Abstract:
The present invention provides a personal information management system, a personal information management program and a personal information protecting method capable of storing personal information in consideration of security protection and facilitating utilization of the stored information. A personal information management system for handling personal information has a function of connection to a personal information dispersion management server that provides functions of encrypting personal information by the secret sharing scheme and decrypting the encrypted personal information with an index key for decrypting. The system has a search keyword management database storing the index key for decrypting and a personal information managing apparatus. When a request for storing personal information requiring security protection is generated, the personal information is divided and stored in the personal information dispersion management server, and the personal information is stored so as to be associated with the index key for decrypting into the search keyword management database.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    The present invention relates to a personal information management system, a personal information management program, and a personal information protecting method capable of storing personal information in consideration of security protection and facilitating utilization of the stored information. 
         [0003]    2. Description of the Related Art 
         [0004]    Various methods for storing personal information while considering security protection have been being devised. For example, in a method disclosed in Japanese Unexamined Patent Publication No. 2004-145755, in the case of storing important secret data, the original data is not simply encrypted but is subjected to secret sharing, and the dispersed data is stored. The disperse data can be reconstructed without being managed in a lump. 
         [0005]    The principal objective of the conventional techniques, however, is data security protection of secret information and personal information, and particularly no attention is paid to utilization method and convenience of the protected data. The method disclosed in Japanese Unexamined Patent Publication No. 2004-145755 also does not describe a utilization method at the user level such that how the user accesses data stringently protected and utilizes the data for his/her work. 
       SUMMARY OF THE INVENTION 
       [0006]    Consequently, an object of the present invention is to provide a user-friendly function capable of freely retrieving information requested by the user. In other words, the present invention is directed to satisfy contradictory objects of security protection of information and convenience in utilization. 
         [0007]    To solve the technical drawbacks, the present invention employs the following configurations. 
         [0008]    The invention according to a first aspect provides a personal information management system for handling personal information, having a function of connection to a personal information dispersion management server that provides functions of encrypting personal information by the secret sharing scheme and decrypting the encrypted personal information with an index key for decrypting. The system includes a search keyword management database and a personal information managing apparatus. The index key for decrypting which is associated with a group of personal information keywords is stored in the search keyword management database. The personal information managing apparatus includes: storage handling means for determining protection level of personal information and determining a storage form on the basis of the determined protection level; data storing means, when a request for storing personal information requiring security protection is generated, for transmitting the personal information to the personal information dispersion management server, obtaining the index key for decrypting from the personal information dispersion management server, and storing the personal information so as to be associated with the index key for decrypting into the search keyword management database; and data obtaining means, when a personal information obtaining request is generated, for retrieving the index key for decrypting with reference to the search keyword management database, transmitting the index key for decrypting to the personal information dispersion management server, and receiving the personal information decrypted with the index key for decrypting from the personal information dispersion management server. 
         [0009]    According to a second aspect of the present invention, with reference to data model attribute definition specifying data characteristics of personal information, the storage handling means determines that information uniquely specifying a person has high protection level, information in plural pieces by which a person can be specified has intermediate protection level, and information by which a person cannot be specified has low protection level, and determines a storage form in accordance with the protection level. 
         [0010]    According to a third aspect of the present invention, in personal information to be stored in the search keyword management database, an attribute having the high protection level is hashed, an attribute having the intermediate protection level is encrypted and stored, and an attribute having the low protection level is stored in a plain text as it is. 
         [0011]    A forth to sixth aspects of the present invention also provides a personal information management program for making the personal information managing apparatus in the personal information management system manage (store and acquire) data. 
         [0012]    A seventh aspect of the present invention also provides a personal information protecting method including the steps of: encrypting a data item requiring security protection by the secret sharing scheme, in data items constructing personal information; storing the encrypted data item into a database; storing an index key for decrypting the encrypted data in the database; hashing or encrypting a data item requiring security protection and storing the hashed or encrypted data so as to be associated with the index key into the database; and storing a data item in a plain text requiring no security protection as it is into the database. 
         [0013]    In the present invention, “personal information” denotes information including data to be under confidentiality typified by personal information. Therefore, the personal information is not limited to personal information in a narrow sense. “Encoding of data by the secret sharing scheme and decrypting of encrypted data with the index key for decrypting” denotes that data is divided into some pieces, the divided data is stored, and the original data is reconstructed by using information for reconstruction provided for the divided data. The “secret sharing scheme” is mentioned as a representative of a method of dividing data and storing the divided data, and data may be divided by other methods. 
         [0014]    The information for reconstructing the divided data to the original data is also called a keyword or the like. In the present invention, the information will be expressed as an “index key for decrypting” to distinguish the information from a group of search keywords in the search keyword management database. In an embodiment, “document ID” and “title of document” correspond to the information. 
         [0015]    The “search keyword management database” is a database for storing a group of keywords for obtaining the divided and stored data by using the index key for decrypting. The database also includes information which is not used as a keyword, such as statistical information and an access log. However, since the main purpose of the database is to store a keyword group, the database is expressed as the “search keyword management” database. 
         [0016]    The “protection level” expresses a level of information which cannot uniquely specify a person, a level of information uniquely specifying a person, and a level of information obtained by combining a plurality of attributes, which can uniquely specify a person. In the embodiment, the information is also called non-confidential information, person specifying information, and semi person specifying information, respectively. 
         [0017]    According to the first to seventh aspects of the present invention, both of the functions which are inherently contradictory to each other such that secret information can be safely stored and easily utilized can be realized. 
         [0018]    Generally, original data is very stringently protected by dispersion management. However, since the personal information is dispersed in a plurality of media, basically, the personal information can be retrieved only by the index key for decrypting. Consequently, the personal information cannot be usually retrieved by using any of the personal information (for example, name). In the present invention, however, information which can be a search keyword and the index key for decrypting is associated with each other and managed in different storing media. Therefore, in the present invention, the dispersed information can be reconstructed as necessary and utilized. 
         [0019]    According to the second and fifth aspects of the present invention, the security protection level can be freely set according to description of the data model attribute definition, and data management in a proper form can be performed in accordance with the set level. Only by changing a file, a change in a transaction can be addressed, so that it is unnecessary to modify software. 
         [0020]    According to the third and sixth aspects of the present invention, data is hashed, encrypted, or unprocessed according to the security protection level, and the hashed or encrypted data or the data remaining in a plain text is stored in the search keyword management database. The degree of stringency on handling of data is increased as the necessity of protection increases, and non-confidential data is stored in a plain text as described above, thereby realizing convenience of a totaling process and the like. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0021]      FIG. 1  is a diagram showing a system configuration of an embodiment; 
           [0022]      FIG. 2  is a diagram showing a software configuration of a personal information managing apparatus of the embodiment; 
           [0023]      FIG. 3  is a diagram showing function blocks of a back end module (in a broad sense) of the embodiment; 
           [0024]      FIG. 4  is a diagram showing types of data protection levels; 
           [0025]      FIG. 5  is a diagram showing the relation between data model attribute definitions and storage forms of the embodiment; 
           [0026]      FIG. 6  is a diagram showing the relation between the data model attribute definitions and storage forms of the embodiment; 
           [0027]      FIG. 7  is a sequence diagram showing data storing process in the embodiment; and 
           [0028]      FIG. 8  is a sequence diagram showing data obtaining process in the embodiment. 
       
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     1. System Configuration 
       [0029]      FIG. 1  shows a system configuration of an embodiment. 
         [0030]    A personal information managing apparatus  1  is connected to a user terminal  2  via a communication network N 1  such as the Internet. The personal information managing apparatus  1  is also connected to a personal information dispersion management server  3  (hereinbelow, “dispersion management server 3”) via a communication network N 2 . The dispersion management server  3  has a plurality of storing media  4  for storing pieces of data obtained by dividing original data. 
         [0031]    Further, the personal information managing apparatus  1  can access a search keyword management database  5  (hereinbelow, “keyword management DB 5”). The keyword management DB  5  may be stored in an internal storage of the personal information managing apparatus  1  or an external storage, or may be stored in a storage of a database server as a computer different from the personal information managing apparatus  1 . 
         [0032]    In the case of transmitting/receiving data over the networks N 1  and N 2 , desirably, the data undergoes any encrypting on communication paths. 
       Configuration of Back End Module (Including Core System) 
       [0033]    The software configuration of the personal information managing apparatus  1  will be described with reference to  FIG. 2 . 
         [0034]    A front end module  6  (hereinbelow, “front end 6”) is software for receiving an input from the user terminal  2  and performing a transaction using personal information. The front end  6  has a business logic adapted to transaction requirements and a user interface. When the necessity of storing or obtaining data arises in the front end  6 , a back end module  7  in a narrow sense performs a data storing/obtaining process in place of the front end  6 . With reference to a data model attribute definition  11  describing characteristics of data according to the transaction requirements, data is stored in the dispersion management server  3  and/or the keyword management DB  5 . A core system  8  is general-purpose software which never depends on the transaction requirements and transmits/receives data via an interface  10  with the dispersion management server  3  and an interface  9  with the keyword management DB  5 . 
         [0035]    Since the back end  12  performs data management in consideration of the security protection, the front end  6  does not have to consider protection of information. 
         [0036]    After the front end  6 , the back end module  7  in the narrow sense and the core system  8  perform management (storage and acquisition) of data. Consequently, in the following description, unless otherwise specified, the back end module  7  in the narrow sense and the core system  8  will be collectively called a back end module  12  (hereinbelow, “back end 12”) (in a broad sense). 
         [0037]    The back end  12  has, storage handling means  13 , data storing means  14 , and data obtaining means  15  as shown in  FIG. 3 . The details of the means will be described later. 
       Relation Between Data Attribute and Data Physical Storing Form 
     (1) Description of Protection Level 
       [0038]    The data storing means  14  considers the protection level of target data at the time of dividing data to be stored to the dispersion management server  3  and the keyword management DB  5 . 
         [0039]    As shown in  FIG. 4 , there are two types of protection levels; a protection level of a data model, and a protection level of an attribute. A data model is a set of one or more attributes and is a lump in a transaction. For example, in a questionnaire process, the name, sex, and the like constructing personal information of a respondent to a questionnaire correspond to attributes. The structured attributes correspond to a data model. 
         [0040]    According to the two types of the protection levels, a data storage location (the dispersion management server  3  or the keyword management DB  5 ) and a form of the storage data (a hash value, an encrypted text, or a plain text) are determined. 
         [0041]    Since the data model of type A in  FIG. 4  includes person specifying information a 1 , it is necessary to carefully handle the data model. The data model of type A is basically stored in the dispersion management server  3 . Desirably, the person specifying information is under control of the dispersion management server  3  and does not become a key for search or extraction. However, depending on a transaction, there is also a case that a search has to be made with the person specifying information. Therefore, the attribute value is stored in the keyword management DB  5  in addition to the dispersion management server  3 , thereby enabling a unique search. Since it is not good from the viewpoint of security to use an attribute value as it is, that is, a plain text, the attribute value is processed to a one-way hash value which is in an irreversible state, and the one-way hash value is stored. 
         [0042]    To make semi person specifying information a 2  retrievable, the attribute value is encrypted and the encrypted attribute value is stored in the keyword management DB  5 . By the semi person specifying information a 2  itself, a person is not specified. However, a plurality of pieces of semi person specifying information can suggest a specific person, so that it is risky to store the semi person specifying information a 2  in a plain text. 
         [0043]    To make non-confidential information a 3  retrievable, the non-confidential information a 3  is stored in a plain text in the keyword management DB  5 . Since a plain text is used as a key, not only the unique search but also a range search and a prefix search can be easily made. 
         [0044]    When each of the person specifying information a 1 , the semi person specifying information a 2 , and the non-confidential information a 3  is not an object to be retrieved, it is unnecessary to store the information in the keyword management DB  5 . 
         [0045]    As described above, all of attribute values of data models whose protection level is the type A are stored in the dispersion management server  3 , and a table storing only an attribute to be retrieved is provided in the keyword management DB  5 . 
         [0046]    A data model of type B in  FIG. 4  does not include person specifying information, so that it is not stored in the dispersion management server  3 . The attribute value of semi person specifying information b 1  is encrypted, and the attribute value of non-confidential information b 2  in a plain text is stored as it is in the keyword management DB  5 . 
         [0047]    A data model of type C in  FIG. 4  does not include the person specifying information and the semi person specifying information, so that it is not stored in the disperse/management server  3 , and each of the attribute values in a plain text is stored as it is in the keyword management DB  5 . 
       (2) Determination of Data Physical Storage Form 
       [0048]    Next, how target data is divided and stored into the table in the keyword management DB  5  and the dispersion management server  3  will be described. 
         [0049]    Although data stored in the dispersion management server  3  is divided into a plurality of storing media in reality, original data which is reconstructed and integrated will be used in the following description. 
         [0050]    The way the storage handling means  13  refers to the data model attribute definition  11  and determines a data storing form will be described with reference to  FIG. 5 . 
         [0051]    The data model attribute definition  11  is data describing the arrangement shown in  FIG. 4  with respect to the attributes of data models, stored in a not-shown storage in the personal information managing apparatus  1 , and read as necessary. In the data model attribute definition  11 , an encryption method and a cipher key may be written. In this case, from the viewpoint of security, it is desirable to store the encryption method and the cipher key so as to be divided in the dispersion management server  3 , and obtain them as necessary. In short, it is sufficient to satisfy both security protection and convenience. 
         [0052]    The data model attribute definition  11  is illustrated in the left part of  FIG. 5 . 
         [0053]    A data model “respondent information” has, as attributes, “user ID” and “user name” as person specifying information, so that the protection level of the data model itself is type A. It is determined that the management handling means  13  stores the attribute value in the dispersion management server  3 . 
         [0054]    The “user ID” and “user name” have the protection level al and are to be retrieved, so that the hash values of the attribute values are stored in the keyword management DB  5 . “Date of birth” has the protection level a 3  and is to be retrieved, so that it is stored in a plain text in the keyword management DB  5 . 
         [0055]    The protection level of “job” is a 2 , and “job” is an object to be retrieved. Consequently, “job” is encrypted and stored in the keyword management DB  5 . On the other hand, although the protection level of “company name” is a 2 , “company name” is not an object to be retrieved, so that it is not stored in the keyword management DB  5 . 
         [0056]    The right part of  FIG. 5  shows the correspondence between the data stored in the table in the keyword management DB  5  and the data stored in the dispersion management server  3 . To link the data, document IDs are stored in both of them. The document IDs are used to reconstruct the divided data. 
         [0057]    Referring now to  FIG. 6 , the storage form in the case where the protection level of a data model is B will be described. 
         [0058]    The data model attribute definition  11  is illustrated in the left part of  FIG. 6 . The table stored in the keyword management DB  5  is shown in the right upper part of  FIG. 6 . 
         [0059]    Since the protection level of a data model “answers to the questionnaire by respondent” is B, it is unnecessary to store the data model in the dispersion management server  3 . To associate the data model with personal information stored in the dispersion management server  3 , “title of document” stored in the dispersion management server  3  is also stored in the keyword management DB  5 . Since the “title of document” is information unique to the specific person, it is encrypted and stored in the keyword management DB  5 . 
         [0060]    In the table corresponding to the data model having the protection level A, “user ID” is written as information unique to the specific person (see  FIG. 5 ). The “user ID” and the “title of document” are different information. The corresponding relations among the “user ID”, “title of document”, and the information unconditionally specifying the person exist only for information stored so as to be dispersed in the dispersion management server  3 . The arrangement of the present invention is directed to certainly protect the personal information. 
         [0061]    By specifying attributes of a data model in the data model attribute definition  11  independently of software, the following advantage is obtained. In the case of changing a work or addressing a new data model, only by changing the data in the data model attribute definition  11 , the change of the back end  12  can be made minimum or no change is required. 
       4. Storage of Data 
       [0062]    Referring now to  FIG. 7 , the operation of the back end  12  performed in the case where a data storing request is newly generated from the front end  6  will be described. 
         [0063]    A data storing request specifying data to be stored and user ID is sent from the front end  6  to the back end  12  (step Si). 
         [0064]    The back end  12  generates a title of document in accordance with a predetermined rule (step S 2 ), and adds the user ID and the title of document to the data to be stored, thereby generating data in a predetermined format in the dispersion management server  3  (step S 3 ). The generated data is original data to be divided and stored in the dispersion management server  3 . When a storing request is received (step S 4 ), the dispersion management server  3  divides the original data into pieces by a predetermined method and stores the divided pieces of data into a plurality of storing media. At this time, the dispersion management server  3  generates a document ID as information for reconstructing the divided data. After completion of the division, storage, and generation of the document ID, the dispersion management server  3  sends the document ID to the back end  12  (step S 5 ). After that, the back end  12  can obtain the data divided and stored by transmitting the document ID to the dispersion management server  3 . 
         [0065]    Next, the back end  12  has to register a table associated with the divided and stored data in the keyword management DB  5 . To register the table, the back end  12  calculates a hash value by properly substituting an attribute value into a predetermined hash function or encrypts the attribute value on the basis of the result of reference to the data model attribute definition  11  by the storage handling means  13  (step S 6 ). The back end  12  adds the document ID and the user ID to the attribute value hashed or the like, and registers the resultant data into the keyword management DB  5  (step S 7 ). 
       5. Acquisition of Data 
       [0066]    Next, the operation of the back end  12  in the case where a data acquisition request is generated from the front end  6  will be described with reference to  FIG. 8 . 
         [0067]    A data acquisition request designating the user name is transmitted from the front end  6  to the back end  12  (step S 11 ). 
         [0068]    The back end  12  refers to the data attribute definition and takes out the protection level of the user name. Since the protection level is al, it is understood that the user name is stored in the hash value, not in a plain text, in the keyword management DB  5 . The back end  12  hashes the designated user (step S 12 ) and, with the obtained hash value, searches the keyword management DB  5  (step S 13 ). When the hash values coincide with each other, the document ID is extracted (step S 14 ). Then, the back end  12  transmits the document ID to the dispersion management server  3  and requests for reconstruction and transmission of the document (step S 15 ). The dispersion management server  3  transmits the reconstructed data (step S 16 ). 
         [0069]    The back end  12  collates the user name included in the transmitted reconstructed data with the user name specified by the front end  6  (step S 17 ). When the user names coincide with each other, the back end  12  sends the data to the front end  6  (step S 18 ). 
         [0070]    Although the user names are different from each other, there is a case such that, as a result of the hash calculation, the hash values become the same. In this case, a plurality of document IDs are returned instep S 14 , the processes in steps S 15  to S 17  are repeated until the user names coincide with each other. 
         [0071]    Although the case of performing the retrieval and extraction by using the “user name” has been taken as an example in the above description, operations performed in the case of using other attributes are similar to the above. When the protection level is a 2 , it is necessary to perform encryption in step S 12 . When the protection level is a 3 , the step S 12  is omitted and it is sufficient to make a search with a plain text in step S 13 . 
       Others 
       [0072]    Although the front end  6  and the back end  12  are installed and operate in the same computer in the foregoing embodiment, they may be installed in different computers. 
         [0073]    Although a transaction is executed in the configuration in which the user terminal is a client and the front end is a server, the configuration is illustrative. The invention is not limited to such a system configuration. 
         [0074]    Although the three protection levels are set in the foregoing embodiment, the number of the protection levels is illustrative and the present invention is not limited to the number. 
         [0075]    The number of cipher keys of the semi person specifying information is not limited to one. Different cipher keys may be provided for attributes. 
         [0076]    In short, the embodiment disclosed above is illustrative in all of aspects and is not restrictive. Therefore, the embodiment can be variously modified. As long as modifications are based on the technical idea described in the scope of claims, the modifications are included in the technical scope of the present invention.