseudonym a and is held in the analysis server30.

(4) The communication apparatus60accesses the analysis server30using an identifier that identifies a group to which the user belongs (a group identifier) and requests an analysis result. As an example, the communication apparatus60may use an account that identifies group G as a group identifier.

(5) Upon receipt of a request message that requests an analysis result, the analysis server30generates an access identifier (α) for the request message.

(6) The analysis server30reports (i.e. notifies) access identifier α to the communication apparatus60.

(7) The communication apparatus60reports to the data server10the access identifier reported from the analysis server30. The communication apparatus60also transmits to the data server10information that identifies a user for whom an analysis result is requested (a user identifier). In the example illustrated inFIG. 1, the combination of access identifier α and the user identifier that identifies user A is reported from the communication apparatus60to the data server10.

(8) Using the received combination of the user identifier and the access identifier, the data server10associates the access identifier with a pseudonym ID. As an example, the data server10recognizes, from the information received from the communication apparatus60, that access identifier α has been allocated to user A. Accordingly, the data server10associates access identifier α with pseudonym a associated with user A.

(9) The data server10reports to the analysis server30the pseudonym ID associated with the reported access identifier. In the example illustrated inFIG. 1, the data server10reports to the analysis server30that the pseudonym ID associated with access identifier α is a.

(10) For an analysis result associated with the pseudonym ID reported from the data server10, the analysis server30determines that a request to transmit the analysis result has been made. That is, in procedure (4), the analysis server30determines that the communication apparatus60has requested the analysis result associated with pseudonym a.

(11) The analysis server30transmits the analysis result associated with pseudonym a to the communication apparatus60.

(12) The communication apparatus60obtains an analysis result for user A from the analysis server30.

Using the communication method described with reference toFIG. 1, the communication apparatus60may request an analysis result directly from the analysis server30without obtaining a pseudonym ID of a user who has requested the analysis result. In addition, in the communication method in accordance with the embodiment, pseudonym IDs are obtained by only the data server10and the analysis server30, so pseudonym IDs become highly confidential. Moreover, data to be concealed such as personal information of a user belonging to group G is not transmitted to the analysis server30, so there is no risk of leakage of, for example, personal information even if the analysis server30is administered by a third party having nothing to do with group G.

For clarification, a situation in which the communication apparatus60is used by an individual user was described with reference to the example ofFIG. 1, but the communication apparatus60may be an apparatus that receives access from a plurality of users, such as a server that provides portal sites.

<System Configuration and Apparatus Configuration>

FIG. 2illustrates an exemplary system configuration. In the following, an exemplary situation will be described in which a communication apparatus60receives access from a plurality of users. Using a particular terminal80(80aand80b), each user accesses the communication apparatus60via an internet5a. For a data server10and an analysis server30, the communication apparatus60performs a proxy authentication process as a proxy for the terminal80of each user. The communication apparatus60communicates with the data server10and the analysis server30via an internet5b. Apparatus configurations of the data server10, the analysis server30, the communication apparatus60, and the terminal80will be described hereinafter. A VPN is used as appropriate for communication performed via the internet5aor5b.

FIG. 3illustrates an exemplary configuration of the data server10. The data server10includes a gateway unit11, an authentication unit15, an application processing unit18, and a storage unit20. The gateway unit11includes a receiver12, a transmitter13, a concealed-information restoration processing unit14, a session managing unit16, and a pseudonym-ID managing unit17. The storage unit20holds a pseudonym-ID table21and a session management table22and further stores data used by, for example, the gateway unit11, the authentication unit15, and the application processing unit18.

The receiver12receives data from the communication apparatus60and the analysis server30via the internet5b. In accordance with a type of the received data, the receiver12distributes the data to the authentication unit15, the concealed-information restoration processing unit14, the session managing unit16, the pseudonym-ID managing unit17, and the application processing unit18. The transmitter13transmits data input from the authentication unit15, the concealed-information restoration processing unit14, the session managing unit16, the pseudonym-ID managing unit17, and the application processing unit18. The transmitter13transmits data to the analysis server30and the communication apparatus60via the internet5b.

The concealed-information restoration processing unit14extracts concealed information from data on each user and generates substituted data by replacing the concealed information with a pseudonym ID associated with the user. By referencing the pseudonym-ID table21, the concealed-information restoration processing unit14determines a pseudonym ID that is used to generate substituted data. The pseudonym-ID table21associates information that uniquely identifies a user with a pseudonym ID that is added to data on the user in the generating of substituted data. An example of the pseudonym-ID table21is illustrated inFIG. 4.FIG. 4depicts an example in which users are students and a group is a school, wherein a student ID of each user is associated with a pseudonym ID.

The authentication unit15performs an authentication process on a user who has accessed the data server10and determines whether the accessing user is authorized to use the data server10. The authentication unit15stores information of the combination of an account and a password for each individual user who is authorized to access the data server10. The account allocated to each user will hereinafter be referred to as a “user account”. When authentication by the authentication unit15succeeds, the session managing unit16generates a session ID. The session managing unit16transmits the session ID via the transmitter13to the communication apparatus60, for which authentication has succeeded. In addition, the session managing unit16generates the session management table22by associating each session with information related to a user performing communication using the session. An example of the session management table22and an example of a method for using the session management table22will be described hereinafter.

When a change is made to the pseudonym-ID table21, the pseudonym-ID managing unit17revises the pseudonym-ID table21. The pseudonym-ID table21may be changed in accordance with a contract between an administrator of the data server10and a user. An operator may transmit, from a communication apparatus that is used to control the data server10to the pseudonym-ID managing unit17, a message that reports details of a change in the pseudonym-ID table21, thereby revising the pseudonym-ID table21. Using an application, the application processing unit18performs a process on data input from the receiver12.

FIG. 5illustrates an exemplary configuration of the analysis server30. The analysis server30includes a gateway unit31, an authentication unit34, an application processing unit40, and a storage unit50. The gateway unit includes a receiver32, a transmitter33, an access-identifier generating unit35, an address solution unit36, and a sequence managing unit37.

The receiver32receives data from the communication apparatus60and the data server10via the internet5band, in accordance with a type of the received data, distributes the data to the authentication unit34, the access-identifier generating unit35, the address solution unit36, the sequence managing unit37, and the application processing unit40. The transmitter33transmits data input from the authentication unit34, the access-identifier generating unit35, the address solution unit36, the sequence managing unit37, and the application processing unit40. The transmitter13transmits data to the data server10and the communication apparatus60via the internet5b.

The authentication unit34performs an authentication process on a user who has accessed the analysis server30and determines whether the accessing user is authorized to use the analysis server30. Each user makes a request for the analysis server30to perform authentication using an account allocated to a group to which the user belongs. Accordingly, for a group authorized to access the analysis server30, the authentication unit34stores information of the combination of an account and a password. An account of each group stored in the authentication unit34will hereinafter be referred to as a “group account”. When authentication by the authentication unit34succeeds, the access-identifier generating unit35generates and transmits a session ID via the transmitter33to an apparatus for which authentication has succeeded. In addition, when the analysis server30receives a request message that requests an analysis result, the access-identifier generating unit35generates an access identifier. The access-identifier generating unit35may associate the access identifier with a session ID and may record this access identifier in a pseudonym-ID table52of the storage unit50.

The address solution unit36uses an account table53. The account table53associates a group account with identification information that identifies the data server10that holds data on a group identified by the group account. When an analysis-service contract is made between the data server10and the analysis agent, the account table53is generated before the analysis service is provided.FIG. 6illustrates an example of the account table53. In the example ofFIG. 6, a URL (Uniform Resource Locator) that is used by a user to access the data server10is used as identification information. The identification information is not limited to a URL but may be, for example, an IP address (Internet Protocol address) allocated to the data server10. For each access identifier, the sequence managing unit37determines whether the access identifier has been registered in the data server10, and records the result of determining in a state table54. An example of the state table54will be described hereinafter.

The application processing unit40includes an analyzing unit41and an output unit42. The analyzing unit41analyzes substituted data received from the data server10and generates an analysis result. The analysis result is stored as data51. When the analysis server30is notified of a pseudonym ID corresponding to a user for whom a request to output an analysis result has been made by a request message, the output unit42generates and outputs, to the transmitter33, a packet that includes an analysis result associated with the pseudonym ID that the analysis server30has been notified of. The transmitter33transmits to a source of the request message the packet input from the output unit42.

The storage unit50holds the data51, the pseudonym-ID table52, the account table53, and the state table54. The data51includes an analysis result. The storage unit50further stores data obtained from a process performed by the gateway unit31, the authentication unit34, and the application processing unit40, and data used in a process performed by the gateway unit31, the authentication unit34, and the application processing unit40.

FIG. 7illustrates an exemplary configuration of the communication apparatus60. The communication apparatus60includes a gateway unit61, an authentication unit64, an ID managing unit65, and a storage unit70. The gateway unit61includes a receiver62, a transmitter63, a proxy authentication unit66, a session managing unit67, and a sequence managing unit68. The storage unit70holds an ID management table71, a cooperation table72, and a session management table73, and stores data generated in a process performed by the gateway unit61, the transmitter63, and the ID managing unit65.

The receiver62receives data from the terminal80via the internet5aand further receives data from the data server10and the analysis server30via the internet5b. Moreover, in accordance with a type of the received data, the receiver62distributes the data to the authentication unit64, the ID managing unit65, the proxy authentication unit66, the session managing unit67, and the sequence managing unit68. The transmitter63transmits data to the terminal80via the internet5aand further transmits data to the data server10and the analysis server30via the internet5b.

The authentication unit64performs an authentication process regarding the terminal80, which has accessed the communication apparatus60, and determines whether a user accessing via the terminal80is authorized to use the communication apparatus60. The authentication unit64, which stores an account and a password for each user authorized to access the communication apparatus60, performs an authentication process using the account and the password. The session managing unit67generates a session ID for the terminal80, for which authentication has succeeded. The session managing unit67also manages information of the session ID that is used for communication between the communication apparatus60and the analysis server30and for communication between the communication apparatus60and the data server10. To easily distinguish between session IDs, a session ID shared between the terminal80and the communication apparatus60and a session ID shared between the communication apparatus60and the analysis server30will hereinafter be referred to as a “first session ID” and a “second session ID”, respectively. In addition, a session ID shared between the communication apparatus60and the data server10will be referred to as a “third session ID”.

The ID managing unit65performs a process of updating the ID management table71. The ID management table71holds information related to a user for whom the communication apparatus60performs proxy authentication. The ID management table71is generated or updated when a contract is made between a user and an agent that provides a service via the communication apparatus60. Information that identifies an access destination for each user and information that is used for authentication at the access destination are associated with each other and recorded in the ID management table71.FIG. 8illustrates an example of the ID management table71. Referring to the example ofFIG. 8, the URLs of access destinations, for which the communication apparatus60performs proxy authentication, and accounts and passwords, both used for authentication at the access destinations, are associated with a user ID and recorded. The proxy authentication unit66performs proxy authentication using information from the ID management table71.

For each user, the session managing unit67manages the values of first, second, and third session IDs and information of a communication partner in a communication performed using the second or third session ID. With reference to a session ID, the sequence managing unit68specifies a situation of a communication specified by the session ID and records this specified situation in the session management table73.

FIG. 9illustrates an exemplary configuration of the terminal80. The terminal80includes an application processing unit85, a display apparatus86, and a restoration processing unit87. The restoration processing unit87includes a transmitter81, a receiver82, a concealed-information restoration processing unit83, and a session managing unit84. The transmitter81transmits data to the communication apparatus60, and the receiver82receives data from the communication apparatus60. To encrypt data to be transmitted to the communication apparatus60, the concealed-information restoration processing unit performs an encrypting process. In addition, when encrypted data is received from the communication apparatus60via the receiver62, the concealed-information restoration processing unit83decrypts this received data. The session managing unit84holds and properly updates session information that is used for communication with the communication apparatus60. Using an application, the application processing unit85processes data. The display apparatus86allows a user to visually check data processed by the terminal80. As an example, the display apparatus86displays a result of a process performed by the application processing unit85.

FIG. 10illustrates an example of a hardware configuration of a server and the terminal80. The data server10, the analysis server30, the communication apparatus60, and the terminal80may all have the hardware configuration depicted inFIG. 10. The server includes a processor101, a memory102, an input apparatus103, an output apparatus104, a bus105, an external storage apparatus106, a medium driving apparatus107, and a network connecting apparatus109. The data server10, the analysis server30, the communication apparatus60, and the terminal80may be achieved as, for example, a computer.

The processor101may be any processing circuit that includes a Central Processing Unit (CPU). In the data server10, the processor101is operated as the concealed-information restoration processing unit14, the authentication unit15, the session managing unit16, the pseudonym-ID managing unit17, and the application processing unit18. In the analysis server30, the processor101is operated as the authentication unit34, the access-identifier generating unit35, the address solution unit36, the sequence managing unit37, and the application processing unit40. In the communication apparatus60, the processor101is operated as the authentication unit64, the ID managing unit65, the proxy authentication unit66, the session managing unit67, and the sequence managing unit68. In the terminal80, the processor101is operated as the concealed-information restoration processing unit83, the session managing unit84, and the application processing unit85. The processor101may execute a program stored in, for example, the external storage apparatus106.

The memory102properly stores data obtained from an operation by the processor101and data used for a process performed by the processor101. The memory102is operated as the storage unit20for the data server10, the storage unit50for the analysis server30, and the storage unit70for the communication apparatus60.

The network connecting apparatus109performs a process for communication with another apparatus. The network connecting apparatus109is operated as the receiver12and the transmitter13for the data server10and as the receiver32and the transmitter33for the analysis server30. The network connecting apparatus109is also operated as the receiver62and the transmitter63for the communication apparatus60and as the transmitter81and the receiver82for the terminal80.

The input apparatus103is achieved as, for example, a button, a keyboard, or a mouse, and the output apparatus104is achieved as, for example, a display. As an example, in the terminal80, the output apparatus104is operated as the display apparatus86. The bus105establishes a connection that allows data to be passed between the processor101, the memory102, the input apparatus103, the output apparatus104, the external storage apparatus106, the medium driving apparatus107, and the network connecting apparatus109. The external storage apparatus106stores, for example, a program and data and properly provides stored information to, for example, the processor101. The medium driving apparatus107may output data from the memory102and the external storage apparatus106to a portable storage medium108, and a program, data, and so on may be read from the portable storage medium108. The portable storage medium108may be any portable storage medium, including a floppy disk, a Magneto-Optical (MO) disc, a Compact Disc Recordable (CD-R), and a Digital Versatile Disk Recordable (DVD-R).

First Embodiment

In the following, an exemplary situation will be described in which F High School administers the data server10and a request has been made for the analysis server30to analyze test results of students. Thus, the following descriptions are based on the assumption that users who attempt to reference the analysis server30are students of F High School. The analysis server30transmits, to a user who has made a request to provide an analysis result, data obtained from a test result of the user.

FIG. 11illustrate a method for generating substituted data and illustrate an example of an analysis result of substituted data.FIG. 11Adepicts an example of a test result of one of the students for whom an analysis is made. A test result of each subject is associated with the name or student ID of an examinee. In this example, the name and the student ID of examinees are concealed from a third party and are treated as concealed information. Accordingly, the pseudonym-ID managing unit17of the data server10determines pseudonym IDs that can uniquely identify a student for whom a test result is obtained, thereby generating a pseudonym-ID table21(seeFIG. 4). After the pseudonym-ID table21is generated, the concealed-information restoration processing unit14replaces concealed information with a pseudonym ID using the pseudonym-ID table21. To convert the test result illustrated inFIG. 11Ainto substituted data using the pseudonym-ID table21illustrated inFIG. 4, the concealed-information restoration processing unit14replaces the student ID and the name, both of which are concealed information, with a pseudonym ID associated with the student ID. Thus, the concealed-information restoration processing unit14generates the substituted data illustrated inFIG. 11Bfrom the information illustrated inFIG. 11A. The concealed-information restoration processing unit14performs a similar process for the test results of all of the students for whom a request is made for the analysis server30to make an analysis. In addition, the concealed-information restoration processing unit14transmits the generated substituted data to the analysis server30.

Upon receipt of substituted data from the data server10, the analyzing unit41of the analysis server30analyzes the substituted data. An analysis result for each user is recorded after it is associated with a pseudonym ID. When a result obtained from an analysis is a deviation value of each subject, the analyzing unit41may hold the analysis result illustrated inFIG. 11Cfor the user with pseudonym ID=123456. Meanwhile, as illustrated inFIG. 11D, the analyzing unit41may generate metadata to easily determine whether an analysis result is present for each user.

FIG. 12AandFIG. 12Bare sequence diagrams illustrating an example of communication in accordance with the first embodiment. With reference toFIG. 12AandFIG. 12B, descriptions will be given of an example of communication that is performed when a user requests an analysis result from the analysis server30after the analysis server30finishes an analysis. The following descriptions are based on the assumption that the user is the student having the test result illustrated inFIG. 11A. In the examples ofFIG. 12AandFIG. 12B, authentication is performed between the terminal80and the communication apparatus60using Security Assertion Markup Language (SAML).

(A1) Using the terminal80, a user makes a request for the communication apparatus60to enable a portal site to be accessed (a portal service request), the portal site including a menu that allows an analysis result to be browsed.

(A2) When authentication is requested from the communication apparatus60, the user enters in the terminal80an account and a password to access the communication apparatus60.

(A3) The terminal80transmits the information entered by the user to the communication apparatus60. Assume that “hanako” and “passwordl” are transmitted to the communication apparatus60respectively as the account and the password.

(A4) The receiver62of the communication apparatus60outputs an authentication request to the authentication unit64. When the entered information is identical with any of the combinations of an account and a password stored in advance, the authentication unit64allows the terminal80to gain access. The authentication unit64of the communication apparatus60issues an authentication assertion to the terminal80.

(A5) By transmitting the authentication assertion to the communication apparatus60, the application processing unit85reports to the communication apparatus60that authentication has succeeded.

(A6) When the authentication assertion is received, the session managing unit67of the communication apparatus60allocates a first session ID to the terminal80and reports the first session ID to the terminal80. In this case, Set Cookie header of HyperText Transfer Protocol (HTTP) may be used, for example.

FIG. 13illustrates an example of updating of information via communication between the terminal80and the communication apparatus60. When a first session ID is generated, the sequence managing unit68associates the progress of the procedures of communication between the terminal80and the communication apparatus60with the first session ID and records this progress in the session management table73. As an example, assume that the first session ID allocated to communication with the terminal80is xxxx001. Accordingly, as of procedure (A6), the sequence managing unit68holds a session management table73aillustrated inFIG. 13.

(A7) By transmitting a portal service request to the communication apparatus60, the application processing unit85makes a request to allow the portal site that includes an analysis-result browsing menu to be accessed. The message that is used to make a request to allow the portal site to be accessed includes the first session ID.

(A8) The communication apparatus60transmits to the terminal80data that is used to display the portal site. Simultaneously, the authentication unit64associates the first session ID with an account reported from the terminal80in the performing of authentication in procedure (A3), so as to record in the cooperation table72information related to the user who has made a request to allow the portal site to be accessed. As of procedure (A8), the communication apparatus60holds a cooperation table72aillustrated inFIG. 13. An account reported from the terminal80to the communication apparatus60in the performing of authentication in procedure (A3) may hereinafter be referred to as a “user ID”.

Meanwhile, the receiver82of the terminal80outputs to the application processing unit85data received from the communication apparatus60. Using the input data, the application processing unit85displays on the display apparatus86the portal site that includes an analysis-result browsing menu.

(A9) The user checks the portal site on the display apparatus86and chooses to browse an analysis result using an input apparatus. Accordingly, the application processing unit85transmits to the communication apparatus60an analysis result request, which indicates a request to allow an analysis result to be browsed. The analysis result request includes the first session ID and the address of the analysis server30that holds the analysis result. The session managing unit67may recognize an address for which access is requested by the analysis result request. Accordingly, when the communication apparatus60receives the analysis result request, the session managing unit67updates the cooperation table72ato the cooperation table72billustrated inFIG. 13. The sequence managing unit68updates the session management table73to the session management table73billustrated inFIG. 13.

Next, with reference to (B1) to (B7) inFIG. 12A, descriptions will be given of an example of a process series from a process in which the communication apparatus60accesses the analysis server30to a process in which an access identifier is reported to the communication apparatus60.

(B1) The proxy authentication unit66obtains from the cooperation table72ban address for which access has been requested by an analysis result request and determines that an access destination is the analysis server30. Accordingly, the proxy authentication unit66transmits to the analysis server30a request message to request an analysis result. In this case, since authentication has not been performed between the communication apparatus60and the analysis server30, the request message does not include a second session ID.

(B2) The authentication unit34of the analysis server30makes a request for the source of the request message that does not include a second session ID to perform authentication.

(B3) Using the ID management table71, the proxy authentication unit66specifies an account and a password, both of which are used for authentication with the analysis server30. In this example, the proxy authentication unit66searches the ID management table71using as keys the user ID and the URL “https://kaisekiservice1.com” of the analysis server30. The proxy authentication unit66specifies the user ID from the cooperation table72band the first session ID included in the analysis result request. Accordingly, as information to be used for proxy authentication, the proxy authentication unit66obtains a group account and a password, both of which are assigned to the group (F High School) to which the user belongs. The following descriptions will be given on the assumption that the proxy authentication unit66has chosen to use group account d001 and password pw001 for proxy authentication by referencing the ID management table71(FIG. 8). Using the group account and the password that have been chosen to be used for proxy authentication, the proxy authentication unit66transmits to the analysis server30an authentication request message to make a request to perform authentication.

(B4) The receiver32of the analysis server30outputs the authentication request message to the authentication unit34. When any of the combinations of an account and a password stored in advance are identical with the combination of a group account and a password included in the input information, the authentication unit34allows the communication apparatus60to be accessed and generates a second session ID. The following descriptions will be given on the assumption that S0001 has been generated as the second session ID.

FIG. 14illustrates an example of updating of information via authentication between the communication apparatus60and the analysis server30. When authentication at the authentication unit34succeeds, the access-identifier generating unit35associates the second session ID and the group account with each other and records this second session ID and this group account, as indicated by a pseudonym-ID table52ainFIG. 14. In addition, the authentication unit34reports the second session ID to the communication apparatus60.

(B5) The receiver62, which has received a report message that includes the second session ID from the analysis server30, outputs the received report message to the proxy authentication unit66and the session managing unit67. Upon receipt of the second session ID from the report message, the session managing unit67updates the cooperation table72b(FIG. 13) to the cooperation table72c(FIG. 14). The proxy authentication unit66generates and transmits a request message that includes the second session ID to the analysis server30via the transmitter63.

(B6) By referencing the pseudonym-ID table52a(FIG. 14), the access-identifier generating unit35determines whether an access identifier is associated with the second session ID included in the request message. The second session ID (S0001) included in the received request message is not associated with an access identifier. Accordingly, the access-identifier generating unit35determines an access identifier to be associated with the second session ID. The following descriptions will be given on the assumption that the access identifier associated with the second session ID S0001 is ac001.

FIG. 15illustrates an example of updating of information in reporting of an access identifier from the analysis server30to the communication apparatus60. The access-identifier generating unit35determines and records an access identifier in the pseudonym-ID table52. As an example, the access-identifier generating unit35updates the pseudonym-ID table52ato the pseudonym-ID table52b. When the access-identifier generating unit35determines an access identifier, the access-identifier generating unit35reports to the sequence managing unit37the combination of the access identifier and the second session ID. Accordingly, the sequence managing unit37updates the state table54, which is used to determine whether the access identifier reported from the access-identifier generating unit35is registered in the data server10. As an example, the access-identifier generating unit35may update the state table54to a state table such as a state table54aillustrated inFIG. 15.

In addition, the access-identifier generating unit35generates a registration request message to register the access identifier in the data server10. To generate the registration request message, the access-identifier generating unit35references the account table53(FIG. 6) so as to specify an address and a URL allocated to the data server10, i.e., a data server in which the access identifier is to be registered. The following descriptions will be given on the assumption that “https://abc.ed.jp” has been specified as a URL allocated to the data server10.FIG. 16illustrates an example of a registration request message. As will be described hereinafter, the registration request message illustrated inFIG. 16is transmitted from the communication apparatus60to the data server10using HTTP redirect. The access-identifier generating unit35transmits the registration request message that includes the specified address to a communication partner identified by the second session ID.

(B7) The receiver62, which has received a registration request message, outputs this registration request message to the session managing unit67. Using the registration request message, the session managing unit67updates the cooperation table72c(FIG. 14) to the cooperation table72d(FIG. 15). Moreover, the session managing unit67transmits the registration request message to the data server10. As an example, upon receipt of the registration request message illustrated inFIG. 16, the session managing unit67transforms this registration request message into a registration request message suitable for the data server10and transmits the transformed registration request message to the data server10via the transmitter63.

(B8) The receiver12of the data server10, which has received the registration request message, outputs this registration request message to the authentication unit15. The authentication unit15determines whether the registration request message includes a third session ID. When a third session ID is not included, the authentication unit15makes a request for the source of the registration request message to perform authentication. Since authentication has not been performed between the communication apparatus60and the data server10, the authentication unit15transmits an authentication request message to the communication apparatus60via the transmitter13. In this case, the authentication unit15incorporates the access identifier included in the registration request message into the authentication request message. Accordingly, in this case, the authentication request message that includes access identifier ac001 is transmitted to the communication apparatus60.

(B9) The receiver62of the communication apparatus60outputs the authentication request message to the proxy authentication unit66. Using the access identifier included in the authentication request message as a key, the proxy authentication unit66searches the cooperation table72d(FIG. 15). In accordance with the cooperation table72d, the requested authentication is judged to be directed to access https://abc.ed.jp, which relates to a user ID “hanako”. Accordingly, the proxy authentication unit66searches the ID management table71using the user ID and the access destination as keys so as to specify an account and a password, both of which are used for authentication. The ID management table71records a user account determined for each user as an account for making a request for the data server10to perform authentication. Thus, the user account is used for authentication from the communication apparatus60to the data server10. As an example, in the case of the ID management table71illustrated inFIG. 8, the account used for authentication is 986012, and the password is pwxxx. Using the account and the password specified using the ID management table71, the proxy authentication unit66makes a request for the data server10to perform authentication.

(B10) The receiver12of the data server10outputs to the authentication unit15the authentication request from the communication apparatus60. When an authentication request is input that includes the combination of an account and a password which are both identical with any of the combinations of a user account and a password stored in advance, the authentication unit15allows access from the communication apparatus60. In addition, the authentication unit15outputs to the session managing unit16the user account of a user who has been newly successfully authenticated. The session managing unit16generates a third session ID for the user account reported from the authentication unit15. Moreover, using the pseudonym-ID table21, the session managing unit16associates the newly generated third session ID with a pseudonym ID so as to generate a session management table22. As an example, assume that the third session ID zzzzzzz is allocated to access from account 986012. Accordingly, the session managing unit16generates a session management table22aillustrated inFIG. 17. The session managing unit16reports to the communication apparatus60the success of authentication and the third session ID.

(B11) The receiver62, which has received a message reporting the success of authentication, outputs this message to the session managing unit67. The session managing unit67processes the input message so as to update the cooperation table72d(FIG. 15) to a cooperation table72e(FIG. 17). The session managing unit67generates a registration request message that includes access identifier ac001 and the third session ID. The registration request message is transmitted to the data server10via the transmitter63.

(B12) Upon receipt of the registration request message that includes the third session ID, the receiver12outputs this received message to the session managing unit16. Using as a key the third session ID included in the input registration request message, the session managing unit16searches the session management table22. The session managing unit16associates the access identifier reported by the registration request message with an entry that has been hit and then registers this access identifier. Through this process, as an example, the session management table22aillustrated inFIG. 17is updated to the session management table22b. When the updating of the session management table22ends, the session managing unit16generates a registration completion message to report the completion of registering of the access identifier to the communication apparatus60and transmits this message to the communication apparatus60via the transmitter13. The registration completion message includes the access identifier that has been registered.

(B13) Upon receipt of the registration completion message, the receiver62outputs this message to the session managing unit67. For the access identifier included in the registration completion message, the session managing unit67generates a message that reports to the analysis server that the registering has been completed (a registration-completion report message). Moreover, using the cooperation table72eillustrated inFIG. 17, the session managing unit67specifies the second session ID and the address allocated to the analysis server30.

(C1) With reference toFIG. 12BandFIG. 18, descriptions will be given of an example of updating of information after an access identifier is registered in the data server10. Upon receipt of a registration-completion report message from the communication apparatus60, the receiver32of the analysis server30outputs this message to the access-identifier generating unit35and the sequence managing unit37. Using the registration-completion report message, the sequence managing unit37updates the state table54a(FIG. 15) to the state table54b(FIG. 18). The access-identifier generating unit35generates a message to request a pseudonym ID associated with the access identifier for which registration completion has been reported (pseudonym-ID request message). In the generating of the pseudonym-ID request message, the access-identifier generating unit35references the pseudonym-ID table52so as to obtain a group account associated with an access identifier for which reporting has been completed. As an example, the access-identifier generating unit35references the pseudonym-ID table52b(FIG. 15) so as to obtain group account d001. The access-identifier generating unit35obtains the address of the data server10by searching the account table53using the obtained group account as a key. The access-identifier generating unit35transmits the pseudonym-ID request message to the data server10.

(C2) The receiver12of the data server10outputs the pseudonym-ID request message to the session managing unit16. The session managing unit16specifies a requested pseudonym ID by referencing the session management table22. When, for example, a pseudonym ID associated with access identifier ac001 is requested, the session managing unit16reports pseudonym ID=123456 to the analysis server30according to the session management table22b(FIG. 17).

When the pseudonym ID is reported from the data server10, the receiver32outputs the report on the pseudonym ID to the access-identifier generating unit35and the output unit42. Using the input information, the access-identifier generating unit35updates the pseudonym-ID table52b(FIG. 15) to the pseudonym-ID table52c(FIG. 18).

(B14) The output unit42generates and outputs to the transmitter33a packet that includes an analysis result associated with the pseudonym ID reported from the data server10. The transmitter33transmits the packet that includes the analysis result to the communication apparatus60as a response to procedure (B13). Assume that the analysis result has been encrypted. As an example, for pseudonym ID=123456, the output unit42outputs the analysis result illustrated inFIG. 11Cto the communication apparatus60.

(A10) Upon receipt of the packet that includes the analysis result from the analysis server30, the receiver62outputs this packet to the session managing unit67. The session managing unit67transmits information included in the input packet to the terminal80via the transmitter63. The session managing unit67may use information from the cooperation table72in order to specify the terminal80. The packet that includes the analysis result is transmitted to the terminal80as a response to procedure (A9). During procedures (A9) to (A10), the communication between the communication apparatus60and the terminal80continues using, for example, keep-alive. The terminal80properly decodes data transmitted from the communication apparatus60. The application processing unit85may display the analysis result on the display apparatus86.

FIG. 19AandFIG. 19Bare flowcharts illustrating exemplary operations of the analysis server30. Upon receipt of a message, the receiver32outputs this received message to the access-identifier generating unit35(step S1). The access-identifier generating unit35determines whether the input message is a request message (step S2). When the access-identifier generating unit35determines that a request message has been received, the access-identifier generating unit35determines whether authentication with a source of the request message has been finished (step S3). As an example, the access-identifier generating unit35determines that authentication has been finished when the request message includes the second session ID, and determines that authentication has not been finished when a second session ID is not included. When the access-identifier generating unit35determines that authentication has not been finished, the access-identifier generating unit35makes a request for the authentication unit34to perform an authentication process, and the authentication unit34performs authentication with the source of the request message (No in step S3; step S4). When authentication between the communication apparatus60and the analysis server30succeeds, the access-identifier generating unit35allocates an access identifier to the communication apparatus60(Yes in step S5; step S7). In addition, the access-identifier generating unit35associates the allocated access identifier with a second session ID associated with the communication apparatus60and then records this access identifier in the pseudonym-ID table52. The access-identifier generating unit35transmits the registration request that includes the access identifier to the source of the request message via the transmitter33(step S8). For the communication apparatus that is not successfully authenticated, the access-identifier generating unit35terminates the process without generating an access identifier (No in step S5).

When the communication apparatus60that has been authenticated is the source of the service request message, the access-identifier generating unit35extracts the second session ID from the request message (Yes in step S3). In addition, the access-identifier generating unit35determines whether the pseudonym-ID table52has recorded therein a pseudonym ID associated with the extracted second session ID (step S6). When the pseudonym-ID table52does not have recorded therein a pseudonym ID associated with the second session ID, the access-identifier generating unit35performs the processes of step S7and the following steps (No in step S6). When the pseudonym-ID table52has recorded therein a pseudonym ID associated with the second session ID, the access-identifier generating unit35obtains the pseudonym ID associated with the second session ID (Yes in step S6; step S9). Moreover, the access-identifier generating unit35outputs the obtained pseudonym ID to the output unit42. The output unit42generates a packet to transmit to the source of the request message a stored analysis result associated with the pseudonym ID input from the access-identifier generating unit35, and transmits this packet to the communication apparatus60(step S10).

When the input message is also not a request message, the access-identifier generating unit35determines whether a registration-completion report message has been input (step S11). When the input message is a registration-completion report message, the access-identifier generating unit35transmits a pseudonym-ID request message to the data server10, which is a source of data to be analyzed (Yes in step S11; step S12).

Meanwhile, when the input message is also not a registration-completion report message, the access-identifier generating unit35determines whether a pseudonym-ID response message has been input (No in step S11; step S13). When the input message is a pseudonym-ID response message, the access-identifier generating unit35extracts and reports a reported pseudonym ID to the output unit42(Yes in step S13). The output unit42generates a packet to transmit to the source of the request message a stored analysis result associated with the pseudonym ID input from the access-identifier generating unit35, and transmits this packet to the communication apparatus60(step S14). When the input message is not a request message, a registration-completion report message, or a pseudonym-ID response message, the access-identifier generating unit35terminates the process (No in step S13).

FIG. 20AtoFIG. 20Care flowcharts illustrating exemplary operations of the communication apparatus60. The receiver62receives a message (step S21). When the receiver62receives an analysis result request from the terminal80, the receiver62outputs this analysis result request to the authentication unit64(Yes in step S22). The authentication unit64determines whether the analysis result request has been requested from the authenticated terminal80(step S23). When the source of the analysis result request is the authenticated terminal80, the authentication unit64outputs the analysis result request to the session managing unit67. By referencing the ID management table71, the session managing unit67specifies a group account that is used to access the analysis server30. In this case, the session managing unit67searches the ID management table71by using as keys the user ID associated with the terminal80and the URL of the analysis server30reported by the analysis result request (Yes in step S23; step S24). The session managing unit67uses the group account so as to generate a request message addressed to the analysis server30, and transmits this request message to the analysis server30via the transmitter63(step S25). Meanwhile, determining that the analysis result request has been received from the terminal80that has not been authenticated in step S23, the authentication unit64makes a request for the terminal80to perform authentication and performs an authentication process with the terminal80(step S26).

When the received message is not an analysis result request, the receiver62determines whether the terminal80has made a request to log out the terminal80(No in step S22; step S27). When the terminal80has made a request to log out the terminal80, the receiver62outputs the received message to the session managing unit67(Yes in step S27). The session managing unit67deletes from the cooperation table72an entry that includes a first session ID reported from the terminal80that has made a request to log out the terminal80(step S28).

When the receiver62determines in step S27that the terminal80has not made a request to log out the terminal80, the receiver62determines whether an authentication request has been received (step S29). When the receiver62determines that the authentication request has been received, the receiver62outputs the authentication request to the proxy authentication unit66. The proxy authentication unit66determines whether the source of the authentication request is the analysis server30(step S30). When the analysis server30has requested authentication, the proxy authentication unit66performs an authentication process with the analysis server30using a group account and a password associated with the group account (step S31). Meanwhile, when the analysis server30has not requested authentication, the proxy authentication unit66determines that the authentication request has been received from the data server10. Accordingly, the proxy authentication unit66performs an authentication process with the data server10using the user account that is used for communication with the data server10and a password associated with the user account (step32).

Meanwhile, when the receiver62determines in step S29that an authentication request has not been reported, the receiver62determines whether the success of authentication has been reported (step S33). When the success of authentication has been reported, the receiver62outputs the received message to the session managing unit67. The session managing unit67determines whether the source of the report of an authentication success is the analysis server30(step S34). When the source is the analysis server30, the session managing unit67transmits a request message to the analysis server30(Yes in step S34; step S35). When the source of the report of an authentication success is not the analysis server30, the session managing unit67determines whether the source is the data server10(No in step S34; step S36). When the source is the data server10, the session managing unit67transmits to the data server10a request to register an access identifier (Yes in step S36; step S37). When the source of the report of an authentication success is neither the analysis server30nor the data server10, the session managing unit67terminates the process (No in step S36).

When the receiver62determines in step S33that an authentication success has not been reported, the receiver62determines whether a report of an access identifier has been received (step S38). When the report of an access identifier is received, the receiver62outputs the received message to the session managing unit67. Assume that the report of an access identifier is a redirect message that designates the data server10as a redirect destination. The session managing unit67uses the redirect message so as to generate an HTTP message that is addressed to the data server10and that includes the access identifier, and transmits this HTTP message via the transmitter63(Yes in step S38; step S39).

Meanwhile, when the receiver62determines in step S38that the received message is also not a report of an access identifier, the receiver62determines whether an analysis result has been reported from the analysis server30(step S40). When an analysis result has been received from the analysis server30, the receiver62outputs the received message to the session managing unit67. The session managing unit67transmits the analysis result via the transmitter63to the terminal80of the user who has transmitted an analysis-result request (Yes in step S40; step S41). When the receiver62determines in step S40that an analysis result has not been received, the receiver62terminates the process.

As described above, the method in accordance with the first embodiment allows the communication apparatus60to request an analysis result from the analysis server30even without obtaining a pseudonym ID of a user who has requested the analysis result. Thus, the analysis result is not transmitted from the analysis server30to the data server10, and the analysis result is not transmitted from the data server10to the terminal80, either. Accordingly, the load on the data server10is decreased, and traffic within the network is reduced. A pseudonym ID is reported from the data server10to the analysis server30but is not reported to the communication apparatus60or the terminal80. So, pseudonym IDs become highly confidential. In addition, data that is to be concealed, such as personal information of a user who uses the terminal80, is not transmitted from the communication apparatus60to the analysis server30and, in addition, is not transmitted from the data server10. Accordingly, there is no risk of leakage of, for example, personal information even if the analysis server30is administered by a third party having nothing to do with a user of the terminal80or an administrator of the data server10.

Second Embodiment

For a second embodiment, descriptions will be given of a situation in which an analysis server does not generate an access identifier in response to a user's request to provide an analysis result but a data server10issues a provisional token. The provisional token is an identifier that can be effectively used during one login in order to uniquely identify a pseudonym ID. In this case, the analysis server may generate a message that includes identification information to identify a request message.

FIG. 21illustrates an exemplary configuration of an analysis server90that is used in the second embodiment. The analysis server90includes a gateway unit91, an authentication unit34, an application processing unit40, and a storage unit93. The gateway unit91includes a provisional-token-request generating unit92. Upon receipt of a request message from a communication apparatus60, the provisional-token-request generating unit92generates a provisional-token request message. The storage unit93holds pseudonym-ID tables94. As illustrated inFIG. 22, the pseudonym-ID tables94(94a,94b) associate a second session ID, a group account, a provisional token, and a pseudonym ID with each other.

In addition to the provisional-token-request generating unit92, the gateway unit91includes a receiver32, a transmitter33, an address solution unit36, and a sequence managing unit37. In addition to the pseudonym-ID tables94, the storage unit93holds data51, an account table53, and a state table54. The receiver32, the transmitter33, the address solution unit36, the sequence managing unit37, the authentication unit34, the application processing unit40, the data51, the account table53, and the state table54are similar to those in the first embodiment.

FIG. 23AandFIG. 23Bare sequence diagrams illustrating an example of communication performed in the second embodiment. In the second embodiment, the communication performed between the communication apparatus60and the terminal80is similar to that performed in the first embodiment.

For the communication apparatus60and the analysis server90, processes using procedures (D1) to (D14) are performed. Procedures (D1) to (D5) are similar to procedures (B1) to (B5), which were described with reference toFIG. 12A.

(D6) The provisional-token-request generating unit92references the pseudonym-ID table94so as to determine whether a provisional token is associated with a second session ID included in a request message. The following descriptions will be given on the assumption that the second session ID included in the received request message is S0001 and that the analysis server90holds the pseudonym-ID table94a. Accordingly, since the second session ID included in the request message is not associated with a provisional token, the provisional-token-request generating unit92generates a provisional-token request message.

FIG. 24AandFIG. 24Billustrate an example of messages used in the second embodiment. The provisional-token-request generating unit92may generate, for example, a message illustrated inFIG. 24Aas a provisional-token request message. The provisional-token request message includes an address of the data server10.

A method used by the analysis server90for specifying a URL of the data server10is similar to the method used by the analysis server30in the first embodiment for specifying the URL of the data server10.FIG. 24Adepicts an example, so an information element within a provisional-token message may be changed in accordance with an implementation by, for example, incorporating a second session ID in a provisional-token request message.

(D7) The receiver62of the communication apparatus60outputs the provisional-token request message to the session managing unit67. In accordance with HTTP redirect, the session managing unit67transmits the provisional-token request message to the data server10.

In addition, using the provisional-token request message, the session managing unit67updates an entry of information of a cooperation table72that relates to the user who has requested the analysis result by using the request message that has caused the provisional-token request message to be generated. As an example, for a user with a user ID of “hanako”, the session managing unit67updates the entry as illustrated in a cooperation table72fillustrated inFIG. 22. By utilizing a situation in which the provisional-token request message is transmitted as a message to respond to the request message, the session managing unit67uniquely specifies the request message that has caused the provisional-token request message to be generated. When a second session ID is included in the provisional-token request message, the session managing unit67may use the second session ID so as to select an entry to be updated from the cooperation table72.

Procedures (D8) to (D10) are similar to procedures (B8) to (B10), which were described with reference toFIG. 12A.

(D11) The receiver62, which has received a message reporting that authentication has succeeded, outputs this message to the session managing unit67. The session managing unit67generates and outputs to the transmitter63a provisional-token request message that includes a third session ID reported from the data server10and information of the analysis server90. The information of the analysis server90is arbitrary information with which the data server can uniquely specify the analysis server90. The information of the analysis server90includes, for example, a URL of a service to allow an analysis result provided by the analysis server90to be browsed and an identifier determined upon conclusion of a contract for analysis results between the data server10and the analysis server90.

(D12) Upon receipt of the provisional-token request message that includes a third session ID, the receiver12outputs this received message to the session managing unit16. The session managing unit16searches the session management table22using as a key the third session ID included in the input message. Moreover, the session managing unit16generates and records in the session management table22a provisional token corresponding to an entry that has been hit. Accordingly, a session management table22cillustrated inFIG. 22is generated.

When a provisional token is generated, the session managing unit16generates a provisional-token report message to report the provisional token to the communication apparatus60, and transmits this generated provisional-token report message to the communication apparatus60via the transmitter13. An exemplary provisional-token report message is depicted inFIG. 24B. In the example illustrated inFIG. 24B, the provisional-token report message is a redirect message that indicates the analysis server90as a redirect destination.

(D13) Upon receipt of the provisional-token report message, the receiver62outputs this message to the session managing unit67. The session managing unit67rewrites a destination of the provisional-token report message and then transmits the provisional-token report message to the analysis server90via the transmitter63. Moreover, using the provisional-token report message, the session managing unit67updates the cooperation table to a table such as a cooperation table72g(FIG. 22).

(E1) The receiver32of the analysis server90outputs the provisional-token report message to the provisional-token-request generating unit92. The provisional-token-request generating unit92generates and outputs to the transmitter33a message to ask about a pseudonym ID that corresponds to the provisional token included in the provisional-token report message (a pseudonym request message). The transmitter33transmits the pseudonym request message to the data server10.

(E2) The receiver12of the data server10outputs the pseudonym request message to the session managing unit16. The session managing unit16specifies the requested pseudonym ID by referencing the session management table22. As an example, when the pseudonym ID associated with pseudonym token ktk001 is requested, the session managing unit16reports pseudonym ID=123456 to the analysis server90according to the session management table22c.

When the pseudonym ID is reported from the data server10, the receiver32outputs the report of the pseudonym ID to the provisional-token-request generating unit92and the output unit42. Using the input information, the provisional-token-request generating unit92updates the pseudonym-ID table94ato the pseudonym-ID table94b.

Procedure (D14) is similar to procedure (B14), which was described with reference toFIG. 12A.

In the method in accordance with the second embodiment, the analysis server90does not generate an access identifier but a provisional token is used that is generated by the data server10. Thus, the processing burden on the analysis server90may be decreased. Pseudonym IDs are not reported to the communication apparatus60or the terminal80and thus become highly confidential. In addition, personal information of a user who uses the terminal80or the like is not provided to the analysis server90. Also, in the method in accordance with the second embodiment, an analysis result is not transmitted from the analysis server90to the data server10or from the data server10to the terminal80. Thus, the load on the data server10may be decreased.

Others

The embodiments are not limited to those described above, and various variations are possible. Some of the variations will be described in the following.

(1) Application to Systems that use Cloud Computing Embodiments, Including the First and Second embodiments described above, are applicable to a system that uses cloud computing. The system that uses cloud computing is suitable for analysis of a large amount of data, i.e., so-called big data, that is complicated. For the system that uses cloud computing, the terminal80is, for example, a computer or a smartphone used by individual users. Meanwhile, the data server10is a server within a private cloud administered by a group to which the user belongs. Moreover, the communication apparatus60is a server that provides a portal site to allow the user to access the data server10and that can perform a proxy authentication process for the user.

In such a system, data obtained from individual users is held in the data server10within the private cloud, and substituted data is generated by the data server10. The data server10makes a request for the analysis server30to perform analysis by transmitting the substituted data to the analysis server30. When data analysis ends, each user accesses the analysis server30via the communication apparatus60. Using the method described with reference to the first or second embodiment, the analysis server30obtains a pseudonym ID and transmits the requested analysis result to the communication apparatus60. Simultaneously, the analysis server30saves the analysis result transmitted to the communication apparatus60. The analysis result is transmitted from the communication apparatus60to the terminal80so that the user can browse the analysis result using the terminal80. This is also true for a situation in which the analysis server90is used instead of the analysis server30.

Accordingly, applying the aforementioned embodiment to a system that uses cloud computing hinders leakage of a pseudonym ID since the pseudonym ID is not reported to the communication apparatus60or the terminal80. Concealed information that includes, for example, personal information of each user is not transmitted from a private cloud to outside. In addition, a vast amount of data does not need to be saved in the data server10, so that the burden on the data server10can be decreased.

(2) Other Variations

A group identifier may be arbitrary information that allows the analysis server30to uniquely identify a group. For example, a group account, a session ID issued by authentication using the group account, and so on are used as the group identifier. Similarly, a user identifier may be arbitrary information that allows the data server10to uniquely identify a user. For example, a user account, a session ID issued by authentication using the user account, and so on may be used as the user identifier.

The descriptions above have been given for an exemplarity situation in which a network includes one terminal80, one communication apparatus60, one data server10, and one analysis server30, but the network may include any number of terminals80, communication apparatuses60, data servers10, and analysis servers30. Even though there are a plurality of analysis servers30, an access destination is reported from the terminal80to the communication apparatus60when the communication apparatus60attempts to access an analysis server30, so that the communication apparatus60can specify the access destination. Even though there are a plurality of data servers10, the communication apparatus60uses information such as a URL reported from the analysis server30when the communication apparatus60attempts to access a data server10, so that the communication apparatus60can specify a data server10that is an access destination. Even in a network that includes a plurality of data servers10and a plurality of analysis servers30, the communication apparatus60may use the ID management table71so as to specify an account and a password which are both used for accessing. In addition, when a plurality of terminals80are present, individual users may be distinguished by using, for example, first to third session IDs or access identifiers, thereby allowing the data server10, the analysis server30, and the communication apparatus60to process requests from a plurality of users in parallel. Similarly, in the second embodiment, a network may include any number of terminals80, communication apparatuses60, data servers10, and analysis servers90.

The tables used in the descriptions above are examples, so information elements included in the tables may be changed in accordance with an implementation. For simplicity of description, a situation was described in which the communication apparatus60, the data server30, and the analysis server30are each one server, but this situation is also an example. For example, the design may be changed to achieve operations of the communication apparatus60using a plurality of arbitrary communication apparatuses. Similarly, processes that would be performed by the data server10and the analysis server30may be achieved by a plurality of communication apparatuses.

The aforementioned embodiments make more confidential the information related to the referencing of an analysis result by a user.