Information management device, information management method and information management program

Abstract

To appropriately organize access to management information by automatically determining access authority for each user. The management system includes a storage unit that stores user identification information and attribute information in association with each other, a storage unit that stores attribute information, accessible information, and an information provision form in association with each other, a unit that receives a request for provision of one piece of management information and one piece of user identification information from one user terminal operated by one user, a unit that extracts one piece of attribute information regarding one user on the basis of one piece of user identification information, a unit that specifies one piece of accessible information and a form of provision of one piece of accessible information on the basis of one piece of attribute information, a unit that converts and processes one piece of management information on the basis of the form of provision of one piece of accessible information in a case where one piece of management information is included in one piece of accessible information, and a unit that provides one piece of management information after conversion and processing to one user terminal.

Description

Technical Field

[0001] This invention relates to an information security technology. Prior Technology

[0002] Businesses possess various important information such as purchase data, customer data, employee data, and financial data. On the other hand, businesses have connections with a large number of unspecified individuals, including employees, trading partners, and business clients. Depending on the circumstances, there may be situations where it becomes necessary for these unspecified individuals to access the information they hold.

[0003] Against this backdrop, the importance of information security has been increasing recently, and technical proposals related to information security have also been developing accordingly. For example, Patent Document 1 proposes a personal information leakage monitoring system that detects the fact that personal information has been leaked from the database of the monitored object, as well as the date and time of the leakage. [Known Technical Documents] [Patent Literature]

[0004] [Patent Document 1] Japanese Patent No. 5674991 Summary of the Invention

[0005] [Problem to be solved by the present invention] However, as mentioned above, it is necessary to allow access to management information to an unspecified number of related persons, and the information accessed must be limited according to the qualifications of each related person. In the prior art, there is still a problem that it cannot meet such requirements.

[0006] Therefore, in view of the above problems, the object of the present invention is to provide an information management device that automatically determines access permissions for each user and appropriately integrates access to management information. [Technical means to solve the problem]

[0007] One aspect of the information management device disclosed in this invention is characterized by comprising: a user attribute memory means for associating and memorizing user identification information and attribute information of the user identified by the user identification information; an access management information memory means for associating and memorizing the attribute information, accessible information in the management information, and the provision format of the accessible information; a request receiving means for receiving a request for the provision of the management information and the user identification information related to the user from a user terminal operated by the user; an attribute information extraction means for extracting the attribute information related to the user from the user attribute memory means based on the user identification information; and a condition determination means for determining the condition based on the attribute information and the access management information memory. The system includes: a means to determine the accessible information and the form in which the accessible information is provided; an information conversion / processing means to convert / process the management information according to the form in which the accessible information is provided, when the management information is included in the accessible information; an information providing means to provide the converted / processed management information to the user terminal; an access management information memory means to associate and memorize the access source information of the user terminal, the attribute information, the accessible information, and the form in which the accessible information is provided; a provision request receiving means to receive the access source information related to the user terminal; and a provision condition determining means to determine the accessible information and the form in which the accessible information is provided, based on the attribute information and the access source information. [Effects of the Invention]

[0008] The information management device disclosed in this invention automatically determines the access permissions for each user and appropriately integrates access to management information. Simple Explanation of the Diagram

[0009] Figure 1 is a schematic diagram showing the information management device of this embodiment. Figure 2 is a functional block diagram of the information management device in this embodiment. Figure 3 is a diagram showing an example of the hardware configuration of the information management device in this embodiment. Figure 4 is a flowchart showing the processing example performed by the information management device in this embodiment. Implementation

[0010] Referring to the drawings, the configuration for carrying out the present invention is described. (Operating principle of the information management device in this embodiment)

[0011] Using Figures 1 and 2, the operating principle of the information management device (hereinafter referred to as "the device") 100 of this embodiment will be explained. Figure 1 is a diagram showing the connection relationship between the device 100 and other devices, and Figure 2 is a functional block diagram of the device 100.

[0012] As shown in Figure 1, this device 100 is connected via a communication network 330 to a user terminal 230 operated by the user 210 and a management information memory device 340 that stores management information 250 that this device 100 considers to be managed objects. The communication network 330 can be either wired or wireless. The user terminal 230 can be a portable information terminal such as a smartphone or a personal computer.

[0013] As shown in Figure 2, this device 100 includes a user attribute memory means 110, an access management information memory means 120, a request receiving means 130, an attribute information extraction means 140, a provision condition determination means 150, an information conversion / processing means 160, and an information provision means 170.

[0014] User attribute memory method 110 associates and memorizes user identification information 220 and attribute information 240 of user 210 identified by user identification information 220. Attribute information 240 may include information related to name, gender, age, organization, and position within the organization.

[0015] Access management information memory means 120 associates and memorizes the access source information 290, attribute information 240, and accessible information (determination information) 270 in management information 250 of user terminal 230, as well as the provision form (determination information) 280 of each accessible information 270. Access source information 290 includes, for example, user terminal identification information 310, such as IP (Internet Protocol) address, and access path 320. Management information 250 refers to information that this device 100 considers to be managed, and is stored, for example, in management information memory means 340. Accessible information 270 is used to determine / specify the accessible information in management information. The provision form 280 is information that determines the provision form of management information 250 when providing management information 250, such as information masking, encryption, hashing, etc.; masking, encryption, and hashing can be applied to all or a specific part of the object information.

[0016] The request receiving means 130 provides a request 260 to receive management information 250 directly or indirectly from the user terminal 230 operated by the user 210. Furthermore, the request receiving means 130 provides user identification information 220 related to the user 210 and access source information 290 related to the user terminal 230 directly or indirectly from the user terminal 230.

[0017] The attribute information extraction method 140 extracts attribute information 240 related to the user 210 from the user attribute memory method 110 based on the user identification information 220 received by the request receiving method 130.

[0018] Provide condition determination means 150, based on attribute information 240 extracted by attribute information extraction means 140, access source information 290 received by request receiving means 130 and access management information memory means 120, determine accessible information (determination information) 270 and the provision form of information 270 (determination information) 280.

[0019] Information transformation / processing means 160 performs further processing when management information 250, which is considered an object of the provision request 260 received by the provision request receiving means 130, is included in the accessible information 270 determined by the provision condition determining means 150. Information transformation / processing means 160 transforms / processes the management information 250, which is considered an object of the provision request 260, according to the provision form 280 of the information determined by the provision condition determining means 150. Information transformation / processing means 160 may, for example, perform masking, encryption, hashing, etc., on all or a specific part of the management information 250. Information providing means 170 provides management information 250, which has been converted / processed by information conversion / processing means 160, to user terminal 230 that sends out the request 260.

[0020] Based on the above operating principle, this device 100 can automatically determine the access permissions for each user 210 and appropriately integrate (manage) the access to management information 250. (Hardware configuration of the information management device in this embodiment)

[0021] Using FIG3, an example of the hardware configuration of the present device 100 will be described. FIG3 is a diagram showing an example of the hardware configuration of the present device 100. As shown in FIG3, the present device 100 includes: CPU (Central Processing Unit) 510, ROM (Read-Only Memory) 520, RAM (Random Access Memory) 530, auxiliary memory device 540, communication interface (Interface (I / F)) 550, input device 560, display device 570, and memory media interface 580.

[0022] CPU 510 is a device that executes programs stored in ROM 520. Following the program's instructions, it processes the data loaded into RAM 530 and controls the entire device 100. ROM 520 stores the programs and data executed by CPU 510. RAM 530, when CPU 510 executes the programs stored in ROM 520, loads the executed programs and data and temporarily stores the processing data during the operation.

[0023] The auxiliary memory device 540 is a device that stores the basic software, i.e., the OS (Operating System), the applications of this embodiment, and related data. The auxiliary memory device 540 may be, for example, an HDD (Hard Disk Drive) or flash memory, and includes a user attribute memory means 110 and an access management information memory means 120.

[0024] The communication interface 550 is used to connect to a wired / wireless LAN (Local Area Network), Internet or other communication network 330, and to send and receive data with other devices 230 that provide communication functions.

[0025] Input device 560 is a device such as a keyboard used for inputting data into this device 100. Display device (output device) 570 is a device such as an LCD (Liquid Crystal Display) that functions as a user interface when the user utilizes the functions of this device 100 or makes various settings. Memory media interface 580 is an interface used for receiving and transmitting data with memory media 590 such as CD-ROM, DVD-ROM, and USB memory.

[0026] The various means provided by this device 100 can be configured to enable the CPU 510 to execute programs corresponding to each means stored in the ROM 520 or auxiliary memory device 540. Furthermore, the various means provided by this device 100 can also be configured to implement the related processing of each means as hardware. Additionally, it can be configured to read the program of this invention from an external server device via the communication interface 550, or read the program of this invention from the memory medium 590 via the memory medium interface 580, thereby enabling the device 100 to execute the program. (Processing example performed by the information management device in this embodiment) Using Figure 4, a processing example performed by this apparatus 100 will be described. Figure 4 is a flowchart showing the process of the processing example performed by this apparatus 100.

[0027] In S10, a request receiving means 130 is provided to directly or indirectly receive a request 260 for management information 250 from the user terminal 230 operated by the user 210. Furthermore, in S10, the request receiving means 130 is provided to directly or indirectly receive user identification information 220 related to the user 210 and access source information 290 related to the user terminal 230 from the user terminal 230.

[0028] In S20, the attribute information extraction method 140 extracts attribute information 240 related to the user 210 from the user attribute memory method 110 based on the user identification information 220 received in S10.

[0029] In S30, a condition determination means 150 is provided, which determines the accessible information 270 and the provision form 280 of the information 270 based on the attribute information 240 extracted in S20, the access source information 290 received in S10, and the access management information memory means 120.

[0030] In S40, the information conversion / processing means 160, considering the management information 250 received in S10 as the object of the provision request 260, includes the accessible information 270 determined in S30, and performs subsequent processing. In S40, the information conversion / processing means 160, based on the information provision format 280 determined in S30, converts / processes the management information 250, which is considered the object of the provision request 260. For example, the information conversion / processing means 160, according to the information provision format 280 determined in S30, performs masking, encryption, hashing, etc., on all or a specific part of the management information 250. In S50, the information providing means 170 provides the user terminal 230 that sent the request 260 with the management information 250 converted / processed in S40.

[0031] By performing the above-described process, the device 100 can automatically determine access permissions for each user 210 and appropriately integrate (manage) access to management information 250.

[0032] While the embodiments of the present invention have been described in detail above, the present invention is not limited to these specific embodiments. Various modifications and alterations can be made within the scope of the spirit of the present invention as described in the claims.

[0033] 100: Information Management Device 110: User Attribute Memory Method 120: Access Management Information Memory Method 130: Provide the required means of receiving the message. 140: Attribute Information Extraction Methods 150: Provide means to determine conditions 160: Information conversion / processing methods 170: Information Provision Methods 210: User 220: User Identification Information 230: User Terminal 240: Attribute Information 250: Management Information 260: Requirements for the provision of management information 270: Accessible Information 280: Forms of Information Provision 290: Access Source Information 310: User Terminal Identification Information 320: Access path 330: Communication Network 340: Management Information Memory Device 510: CPU 520:ROM 530: RAM 540: Auxiliary Memory Device 550: Communication Interface 560: Input device 570: Output device 580: Memory Media Interface 590: Memory Media

Claims

1. An information management device comprising: a user attribute memory means for associating and memorizing user identification information and attribute information of a user identified by the user identification information; an access management information memory means for associating and memorizing the attribute information, accessible information in management information, and the provision format of the accessible information; a request receiving means for receiving a request for the provision of management information and user identification information related to the user from a user terminal operated by the user; an attribute information extraction means for extracting the attribute information related to the user from the user attribute memory means based on the user identification information; a condition determination means for determining the accessible information and the provision format of the accessible information based on the attribute information and the access management information memory means; an information conversion / processing means for converting / processing the management information according to the provision format of the accessible information when the management information is included in the accessible information; and an information providing means for providing the converted / processed management information to the user terminal. In the access management information memory means, the access source information, attribute information, accessible information, and the provision format of the accessible information of the user terminal are associated and memorized; the provision request receiving means receives the access source information related to the user terminal; the provision condition determining means determines the accessible information and the provision format of the accessible information based on the attribute information and the access source information.

2. An information management method, implemented in a computer equipped with a user attribute memory means and an access management information memory means; the user attribute memory means associates and remembers user identification information and attribute information of a user identified by the user identification information; the access management information memory means associates and remembers the attribute information, accessible information in management information, and the provision format of the accessible information; the information management method includes the following steps: a request receiving means receives a request for providing management information and user identification information related to the user from a user terminal operated by the user; an attribute information extraction means extracts the attribute information related to the user from the user attribute memory means based on the user identification information; and a provision condition determination means determines the accessible information and the provision format of the accessible information based on the attribute information and the access management information memory means. The information conversion / processing means, when the management information is contained within the accessible information, converts / processes the management information according to the provision format of the accessible information; and the information providing means provides the converted / processed management information to the user terminal; the access management information memory means associates and memorizes the access source information of the user terminal, the attribute information, the accessible information, and the provision format of the accessible information; the provision request receiving means receives the access source information related to the user terminal; and the provision condition determining means determines the accessible information and the provision format of the accessible information based on the attribute information and the access source information.

3. An information management program for enabling a computer to perform the information management method as described in claim 2.

Images