Method and apparatus for supporting personal information protection

Methods and apparatus, including computer program products, implementing and using techniques for causing an application program containing personal information to operate on an operating system. It is detected whether the application program outputs, transfers or generates data to the outside of a storage region of the application program. A real-time determination is made as to whether or not the data is subject to personal information management. Processing of the application program is continued, interrupted or corrected based the determination. Personal information is detected by scanning contents of the data when the data is subject to personal information management. Detected personal information is displayed to a user. A result of the determination is input according to a level of risk against the data for the user. Contents of the determination result is stored as a history. A risk indicator for the data is computed and displayed to the user.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority under 35 U.S.C. 119(a)-(d) from Japanese Patent Application No. JP2006-116548 entitled “INFORMATION PROCESSING APPARATUS FOR SUPPORTING PERSONAL INFORMATION PROTECTION” filed Apr. 20, 2006, the entire disclosure of which is incorporated herein by reference for all purposes

BACKGROUND

This invention relates to protecting personal information in a computer system.

In recent years, leaking of corporate confidential information and personal information has become more prevalent, and measures against such leaking have been strongly demanded. For example, in Japan the law “Act on the Personal Information Protection” became fully effective in April 2005, and specification and secure data management of personal information have been required of any corporation which retains personal information of at least 5000 people for at least six months.

Personal information subject to the law includes not only data stored inside an electronic commerce web server and a database, but also data inside a notebook personal computer (PC) carried by a corporate employee. In a PC carried by a sales person, for example, a customer list, a staff register, a conference participant list and the like are stored, and such information also needs to be considered as personal information subject to personal information management. Backup files and older versions of files containing such personal information exist in various locations in a file system of a PC, and often the owner of the PC is not aware of the locations of the personal data on the computer. Additionally, the hard disk sizes of some of the recent PCs exceed 100 GB, making it difficult to manually detect the data.

End user monitoring systems, thin-client systems, document management systems and the like have been put into practical use as technologies for personal information management. However, these techniques have not come into full-scale use because they suffer from problems such as reduced operability for a user, and high costs for installation of a dedicated server, replacement of business software, and the like.

An access control has been proposed which determines whether to permit or prohibit access to each of the personal information in a personal information management system. This determination is made by referring to a personalized access control list where various access rights to each piece of personal information are determined. The access rights are set up by an individual who is a subject of each piece of the personal information (see, for example, Japanese Patent Application Laid-open No. JP2005-196699). However, all the above techniques for enhancing a security level of a PC require alteration of an existing operating system and/or an application program in the PC.

If personal information is detected by a software tool which semi-automatically detects personal information, personnel costs can be considerably reduced. Normally, such a detection tool is executed by a user or a system administrator at certain intervals (for example, once a month). When such a usage frequency is assumed, however, a time lag (for example, for a maximum of one-month period in the foregoing example) can occur between a time when data containing personal information is actually generated, and a timing of detection by using the tool. As a result, it is difficult to perform real-time risk management.

SUMMARY

In general, in one aspect, the invention provides methods and apparatus, including computer program products, implementing and using techniques for causing an application program containing personal information to operate on an operating system. It is detected whether the application program outputs, transfers or generates data to the outside of a storage region of the application program. A real-time determination is made as to whether or not the data is subject to personal information management. Processing of the application program is continued, interrupted or corrected based on a result of the determination by the personal information management determining unit. Personal information is detected by scanning contents of the data when the determination of the personal information management determining unit indicates that the data is subject to personal information management. Personal information detected in the step of detecting personal information is displayed to a user required to manage the personal information. A result of the determination is input according to a level of risk against the data on the user. Contents of the determination result is stored as a history. A risk indicator of the risk against the data is computed. The computed risk indicator is displayed to the user.

The invention can be implemented to include one or more of the following advantages. The invention makes it possible to provide an information processing apparatus, an information processing method and a computer program product thereof which detect processing on personal information data in real time, and which thus support protection of personal information.

DETAILED DESCRIPTION

The invention will be described below by way of example and with reference toFIGS. 1 to 7. It should be understood that the following exemplary embodiments do not limit the scope of the invention as recited in the claims, and also that not all combinations of characteristics described in the embodiments below are necessary for the invention to be operable.

FIG. 1is a schematic block diagram showing a configuration of the information processing apparatus100in accordance with one embodiment of the invention. The information processing apparatus100includes an operating system60which operates on hardware shown inFIG. 11, which will be described later in detail; a transfer detector/controller120for detecting whether any one of application programs110,112and114which operate on the operating system60outputs, transfers or generates data to the outside of a storage region of any one of the application programs110,112and114; and a personal information management determining unit130for determining in real time whether or not the data is subject to personal information management.

Furthermore, as shown inFIG. 1, the information processing apparatus100includes a personal information detector150for detecting personal information by scanning contents of the data if the determination by the personal information management determining unit130indicates that there is a need to subject the data to personal information management; a display unit for displaying to a user who needs to manage personal information, the personal information being detected by the personal information detector150; an input unit160through which a result of the determination according to a level of risk against the data against the user is input; a user determination history storage unit142for storing, as a history, contents of the determination result; and a determination policy storage unit144for storing determination policies. The display unit is composed of a display device1022ofFIG. 11, which will be described below in further detail, and corresponding software.

The transfer detector/controller120includes an API hook126and an application program execution controller132(an AP execution controller132) for continuing, interrupting or correcting processing of any one of the application programs110,112and114based on the determination result by the personal information management determining unit130. The user determination history storage unit142and the determination policy storage unit144for storing determination policies can be stored in the same storage unit140as shown inFIG. 1, or may be stored separately.

The operating system60includes an OS kernel124. An OS API122acts as a bridge between each of the application programs110,112and114and the operating system60.

FIGS. 2 and 3are diagrams showing flows of control paths of the information processing apparatus in accordance with one embodiment of the invention. First, the API hook126is contained in the OS API122. Under normal conditions, the role of the API hook126is to drag out the control path to be passed as-is to the OS kernel124at a lower level. “1. API CALL INTERRUPTION” indicated by an elliptical frame inFIG. 2corresponds to this action.

Subsequently, the control is passed to the personal information management determining unit130(“2. DETERMINATION REQUEST” indicated by an elliptical frame), from which a result is returned to the AP execution controller132(“3. DETERMINATION RESULT” indicated by an elliptical frame). The AP execution controller132instructs the API hook126to perform continuation, interruption, correction and the like of processing (“4. INSTRUCTION FOR CONTINUATION” indicated by an elliptical frame). In a case of continuation of processing, the API hook126passes the control to the OS kernel124at a lower level as if nothing has happened (“5. API CALL CONTINUATION” indicated by an elliptical frame).

FIG. 3is a diagram showing a flow of the control path in a case of the interruption of processing. As shown inFIG. 3, with reference to the determination result from the personal information management determining unit130, the AP execution controller132instructs the API hook to perform the interruption. The API hook126returns an error code to any applicable one of the application program110and the like (“5. ERROR CODE” indicated by an elliptical frame inFIG. 3).

The transfer detector/controller120is described in detail in the document “Development of Technologies for Real Time Monitoring/Controlling of Program in PC and Application thereof to Information Security Systems” (Sanehiro Furuichi et al., Symposium on Cryptography and Information Security 2006, the Institute of Electronics, Information and Communication Engineers), which is hereby incorporated by reference in its entirety. In the following description, the transfer detector/controller120will be described as a file, which is one example of the data.

FIG. 4is a format sample of determination policies in accordance with one embodiment of the invention. The determination policies are obtained by describing, as policy rules, an algorithm of the personal information management determining unit130. Here, the determination policy is a policy for calling up the personal information detector150in a case where an API of a type of file generation is called. The determination policy causes, in a case where an API regarding file transfer is called, the application program execution controller132to prohibit the transfer of the file into a removable device such as a USB if the relevant file is treated as personal information (a result of whether or not the file is treated accordingly is obtained by searching the user determination history storage unit142). If an API regarding file deletion is called, the determination policy is a policy for deleting an applicable history from the user determination history storage unit142. By describing processing in association with the API, it is possible to flexibly determine how personal information is to be treated. In the personal information management determining unit130, the determination policies can be implemented by using any one of the C++® and Java® programming languages, or alternatively an interpreter can be called, which interprets and executes the determination policies.

If it is determined in the personal information management determining unit130that detection processing of personal information is necessary, the personal information detector150is called next.

FIG. 5is a flowchart showing operations of the personal information detector150in accordance with one embodiment of the invention. First, a file, for which detection of personal information has been determined to be necessary, is input into the personal information detector150(step S110). Subsequently, file type discrimination is performed on the input file (step S120). Character strings are then extracted in accordance with a file type (step S130). Morphological analysis is performed on the extracted character strings (step S140). The morphological analysis is defined as follows. In a case of Japanese, the morphological analysis refers to word segmentation processing, that is, word-by-word segmentation of a sentence which is written without spaces, and which utilizes Japanese phonetic syllables and Chinese characters. In a case of a language such as English, the morphological analysis means analysis on word inflexion. One example of specific techniques for the morphological analysis can be found, for example, in Chapter 1 of “Natural Language Processing” under the editorial leadership of Hozumi Tanaka (the Institute of Electronics, Information and Communication Engineers).

String analysis is then performed on each of analyzed morphemes (step S150). The string analysis is performed by comparing each of the morphemes with a Japanese dictionary, a proper noun dictionary, an address name dictionary, and a postal code dictionary, which are stored in a dictionary database storage unit. After the string analysis, a result of the determination is output to the display unit. The display unit includes the display device1022ofFIG. 11, and the corresponding software.

FIG. 6is a display example of contents detected by the personal information detector150. When a personal information file is detected, a relevant screen as shown inFIG. 6is displayed. The display device1022shows contents on the screen, which includes detailed information about the file. The display prompts the user to manage the file. As a response to the screen shown inFIG. 6, the user is prompted to determine: whether or not personal information in the file is important personal information, and is subject to the management; whether or not, while personal information is contained therein, the personal information needs to be managed; or whether or not personal information is not contained.

The user checks the contents of the detailed information, and then determines to what kind of management the personal information is subject. The user can input, via a user determination input unit160, a content of the determination by selecting a button inFIG. 6, and by operating a lower part of the screen.

FIG. 7is a format sample stored in the user determination history storage unit142. Items include a computer resource (a file name or the like) subject to the management; a size of the computer resource; date and time of file generation or of update; a level of determination by a user; and date and time when the determination by the user has been made. The first three pieces of information are used as indicators in searching for the computer resource. If these three items are found, it is possible to determine whether the user has already made a decision about the file. The level of determination indicates a degree of risk against personal information. The risk is high when the level is indicated as “High,” and the risk is low when the level is indicated as “Low.” When the risk is determined to be low, checking processing for personal information protection can be considered as unnecessary during subsequent processing on the computer resource. When the risk is determined to be high, the user is prompted to check the computer resource for personal information protection at the subsequent detections on the computer resource. However, in a case where there are no changes in the file size, and the date and time of file generation or update, a response having been taken at the time of previous detection can be considered as effective. Accordingly, there is no problem if determination by the user is omitted in this case. These pieces of information are used in the personal information management determining unit130. “None” is stored in the user determination history storage unit142in a case where the personal information detector150does not detect any personal information. “High/Low” and the like are stored as the determination result by the user.

In the above described manner, by performing personal information detection at a timing when a file is generated, transferred or deleted, it is possible to minimize risk management in a corporation, and to provide an information processing system which is less burdensome to the user when the user uses the tool.

FIG. 8shows another embodiment where the information processing apparatus100further includes a risk indicator computing unit155. As shown inFIG. 8, the information processing apparatus100includes the risk indicator computing unit155for computing an indicator of risk against a file. When a personal information file is detected by the personal information detector150, the file is input to the risk indicator computer unit155. The risk indicator is computed for the input file with reference to the determination policies previously stored in the storage unit140. Among personal information files, one including a password is at a high risk. On the other hand, information which is a mere name list, and which does not contain addresses or telephone numbers, is at a relatively low risk. These risks are computed in accordance with results of the detection by the personal information detector150. The computed risk indicator is displayed for the user with the display device1022(described later with reference toFIG. 11).

FIG. 9is a flowchart of a minimization mechanism unit for minimizing a request to the user for intervention. The minimization mechanism unit, which is further included in the personal information detector150, minimizes a number of times of the subsequent detection on personal information, and of subsequent request to the user to intervene in the personal information, by utilizing the history stored in the user determination history storing unit142.

When a file subject to the management is detected by the personal information detector150, the file is called up by the minimization mechanism unit. It is checked whether or not the file exists in the user determination history storage unit142stored in the storage unit140(step S210). In a case of “YES” at S210, it is further checked whether or not file update date and time is more recent than previous determination date and time by searching the related items in the user determination history storage unit142(step S220). When the file update date and time is more recent than previous determination date and time, the user is prompted to make determination (step S230). Thereafter, when the user determination is input through the user determination input unit160, the user determination history storage unit142is updated in accordance with the content (step S240).

When the file update date and time is not more recent than previous determination date and time (in case of “NO” in step S220inFIG. 9), the minimization mechanism unit terminates its operation. That is, without displaying anything on the display unit for the user, the flow proceeds to processing performed by an application program having been originally executed. In this manner, it is possible to minimize a number of times of the subsequent detection on personal information, and of subsequent request to the user to intervene in the personal information.

In addition, the following function can be further included in the personal information management determining unit130. Specifically, the function determines how to treat the detected personal information according to an attribute of an output destination of the file, the response being based on the predetermined determination policy previously stored in the user policy storage unit144. As has been described inFIG. 3, levels of importance are different among cases where: the file is output to a printer; the file is transferred to a storage unit within the same corporation; and the file is generated on a clipboard. By storing this information in the determination policies, it is possible to minimize the requests to the user for intervention.

Furthermore, by changing the processing in accordance with a progress status of the application program, it is also possible to reduce the request to the user for intervention, and to thereby make responding to the request more manageable for the user. That is, different results may be given as the determination policy in accordance with status of an application program which has called up the API. For example, determination results may be weighted differently when a window for the application program is active and when the window is non-active. Additionally, a status of an application program different from the application program which has called up the API may be reflected in the determination policy. For example, determination results may be made stricter for file operation by another program and for clipboard operation only during a period when a certain program A has a particular file or URL open. Alternatively, a previous history may be reset, and the user may be prompted to make determination again.

FIG. 10is a flowchart showing an example of processing when a determination is made in accordance with a progress status of an application program. When processing is shifted to the personal information management determining unit130, it is checked whether or not the application program is active (step S310). When the application program is active, a rule A is applied (step S320). When it is not active, a rule B is applied (step S330). The function dynamically determines, in accordance with the progress status of the application program, which one of the rules is to be applied. A number of these rules may be more than two.

FIG. 11shows an example of a hardware configuration of the information processing apparatus100. The information processing apparatus100includes a CPU (Central Processing Unit)1010, a bus line1005; a communication I/F1040, a main memory1050, a BIOS (Basic Input Output System)1060, a parallel port1080, a USB port1090, a graphic controller1020, a VRAM1024, a sound processor1030, an I/O controller1070, and input means1100such as a keyboard and a mouse adapter. Storage means such as a flexible disk drive1078, a hard disk1074, an optical disk drive1076, and a semiconductor memory1078can be connected to the I/O controller1070. Any one of these storage means can be used as the storage unit140.

An amplifier circuit1032and a speaker1034are connected to the sound processor1030. In addition, the display device1022is connected to the graphic controller1020.

The BIOS1060includes a boot program executed by the CPU1010at the startup of the information processing apparatus100; a program dependent on hardware of the information processing apparatus100; and the like. The flexible disk (FD) drive1072reads a program or data from a flexible disk1071, and supplies the data to the main memory1050or the hard disk1074through the I/O controller1070.

Any one of a DVD-ROM drive, a CD-ROM drive, a DVD-RAM drive and a CD-RAM drive, for example, can be used as the optical disk drive1076. In this case, an optical disk1077for a corresponding one of the drives needs to be used. The optical disk drive1076may read a program or data from the optical disk1077, and supply the data to the main memory1050or to the hard disk1074via the I/O controller1070.

The computer program product provided to the information processing apparatus100is stored in a recording medium such as the flexible disk1071, the optical disk1077, and a memory card to be provided by a user. By being read out from the recording medium, or by being downloaded via the I/O controller1070, the computer program product is installed and executed in the information processing apparatus100. Operations which the computer program product causes an information processing apparatus to perform are the same as the operations in the information processing apparatus100which have been described in association withFIGS. 1 to 10.

The above-described computer program product may be stored in an external storage medium. Any one of a tape medium and a magneto-optical recording medium, such as an MD, can be used as the storage medium in addition to the flexible disk1071, the optical disk1077and a memory card. The computer program product may be provided to the information processing apparatus100via a communication network by using, as the recording medium, a storage device such as a hard disk or an optical disk library which are provided to a server system connected to a dedicated communication line or the Internet.

The above-described examples, descriptions have been given mainly with reference to an information processing apparatus. However, it is possible to cause a computer to have the same functions as the above-described functions of the information processing apparatus in the following way. Specifically, the computer can be operated as the information processing apparatus by installing, into the computer, a program provided with the functions having been described in connection with the information processing apparatus. Accordingly, the information processing apparatus having been described as one embodiment of the invention can be achieved also by means of an information processing method and a computer program product thereof.

The invention has been described using the above exemplary embodiments. However, a technical scope of the invention is not limited to the scope described in the above-described embodiments. On the contrary, a variety of alterations and improvements can be added to the above-described embodiments. Moreover, it is obvious from description in the scope of claims that aspects to which such alterations or improvements are added can also be incorporated in the technical scope of the invention. For example, the embodiment has been described with the operating system being Windows2000/XP®. However, the invention can be achieved with the operating system being a different OS such as, for example, UNIX®.

Although the preferred embodiment of the invention has been described in detail, it should be understood that various changes, substitutions and alternations can be made therein without departing from spirit and scope of the inventions as defined by the appended claims.