Information management device

Abstract

An information management device, method, and program are provided that automatically determine access rights for each user and appropriately manage access to management information. [Solution] The information management device has a storage means for storing user identification information and attribute information in association with each other, a storage means for storing attribute information, accessible information, and information provision form in association with each other, a means for accepting a request for provision of one management information and one user identification information from a user terminal operated by a user, a means for extracting one attribute information related to a user based on the one user identification information, a means for identifying one accessible information and a provision form of the one accessible information based on the one attribute information, a means for converting and processing the one management information based on the provision form of the one accessible information when the one management information is included in the one accessible information, and a means for providing the converted and processed one management information to a user terminal.

Description

[Technical Field]

[0001] Regarding information security technology. [Background technology]

[0002] Businesses hold a variety of important information, including purchasing data, customer data, employee data, financial data, etc. On the other hand, businesses have connections with an unspecified number of people, such as employees, business partners, and contractors, and in some cases may be forced to allow these unspecified people access to the information they hold.

[0003] Against this background, the importance of information security has been increasing in recent years, and many technical proposals relating to information security have been made. For example, Patent Document 1 proposes a personal information leakage monitoring system that detects the fact that personal information has been leaked from a monitored database and the date and time when the leak occurred. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 5674991 Summary of the Invention [Problem to be solved by the invention]

[0005] However, as mentioned above, it is necessary to allow an unspecified number of parties to access the management information, and it becomes necessary to limit the information that each party can access according to their qualifications. However, conventional technology has the problem of being unable to meet such needs.

[0006] In view of the above problems, the present invention aims to provide an information management device that automatically determines access authority for each user and appropriately manages access to management information. [Means for solving the problem]

[0007] One form of the disclosed information management device includes: a user attribute storage means for storing user identification information and attribute information of a user identified by the user identification information in association with each other; an access management information storage means for storing the attribute information, accessible information among management information, and a provision form of the accessible information in association with each other; a provision request receiving means for receiving a provision request for one of the management information and one of the user identification information related to the one user from a user terminal operated by the one user; an attribute information extraction means for extracting one of the attribute information related to the one user from the user attribute storage means based on the one user identification information; a provision condition specifying means for specifying one of the accessible information and one of the provision forms of the accessible information based on the one attribute information and the access management information storage means; an information conversion and processing means for converting and processing the one of the management information based on the provision form of the one accessible information when the one of the management information is included in the one of the accessible information; and an information providing means for providing the one of the converted and processed management information to the one user terminal. The access management information storage means stores the access source information of the user terminal, the attribute information, the accessible information, and a provision form of the accessible information in association with each other, the provision request receiving means receives one of the access source information related to the user terminal, and the provision condition specifying means specifies the one of the accessible information and the provision form of the one of the accessible information based on the one of the attribute information and the one of the access source information. It is characterized by: [Effects of the Invention]

[0008] The disclosed information management device automatically determines access rights for each user and appropriately manages access to management information. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a diagram showing an overview of an information management device according to an embodiment of the present invention; [Figure 2] 1 is a functional block diagram of an information management device according to an embodiment of the present invention; [Figure 3] FIG. 2 is a diagram illustrating an example of a hardware configuration of an information management device according to the present embodiment. [Figure 4] 10 is a flowchart illustrating a flow of an example of processing by the information management device according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described with reference to the drawings. (Operation principle of the information management device according to this embodiment)

[0011] The operating principle of an information management device 100 according to this embodiment (hereinafter simply referred to as "the device") will be described using Figures 1 and 2. Figure 1 is a diagram showing the connection relationship between the device 100 and other devices, and Figure 2 is a functional block diagram of the device 100.

[0012] 1, the device 100 is connected via a communication network 330 to a user terminal 230 operated by a user 210 and a management information storage device 340 that stores management information 250 that is to be managed by the device 100. The communication network 330 may be either wired or wireless. The user terminal 230 may be a mobile information terminal such as a smartphone, or may be a personal computer.

[0013] As shown in FIG. 2, the device 100 includes a user attribute storage means 110, an access management information storage means 120, a provision request receiving means 130, an attribute information extraction means 140, a provision condition specification means 150, an information conversion / processing means 160, and an information provision means 170.

[0014] The user attribute storage means 110 stores user identification information 220 and attribute information 240 of the user 210 identified by the user identification information 220 in association with each other. The attribute information 240 is information relating to, for example, name, sex, age, affiliation, position at the affiliation, and the like.

[0015] The access management information storage means 120 stores, in association with one another, access source information 290 of the user terminal 230, attribute information 240, accessible information (information defining) 270 from the management information 250, and provision form (information defining) 280 for each accessible information 270. The access source information 290 is, for example, user terminal identification information 310 and an access path 320 such as an IP (Internet Protocol) address. The management information 250 is information managed by the device 100 and is stored, for example, in the management information storage device 340. The accessible information 270 is information for identifying and defining accessible information. The information provision form 280 is information that determines the provision form of the management information 250 when the management information 250 is provided, and is, for example, masking, encryption, hashing, etc., of the information. The masking, encryption, and hashing may be performed on all or a specific portion of the target information.

[0016] The provision request receiving means 130 receives a provision request 260 for management information 250 directly or indirectly from a user terminal 230 operated by a user 210. In addition, the provision request receiving means 130 receives user identification information 220 related to the user 210 and access source information 290 related to the user terminal 230 directly or indirectly from the user terminal 230.

[0017] The attribute information extraction means 140 extracts attribute information 240 relating to the user 210 from the user attribute storage means 110 based on the user identification information 220 received by the provision request receiving means 130 .

[0018] The provision condition identification means 150 identifies accessible information (information defining the information) 270 and the form of provision of the information 270 (information defining the information) 280 based on the attribute information 240 extracted by the attribute information extraction means 140, the access source information 290 accepted by the provision request acceptance means 130, and the access management information storage means 120.

[0019] The information conversion and processing means 160 performs the following processing when the management information 250 targeted by the provision request 260 received by the provision request receiving means 130 is included in the accessible information 270 identified by the provision condition identifying means 150. The information conversion and processing means 160 converts and processes the management information 250 targeted by the provision request 260 based on the information provision form 280 identified by the provision condition identifying means 150. The information conversion and processing means 160 performs, for example, masking, encryption, hashing, etc. on all or a specific part of the management information 250. The information providing means 170 provides the management information 250 converted and processed by the information converting and processing means 160 to the user terminal 230 that has sent the provision request 260 .

[0020] Based on the above-described operating principle, the device 100 can automatically determine the access authority for each user 210 and appropriately manage (control) access to the management information 250. (Hardware configuration of the information management device according to this embodiment)

[0021] An example of the hardware configuration of the present device 100 will be described using Fig. 3. Fig. 3 is a diagram showing an example of the hardware configuration of the present device 100. As shown in Fig. 3, the present device 100 has a CPU (Central Processing Unit) 510, a ROM (Read-Only Memory) 520, a RAM (Random Access Memory) 530, an auxiliary storage device 540, a communication I / F 550, an input device 560, a display device 570, and a storage medium I / F 580.

[0022] CPU 510 is a device that executes programs stored in ROM 520, performs arithmetic processing on data loaded into RAM 530 in accordance with program instructions, and controls the entire device 100. ROM 520 stores programs and data to be executed by CPU 510. When CPU 510 executes a program stored in ROM 520, the programs and data to be executed are loaded into RAM 530, and RAM 530 temporarily holds the arithmetic data during the calculation.

[0023] The auxiliary storage device 540 is a device that stores the OS (Operating System), which is basic software, the application program according to this embodiment, and other related data. The auxiliary storage device 540 is, for example, a HDD (Hard Disk Drive) or flash memory, and includes the user attribute storage means 110 and the access management information storage means 120.

[0024] The communication I / F 550 is an interface for connecting to a communication network 310 such as a wired or wireless LAN (Local Area Network) or the Internet, and for transmitting and receiving data to and from another device 230 that provides a communication function.

[0025] The input device 560 is a device such as a keyboard for inputting data to the device 100. The display device (output device) 570 is a device formed of an LCD (Liquid Crystal Display) or the like, and functions as a user interface when the user uses the functions of the device 100 or when making various settings. The storage medium I / F 580 is an interface for sending and receiving data to and from a storage medium 590 such as a CD-ROM, DVD-ROM, or USB memory.

[0026] Each of the means included in device 100 may be realized by CPU 510 executing a program corresponding to each of the means stored in ROM 520 or auxiliary storage device 540. Each of the means included in device 100 may also be realized by hardware that performs the processing associated with the means. Alternatively, device 100 may be caused to execute the program by loading the program according to the present invention from an external server device via communication I / F 550 or from storage medium 590 via storage medium I / F 580. (Example of processing by the information management device according to this embodiment) An example of processing by the device 100 will be described with reference to Fig. 4. Fig. 4 is a flowchart showing the flow of an example of processing by the device 100.

[0027] At S10, the provision request receiving means 130 receives a provision request 260 for management information 250 directly or indirectly from the user terminal 230 operated by the user 210. In addition, at S10, the provision request receiving means 130 receives, directly or indirectly from the user terminal 230, user identification information 220 related to the user 210 and access source information 290 related to the user terminal 230.

[0028] In S20, the attribute information extraction means 140 extracts the attribute information 240 relating to the user 210 from the user attribute storage means 110 based on the user identification information 220 received in S10.

[0029] At S30, the provision condition identification means 150 identifies accessible information 270 and the provision form 280 of the information 270 based on the attribute information 240 extracted at S20, the access source information 290 received at S10, and the access management information storage means 120.

[0030] In S40, the information converting and processing means 160 performs the following process when the management information 250 targeted by the provision request 260 received in S10 is included in the accessible information 270 identified in S30. In S40, the information converting and processing means 160 converts and processes the management information 250 targeted by the provision request 260 based on the information provision form 280 identified in S30. For example, the information converting and processing means 160 masks, encrypts, hashes, etc., all or a specific part of the management information 250 in accordance with the information provision form 280 identified in S30. In S50, the information providing means 170 provides the management information 250 converted and processed in S40 to the user terminal 230 that has sent the provision request 260.

[0031] By performing the above-described processing, the device 100 can automatically determine the access authority for each user 210 and appropriately manage (control) access to the management information 250.

[0032] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and variations are possible within the scope of the gist of the present invention as defined in the claims. [Explanation of symbols]

[0033] 100 Information management device 110 User attribute storage means 120 Access management information storage means 130 Provision request acceptance means 140 Attribute information extraction means 150 Means for specifying provision conditions 160 Information conversion and processing means 170 Means of providing information 210 users 220 User Identification Information 230 user terminals 240 Attribute information 250 Management information 260 Management Information Request 270 Accessible Information 280 Form of information provision 290 Access Source Information 310 User Device Identification Information 320 Access Route 330 Communication Network 340 Management information storage device 510 CPU 520 ROM 530 RAM 540 Auxiliary storage 550 Communication Interface 560 Input Device 570 Output Device 580 Storage Media Interface 590 Storage medium

Claims

1. a user attribute storage means for storing user identification information and attribute information of a user identified by the user identification information in association with each other; an access management information storage means for storing the attribute information, accessible information among the management information, and a provision form of the accessible information in association with each other; a provision request receiving means for receiving a provision request for one of the management information and one of the user identification information related to one of the users from one user terminal operated by one of the users; attribute information extraction means for extracting one of the attribute information related to the one user from the user attribute storage means based on the one user identification information; a provision condition specifying means for specifying one of the accessible information items and a provision form of the accessible information item based on the one of the attribute information items and the access management information storage means; an information conversion / processing means for converting and processing the one management information based on a providing format of the one accessible information when the one management information is included in the one accessible information; an information providing means for providing the one management information after conversion and processing to the one user terminal, the access management information storage means stores the access source information of the user terminal, the attribute information, the accessible information, and the provision form of the accessible information in association with each other; the provision request receiving means receives one of the access source information related to the user terminal; An information management device characterized in that the provision condition identification means identifies the one accessible information and the provision form of the one accessible information based on the one attribute information and the one access source information.

2. A computer comprising: a user attribute storage means for storing user identification information and attribute information of a user identified by the user identification information in association with each other; and an access management information storage means for storing the attribute information, accessible information among management information, and a form of providing the accessible information in association with each other; a provision request receiving means receiving a provision request for one of the management information and one of the user identification information related to the one of the users from one user terminal operated by the one of the users; an attribute information extraction means extracting one of the attribute information related to the one user from the user attribute storage means based on the one user identification information; a provision condition specifying means for specifying one of the accessible information items and a provision form of the accessible information item based on the one of the attribute information items and the access management information storage means; an information converting / processing means converting / processing the one management information based on a providing format of the one accessible information when the one management information is included in the one accessible information; an information providing means providing the one management information after conversion and processing to the one user terminal; the access management information storage means stores the access source information of the user terminal, the attribute information, the accessible information, and the provision form of the accessible information in association with each other; the provision request receiving means receives one of the access source information related to the user terminal; An information management method characterized in that the provision condition identification means identifies the one accessible information and the provision form of the one accessible information based on the one attribute information and the one access source information.

3. An information management program for causing a computer to execute the method according to claim 2.

Images