Distributed mesh data server and program

Abstract

To provide a distributed mesh data server and a program, allowing user authentication access control to mesh data dispersively existing on different servers, and allowing recording and updating (metering) of user access frequency information according to use of the mesh data by a user.SOLUTION: The distributed mesh data server 1 includes a mesh data provision unit 118 that provides mesh data corresponding to a mesh code, a user information update unit 119 that updates user information related to a user when the mesh data provision unit provides the mesh data to the user, a common secret key acquisition unit 114 that acquires a common secret key used by a plurality of servers, an encryption unit 120 that encrypts the user information using the common secret key, and an encrypted information provision unit 121 that provides the encrypted user information to another server. This system is provided with an encryption information acquisition part 115 for acquiring encrypted user information from another server and a decryption part 116 for decrypting the encrypted user information.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a distributed mesh data server and a program. [Background technology]

[0002] Mesh data, which is defined as a grid of longitude and latitude on a map, is used to digitize information on maps or to obtain various statistical information about regions. Mesh data includes, for example, primary mesh divisions with sides of approximately 80 km, which are areas divided vertically and horizontally by meridians at each degree, even-numbered latitudes, and latitudes that divide the intervals between them into thirds, based on 100 degrees east longitude and 0 degrees north latitude; secondary mesh divisions with sides of approximately 10 km, which are areas obtained by dividing the primary mesh division into eight equal parts in the latitude and meridian directions; and tertiary mesh divisions (standard regional mesh) with sides of approximately 1 km, which are areas obtained by dividing the secondary mesh division into ten equal parts in the latitude and meridian directions.

[0003] If the mesh data is further divided into standard area meshes, such as 1 / 10 fine mesh blocks with sides of approximately 100 meters, which are areas obtained by dividing a third-order mesh block into ten equal parts in the latitude and longitude directions, the spatial resolution of the mesh data can be further improved. However, the smaller the area into which the mesh data is divided, the greater the number and volume of data in the mesh data. For example, Patent Document 1 discloses a system that calculates mesh statistics from satellite data at different spatial resolutions while integrating mesh data divided into smaller blocks. In systems that handle mesh data divided into smaller blocks, such as those exemplified in Patent Document 1, the data capacity and processing power required of the mesh data server on which the mesh data is stored becomes even greater. Therefore, there is a need to improve the processing power of the mesh data server.

[0004] With regard to improving the processing capacity of a server storing map-related data, Patent Document 2 discloses a database search program that causes a computer to execute steps such as: in a map database or the like relating to an area on a map divided into meshes of a plurality of unit sizes, the data relating to the map database is stored in a plurality of database server devices; a search request relating to the data is divided into a plurality of split search requests; the generated split search requests are registered in a common queue provided in common to the plurality of database server devices, together with the reception time of the original search requests; determining one or more database server devices to which the split search requests can be added and which satisfy predetermined processability conditions and specific parallel processability conditions; additionally submitting the selected split search request to one of the one or more database server devices determined as being able to be added; and, in synchronization with the completion of processing of any split search request by any database server device, selecting from the common queue the oldest split search request that satisfies the processability conditions and parallel processability conditions and submitting it to that database server device.

[0005] Patent Document 2 enables the construction of a large-scale information database system through a distributed configuration using multiple database server devices, without being restricted in performance by the storage capacity per computer, the limits of CPU performance, or the platform such as the OS, while preventing an increase in the processing time for split search requests and shortening the processing time for search requests. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent No. 7328650 [Patent Document 2] Japanese Patent Application Laid-Open No. 2004-102631 Summary of the Invention [Problem to be solved by the invention]

[0007] When mesh data stored in a mesh data server is provided for a fee, there is a need to identify which user a search request belongs to in order to appropriately calculate the fee for each user. There is also a need to keep the search request itself secret from other users. Due to various needs exemplified by these needs, there is a need to appropriately manage user information related to search requests on multiple mesh data servers. Hereinafter, each mesh data server that performs parallel processing will also be referred to as a distributed mesh data server. Furthermore, multiple distributed mesh data servers that perform parallel processing will also be referred to as a distributed mesh data server group.

[0008] Regarding the proper management of user information, when user information is handled in a group of distributed mesh data servers, there is a concern that the user information may be updated asynchronously across multiple distributed mesh data servers, resulting in a loss of consistency of the user information.

[0009] Furthermore, with regard to the appropriate management of user information, encryption of user information is considered as a means for protecting the confidentiality of user information. However, when encryption is used to protect the confidentiality of user information in a distributed mesh data server group, there is a concern that the processing load and processing time will increase due to repeated encryption and decryption processes on each of the multiple distributed mesh data servers.

[0010] Therefore, the techniques of Patent Documents 1 and 2 have room for further improvement in terms of appropriately managing user information on a distributed mesh data server group.

[0011] The present invention has been made in consideration of the above circumstances, and an object of the present invention is to appropriately manage user information on a distributed mesh data server group. [Means for solving the problem]

[0012] As a result of intensive research into solving the above-mentioned problems, the inventors have discovered that the above-mentioned object can be achieved by obtaining a common secret key used by multiple servers and exchanging user information encrypted using the common secret key between distributed mesh data servers. As a result, the inventors have completed the present invention. Specifically, the present invention provides the following.

[0013] The present invention provides a distributed mesh data server comprising a mesh data providing unit that provides mesh data corresponding to a mesh code, a user information updating unit that updates user information related to the user when the mesh data providing unit provides mesh data to the user, a common private key obtaining unit that obtains a common private key used by multiple servers, an encryption unit that encrypts the user information using the common private key, an encrypted information providing unit that provides the encrypted user information to other servers, an encrypted information obtaining unit that obtains the encrypted user information from the other servers, and a decryption unit that decrypts the encrypted user information.

[0014] The mesh data is defined as a longitude-latitude grid on a map and is stored in association with a mesh code that identifies the grid. In the present invention, a mesh data providing unit provides mesh data corresponding to the mesh code. In the present invention, a user information updating unit updates user information in response to the provision of the mesh data.

[0015] Then, the present invention provides the updated user information to other distributed mesh data servers by the encrypted information providing unit and the encrypted information acquiring unit, and can acquire the updated user information from other distributed mesh data servers. As a result, the present invention can maintain the consistency of user information even though the user information is updated on the distributed mesh data server group.

[0016] In mesh data, data corresponding to a wide geographical area such as a city, town, village, prefecture, country, or region is divided and stored in a large number of mesh data. Therefore, in a distributed mesh data server group, when a search request corresponding to a wide geographical area is made, the divided and / or replicated search request may be processed in parallel by a large number of servers. Therefore, in a distributed mesh data server group, synchronous parallel processing is required to exchange updated results of user information corresponding to a search request with other distributed mesh data servers.

[0017] On the other hand, data encryption is usually performed using a method that uses a private key unique to the server. Therefore, when a search request covering a wide geographical area is made, each distributed mesh data server using this method will perform encryption and / or decryption processing using multiple private keys corresponding to multiple other distributed mesh data servers. Therefore, in a distributed mesh data server group configured in this way, the processing load and processing time required to update encrypted user information will increase.

[0018] In the present invention, the encryption unit and decryption unit encrypt and decrypt user information using a common secret key used by multiple servers. This allows each distributed mesh data server to encrypt and decrypt user information using a single common secret key, without the need for processing that requires a large processing load and time using multiple secret keys. Therefore, the present invention can protect the confidentiality of user information without unnecessarily increasing the processing load and time. [Effects of the Invention]

[0019] The present invention can appropriately manage user information on a group of distributed mesh data servers, thereby providing a system that enables user authentication and access control to mesh data distributed across different servers, as well as recording and updating (metering) information on the number of user accesses according to the user's use of mesh data. [Brief explanation of the drawings]

[0020] [Figure 1] FIG. 1 is a diagram showing an outline of a system S according to this embodiment (first embodiment). [Figure 2] FIG. 2 is a block diagram showing the hardware and software configurations of the system S of this embodiment. [Figure 3] Figure 3 is an example of a grid-divided map. [Figure 4] FIG. 4 is an example of the mesh data database 131. [Figure 5] FIG. 5 is an example of the multimedia database 132. [Figure 6] FIG. 6 is a block diagram showing the hardware and software configurations of the user information management server 2 of this embodiment. [Figure 7] FIG. 7 is an example of the server database 221. [Figure 8] FIG. 8 is an example of the user information database 222. [Figure 9] FIG. 9 is a block diagram showing the hardware and software configurations of the certificate authority server 3 of this embodiment. [Figure 10] FIG. 10 is a flowchart showing an example of a preferable flow of the mesh data acquisition process executed by the terminal T of this embodiment. [Figure 11] FIG. 11 is a continuation of FIG. [Figure 12] FIG. 12 is a main flowchart showing an example of a preferred flow of the mesh data providing process executed by the distributed mesh data server 1 of this embodiment. [Figure 13] FIG. 13 is a continuation of FIG. [Figure 14] FIG. 14 is a continuation of FIG. [Figure 15] FIG. 15 is a continuation of FIG. [Figure 16] FIG. 16 is a flowchart showing an example of a preferable flow of the mesh code conversion process. [Figure 17]FIG. 17 is a flowchart showing an example of a preferable flow of the user information management process executed by the user information management server 2 of this embodiment. [Figure 18] FIG. 18 is a flowchart showing an example of a preferable flow of the server authentication process executed by the certificate authority server 3 of this embodiment. [Figure 19] FIG. 19 is a block diagram showing the hardware and software configurations of the system S of the second embodiment. [Figure 20] FIG. 20 is a flowchart showing an example of a preferable flow of the mesh data generation process. [Figure 21] FIG. 21 is a flow chart continuing from the previous figure. [Figure 22] FIG. 22 is a flow chart continuing from the previous figure. [Figure 23] FIG. 23 is a flow chart continuing from the previous figure. [Figure 24] FIG. 24 is a flow chart continuing from the previous figure. [Figure 25] FIG. 25 is a flow chart continuing from the previous figure. [Figure 26] FIG. 26 is a flow chart continuing from the previous figure. DETAILED DESCRIPTION OF THE INVENTION

[0021] First, although the following disclosure, diagrams, and / or claims may be described as being presented alone or in combination with one or more other aspects, the subject matter of the immediate disclosure is not intended to be so limited. That is, the immediate disclosure, diagrams, and claims are intended to encompass the various aspects described herein, each alone or in one or more combinations with each other. For example, even if the immediate disclosure describes and illustrates a first, second, and third embodiment in such a way that the first embodiment is described and illustrated specifically in conjunction with the second embodiment, or the second embodiment is described and illustrated only in conjunction with the third embodiment, the immediate disclosure and illustrations are not so limited and may include only the first embodiment, only the second embodiment, only the third embodiment, or one or more combinations of the first, second, and / or third embodiments, such as the first and second embodiments, the first and third embodiments, the second and third embodiments, or the first, second, and third embodiments.

[0022] The use of the phrase "or" in this document shall mean a "non-exclusive" arrangement unless expressly specified otherwise. For example, when we say "item x is A or B," we mean either: (1) item x is either A or B, but not both; or (2) item x is both A and B. In other words, the word "or" is not used to define an "exclusive" arrangement.

[0023] Additionally, the phrases "comprising at least one of" and "comprising at least one of the following," when used in conjunction with a system or element, mean that the system or element includes one or more of the elements listed after the phrase. For example, if there are three types of elements, element 1 through element 3, the phrases "comprising at least one of" and "comprising at least one of the following" are to be interpreted as any of the following structural arrangements: a device including the first element, a device including the second element, a device including the third element, a device including the first and second elements, a device including the first and third elements, a device including the second and third elements, or a device including the first, second, and third elements.

[0024] A similar interpretation is intended when the phrase "used in at least one of the following" is used in this context. Furthermore, as used in this context, "and / or" is used as a verbal conjunction to indicate that one or more of the listed elements or conditions are included or occur. For example, a device including a first element, a second element, and / or a third element is to be interpreted as any of the following structural arrangements: a device including the first element, a device including the second element, a device including the third element, a device including the first element and the second element, a device including the first element and the third element, a device including the second element and the third element, or a device including the first element, the second element, and the third element.

[0025] In addition, the use of the phrase "and / or" in the text means a "non-exclusive" agreement, as stipulated in the Japanese Industrial Standards (JIS) "Format and preparation method of standard sheets JIS Z 8301."

[0026] <<First Embodiment>> Hereinafter, an example of a first embodiment of the present invention (hereinafter also simply referred to as "the present embodiment") will be described in detail with reference to the drawings.

[0027] <System S> Fig. 1 is a diagram showing an outline of a system S according to this embodiment (first embodiment). Fig. 2 is a block diagram showing the hardware and software configurations of the system S according to this embodiment. The following describes an example of a preferred configuration of the system S according to this embodiment using Figs. 1 and 2.

[0028] The system S of this embodiment includes one or more terminals T, a plurality of distributed mesh data servers 1, a user information management server 2, and a certification authority server 3, which are configured to be able to communicate with each other via a network N.

[0029] An overview of the system S of this embodiment will be described below. In the system S of this embodiment, a shared secret key, user information, and various mesh data are stored in the distributed mesh data server 1. The distributed mesh data server 1 receives a user authentication request from a terminal T, performs user authentication related to the user authentication request using the user authentication API of the user information management server 2, and starts a session if the user authentication is successful. Using the one-time shared secret key API of the certification authority server 3, the distributed mesh data server 1 obtains a shared secret key used by multiple distributed mesh data servers 1 (a distributed mesh data server group) from the certification authority server 3, and shares and updates user information encrypted using the shared secret key. The system S may include one or more distributed mesh data server groups. A configuration in which the system S includes one distributed mesh data server group simplifies the overall configuration and contributes to improved security. A configuration in which the system S includes multiple distributed mesh data server groups allows multiple distributed mesh data server groups managed by different administrators to be integrated into a single system S. Furthermore, a configuration in which the system S includes multiple distributed mesh data server groups makes it possible to assign processes related to different users to different distributed mesh data server groups. This allows the system S of this embodiment to process processes for different users using different common secret keys. This prevents the processing contents from being leaked between different users. Therefore, a configuration in which the system S includes multiple distributed mesh data server groups improves security.

[0030] The distributed mesh data server 1 of this embodiment uses a common secret key instead of a secret key specific to each individual distributed mesh data server 1, so that even though user information is updated across a group of distributed mesh data servers, it is possible to maintain the consistency of user information and protect the confidentiality of user information without unnecessarily increasing the processing load and processing time.

[0031] In addition, the distributed mesh data server 1 of this embodiment uses a common secret key configured as a one-time common secret key, thereby minimizing increases in processing load and processing time while further reducing the risk of interception of user information, etc.

[0032] In addition, the distributed mesh data server 1 of this embodiment updates the number of accesses to the distributed mesh data server 1, which is part of the user information, so that the fee for each user related to the provision of mesh data can be appropriately calculated.

[0033] In addition, the distributed mesh data server 1 of this embodiment can separate the processing for each user related to the provision of mesh data by session, thereby protecting user confidentiality, by performing session initiation processing based on user authentication and processing that commands the storage of user information at the end of the session.

[0034] Furthermore, the terminal T included in the system S of this embodiment converts location information into a mesh code and searches for and acquires mesh data based on the mesh code, thereby protecting the confidentiality of the user's detailed location information, which is part of the user information.

[0035] [Terminal T] The type of terminal T is not particularly limited. Terminal T may be, for example, a personal computer, a laptop computer, a smartphone, a tablet terminal, or the like. Terminal T includes a control unit, a storage unit, a communication unit, an input unit, and a display unit (not shown). Terminal T also includes a position measurement unit (not shown) that measures the current position of terminal T, exemplified by a global positioning system receiver (GPS receiver), or the like. Terminal T stores a program that causes terminal T to execute a mesh data acquisition process that acquires mesh data from the distributed mesh data server 1. The functions provided by each of the software components of the program (search request unit, position acquisition unit, mesh code generation unit, mesh data display unit, etc.) will be described in the description of a preferred flow of the mesh data acquisition process, which will be described later.

[0036] [Distributed Mesh Data Server 1] The distributed mesh data server 1 includes a control unit (data server control unit 11), a memory unit (data server memory unit 13), and a communication unit (data server communication unit 14). The type of the distributed mesh data server 1 is not particularly limited. The type of the distributed mesh data server 1 may be, for example, a server or a node that constitutes a distributed database.

[0037] [Data Server Control Unit 11] The data server control unit 11 includes a central processing unit (CPU), a random access memory (RAM), a read only memory (ROM), and the like.

[0038] The data server control unit 11 cooperates with the data server storage unit 13 and / or the data server communication unit 14 as necessary. The data server control unit 11 then realizes the following software components of the program of this embodiment executed by the distributed mesh data server 1: a user authentication request receiving unit 111, a user authentication unit 112, a session initiation unit 113, a common secret key acquisition unit 114, an encrypted information acquisition unit 115, a decryption unit 116, a mesh code receiving unit 117, a mesh data providing unit 118, a user information update unit 119, an encryption unit 120, an encrypted information providing unit 121, and a session termination unit 122. The functions provided by each of the software components of the program related to the distributed mesh data server 1 of this embodiment will be described later in the description of a preferred flow of the mesh data providing process.

[0039] The main processing performed by the distributed mesh data server 1 is data processing related to the search and acquisition of mesh data (described later). This type of data processing is characterized by having few serially executed parts that cannot be parallelized. For this reason, it is preferable that the distributed mesh data server 1 be configured so that mesh data is stored in a parallel database and processed in parallel. However, even if mesh data is stored in a parallel database, a single-core CPU executes parallelizable processing serially, and the benefits of parallel processing cannot be realized.

[0040] For the above reasons, it is preferable that the data server control unit 11 has a multi-core CPU. This allows the data server control unit 11 to perform parallelizable processing related to the parallel database in parallel using each core of the CPU, thereby increasing the processing capacity. For example, if the number of cores and the number of parallel databases of the ith distributed mesh data server 1 in a distributed mesh data server group consisting of n distributed mesh data servers 1 are m, i If m1 is a distributed mesh data server group, m1 to m n A parallelism of several M can be achieved by summing up all of the above.

[0041] [Data Server Storage Unit 13] The data server storage unit 13 is a device in which data and / or files are stored, and includes a storage unit that stores data non-temporarily using a hard disk, a semiconductor memory, a recording medium, a memory card, or the like.

[0042] The data server storage unit 13 stores a program executed by the microcomputer, a mesh data database 131, a multimedia database 132, a common secret key, user information, a secret key unique to the distributed mesh data server 1, and the like.

[0043] (Mesh data database 131) Mesh data, which is data obtained by dividing a map into a grid, is stored in the mesh data database 131. If the data server control unit 11 has a multi-core CPU, it is preferable that the mesh data database 131 be a parallel database in order to increase processing capacity through parallel processing.

[0044] From the viewpoint of maintaining compatibility of mesh data, it is preferable that the division method for dividing the map into a grid conforms to JIS X0410, which is related to regional mesh codes. From the viewpoint of handling mesh data from all over the world in a unified manner, it is even more preferable that the division method conforms to the World Mesh Standard, which is an extension of JIS X0410. The type of mesh data is not particularly limited as long as it is data that can be associated with divisions on the map. Mesh data may be various types of data, such as population, land use classification, vegetation, topography, and elevation. These mesh data are stored, for example, in multiple data tables according to their types.

[0045] Figure 3 is an example of a map divided into grids. The example shown in Figure 3 shows a map including a first district A1, a second district A2, and a third district A3 indicated by dotted lines. The map is divided into tertiary mesh divisions indicated by solid lines and expanded 100m meshes indicated by dashed lines. This makes it possible to calculate data corresponding to areas on the map exemplified by districts, etc., as the integrated value of mesh data associated with divisions that intersect with the area.

[0046] In the example map shown in Figure 3, 10m meshes are indicated by dashed lines. This allows the distributed mesh data server 1 to treat, for example, the first district A1 as an area made up of multiple expanded 100m meshes and many expanded 10m meshes. The distributed mesh data server 1 can then add up the mesh data for these meshes and provide it as data corresponding to the first district A1.

[0047] 4 is an example of the mesh data database 131. The mesh data database 131 stores various types of mesh data in association with mesh codes. In this example, the mesh code "5439-21-68" is associated with mesh data such as a population of "8,000 people" and an administrative division of "△△ town" in the third-order mesh block identified by the reference area mesh code. Also, in this example, the mesh code "5439-21-78" is associated with mesh data such as a population of "7,000 people" and an administrative division of "△△ town" in the third-order mesh block identified by the mesh code. This allows the distributed mesh data server 1 to provide mesh data such as population in the third-order mesh block identified by the mesh code.

[0048] (Multimedia Database 132) The multimedia database 132 stores multimedia data such as images, videos, and audio in association with mesh codes. This allows the distributed mesh data server 1 to provide various types of multimedia data corresponding to the mesh codes. In order to treat multimedia data in the same way as mesh data, it is preferable that the mesh codes in the multimedia database 132 are the same as those in the mesh data database 131. If the data server control unit 11 has a multi-core CPU, it is preferable that the multimedia database 132 is a parallel database in order to increase processing power through parallel processing.

[0049] FIG. 5 is an example of the multimedia database 132. The multimedia database 132 of the example shown in FIG. 5 stores various types of multimedia data in association with mesh codes. In this example, the mesh code "5439-21-68" is associated with an image of the scenery in the third-order mesh section identified by the reference area mesh code, and audio recorded in the third-order mesh section. Also, in this example, the mesh code "5439-21-78" is associated with an image of the scenery in the third-order mesh section identified by the mesh code, audio recorded in the third-order mesh section, and video captured in the third-order mesh section. This allows the distributed mesh data server 1 to provide various types of multimedia data for the third-order mesh section identified by the mesh code.

[0050] (Common secret key) The common private key is an encryption key used by multiple distributed mesh data servers 1 (distributed mesh data server group). The common private key is obtained from the certification authority server 3. The common private key is kept secret from outside the system S. The common private key encrypts user information, etc. This makes it virtually impossible for an interceptor who does not possess the common private key to decrypt the encrypted information within a practically meaningful time period. In other words, the common private key makes it difficult for an interceptor who does not possess the common private key to use the encrypted information.

[0051] The common private key method is not particularly limited as long as information encrypted with the common private key can be decrypted by the distributed mesh data server 1. The common private key can be, for example, a combination of a random character string distributed in advance in writing by the certification organization managing the certification authority server 3 (one-time common private key server) and an authentication method using arbitrary encryption with an RSA public-private key pair. To ensure the security of the authentication path, communication between the distributed mesh data server 1 and the certification authority server 3 in this embodiment preferably uses, for example, an encrypted communication method via SSL, or an authentication method using arbitrary encryption with an RSA public-private key pair. The certification authority server 3 (one-time common private key server) creates and stores a random character string specific to the session using generation logic at the start of a session (synchronization time interval), and distributes a different one-time common private key for each group of distributed mesh data servers 1 in response to a request from the distributed mesh data server 1. This allows the operating organization of the certification authority server 3 to control the possibility of communication between the distributed mesh data servers 1 during a session. The random string generation logic can use a method of generating a string of alphanumeric characters registered in advance using uniform random numbers, or, for example, a random code generation method using irreversible hashing with a representative time and secret phrase. This allows the certificate authority server 3 to mechanically generate unique and controllable random strings at synchronized time intervals. Because the mechanical generation method uses an irreversible hashing process, the representative time and secret phrase used originally cannot be decrypted. Therefore, this method is superior to reversible AES encryption, etc.

[0052] The common secret key is preferably a one-time common secret key with a set expiration date that is updated within a certain period of time. This prevents information intercepted after the expiration date from being decrypted even if the one-time common secret key becomes non-secret. This allows the distributed mesh data server 1 of this embodiment to further reduce the risk of interception of user information while minimizing increases in processing load and processing time.

[0053] It is preferable that the one-time common secret key is stored in association with its expiration date. This prevents the distributed mesh data server 1 from continuing to use an expired one-time secret key. This also allows the distributed mesh data server 1 to properly update an expired one-time common secret key.

[0054] (User information) The user information is not particularly limited as long as it is information related to a user who uses the distributed mesh data server 1. The user information includes information that can be updated according to the user's use of the distributed mesh data server 1. An example of information that can be updated according to use is the access count (user access count information), which is the number of times a user has accessed the distributed mesh data server 1. By including the access count in this information, the distributed mesh data server 1 can record and update (meter) the user access count information according to the user's use of mesh data. This allows the distributed mesh data server 1 to charge the user a usage fee according to the number of accesses. Furthermore, in order to enable advance payment of the usage fee, the user information preferably includes a charge that increases according to payment from the user and decreases according to the user's use of the distributed mesh data server 1.

[0055] [Data Server Communication Section 14] The data server communication unit 14 is not particularly limited as long as it connects the distributed mesh data server 1 to the network N and enables communication with the user information management server 2, the certification authority server 3, and the terminal T. An example of the data server communication unit 14 is a network card compatible with the Ethernet standard.

[0056] [User information management server 2] 6 is a block diagram showing the hardware and software configurations of the user information management server 2 of this embodiment. The user information management server 2 includes a control unit (management server control unit 21), a storage unit (management server storage unit 22), and a communication unit (management server communication unit 23). The type of the user information management server 2 is not particularly limited.

[0057] [Management server control unit 21] The hardware configuration of the management server control unit 21 may be the same as that of the data server control unit 11. The management server control unit 21 cooperates with the management server storage unit 22 and / or the management server communication unit 23 as necessary. The management server control unit 21 then realizes the software components of the program of this embodiment executed by the user information management server 2, such as a user authentication request receiving unit 211, a user authentication executing unit 212, a user information providing unit 213, a user information receiving unit 214, and a user information storage executing unit 215. The functions provided by each of the software components of the program related to the user information management server 2 of this embodiment will be described later in the description of a preferred flow of user information management processing.

[0058] [Management Server Storage Unit 22] The hardware configuration of the management server storage unit 22 may be the same as that of the data server storage unit 13. The management server storage unit 22 stores programs executed by the microcomputer, a server database 221, a user information database 222, and the like.

[0059] (Server database 221) The server database 221 stores information (server information) related to the distributed mesh data server 1. The server information includes information for identifying the distributed mesh data server 1 related to the server information from among multiple distributed mesh data servers 1. By including information for identifying the distributed mesh data server 1 in the server information, the user information management server 2 performs an identification process related to the server requesting provision of the common secret key, and can provide the user information only when the server is identified as an appropriate distributed mesh data server 1 to which the user information is to be provided. This protects the confidentiality of the user information.

[0060] Information that identifies the distributed mesh data server 1 includes the name of the distributed mesh data server 1 (server ID), a public key corresponding to a private key unique to the distributed mesh data server 1, information relating to the location of the distributed mesh data server 1 on the network N, exemplified by an IP address, and information unique to the distributed mesh data server 1, exemplified by a MAC address.

[0061] Fig. 7 is an example of the server database 221. In the server database 221 of the example shown in Fig. 7, server information such as a public key corresponding to a private key unique to the distributed mesh data server 1 is stored in association with a server ID. In this example, the server ID "N0001" is associated with server information such as a public key corresponding to the private key unique to the distributed mesh data server 1 identified by the server ID, an IP address, a MAC address, etc. Also in this example, the server ID "N0002" is associated with server information such as a public key corresponding to the private key unique to the distributed mesh data server 1 identified by the server ID, an IP address, a MAC address, etc. This allows the user information management server 2 to perform authentication related to the distributed mesh data server 1 identified by the server ID "N0001", "N0002", etc. using the public key.

[0062] (User Information Database 222) The user information database 222 stores user information of users who use the distributed mesh data server 1. The user information preferably includes the number of times the distributed mesh data server 1 has been accessed. This allows the system S to update the number of times the distributed mesh data server 1 has been accessed, which is part of the user information, and appropriately calculate the compensation for each user related to the provision of mesh data. The user information also preferably includes the remaining balance of the charge used to pay the compensation related to the provision of mesh data. This allows the system S to provide mesh data by deducting the compensation from the charge previously acquired by the user, without requiring the user to pay the compensation each time.

[0063] Furthermore, it is preferable that the user information includes information related to the authentication of the corresponding user (user authentication information). This allows the user information management server 2 to perform user authentication processing and start a session related to use of the distributed mesh data server 1 only when the user is identified as a user of the distributed mesh data server 1. This prevents unauthorized users from using the distributed mesh data server 1.

[0064] FIG. 8 is an example of the user information database 222. In the user information database 222 of the example shown in FIG. 8, user information such as user authentication information, number of accesses, and charge balance is stored in association with a user ID. In this example, user ID "U0001" is stored in association with user information such as the user's user authentication information, number of accesses "3," and charge balance "2,000." Also, in this example, user ID "U0002" is stored in association with user information such as the user's user authentication information, number of accesses "1," and charge balance "500." This allows the user information management server 2 to perform processes related to authentication of users identified by user IDs "U0001," "U0002," etc., updating of the number of accesses, consumption of charge due to use, etc.

[0065] [Administration Server Communication Unit 23] The management server communication unit 23 is not particularly limited as long as it connects the user information management server 2 to the network N and enables communication with the distributed mesh data server 1, etc. The hardware configuration of the management server communication unit 23 may be the same as that of the data server communication unit 14.

[0066] [Certification Authority Server 3] 9 is a block diagram showing the hardware and software configurations of the certification authority server 3 of this embodiment. The certification authority server 3 includes a control unit (certification authority server control unit 31), a storage unit (certification authority server storage unit 32), and a communication unit (certification authority server communication unit 33). The type of certification authority server 3 is not particularly limited.

[0067] From the viewpoint of centralizing authentication related to the common private key, it is preferable that the number of certification authority servers 3 is one. If the system S is used frequently or if high availability is required for the system S, it is preferable that the number of certification authority servers 3 is multiple. This distributes the load of authentication related to the common private key. Furthermore, this also allows the other certification authority servers 3 to perform authentication related to the common private key even if one of the certification authority servers 3 becomes unable to perform authentication. This prevents the distributed mesh data server 1 from being unable to share user information using the common private key due to one of the certification authority servers 3 being unable to perform authentication.

[0068] [Certification authority server control unit 31] The hardware configuration of the certificate authority server control unit 31 may be the same as that of the data server control unit 11. The certificate authority server control unit 31 cooperates with the certificate authority server storage unit 32 and / or the certificate authority server communication unit 33 as necessary. The certificate authority server control unit 31 then implements the software components of the program of this embodiment executed by the certificate authority server 3, such as a server authentication request receiving unit 311, a server determination unit 312, and a common secret key providing unit 313. The functions provided by each of the software components of the program related to the certificate authority server 3 of this embodiment will be described later in the description of a preferred flow of server authentication processing.

[0069] [Certification authority server storage unit 32] The hardware configuration of the certificate authority server storage unit 32 may be the same as that of the data server storage unit 13. The certificate authority server storage unit 32 stores a program executed by a microcomputer, a server database 321, a common secret key, and the like.

[0070] (Server database 321) The server database 321 stored in the certificate authority server storage unit 32 may be the same as the server database 221 .

[0071] (Common secret key) The common secret key stored in the certificate authority server storage unit 32 may be the same as the common secret key related to the distributed mesh data server 1.

[0072] [Certification Authority Server Communication Section 33] The certification authority server communication unit 33 is not particularly limited as long as it connects the certification authority server 3 to the network N and enables communication with the distributed mesh data server 1, etc. The hardware configuration of the certification authority server communication unit 33 may be the same as that of the data server communication unit 14.

[0073] [Network N] The type of network N is not particularly limited as long as it enables communication between the distributed mesh data server 1, the user information management server 2, the certification authority server 3, and one or more terminals T. The type of network N may be, for example, the Internet, a mobile phone network, a wireless LAN, or the like.

[0074] The network N may include a first network that enables multiple distributed mesh data servers 1 to communicate with each other, separate from a second network used for other communications, in order to increase the communication speed between the distributed mesh data servers 1. The network N may also include a third network that enables the distributed mesh data server 1, the user information management server 2, and the certification authority server 3 to communicate with each other, separate from a fourth network used for other communications, in order to keep communications between the distributed mesh data server 1, the user information management server 2, and the certification authority server 3 secret from external devices, terminals, etc., such as the terminal T.

[0075] The following is an example of a preferred flow of processing executed by each computer (terminal T, distributed mesh data server 1, user information management server 2, and certification authority server 3) included in the system S of this embodiment.

[0076] [Flowchart of mesh data acquisition process executed on terminal T] Fig. 10 is a flowchart showing an example of a preferable flow of the mesh data acquisition process executed by terminal T in this embodiment. Fig. 11 is a diagram continuing from Fig. 10. Hereinafter, an example of a preferable flow of the mesh data acquisition process executed by terminal T in this embodiment will be described using Figs. 10 and 11.

[0077] In order to further protect the confidentiality of user information in the distributed mesh data server 1, the mesh data acquisition process preferably includes a series of processes (steps S1 to S3) related to the start of a user session.

[0078] [Step S1: Determine whether to start a user session] The control unit of terminal T executes a user authentication request unit (not shown) in cooperation with a storage unit, a communication unit, an input unit, a display unit, etc. Then, the control unit executes a process of determining whether to start a user session by the user authentication request unit (step S1, user session start determination step). If it is determined that a user session should be started, the control unit moves the process to step S2. If it is not determined that a user session should be started, the control unit returns the process to step S1.

[0079] The user session start determination step includes a procedure for determining that a user session should be started when, for example, a user using terminal T issues an instruction via an input unit to start searching for mesh data.

[0080] [Step S2: Send authentication request] The control unit of the terminal T causes the user authentication request unit to execute a process of transmitting an authentication request to any of the distributed mesh data servers 1 (step S2, user authentication request execution step). The control unit moves the process to step S3.

[0081] The user authentication request execution step includes, for example, a procedure of transmitting an authentication request including a user ID and a password. From the viewpoint of protecting the confidentiality of user information, it is preferable that the user ID and password included in the authentication request are encrypted.

[0082] [Step S3: Determine whether authentication success notification has been received] The control unit of the terminal T executes a process of determining whether or not the user authentication request unit has received an authentication success notification from the distributed mesh data server 1 in step S2 (step S3, authentication success notification reception determination step). If it is determined that the notification has been received, the control unit moves the process to step S4. If it is not determined that the notification has been received, the control unit returns the process to step S3.

[0083] The mesh data acquisition process preferably involves a series of steps to search for mesh data based on information indicating a geographical area, such as a place name, a building name, or a geometric figure enclosing an area. Steps S4 to S5 shown below are an example of this process. The example shown below shows the procedure for "searching based on a place name," but the process can also be configured in a similar manner when searching for mesh data based on information other than a place name that indicates a geographical area, such as a building name or a geometric figure enclosing an area.

[0084] [Step S4: Determine whether to perform a search based on place names] The control unit of terminal T executes a search request unit (not shown) in cooperation with a storage unit, a communication unit, an input unit, a display unit, etc. Then, the control unit of terminal T executes a process of determining whether to perform a search based on a place name using the search request unit (step S4, place name search request determination step). If it is determined that a search should be performed, the control unit moves the process to step S5. If it is not determined that a search should be performed, the control unit moves the process to step S6.

[0085] The user session start determination step includes a procedure for determining that a search based on a place name should be started when, for example, a user of terminal T issues an instruction via an input unit to start a search for mesh data based on a place name or a current location. The input via the input unit may be, for example, input via a character input means such as a keyboard or a software keyboard on a touch panel, input via voice recognition, or input via a graphical user interface (GUI). In particular, a configuration for searching mesh data via voice recognition input facilitates searching for mesh data from terminal T configured as a mobile terminal such as a smartphone. Since detailed location information of a mobile terminal is updated as the terminal moves, there is a greater need to keep location information confidential than for a fixed terminal. Therefore, a synergistic effect is achieved between the program of this embodiment, which conceals detailed location information through a mesh data acquisition process, and the configuration for searching mesh data via voice recognition input.

[0086] [Step S5: Send a search request based on a place name] The control unit of the terminal T executes a process of transmitting a search request based on the place name in step S4 to any of the distributed mesh data servers 1 by the search request unit (step S5, place name search request transmission step). The control unit moves the process to step S10.

[0087] The mesh data acquisition process involves a series of processes for searching based on mesh codes. Regarding mesh data searches, there is a demand for searching mesh data related to various areas that include the current location of terminal T. However, when searching for such mesh data, if location information indicating the current location of terminal T is sent to a server, there is a concern that the confidentiality of terminal T's current location may be leaked.

[0088] The mesh data acquisition process performs a series of processes for searching based on mesh codes, allowing terminal T to perform a search based on location information while protecting the confidentiality of the current location of terminal T, i.e., the current location of the user using terminal T. This series of processes can be implemented not only for searches related to the current location of terminal T, but also for searches of mesh data based on information indicating a geographical area, such as place names and building names.

[0089] Steps S6 to S9 shown below are an example of a preferred process flow for performing a search based on a mesh code. The example shown below shows a case where a search is performed based on a mesh code related to the location information of terminal T. By equipping terminal T with a mesh code search engine that searches for mesh codes corresponding to information other than place names that indicate geographical areas, a similar configuration can be used to search for mesh data based on information other than place names that indicate geographical areas.

[0090] [Step S6: Determine whether to perform a search based on mesh code] The control unit of terminal T, in cooperation with the storage unit, communication unit, input unit, display unit, etc., executes a process of determining whether to perform a search based on location information (step S6, mesh code search request determination step). If it is determined that a search should be performed, the control unit proceeds to step S7. If it is not determined that a search should be performed, the control unit proceeds to step S10.

[0091] [Step S7: Obtain location information] The control unit of terminal T executes a location information acquisition unit (not shown) in cooperation with the storage unit, location measurement unit, etc. The control unit of terminal T executes a process of acquiring location information relating to the current location of terminal T from the location measurement unit using the location information acquisition unit (step S7, location information acquisition step). The control unit moves the process to step S8.

[0092] [Step S8: Generate mesh code] The control unit of terminal T executes a mesh code generation unit (not shown) in cooperation with a storage unit, etc. The control unit of terminal T executes a process of generating a mesh code based on the location information acquired in the location information acquisition step using the mesh code generation unit (step S8, mesh code generation step). The control unit moves the process to step S9.

[0093] When searching based on a mesh code related to the location information of terminal T, in the mesh code generation step, a mesh code is generated from the latitude and longitude of the current location included in the location information. At this time, if the search target is a "circular area centered on the current location" or a "rectangular area centered on the current location," a mesh code related to that area is generated based on the latitude and longitude of the current location and parameters (radius, scale, length and width, etc.) that identify such an area.

[0094] Furthermore, if the search targets are "administrative districts that include the current location," "street that includes the current location," "buildings that include the current location," etc., a mesh code is generated from the search results using the mesh code search engine. The same applies when the reference and search target are locations different from the current location. The mesh code search engine performs processing similar to the mesh code conversion processing described later using Figure 16, for example.

[0095] [Step S9: Send a search request based on the mesh code] The control unit of terminal T executes a mesh data request unit (not shown) in cooperation with the storage unit, communication unit, input unit, display unit, etc. Then, the control unit of terminal T executes a process in which the mesh data request unit transmits a search request based on the mesh code generated in the mesh code generation step to any of the distributed mesh data servers 1 (step S9, mesh data request step). The control unit then proceeds to step S10.

[0096] The search request based on the mesh code may include the mesh code and an instruction to search for the administrative district corresponding to the mesh code. This allows terminal T to send a search request to the distributed mesh data server 1 to search for mesh data for the administrative district corresponding to its current location without transmitting detailed location information of terminal T.

[0097] [Step S10: Determine whether mesh data has been received] The control unit of the terminal T, in cooperation with the storage unit, communication unit, etc., executes a process of determining whether mesh data has been received from any of the distributed mesh data servers 1 (step S10, mesh data reception determination step). If it is determined that mesh data has been received, the control unit moves the process to step S11. If it is not determined that mesh data has been received, the control unit returns the process to step S10.

[0098] [Step S11: Display mesh data] The control unit of terminal T executes a mesh data display unit (not shown) in cooperation with a storage unit etc. The control unit of terminal T executes a process in which the mesh data display unit displays the mesh data determined to have been received in the mesh data reception determination step (step S11, mesh data display step). The control unit returns the process to step S1 and repeats the processes from step S1 to step S11. The process of displaying the mesh data includes, for example, a procedure of displaying the mesh data on a browser.

[0099] [Effects of the program that executes the mesh data acquisition process] Improvements in global positioning system receivers (GPS receivers) have made it possible to measure the current location of terminal T with high accuracy. This allows the precise current location measured with high accuracy, i.e., the detailed location information of terminal T, to be transmitted to a server, where the detailed location information can be stored. However, when the detailed location information is stored on a server, users may have privacy concerns. Furthermore, if the detailed location information of terminal T is transmitted outside terminal T, there is a concern that the location information may be intercepted and the precise current location of the user using terminal T may be leaked. Leaking the precise current location may not only lead to a violation of the user's privacy, but also raise concerns that the leaked precise current location may be used for crimes such as stalking, blackmail, and kidnapping.

[0100] The program stored in terminal T of this embodiment causes terminal T to execute a mesh data acquisition process, thereby preventing detailed location information of terminal T, among other user information, from being sent as is to the distributed mesh data server 1 and preventing such location information from being accumulated in the distributed mesh data server 1, user information management server 2, etc. Terminal T can then send only the mesh code, which is the minimum amount of data required to search for mesh data, to the distributed mesh data server 1. This prevents the detailed current location of the user using terminal T from being leaked. Therefore, the program can protect the confidentiality of user information in the distributed mesh data server 1.

[0101] [Main flowchart of mesh data provision processing executed by distributed mesh data server 1] Fig. 12 is a main flowchart showing an example of a preferred flow of the mesh data provision process executed by the distributed mesh data server 1 of this embodiment. Fig. 13 is a diagram continuing from Fig. 12. Fig. 14 is a diagram continuing from Fig. 13. Fig. 15 is a diagram continuing from Fig. 14. Below, an example of a preferred flow of the mesh data provision process executed by the distributed mesh data server 1 of this embodiment will be explained using Figs. 12 to 15.

[0102] As described above, the group of distributed mesh data servers that make up the system S includes multiple distributed mesh data servers 1. Hereinafter, of these multiple distributed mesh data servers 1, the distributed mesh data server 1 that is being closely watched in the processing flow will be referred to as "this distributed mesh data server 1" and distinguished from it. Also, distributed mesh data servers 1 that are different from this distributed mesh data server 1 will be referred to as "other distributed mesh data servers 1."

[0103] In order to further protect the confidentiality of user information in the distributed mesh data server 1, the mesh data providing process preferably includes a series of processes related to the start of a user session (steps S21 to S24).

[0104] [Step S21: Determine whether an authentication request has been received] The data server control unit 11 executes the user authentication request receiving unit 111 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether an authentication request has been received from the terminal T by the user authentication request receiving unit 111 (step S21, user authentication request receiving step). If it is determined that the request has been received, the data server control unit 11 moves the process to step S22. If it is not determined that the request has been received, the data server control unit 11 returns the process to step S21.

[0105] [Step S22: Request user authentication] The data server control unit 11 cooperates with the data server storage unit 13, the data server communication unit 14, etc. to execute the user authentication unit 112. Then, the data server control unit 11 executes processing to request user authentication from the user information management server 2 by the user authentication unit 112 (step S22, user authentication request step). The data server control unit 11 moves the processing to step S23.

[0106] In the user authentication request step, for example, a user authentication request including information related to the authentication request received in the user authentication request receiving step is provided to the user authentication API of the user information management server 2. The user authentication request includes information related to user authentication, such as a user ID and password. To further improve security, the user authentication request step preferably includes authentication using a one-time password. In this authentication, the distributed mesh data server 1 performs authentication using a one-time password generated by the certification authority server 3 at the start of a server session. This prevents an attacker from gaining unauthorized access unless they can break the one-time password during the short time that authentication using the one-time password is performed. Therefore, such a user authentication request step significantly narrows the attacking opportunities of an attacker. As a result, such a user authentication request step improves security.

[0107] [Step S23: Determine whether a user authentication success notification has been received] The data server control unit 11 executes a process of determining whether a user authentication success notification has been received from the user information management server 2 by the user authentication unit 112 (step S23, user authentication success confirmation step). If it is determined that the notification has been received, the data server control unit 11 moves the process to step S24. If it is not determined that the notification has been received, the data server control unit 11 returns the process to step S23.

[0108] The user authentication success notification includes, for example, a user-specific API key obtained from the user authentication API. The user is identified by the user-specific API key. This makes it possible to manage access rights to various data processed by the distributed mesh data server 1 on a per-user basis.

[0109] [Step S24: Start session] The data server control unit 11 executes the session initiation unit 113 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes processing to start a user session corresponding to the user related to the user authentication success notification received in the user authentication success confirmation step, by the session initiation unit 113 (step S24, session initiation step). The data server control unit 11 proceeds to step S25.

[0110] The user session includes management of access to data using a user-specific API key. This allows communication between the terminal T used by the user and the distributed mesh data server 1 to be kept secret from anyone other than the user. It is also preferable that the user session includes management of access to communication using a user-specific API key. This allows communication between the terminal T used by the user and the distributed mesh data server 1 to be kept secret from anyone other than the user.

[0111] In order to further protect the secrecy of user information in the distributed mesh data server 1, it is preferable that the mesh data providing process includes a series of processes related to server authentication (steps S25 to S26).

[0112] [Step S25: Request server authentication] The data server control unit 11 cooperates with the data server storage unit 13, the data server communication unit 14, etc. to execute the common secret key acquisition unit 114. Then, the data server control unit 11 executes processing to request server authentication from the certificate authority server 3 by the common secret key acquisition unit 114 (step S25, server authentication request step). The data server control unit 11 moves the processing to step S26.

[0113] In order to prevent the common private key from being obtained by a server without proper authority, the server authentication request step preferably includes a procedure for obtaining the common private key using a server-specific private key associated with the distributed mesh data server 1. In this case, the server authentication request step provides authentication information related to the server-specific private key associated with the distributed mesh data server 1 to the common private key API of the certification authority server 3. The "authentication information related to the server-specific private key" includes, for example, information signed with the server-specific private key, the server-specific private key itself, etc.

[0114] If the certification authority server 3 has a one-time common private key API, the server authentication request step preferably provides the server-specific private key associated with the distributed mesh data server 1 to the one-time common private key API of the certification authority server 3. This allows the distributed mesh data server 1 to use a common private key configured as a one-time common private key that has an expiration date and is updated at regular intervals.

[0115] [Step S26: Determine whether a server authentication success notification has been received] The data server control unit 11 executes a process of determining whether a server authentication success notification has been received from the certificate authority server 3 by the common private key acquisition unit 114 (step S26, server authentication success confirmation step). If it is determined that the notification has been received, the data server control unit 11 moves the process to step S27. If it is not determined that the notification has been received, the data server control unit 11 returns the process to step S26. The server authentication success notification includes at least the common private key acquired from the common private key API.

[0116] The mesh data providing process includes a process of acquiring a common secret key from the certificate authority server 3, etc. Step S27 is an example of this process.

[0117] [Step S27: Obtain the common secret key] The data server control unit 11 cooperates with the data server storage unit 13, the data server communication unit 14, etc. to execute the common secret key acquisition unit 114. Then, the data server control unit 11 executes processing to acquire a common secret key by the common secret key acquisition unit 114 (step S27, common secret key acquisition step). The data server control unit 11 moves the processing to step S28.

[0118] From the viewpoint of carrying out the process integrally with the authentication procedure, it is preferable that the common secret key acquisition step includes a step of acquiring the common secret key from the server authentication success notification determined to have been received in the server authentication success confirmation step.

[0119] If the certificate authority server 3 has a one-time common private key API, the common private key acquisition step preferably includes a procedure of acquiring, from the one-time common private key API, a one-time common private key that has a set expiration date and is updated at regular intervals. This allows the distributed mesh data server 1 to use a common private key configured as a one-time common private key. Because the one-time common private key has a set expiration date and is updated at regular intervals, it is possible to minimize increases in processing load and processing time while further reducing the risk of interception of user information, etc.

[0120] [Step S28: Determine whether a search request has been received] The data server control unit 11 executes the mesh code receiving unit 117 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether a search request has been received from another device (terminal T or another distributed mesh data server 1) by the mesh code receiving unit 117 (step S28, search request receiving step). If it is determined that a search request has been received, the data server control unit 11 proceeds to step S29. If it is not determined that a search request has been received, the data server control unit 11 proceeds to step S40.

[0121] The mesh data providing process includes a series of processes for distributing the search request received in the search request receiving step to a plurality of distributed mesh data servers 1 belonging to a distributed mesh data server group. The series of processes for distributing the processing is not particularly limited, and may be similar to that of a conventional distributed server that stores mesh data in a distributed manner on a plurality of servers and processes the mesh data in a distributed manner using these servers. Steps S29 to S31 are an example of a series of processes for distributing the processing.

[0122] [Step S29: Determine whether further parallelization is required] The data server control unit 11, in cooperation with the data server storage unit 13 and the data server communication unit 14, etc., executes a process of determining whether the process related to the search request received in the search request receiving step requires further parallelization (step S29, parallelization determination step). If it determines that it does, the data server control unit 11 proceeds to step S30. If it does not determine that it does, the data server control unit 11 proceeds to step S32.

[0123] The parallelization determination step includes, for example, a procedure for determining that further parallelization is required if the search request is sent from terminal T and is not a search request that has been duplicated or otherwise processed in another distributed mesh data server 1.

[0124] The parallelization determination step also includes, for example, a procedure for determining whether or not mesh data corresponding to the mesh code related to the search request is stored in other distributed mesh data servers 1, and determining that further parallelization is required if it is determined that the mesh data is stored in one or more other distributed mesh data servers 1. The determination procedure may be a procedure corresponding to various methods (range division, hash division, etc.) for distributing mesh data to multiple distributed mesh data servers 1.

[0125] [Step S30: Encrypt the search request] The data server control unit 11, in cooperation with the data server storage unit 13 and the like, executes a process of encrypting the search request using a common secret key (step S30, search request encryption step). The data server control unit 11 moves the process to step S31. Because encryption is performed using a common secret key, each distributed mesh data server 1 belonging to the same distributed mesh data server group can confirm that they mutually possess the same common secret key with a relatively small computational cost. Furthermore, because encryption is performed with a common secret key, the distributed mesh data server 1 can decrypt with a relatively small computational cost. These advantages contribute to a significant reduction in computational costs, particularly when the common secret key is a one-time common secret key that is periodically changed.

[0126] [Step S31: Send search request] The data server control unit 11, in cooperation with the data server storage unit 13 and the data server communication unit 14, etc., executes a process of transmitting a search request (query) that has been copied, etc. to other distributed mesh data servers 1 (step S30, search request transmission step). The data server control unit 11 moves the process to step S32. The transmission of the search request and the acquisition of the result in the search request transmission step are performed via an API that uses the query and an encrypted user private key as authentication options. For example, communication for each user between distributed mesh data servers 1 during a session is performed using a one-time common private key over an encrypted route via SSL to encrypt the user-specific private key. Note that, to prevent eavesdropping on the communication route, it is preferable that the distributed mesh data server 1 transmits the search request over an encrypted route via SSL.

[0127] The "duplicated search request" in the search request transmission step is, for example, a duplicate of a search request received from a terminal T, etc. Also, if it is possible to identify the distributed mesh data server 1 in which mesh data corresponding to the mesh code is stored, the "duplicated search request" may be a search request that requests only a portion of the search request that corresponds to the mesh data stored in the distributed mesh data server 1 to which it is sent.

[0128] The other distributed mesh data servers 1 to which the search request is sent in the search request sending step are, for example, "one or more other distributed mesh data servers 1" that are determined in the parallelization determination step to have mesh data corresponding to the mesh code stored therein. If the other distributed mesh data servers 1 that store mesh data are not determined to prevent search omissions, it is preferable that the other distributed mesh data servers 1 to which the search request is sent in the search request sending step are all distributed mesh data servers 1 that belong to the distributed mesh data server group.

[0129] [Step S32: Mesh code conversion process] If the search request received in the search request receiving step is not a search request related to a mesh code, the data server control unit 11 executes a mesh code conversion process (step S32, mesh code conversion step) in cooperation with the data server storage unit 13, etc. The data server control unit 11 moves the process to step S33. The details of the mesh code conversion process will be described later with reference to FIG.

[0130] [Step S33: Obtain mesh data] The data server control unit 11, in cooperation with the data server storage unit 13 and the data server communication unit 14, executes a process of acquiring mesh data corresponding to the mesh code related to the search request received in the search request receiving step (step S33, mesh data acquisition step). The data server control unit 11 then proceeds to step S34.

[0131] [Step S34: Provide mesh data] The data server control unit 11 executes the mesh data providing unit 118 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of providing the mesh data acquired in the mesh data acquisition step to the device related to the search request received in the search request reception step by the mesh data providing unit 118 (step S34, mesh data providing step). The data server control unit 11 moves the process to step S35.

[0132] In the mesh data providing step, the "device related to the search request received in the search request receiving step" is terminal T or another distributed mesh data server 1. This "other distributed mesh data server 1" refers to another distributed mesh data server 1 that has copied the search request or otherwise transmitted it to this distributed mesh data server 1.

[0133] If the search request is copied or otherwise transmitted to other distributed mesh data servers 1 in the search request transmission step, it is preferable that the mesh data provision step includes a procedure of receiving mesh data as the search result from the distributed mesh data server 1 to which the search request was copied or otherwise transmitted, and combining it with the mesh data acquired in the mesh data acquisition step, in order to centralize the distributed mesh data servers 1 with which clients such as terminal T communicate.

[0134] [Step S35: Determine whether encrypted user information has been received] The data server control unit 11 executes the encrypted information acquisition unit 115 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether encrypted user information has been received from another distributed mesh data server 1 by the encrypted information acquisition unit 115 (step S35, encrypted information acquisition step). If it is determined that the encrypted user information has been received, the data server control unit 11 moves the process to step S36. If it is not determined that the encrypted user information has been received, the data server control unit 11 returns the process to step S37.

[0135] The encrypted user information preferably includes a user API key that identifies the user and an access count, which is the number of times the user has accessed the distributed mesh data server 1. The "number of times the user has accessed the distributed mesh data server 1" is the sum of the number of times the user has accessed any of the multiple distributed mesh data servers 1 that belong to the distributed mesh data server group. The access count is associated with the user API key.

[0136] By including the user API key in the encrypted user information, the distributed mesh data server 1 can identify the user. This allows the distributed mesh data server 1 to process the session related to that user so that only data related to that user can be accessed. Therefore, the confidentiality of the user information is maintained.

[0137] Since mesh data may have commercial value, there is a demand for payment according to the number of times the mesh data is accessed. By including the number of accesses in the encrypted user information, the distributed mesh data server 1 can appropriately calculate the compensation for each user for the provision of mesh data.

[0138] [Step S36: Decrypt the encrypted user information] The data server control unit 11 executes the decryption unit 116 in cooperation with the data server storage unit 13 etc. Then, the data server control unit 11 executes a process of decrypting the encrypted user information acquired in the encrypted information acquisition step by the decryption unit 116 (step S36, decryption step). The data server control unit 11 moves the process to step S37.

[0139] The encrypted user information is user information encrypted using a common secret key in an encryption step (described later) executed by another distributed mesh data server 1. This common secret key is a common secret key used by multiple servers, i.e., multiple distributed mesh data servers 1 belonging to a distributed mesh data server group. Therefore, this distributed mesh data server 1 can decrypt the encrypted user information using the common secret key without managing encryption keys unique to the other distributed mesh data servers 1. This reduces the processing load associated with the decryption and prevents an increase in the processing load caused by managing encryption keys unique to each of the multiple distributed mesh data servers 1 belonging to the distributed mesh data server group.

[0140] [Step S37: Update user information] The data server control unit 11, in cooperation with the data server storage unit 13 and the like, executes a process of updating the user information stored in the data server storage unit 13 (step S37, user information update step). The data server control unit 11 moves the process to step S38.

[0141] In order to reflect the acquisition of mesh data in the access count, the user information update step preferably includes a procedure for updating the access count in the user information in accordance with the mesh data acquired in the mesh data acquisition step. Also, in order to reflect the update of the access count in other distributed mesh data servers 1, the user information update step preferably includes a procedure for updating the access count using the encrypted user information decrypted in the decryption step.

[0142] [Step S38: Encrypt user information] The data server control unit 11 operates the encryption unit 120 in cooperation with the data server storage unit 13, etc. Then, the data server control unit 11 executes a process of encrypting the user information updated in the user information update step by the encryption unit 120 (step S38, encryption step). The data server control unit 11 moves the process to step S39.

[0143] [Step S39: Provide user information] The data server control unit 11 cooperates with the data server storage unit 13 and the like to execute the encrypted information providing unit 121. Then, the data server control unit 11 executes a process of providing the encrypted user information encrypted in the encryption step to other distributed mesh data servers 1 by the encrypted information providing unit 121 (step S39, encrypted information providing step). The data server control unit 11 moves the process to step S40.

[0144] Through the series of processes from step S35 to step S39, the user information updated in the user information update step of this distributed mesh data server 1 is shared with other distributed mesh data servers 1 in an encrypted state.

[0145] When a series of processes related to the start of a user session (steps S21 to S24) is executed, the mesh data providing process preferably includes a series of processes related to the end of the user session (steps S40 to S42). This ends the user session that has completed its role by completing the provision of mesh data, etc. This further protects the confidentiality of user information in the distributed mesh data server 1.

[0146] [Step S40: Determine whether to end the session] The data server control unit 11 executes the session termination unit 122 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes processing to determine whether to terminate the session using the session termination unit 122 (step S40, session termination determination step). If it is determined that the session should be terminated, the data server control unit 11 moves the processing to step S41. If it is not determined that the session should be terminated, the data server control unit 11 returns the processing to step S28.

[0147] The session termination determination step includes, for example, a procedure for determining that the session should be terminated when an instruction to terminate the mesh data search is received from the user of terminal T. The session termination determination step also includes, for example, a procedure for determining that the session should be terminated when all mesh data related to the search request has been provided to terminal T.

[0148] [Step S41: Command to store user information] The data server control unit 11 executes a process of instructing the user information management server 2 to store the user information through the session termination unit 122 (step S41, user information storage instruction step). The data server control unit 11 moves the process to step S42. As a result, the user information shared among the multiple distributed mesh data servers 1 and including the number of accesses and the like updated in response to accesses to the mesh data is stored in the user information management server 2 and is managed centrally.

[0149] [Step S42: End the session] The data server control unit 11 causes the session termination unit 122 to execute processing to terminate the session started in the session start step (step S42, session termination execution step). The data server control unit 11 returns the processing to step S21 and repeats the processing from step S21 to step S42. If a one-time password (one-time common secret key) is used, the distributed mesh data server 1 discards the one-time password in the session termination execution step. This allows the distributed mesh data server 1 to prevent unauthorized access after the session using the one-time password has ended.

[0150] [Search for mesh data by text] In order to enable provision of mesh data based on text, the mesh data provision process preferably includes a procedure for searching for mesh data based on a search request related to text provided from terminal T. As a configuration for realizing such a procedure, for example, a proper noun mesh database (not shown) storing proper noun mesh data is stored in the data server storage unit 13. In this configuration, for example, a mesh code is searched for from the proper noun mesh database using the text provided from terminal T as a search key.

[0151] [Provided by multimedia data] The mesh data acquisition step acquires mesh data corresponding to the mesh code from the mesh data database 131. In order to provide multimedia data such as images, audio, and video related to the mesh code, the mesh data acquisition step preferably includes a procedure of acquiring mesh data corresponding to the mesh code from the multimedia database 132. This allows the distributed mesh data server 1 to provide various types of multimedia data corresponding to the mesh code.

[0152] [Calculating administrative districts from mesh codes] The search request received in the search request receiving step may include a mesh code and an instruction to perform a search for an administrative district corresponding to the mesh code. In such a case, the distributed mesh data server 1 identifies the administrative district corresponding to the mesh code based on the mesh code. Then, the distributed mesh data server 1 calculates a mesh code that covers the identified administrative district by a mesh code conversion process. This allows the distributed mesh data server 1 to perform a search for an administrative district corresponding to the current location of terminal T without receiving detailed location information from terminal T.

[0153] [Update mesh data] In order to enable updating of mesh data based on the mesh code, the mesh data providing process preferably includes a series of processes related to updating the mesh data. The mesh data update request includes a mesh code that identifies the mesh data to be updated and data related to the mesh data update. The data related to the mesh data update includes, for example, the updated mesh data, instructions for changing the currently stored mesh data, and a change procedure.

[0154] [Effect of mesh data provision processing] In the mesh data providing process, a common secret key is used (steps S26 to S39) instead of using a secret key specific to each distributed mesh data server 1. This allows the mesh data providing process to update the user information on the distributed mesh data server group (steps S35 to S39), while maintaining the consistency of the user information and protecting the confidentiality of the user information without unnecessarily increasing the processing load and processing time.

[0155] In addition, the mesh data providing process can use a common secret key configured as a one-time common secret key (step S27), which can further reduce the risk of interception of user information while minimizing increases in processing load and processing time.

[0156] Additionally, in the mesh data providing process, the number of accesses to the distributed mesh data server 1, which is part of the user information, can be updated (step S37). As a result, the mesh data providing process realizes a fee billing transaction that appropriately calculates the fee for each user related to the provision of mesh data.

[0157] Furthermore, in the mesh data providing process, the processes for providing mesh data for each user are separated by session, making it possible to protect the privacy of the users (steps S21 to S24, steps S40 to S42).

[0158] Therefore, by executing the mesh data provision process on the distributed mesh data server 1, the distributed mesh data server 1 can appropriately manage user information on the distributed mesh data server group. This provides a system S that enables user authentication access control to mesh data distributedly present on different distributed mesh data servers 1, and also enables recording and updating (metering) user access count information (access count) according to the user's use of mesh data.

[0159] [Flowchart of mesh code conversion process] The process of converting a search request that is not related to a mesh code (for example, a search request related to various information such as information indicating a geographical area exemplified by a place name, a building name, a geometric figure surrounding an area, etc.) into a search request related to a mesh code is not particularly limited and may be the same as that of conventional techniques. Figure 16 is a flowchart showing an example of a preferred flow of the mesh code conversion process. Below, an example of a preferred flow of the mesh code conversion process executed in step S32 of Figure 14 will be described using Figure 16.

[0160] In order to provide various programs with a means of accessing mesh data, it is preferable that the program that performs the mesh code conversion process be provided as part of a library that obtains mesh data corresponding to a world mesh code in response to a search request, i.e., a world mesh code library.

[0161] In the following description, the geographical area related to the search request is also referred to as the "target area." A detailed description of the specific means for determining the intersection between the target area and a mesh will be omitted. The intersection determination is performed starting from the coarsest mesh (e.g., the first mesh of the world mesh). The mesh that is the target of the intersection determination is also referred to as the "conversion target."

[0162] [Step S51: Determine whether there is a mesh that contains the entire target] The data server control unit 11, in cooperation with the data server storage unit 13, performs a process of determining whether the target region intersects with a mesh and whether there is a mesh whose entirety is included in the target region (step S51, fully covered mesh determination step). If it is determined that there is, the data server control unit 11 proceeds to step S52. If it is not determined that there is, the data server control unit 11 proceeds to step S53.

[0163] [Step S52: Add mesh code] The data server control unit 11, in cooperation with the data server storage unit 13, executes a process of adding the mesh codes of the meshes determined to include the whole in the all-covered mesh determination step to the converted mesh code (step S52, all-covered mesh code addition step). The data server control unit 11 then proceeds to step S53.

[0164] [Step S53: Determine whether there is a mesh that contains part of the target] The data server control unit 11, in cooperation with the data server storage unit 13, performs a process of determining whether the target area intersects with a mesh and whether there is a mesh that is partially included in the target area (step S53, partially covered mesh determination step). If it is determined that there is, the data server control unit 11 proceeds to step S54. If it is not determined that there is, the data server control unit 11 ends the mesh code conversion process and returns the process to step S33.

[0165] [Step S54: Determine whether a more detailed mesh exists] The data server control unit 11, in cooperation with the data server storage unit 13, executes a process of determining whether there are any meshes that are finer than the meshes for which intersection determination was performed in the fully covered mesh determination step and the partially covered mesh determination step, as targets for further intersection determination (step S54, granularity change determination step). If it is determined that there are any meshes, the data server control unit 11 proceeds to step S55. If it is not determined that there are any meshes, the data server control unit 11 proceeds to step S56.

[0166] [Step S55: Change to a more detailed mesh] The data server control unit 11 executes a process of changing the conversion target to a finer mesh in cooperation with the data server storage unit 13 (step S55, granularity change step). The data server control unit 11 returns the process to step S51.

[0167] From the viewpoint of load distribution, it is preferable that the granularity change step change the conversion object to a finer mesh, that is, change the conversion object to a finer mesh along a path that evens out the division load when dividing the conversion object for intersection detection. One such path is a path that changes the conversion object to a finer mesh in the following order in the world mesh: first-order mesh, second-order mesh, third-order mesh, fourth-order mesh, fifth-order mesh, expanded 10m mesh, and expanded 1m mesh.

[0168] [Step S56: Add mesh code] The data server control unit 11, in cooperation with the data server storage unit 13, executes a process of adding the mesh code of the mesh determined to be partially included in the partially covered mesh determination step to the converted mesh code (step S56, partially covered mesh code addition step). The data server control unit 11 ends the mesh code conversion process and returns the process to step S33.

[0169] [Mesh code conversion processing effect] When an arbitrary region is given as the target region, it is easy to identify the primary mesh code that includes this region. After identifying the primary mesh code, the mesh code conversion process repeatedly checks the intersection between the arbitrary region and the divided meshes each time the target region is divided into finer meshes. This allows the mesh code conversion process to generate a mesh code that covers the arbitrary region (target region) up to a spatial resolution corresponding to a maximum expanded 1m mesh.

[0170] [Flowchart of user information management processing executed by user information management server 2] 17 is a flowchart showing an example of a preferable flow of the user information management process executed by the user information management server 2 of this embodiment. Hereinafter, an example of a preferable flow of the user information management process executed by the user information management server 2 of this embodiment will be described with reference to FIG.

[0171] [Step S61: Determine whether a user authentication request has been received] The management server control unit 21 executes the user authentication request receiving unit 211 in cooperation with the management server storage unit 22, management server communication unit 23, etc. Then, the management server control unit 21 executes a process of determining whether a user authentication request relating to a user who has requested authentication from the distributed mesh data server 1 from terminal T has been received from the distributed mesh data server 1 using the user authentication API provided by the user authentication request receiving unit 211 (step S61, user authentication request receiving step). If it is determined that the request has been received, the management server control unit 21 proceeds to step S62. If it is not determined that the request has been received, the management server control unit 21 proceeds to step S65.

[0172] [Step S62: Execute user authentication] The management server control unit 21 executes the user authentication execution unit 212 in cooperation with the management server storage unit 22 and the like. Then, the management server control unit 21 executes a process of executing user authentication related to the user authentication request received in the user authentication request receiving step, by using the user authentication execution unit 212, with reference to the user information database 222 (step S62, user authentication execution step). The management server control unit 21 moves the process to step S63. To further improve security, the user authentication execution step preferably includes authentication using a one-time password. In this authentication, the user information management server 2 generates a one-time password at the start of a server session. Then, the user information management server 2 performs user authentication using the one-time password. Then, the user information management server 2 discards the one-time password at the end of the server session. In this way, the user information management server 2 prevents unauthorized access after the end of the server session using the one-time password.

[0173] In order to prevent user information from being sent to a server that is not included in the distributed mesh data server group, the user information management process preferably includes a procedure for determining whether the server that is the sender in the user authentication request receiving step is a distributed mesh data server 1 that is included in the distributed mesh data server group. Step S63 is an example of this procedure.

[0174] [Step S63: Determine whether server authentication was successful] The management server control unit 21, in cooperation with the management server storage unit 22 and the like, executes a process of determining whether server authentication of the distributed mesh data server 1 that is the sender in the user authentication request receiving step has been successful by referencing the authentication information related to the server-specific private key associated with the distributed mesh data server 1 provided by the distributed mesh data server 1 that is the sender in the user authentication request receiving step and the server database 221 (step S63, server authentication step). If it is determined that the authentication has been successful, the management server control unit 21 proceeds to step S64. If it is not determined that the authentication has been successful, the management server control unit 21 proceeds to step S65.

[0175] [Step S64: Send authentication result and user information] The management server control unit 21 executes the user information providing unit 213 in cooperation with the management server storage unit 22 and the like. Then, the management server control unit 21 executes a process in which the user information providing unit 213 transmits the authentication result related to the user authentication execution step and the like and the user information related to the user authenticated in the user authentication execution step to the sender of the user authentication request received in the user authentication request receiving step (step S64, user information providing step). The management server control unit 21 moves the process to step S65. The user information is acquired from the user information database 222 based on the authentication result in the user authentication execution step.

[0176] [Step S65: Determine whether user information has been received] The management server control unit 21 executes the user information receiving unit 214 in cooperation with the management server storage unit 22, management server communication unit 23, etc. Then, the management server control unit 21 executes a process of determining whether the user information has been received from the distributed mesh data server 1 by the user information receiving unit 214 (step S65, user information receiving step). If it is determined that the user information has been received, the management server control unit 21 moves the process to step S66. If it is not determined that the user information has been received, the management server control unit 21 returns the process to step S61 and repeats the processes from step S61 to step S66.

[0177] [Step S66: Store user information] The management server control unit 21 cooperates with the management server storage unit 22 and the like to execute the user information storage execution unit 215. Then, the management server control unit 21 executes processing to store the user information determined to have been received in the user information receiving step in the user information database 222 by the user information storage execution unit 215 (step S66, user information storage execution step). The management server control unit 21 returns the processing to step S61 and repeats the processing from step S61 to step S66.

[0178] [Effects of user information management processing] In the user information management process, user authentication and, if necessary, server authentication are performed, and user information is sent only if authentication is successful (steps S61 to S64). Then, the user information updated by the distributed mesh data server 1, which is the recipient, is stored in the user information database 222 (steps S65 to S66). This protects the confidentiality of the user information, and the updated user information is managed in a unified manner in the user information database 222. Therefore, the user information management server 2 contributes to the appropriate management of user information on the distributed mesh data server group.

[0179] [Flowchart of server authentication process executed by certification authority server 3] 18 is a flowchart showing an example of a preferable flow of server authentication processing executed by the certification authority server 3 of this embodiment. Hereinafter, an example of a preferable flow of server authentication processing executed by the certification authority server 3 of this embodiment will be described with reference to FIG.

[0180] [Step S71: Determine whether a server authentication request has been received] The certificate authority server control unit 31 executes the server authentication request receiving unit 311 in cooperation with the certificate authority server storage unit 32 and the certificate authority server communication unit 33, etc. Then, the certificate authority server control unit 31 executes a process of determining whether a server authentication request related to the distributed mesh data server 1 has been received from any of the distributed mesh data servers 1 using the common secret key API provided by the server authentication request receiving unit 311 (step S71, server authentication request receiving step). If it is determined that a server authentication request related to the distributed mesh data server 1 has been received, the certificate authority server control unit 31 moves the process to step S72. If it is not determined that a server authentication request has been received, the certificate authority server control unit 31 returns the process to step S71.

[0181] The server authentication request determined to have been received in the server authentication request receiving step preferably includes authentication information relating to a server-specific private key associated with the sender distributed mesh data server 1. This allows the certification authority server 3 to perform reliable server authentication using the server-specific private key. Additionally, the server authentication request may include data that can be used to identify the sender distributed mesh data server 1, such as an IP address or MAC address, to be used for server authentication in the server authentication process.

[0182] The common secret key API provided by the server authentication request receiving unit 311 is preferably a one-time common secret key API that has an expiration date and is updated at regular intervals. This allows the certification authority server 3 to prevent information intercepted after the expiration date from being decrypted, even if the one-time common secret key becomes non-secret.

[0183] [Step S72: Execute server authentication] The certificate authority server control unit 31 operates in cooperation with the certificate authority server storage unit 32 and the certificate authority server communication unit 33, etc., to execute the server determination unit 312. Then, the certificate authority server control unit 31 executes a process to execute server authentication for the distributed mesh data server 1 that is the sender of the server authentication request, based on the server authentication request received in the server authentication request reception step, using the server determination unit 312 (step S72, server authentication execution step). The certificate authority server control unit 31 moves the process to step S73.

[0184] The server authentication in the server authentication execution step is not particularly limited as long as it determines, based on the data included in the server authentication request, whether the sending server is one of the distributed mesh data servers 1 belonging to the distributed mesh data server group, i.e., one of the distributed mesh data servers 1 stored in the server database 321. If the server authentication request includes authentication information related to a server-specific private key, the server authentication includes a procedure for verifying the authentication information with a corresponding encryption key (for example, a public key corresponding to the server-specific private key stored in the server database 321).

[0185] [Step S73: Determine whether server authentication was successful] The certificate authority server control unit 31 operates the server determination unit 312 in cooperation with the certificate authority server storage unit 32, the certificate authority server communication unit 33, etc. Then, the certificate authority server control unit 31 executes processing to determine whether the server authentication was successful in the server authentication execution step using the server determination unit 312 (step S73, server determination step). If it is determined to be successful, the certificate authority server control unit 31 moves the processing to step S74. If it is not determined to be successful, the certificate authority server control unit 31 returns the processing to step S71.

[0186] When the common secret key API provided by the server authentication request receiving unit 311 is a one-time common secret key API, the server authentication process preferably includes a series of processes related to updating the one-time common secret key. Steps S74 to S75 are an example of such processes.

[0187] [Step S74: Determine whether the one-time shared secret key needs to be updated] The certificate authority server control unit 31, in cooperation with the certificate authority server storage unit 32 and the like, executes a process of determining whether the one-time common secret key needs to be updated (step S74, one-time common secret key update determination step). If it is determined that it needs to be updated, the certificate authority server control unit 31 proceeds to step S75. If it is not determined that it needs to be updated, the certificate authority server control unit 31 proceeds to step S76.

[0188] The one-time shared private key update determination step includes a procedure for determining that the one-time shared private key needs to be updated when a server authentication request is sent from a source server belonging to a distributed mesh data server group that has not sent a server authentication request since the start of the server session. This allows the certification authority server 3 to provide a different one-time shared private key for each distributed mesh data server group. This prevents, for example, the processing details of other distributed mesh data server groups from being leaked to distributed mesh data server groups managed by different administrators. The determination in the one-time shared private key update determination step includes a procedure for determining that the one-time shared private key needs to be updated when the current time is after the expiration date of the one-time shared private key. The expiration date of the one-time shared private key may or may not match the update frequency of the one-time shared private key. To achieve both reduced frequency of server authentication processing in the certification authority server 3 and security, it is preferable that the expiration date of the one-time shared private key be 60 minutes after the one-time shared private key is acquired. In other words, it is preferable that the one-time shared private key acquired from the certification authority server 3 is cached in the distributed mesh data server 1 for 60 minutes.

[0189] Regarding the one-time shared private key update determination step, the higher the update frequency of the one-time shared private key, the higher the security guaranteed. However, the higher the update frequency of the one-time shared private key, the longer the update process of the one-time shared private key takes. In other words, there is a trade-off between security and calculation speed in the update frequency of the one-time shared private key. Meanwhile, it is considered that demand for map data is closely related to human activity, such as movement. Therefore, it is considered that the frequency of mesh data search requests has a daily periodicity. In order to update the one-time shared private key in accordance with this periodicity, it is preferable that the update frequency of the one-time shared private key in the certification authority server 3 is once a day.

[0190] The update frequency of the one-time shared secret key may vary depending on the importance of the mesh data related to the search request. In this case, for example, for mesh data for which the economic loss due to leakage can be ignored to a certain extent, or for mesh data that is the subject of large-scale data processing, the update frequency of the one-time shared secret key may be set lower than once a day. For example, it may be "every week," which allows update processing to be performed on weekends. In addition, in this case, for critical mesh data for which leakage must be strictly prevented, the update frequency of the one-time shared secret key may be set higher than once a day. For example, it may be updated every hour, or it may be updated according to the amount of mesh data, such as "every time a predetermined number of critical mesh data are searched."

[0191] [Step S75: Update the one-time shared secret key] The certificate authority server control unit 31 executes a process to update the one-time common secret key in cooperation with the certificate authority server storage unit 32 etc. (step S75, one-time common secret key update execution step). The certificate authority server control unit 31 moves the process to step S76.

[0192] The one-time common private key update execution step is realized, for example, by a series of processes that acquire a one-time common private key list from a given one-time common private key list and delete the acquired one-time common private key from the list, and a process that generates a one-time common private key using a randomly generated seed value.

[0193] [Step S76: Provide authentication result and common secret key] The certificate authority server control unit 31 operates the common secret key providing unit 313 in cooperation with the certificate authority server storage unit 32 and the certificate authority server communication unit 33, etc. Then, the certificate authority server control unit 31 executes a process of providing the common secret key and an authentication result indicating successful server authentication to the sender of the server authentication request received in the server authentication request receiving step, by the common secret key providing unit 313 (step S76, common secret key providing step). The certificate authority server control unit 31 returns the process to step S71 and repeats the processes from step S71 to step S76.

[0194] [Effect of server authentication processing] In the server authentication process, the server authentication request receiving unit 311 provides a common secret key API (step S71, etc.). The common secret key API performs server authentication using authentication information related to a server-specific secret key associated with the distributed mesh data server 1 requesting server authentication, and provides the distributed mesh data server 1 with a common secret key used among multiple servers (steps S71 to S76). This makes it possible to appropriately determine whether the server requesting server authentication is a distributed mesh data server 1 belonging to the distributed mesh data server group, and the common secret key is provided only to distributed mesh data servers 1 belonging to the distributed mesh data server group.

[0195] By the above process, even if a server other than the distributed mesh data server 1 is able to intercept user information transmitted using the common secret key, it becomes virtually impossible to read the contents of the information. Therefore, the confidentiality of the user information in the distributed mesh data server 1 is protected.

[0196] Furthermore, the server authentication request receiving unit 311 can provide a one-time common secret key API as the common secret key API. The one-time common secret key API provides a one-time common secret key with a set expiration date that is updated at regular intervals. This allows the distributed mesh data server 1 to use the one-time common secret key. Therefore, the distributed mesh data server 1 can further reduce the risk of interception of user information, etc., while minimizing increases in processing load and processing time.

[0197] <Usage example> The following is an example of how to use the distributed mesh data server 1.

[0198] [Start Session] A user requests authentication from one of the distributed mesh data servers 1 via terminal T. The distributed mesh data server 1 that has received the authentication request makes an authentication request to the user information management server 2. The user information management server 2 performs authentication for the user and returns the authentication result. After successful authentication, the distributed mesh data server 1 starts a session for the user. User information such as the number of accesses and the user-specific API key provided by the user information management server 2 are read into the distributed mesh data server 1.

[0199] [Get the shared secret key] The distributed mesh data server 1 provides an authentication request for the server-specific private key, etc. to the one-time common private key API of the certification authority server 3. The certification authority server 3 performs authentication using the server-specific private key and provides the one-time common private key to the certification authority server 3. The distributed mesh data server 1 acquires the one-time common private key.

[0200] [Get mesh code from current location] The user instructs terminal T to search for mesh data related to the current location. Terminal T acquires location information related to the current location via a GPS function or the like. Terminal T generates a mesh code from the location information related to the current location, etc.

[0201] [Search for mesh data] The terminal T transmits a search request including the generated mesh code to the distributed mesh data server 1. The distributed mesh data server 1 that receives the search request may copy the search request as necessary, encrypt it with a one-time common secret key, and then provide it to other distributed mesh data servers 1. The distributed mesh data server 1 and other distributed mesh data servers 1 that receive the search request acquire mesh data corresponding to the mesh code from the mesh data database 131 and the multimedia database 132.

[0202] At this time, each distributed mesh data server 1 updates the access count in response to the acquisition of mesh data. Then, each distributed mesh data server 1 encrypts the updated access count with a one-time common secret key and shares it. That is, the distributed mesh data server 1 updates the access count while performing server mutual authentication using the one-time common secret key. In addition, other distributed mesh data servers 1 encrypt the acquired mesh data with a one-time common secret key and provide it to the distributed mesh data server 1 that received the search request.

[0203] Then, the distributed mesh data server 1 that receives the search request compiles the mesh data that has been encrypted with a one-time common secret key and provided to the distributed mesh data server 1 from other distributed mesh data servers 1, and transmits it to terminal T.

[0204] [Mesh Data Display] Terminal T receives and displays the mesh data. Terminal T then generates a view of the administrative district corresponding to the current location of terminal T, for example, using multimedia data included in the mesh data. Terminal T can then play back a view of the administrative district, including images, audio, video, and the like.

[0205] [Update user information] Furthermore, upon receiving the search request, the distributed mesh data server 1 instructs the user information management server 2 to store the encrypted, shared, and updated user information such as the number of accesses. The user information management server 2 stores the user information in the user information database 222. The user information management server 2 then performs a billing process, such as deducting the fee for providing the mesh data from the points stored in the user information based on the number of accesses.

[0206] <<Second embodiment>> The following is a description of a second embodiment of the present invention. The second embodiment realizes appropriate management of information, including security and confidentiality, when individual data including personal and confidential information is statistically processed on a distributed mesh data server group similar to that of the first embodiment and provided to an external party as mesh data.

[0207] <Background of the second embodiment> Mesh data is a statistical analysis of individual data, each of which is aggregated into a mesh. Mesh codes are used as a common key to link data across different distributed servers. Individual data contain personal or confidential information. However, when operators of distributed mesh data servers obtain data related to such individual data from individuals, they face psychological resistance. Regarding psychological resistance, data disclosure is irreversible; once data is disclosed, it cannot be restored to a confidential state. In addition, in distributed mesh data servers used by many users, individuals who provide individual data find it difficult to build trusting relationships with those to whom the data will be disclosed, as they are unaware of the parties to whom the data will be disclosed and the limitations on the scope of use of the disclosed data.

[0208] Furthermore, when acquiring individual data from distributed mesh data servers, there is also the issue of incentive matching for providing individual data. Conventional technologies that provide mesh data generated from individual data do not allow for gradual data disclosure, resulting in a binary decision: whether to disclose or not. Furthermore, in such cases, it is impossible to determine the affinity between multiple data sets and the synergistic effects of combining them before disclosing them. Furthermore, because there is no precedent for such a case, it is impossible to build mutual understanding and trust based on precedent, nor to advance mutual understanding regarding the exchange of large amounts of data.

[0209] <Problems with the second embodiment> Given the above background, when handling user information and other information on a distributed mesh data server group, there is a demand for security and confidentiality of the individual data provided for mesh data generation. "Security" here refers to making it difficult to reconstruct the original data from the mesh data provided. "Confidentiality" refers to the control of personal information to protect the freedom and dignity of individuals.

[0210] As described above, the first embodiment of the present invention can protect the confidentiality of user information relating to users who use a distributed mesh data server group without unnecessarily increasing the processing load and processing time. On the other hand, the second embodiment aims to ensure the security and confidentiality of the mesh data itself that is provided in addition to the above.

[0211] <Means for solving the problems in the second embodiment> As a result of intensive research into solving the above-mentioned problems, the inventors have found that the above-mentioned object can be achieved by acquiring a desired level of safety and a designation of a process to be executed to ensure the safety when generating mesh data, and then executing one of two types of processes related to ensuring the safety based on the acquired desired level of safety and the designation of the process. The inventors have then completed the present invention. Specifically, the present invention provides the following.

[0212] A first invention according to a second embodiment of the present invention (hereinafter also simply referred to as "the first invention") provides a distributed mesh data server further comprising: a safety specification acquisition unit that acquires a specification of desired safety and a process to be executed to ensure safety when generating mesh data; a mesh data generation unit that generates hierarchical mesh data; a mesh data integration unit that, when the specification includes a k-anonymity threshold n, integrates mesh data of an order k=n or less related to k-anonymity with neighboring mesh data; a noise addition unit that, when the specification includes a differential privacy criterion, adds noise to individual data of mesh data that does not satisfy the criterion; and a mesh data provision control unit that, when the specification includes an l-diversity threshold m, controls a hierarchical layer of mesh data of an order l=m or less related to l-diversity so that the hierarchical layer is not provided, wherein the safety specification acquisition unit acquires the specification including at least one of the k-anonymity threshold n, the differential privacy criterion, and the l-diversity threshold m.

[0213] Technologies for protecting the anonymity of data include (1) a technology for evaluating the anonymity of data using k-anonymity, (2) a technology for ensuring differential privacy by adding noise, and (3) a technology for evaluating the anonymity of data using l-diversity.

[0214] Regarding (1), if a data set consisting of multiple individual records, each of which has multiple attributes, has a minimum number of individual records with the same combination of attributes of k, the data set is evaluated as satisfying k-anonymity. In other words, since the data set has at least k individual records with the same combination of attributes, it has the anonymity that allows narrowing down the number of relevant individual records using the combination to no more than k.

[0215] In the first invention, a mesh data integration unit integrates mesh data with low anonymity that falls below the k-anonymity threshold n with neighboring mesh data, preventing such mesh data with low anonymity from being provided. This allows the first invention to provide only mesh data that satisfies the k-anonymity specifications, ensuring the safety and confidentiality of the mesh data itself.

[0216] Regarding (2), there is a method for estimating the value of an element in the non-intersecting part of a data set by taking the difference between the statistical values ​​of two data sets that have a common part. For example, for an element x, by taking the difference c=ab between the sum a of the set A≡x+U and the sum b of the set B≡U, the value of x can be estimated from c. Similar estimations can also be realized for other statistical values, such as the mean.

[0217] The first invention adds noise to individual records (such as location information) of mesh data that does not satisfy the criteria for differential privacy and aggregates them, making it difficult to infer the individual records from the differences in mesh data. This makes it possible to ensure the security and confidentiality of the mesh data itself.

[0218] Regarding (3), mesh data that satisfies k-anonymity is vulnerable to homogeneity attacks and background knowledge attacks. A homogeneity attack is an attack that attempts to guess the value of a sensitive attribute (e.g., skill, industry, occupation, age group, etc.) that needs to be kept secret when the value is the same for all k individual records. A background knowledge attack is an attack that exploits the association between one or more quasi-identifier attributes and a sensitive attribute to reduce the set of values ​​that can be used for the sensitive attribute.

[0219] In the first invention, the mesh data provision control unit provides only hierarchies of mesh data with l-diversity, where the sensitive attribute has at least l well-represented values. Therefore, the first invention makes it difficult to narrow down the candidate values ​​of the sensitive attribute to a number less than l. This ensures the security and confidentiality of the mesh data itself.

[0220] In the first invention, the safety specification acquisition unit acquires a specification that includes at least one of the k-anonymity threshold n, the differential privacy criterion, and the l-diversity threshold m, and therefore, processing related to the safety of at least one of (1) and (2) above is executed, and the output of the output mesh data item is suppressed by the evaluation of (3), thereby ensuring the safety and confidentiality of the mesh data itself.

[0221] As described above, the first invention not only protects the confidentiality of user information relating to users who use a distributed mesh data server group, but also ensures the security and confidentiality of the mesh data itself that is provided, without unnecessarily increasing the processing load and processing time.

[0222] The second invention relating to the second embodiment of the present invention (hereinafter also simply referred to as the "second invention") provides a distributed mesh data server further comprising a first API unit that provides a mesh data generation program that generates mesh data from individual records.

[0223] When mesh data is generated from individual records in a distributed mesh data server group, the provider of the individual record faces difficulty in verifying the security and confidentiality of the mesh data before providing it. The second invention provides a mesh data generation program via the first API unit, enabling the provider of the individual record to generate mesh data on a secret computer or the like different from the distributed mesh data server group and to verify the security and confidentiality of the mesh data.

[0224] As described above, the second invention not only protects the confidentiality of user information relating to users who use a distributed mesh data server group, but also ensures the safety and confidentiality of the mesh data itself that is provided, without unnecessarily increasing the processing load and processing time.

[0225] The third invention relating to the second embodiment of the present invention (hereinafter also simply referred to as the "third invention") provides a distributed mesh data server which further includes a second API unit which acquires information relating to the generation of mesh data as confidential information and provides an indicator relating to the relationship with the mesh data under its management.

[0226] There is a demand for determining the benefits of using the distributed mesh data server group that constitutes the MeshStats platform for analytical purposes before releasing the data. The third invention obtains information related to the generation of mesh data, such as target variables and provided data, as private information, and provides indicators related to relationships such as correlation coefficients with other mesh data and spatiotemporal distances between sparse data, thereby providing information for determining the above-mentioned benefits before releasing the data. This allows users to understand relationships such as correlation coefficients with other mesh data that are linked and useful on the platform, and spatiotemporal distances between sparse data, and confirm the above-mentioned benefits before deciding whether to upload the data to a production environment and perform analysis.

[0227] As described above, the third invention not only protects the confidentiality of user information relating to users who use a distributed mesh data server group, but also ensures the safety and confidentiality of the mesh data itself that is provided, without unnecessarily increasing the processing load and processing time.

[0228] The fourth invention relating to the second embodiment of the present invention (hereinafter also simply referred to as the "fourth invention") provides a distributed mesh data server further comprising a mutual use condition setting unit that acquires conditions related to targets for mutual data use and exchange, and sets other users who satisfy the conditions as targets for mutual data use and exchange.

[0229] When using a distributed mesh data server as a mesh data infrastructure, there is a demand for mutual data use and exchange on the infrastructure based on desired conditions among parties that meet the desired requirements. The fourth invention enables mutual data use and exchange among multiple users who meet similar conditions by obtaining conditions related to the targets of mutual data use and exchange (for example, trust negotiation and incentive matching conditions exemplified by data disclosure conditions, counter-partner conditions, conditions related to the purpose of use, conditions related to the disclosure level, conditions related to costs, conditions related to the possibility of mutual information provision, conditions related to data holders, and transfer conditions).

[0230] As described above, the fourth invention not only protects the confidentiality of user information relating to users who use a distributed mesh data server group, but also ensures the safety and confidentiality of the mesh data itself that is provided, without unnecessarily increasing the processing load and processing time.

[0231] <System S of the Second Embodiment> FIG. 19 is a block diagram showing the hardware and software configurations of a system S according to the second embodiment. The following describes the system S according to the second embodiment (hereinafter also simply referred to as "system S") using FIG. 19. In the following description, when referring to hardware components, software components, process names, etc. according to the second embodiment, phrases such as "according to the second embodiment" may be omitted. On the other hand, when referring to hardware components, software components, process names, etc. according to the first embodiment, phrases such as "according to the first embodiment" are not omitted. Furthermore, in the following description, as a general rule, descriptions of hardware components, software components, process names, etc. that are the same as those in the first embodiment will be omitted.

[0232] The system S according to the second embodiment generates mesh data with guaranteed security and confidentiality. The hardware configuration of the system S may be the same as that of the system S according to the first embodiment. The device for generating mesh data according to the second embodiment is not limited to the distributed mesh data server 1 according to the second embodiment, but may be a separately configured computer. The following is a description of the system S that generates mesh data in the distributed mesh data server 1 according to the second embodiment, but a person skilled in the art will be able to easily conceive of a configuration for generating mesh data using a separately configured computer from this description.

[0233] [Distributed Mesh Data Server 1] The hardware configuration of the distributed mesh data server 1 of the second embodiment may be the same as that of the distributed mesh data server 1 of the first embodiment. The distributed mesh data server 1 of the second embodiment differs from the distributed mesh data server 1 of the first embodiment in that the data server control unit 11 and the like perform further processing to ensure safety and confidentiality in the software components involved in generating mesh data.

[0234] [Data Server Control Unit 11] The data server control unit 11 cooperates with the data server storage unit 13 and / or the data server communication unit 14 as necessary. The data server control unit 11 further realizes the following software components in addition to the software components of the program of this embodiment executed by the distributed mesh data server 1 of the first embodiment. The software components further realized in the second embodiment include a mesh data generation unit 123, a safety specification acquisition unit 124, a mesh data integration unit 125, a noise addition unit 126, a mesh data provision control unit 127, an API unit 128, and a mutual use condition setting unit 129. The functions provided by each of these software components will be described later in the description of a preferred flow of the mesh data generation process.

[0235] [Data Server Storage Unit 13] The hardware configuration of the data server storage unit 13 may be the same as that of the data server storage unit 13 of the first embodiment. The data server storage unit 13 can store a mesh data conversion program provided to an external device by an API unit 128 (described later), in addition to the program of the second embodiment executed by the microcomputer and various data similar to those stored in the data server storage unit 13 of the first embodiment.

[0236] [Terminal T] In addition to the various data stored in the terminal T of the first embodiment, the terminal T of the second embodiment stores a mesh data conversion program provided by an API unit 128 (described later), individual data that are statistically processed as mesh data, mesh data generated from the individual data by the mesh data conversion program, etc. The software components and processing flow of the mesh data conversion program are the same as those related to the mesh data generation processing.

[0237] [Flowchart of mesh data generation process] Fig. 20 is a flowchart showing an example of a preferred flow of mesh data generation processing. Fig. 21 is a flowchart continuing from the previous figure. Fig. 22 is a flowchart continuing from the previous figure. Fig. 23 is a flowchart continuing from the previous figure. Fig. 24 is a flowchart continuing from the previous figure. Fig. 25 is a flowchart continuing from the previous figure. Fig. 26 is a flowchart continuing from the previous figure. The following describes an example of a preferred flow of mesh data generation processing executed by the distributed mesh data server 1 etc. in the second embodiment, using Figs. 20 to 26.

[0238] The mesh data generation process executes a series of steps related to the generation of mesh data, steps S101 to S103 being an example of this process.

[0239] [Step S101: Determine whether to generate mesh data] The data server control unit 11 executes the mesh data generation unit 123 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether to generate mesh data by the mesh data generation unit 123 (mesh data generation determination step). If it is determined that mesh data should be generated, the data server control unit 11 shifts the process to step S102. If it is not determined that mesh data should be generated, the data server control unit 11 shifts the process to step S118.

[0240] The mesh data generation determination step includes a procedure for determining that mesh data should be generated when, for example, a user of terminal T issues an instruction via an input unit to start generating mesh data.

[0241] [Step S102: Obtain individual ballots] The data server control unit 11 executes a process of acquiring individual records related to the generation of mesh data by the mesh data generation unit 123 (individual record acquisition step). The data server control unit 11 moves the process to step S103. The "individual record" here refers to individual data used to generate mesh data.

[0242] The individual record acquisition step acquires individual records, for example, by a procedure for acquiring individual records transmitted by terminal T, or a procedure for acquiring individual records from a source identified by information transmitted by terminal T (for example, a database server connected to network N).

[0243] [Step S103: Generate mesh data] The data server control unit 11 executes a process of generating mesh data based on the individual records acquired in the individual record acquisition step (mesh data generation step) using the mesh data generation unit 123. The data server control unit 11 moves the process to step S104.

[0244] The mesh data generation process preferably includes a series of processes for ensuring the security of the mesh data based on specifications regarding the security of the mesh data to be generated. "Security" here refers to a low risk of leakage of personal and confidential information contained in the individual records used to generate the mesh data. Steps S104 to S116 are an example of such processes.

[0245] [Step S104: Determine whether to acquire a safety-related designation] The data server control unit 11 executes the safety designation acquisition unit 124 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether to acquire a designation related to the safety of the mesh data by the safety designation acquisition unit 124 (safety designation acquisition determination step). If it is determined that the designation should be acquired, the data server control unit 11 moves the process to step S105. If it is not determined that the designation should be acquired, the data server control unit 11 moves the process to step S117.

[0246] The safety designation acquisition determination step includes a procedure for determining whether to acquire a safety designation when, for example, a user of terminal T instructs the user to make a safety designation by inputting the instruction via an input unit.

[0247] [Step S105: Obtain safety-related designation] The data server control unit 11 executes a process of acquiring a safety-related designation by the safety designation acquisition unit 124 (safety designation acquisition step). The data server control unit 11 moves the process to step S106. The "safety-related designation" here includes at least one of the k-anonymity threshold n, the differential privacy criterion, or the l-diversity threshold m. The safety designation acquisition step acquires a safety-related designation, for example, by a procedure for acquiring a safety-related designation transmitted by terminal T.

[0248] Since l-diversity is an extension of k-anonymity, it is preferable that the threshold m for l-diversity is specified together with the threshold n for k-anonymity in specifying security.

[0249] The generation process preferably includes a series of processes that ensure that the mesh data satisfies the k-anonymity threshold n. This ensures that anyone attempting to learn the privacy of individuals related to individual records from the mesh data can narrow down the individuals to a group of n people only. This protects the privacy of the individual records. Steps S106 to S109 are an example of this process.

[0250] [Step S106: Determine whether k-anonymity threshold n is included] The data server control unit 11 executes the mesh data integration unit 125 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process in which the mesh data integration unit 125 determines whether the safety-related designation acquired in the safety designation acquisition step includes the k-anonymity threshold n (k-anonymity determination step). If it is determined that it does, the data server control unit 11 proceeds to step S107. If it is not determined that it does, the data server control unit 11 proceeds to step S110.

[0251] [Step S107: Calculate k related to k-anonymity] The data server control unit 11 executes a process of calculating k relating to k-anonymity for the mesh data generated in the mesh data generation step by the mesh data integration unit 125 (k-anonymity calculation step). The data server control unit 11 moves the process to step S108.

[0252] "k-anonymity" as used herein refers to a state in which an individual in a dataset cannot be distinguished from at least (k-1) other individuals. The k involved in k-anonymity can be calculated using a conventionally known method. "k-anonymity" will be explained below using an example.

[0253] For example, suppose there is the following data set relating to four individuals A to D: A (23 years old, female, secret 1), B (25 years old, female, secret 2), C (31 years old, male, secret 3), and D (33 years old, male, secret 4). Here, age and gender, which are pieces of information that can be used to identify an individual when combined, are called "quasi-identifiers." Furthermore, secrets 1 to 4, which are pieces of information that one does not want others to know, are called "sensitive attributes." In this case, if a person who wants to know the secret knows the target's age and gender, they can identify from this data set which of secrets 1 to 4 the target's secret is.

[0254] Now, let's assume that the "age" of this dataset is aggregated as follows: A (20s, female, secret 1), B (20s, female, secret 2), C (30s, male, secret 3), and D (30s, male, secret 4). In this case, even if a person who wants to know the secret knows that the target's age is "23" and gender is "female," there are two individuals who fall into the "20s, female" category, so the person who wants to know the secret cannot distinguish between the target individual and another individual from the dataset. As a result, even by looking at this dataset, the person who wants to know the secret cannot determine whether the target's secret is secret 1 or secret 2. The same is true for "30s, male." Therefore, such a dataset is said to have "2-anonymity." This protects the privacy of each individual whose individual records were used to generate the mesh data.

[0255] [Step S108: Determine whether data below k=n is included] The data server control unit 11 executes a process in which the mesh data integration unit 125 determines whether data equal to or less than k=n is included in the mesh data generated in the mesh data generation step, for k calculated in the k-anonymity calculation step (k-anonymity designation determination step). If it is determined that data is included, the data server control unit 11 proceeds to step S109. If it is not determined that data is included, the data server control unit 11 proceeds to step S110.

[0256] [Step S109: Integrate with neighboring mesh data] The data server control unit 11 executes a process in which the mesh data integration unit 125 integrates the data determined to be "included" in the k-anonymity designation determination step with the neighboring mesh data (mesh data integration step). The data server control unit 11 moves the process to step S107.

[0257] The series of processes for ensuring that mesh data meets the requirements for k-anonymity preferably includes a procedure for ensuring that the data does not contain unstructured zeros. This procedure is realized, for example, by a series of procedures for detecting unstructured zeros and integrating data in which unstructured zeros are detected with neighboring mesh data. Note that "unstructured zeros" here refer to combinations that could be included in a dataset but are not included in the dataset. Below, a privacy attack using "unstructured zeros" is explained using an example.

[0258] For example, suppose we have the following dataset for four individuals A to D: A (20s, female, passed), B (20s, female, failed), C (20s, male, failed), and D (20s, male, failed). This dataset satisfies 2-anonymity because it contains at least two individuals in both the "20s, female" and "20s, male" categories.

[0259] However, if someone who wants to know the secret of whether the subject passed or failed knows that the subject is male and in his / her 20s, they can find out that the subject failed from the number of successful applicants by age and gender generated from this dataset. This is because the number of successful applicants includes a non-structural zero, where the number of successful applicants for "male in his / her 20s" is "0".

[0260] If we combine "female" and "male" here, we get the following dataset: A (20s, passed), B (20s, failed), C (20s, failed), D (20s, failed). This dataset does not contain unstructured zeros. Because the number of successful applicants in their 20s generated from this dataset is "1," it is not possible to determine whether an individual passed or failed for any of the individuals AD. Therefore, even if someone tries to learn the secret, they cannot determine whether the subject passed or failed from this dataset, even if they know the age and gender. Therefore, the privacy of each individual whose individual records were used to generate the mesh data is protected.

[0261] The generation process preferably includes a series of processes that ensure that the mesh data meets the criteria for differential privacy. This prevents anyone attempting to learn the privacy of an individual related to an individual record from identifying that individual's information based on the differences between multiple mesh data sets. This protects the privacy of the individual record. Steps S110 to S112 are an example of this process.

[0262] [Step S110: Determine whether the criteria for differential privacy are included] The data server control unit 11 executes the noise adding unit 126 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process in which the noise adding unit 126 determines whether the safety designation acquired in the safety designation acquisition step includes the criteria for differential privacy (differential privacy determination step). If it is determined that the designation includes the criteria, the data server control unit 11 proceeds to step S111. If it is not determined that the designation includes the criteria, the data server control unit 11 proceeds to step S113.

[0263] The criterion for differential privacy is given by, for example, ε and δ in (ε, δ)-differential privacy. (ε, δ)-differential privacy is defined as follows: Given a region N that has been noisy by a noise-adding algorithm M, |X| When a dataset S satisfies (ε,δ)-differential privacy, all x, y∈N satisfying ||xy||1≦1.|X| satisfies the equation "Pr[M(x)∈S]≦exp(ε)Pr[M(y)∈S]+δ".

[0264] [Step S111: Add noise] The data server control unit 11 executes a process of adding noise to the individual data by the noise adding unit 126 so that the individual data satisfies the indicators determined to be included in the differential privacy determination step (noise adding step). Next, the mesh data generation unit 123 executes a process of generating mesh statistics (mesh statistics generation step). The data server control unit 11 moves the process to step S112. The noise adding procedure in the noise adding step may be, for example, a procedure using a conventionally known noise adding algorithm related to (ε, δ)-differential privacy.

[0265] [Step S112: Determine whether there is mesh data that does not meet the criteria] The data server control unit 11 executes a process of determining whether or not there is mesh data that does not satisfy the above-mentioned criteria among the mesh data to which noise has been added in the noise adding step by the noise adding unit 126 (differential privacy criteria determination step). If it is determined that there is, the data server control unit 11 proceeds to step S111. If it is not determined that there is, the data server control unit 11 proceeds to step S113.

[0266] If the generation process includes a series of processes for ensuring that the mesh data meets the k-anonymity threshold n, it is preferable that the generation process also includes a series of processes for ensuring that the mesh data meets the l-diversity threshold m. This makes it difficult for someone attempting to learn the privacy of an individual related to an individual record to use sensitive attributes to identify an individual from a group of individuals whose attributes other than the sensitive attributes are homogeneous. This protects the privacy of the individual record. Steps S113 to S116 are an example of this process.

[0267] [Step S113: Determine whether l-diversity threshold m is included] The data server control unit 11 executes the mesh data provision control unit 127 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether the safety-related designation acquired in the safety designation acquisition step includes the l-diversity threshold m by the mesh data provision control unit 127 (l-diversity determination step). If it is determined that it includes the l-diversity threshold m, the data server control unit 11 proceeds to step S114. If it is not determined that it includes the l-diversity threshold m, the data server control unit 11 proceeds to step S117.

[0268] [Step S114: Calculate l related to l-diversity] The data server control unit 11 executes a process of calculating l relating to l-diversity for the mesh data generated in the mesh data generation step by the mesh data provision control unit 127 (l-diversity calculation step). The data server control unit 11 moves the process to step S115.

[0269] "l-diversity" here refers to a state in which there are at least l other types of sensitive attributes corresponding to homogeneous groups in a dataset. Calculation of l relating to l-diversity may be performed using a conventionally known method. "l-diversity" will be explained below using an example.

[0270] For example, suppose there is the following data set for six individuals A to F: A (20s, female, stomach ulcer), B (20s, female, heart disease), C (30s, male, malignant neoplasm), D (30s, male, malignant neoplasm), E (20s, male, heart disease), and F (20s, male, heart disease). Here, the sensitive attribute is the name of the disease. This data set is divided into two groups: two individuals (20s, female), two individuals (30s, male), and two individuals (20s, male), so it has 2-anonymity. However, the sensitive attribute for the two individuals (30s, male) is only one type: "malignant neoplasm." Therefore, someone who wants to know the secret can narrow down the list to one of the two individuals (30s, male) who has "malignant neoplasm." The same is true for the individuals (20s, male).

[0271] Let's assume that the "age" of this dataset can be integrated into the following hierarchy: A (20s-30s, female, stomach ulcer), B (20s-30s, female, heart disease), C (20s-30s, male, malignant neoplasm), D (20s-30s, male, malignant neoplasm), E (20s-30s, male, heart disease), F (20s-30s, male, heart disease). Even if someone who wants to know the secret knows that the subject has "malignant neoplasm," they can only narrow down the subject to four people (20s-30s, male). Therefore, such a dataset is said to have "2-diversity." This protects the privacy of each individual whose individual records were used to generate the mesh data.

[0272] [Step S115: Determine whether hierarchical levels below l=m are included] The data server control unit 11 executes a process in which the mesh data provision control unit 127 determines whether the hierarchical levels l=m or lower are included for the hierarchical level l calculated in the hierarchical level l-diversity calculation step, which is related to the mesh data generated in the mesh data generation step (i.e., an hierarchical level l-diversity designation determination step). If it is determined that the hierarchical levels l=m or lower are included, the data server control unit 11 proceeds to step S116. If it is not determined that the hierarchical levels l=m or lower are included, the data server control unit 11 proceeds to step S117.

[0273] [Step S116: Control so that the relevant layer is not provided] The data server control unit 11 executes a control process in which the mesh data provision control unit 127 controls the provision of a layer determined to be included in the l-diversity designation determination step among layers related to the mesh data generated in the mesh data generation step so that the layer is not provided (mesh data provision control step). The data server control unit 11 moves the process to step S114.

[0274] An example of control in the mesh data provision control step will be described using the above example. In the above example, the 20's and 30's hierarchies do not satisfy the l-diversity threshold "2". Therefore, the mesh data provision control unit 127 controls so that the 20's and 30's hierarchies are not provided, and only a higher integrated hierarchical level, for example, a hierarchical level combining the 20's and 30's, is provided. In this way, the mesh data provision control step protects the privacy of each individual associated with the individual records used to generate the mesh data.

[0275] [Step S117: Provide mesh data] The data server control unit 11 executes a process of providing the mesh data generated in the mesh data generation step (mesh data provision step) by the mesh data provision control unit 127. The data server control unit 11 moves the process to step S118.

[0276] When each of the above-mentioned privacy protection processes is performed, the mesh data providing step performs privacy protection according to each process, thereby protecting the privacy of each individual whose individual record is used to generate the mesh data.

[0277] The mesh data generation process preferably includes a series of processes for providing a mesh data generation program via an API. This allows users to generate mesh data in their own environment and verify its security without uploading individual data to an external mesh data server group. Steps S118 to S119 are an example of this process.

[0278] [Step S118: Determine whether to provide the program] The data server control unit 11 executes the API unit 128 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes processing to determine whether to provide a mesh data generation program that generates mesh data from an individual form using the API unit 128 (program provision determination step). If it is determined that the program should be provided, the data server control unit 11 moves the processing to step S119. If it is not determined that the program should be provided, the data server control unit 11 moves the processing to step S120.

[0279] The program provision determination step includes a procedure of determining that the program should be provided when, for example, a user of terminal T issues an instruction to provide the program via an input unit.

[0280] [Step S119: Provide mesh data generation program] The data server control unit 11 executes a process of providing a mesh data generation program that generates mesh data from the individual records (program providing step) using the API unit 128. The data server control unit 11 moves the process to step S120.

[0281] The mesh data generation program is a program that causes a computer to execute at least a portion of the mesh data generation process described above. This portion includes at least an individual data acquisition step and a mesh data generation step. Preferably, this portion also includes a series of processes that ensure the security of the mesh data based on a specification related to the security of the mesh data to be generated. This series of processes preferably includes at least one of a series of processes that ensures that the mesh data satisfies a threshold n for k-anonymity, a series of processes that ensures that the mesh data satisfies a standard for differential privacy, or a series of processes that ensures that the mesh data satisfies a threshold m for l-diversity.

[0282] The mesh data generation process preferably includes a series of steps that acquires private information related to the generation of mesh data and provides indicators of relationships with managed mesh data. These indicators include correlation coefficients with other mesh data with linkage utility on the platform, spatiotemporal distances between sparse data, and other examples of relationships. This allows users to confirm the benefits of using the MeshStats platform for analytical purposes based on the indicators before providing mesh data. Based on this confirmation, users can then decide whether to upload the data to a production environment where the mesh data will be made public and proceed with analysis. Steps S120 through S123 are an example of this process.

[0283] [Step S120: Determine whether to provide an index] The data server control unit 11 executes the API unit 128 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether to provide an index relating to the relationship between information relating to the generation of mesh data and the mesh data under its management by the API unit 128 (index provision determination step). If it is determined that the information should be provided, the data server control unit 11 proceeds to step S121. If it is not determined that the information should be provided, the data server control unit 11 proceeds to step S124.

[0284] The index provision determination step includes a procedure for determining whether to provide the index when, for example, a user of terminal T instructs the user to provide the index by input via an input unit.

[0285] [Step S121: Obtain information related to mesh data generation] The data server control unit 11 executes a process of acquiring information related to the generation of mesh data through the API unit 128 (generation information acquisition step) The data server control unit 11 moves the process to step S122.

[0286] [Step S122: Control to keep confidential] The data server control unit 11 executes a process of controlling the API unit 128 to make the information acquired in the generation information acquisition step private (privacy control step). The data server control unit 11 moves the process to step S123. This control is realized, for example, by a procedure of storing the information in a private area of ​​the data server storage unit 13, a procedure of attaching an attribute to the information as private information, etc.

[0287] [Step S123: Provide index] The data server control unit 11 executes a process (index providing step) in which the API unit 128 provides an index relating to the relationship between the information acquired in the generation information acquisition step and the mesh data under the management of the distributed mesh data server 1. The data server control unit 11 moves the process to step S124.

[0288] The indices include indices relating to relationships exemplified by, for example, correlation coefficients with other mesh data that are linked and useful on the platform, spatiotemporal distances between sparse data, etc. The index providing step calculates at least one of these indices relating to relationships and provides it to the user.

[0289] It is preferable that the mesh data generation process includes a series of processes for obtaining conditions related to the targets for mutual data use and exchange, and setting other users who meet those conditions as targets for mutual data use and exchange.

[0290] If there are no restrictions on the parties with whom data is used or exchanged, there is a concern that data use or exchange may become unfair. For example, data from a user who charges low fees for the use of their own data may be used by a party who charges high fees for the use of their data.

[0291] This series of processes allows users to pre-set trust negotiation or incentive matching conditions, such as the conditions under which they will disclose their data, the conditions for available counterparts, the conditions for the purpose of use, the conditions for the level of disclosure, the presence or absence of costs and pricing conditions, the conditions for the possibility of mutual information provision (exchange), the data owner, and transfer conditions. Based on these conditions, users can then mutually use and exchange data on the platform with parties that meet their desires, under the desired conditions, without having to use and exchange data with all parties. Steps S124 to S127 are an example of this process.

[0292] [Step S124: Determine whether to register conditions] The data server control unit 11 executes the mutual use condition setting unit 129 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes processing to determine whether or not to register conditions related to targets for mutual data use and exchange using the mutual use condition setting unit 129 (condition registration determination step). If it is determined that registration should be performed, the data server control unit 11 moves the processing to step S125. If it is determined that registration should not be performed, the data server control unit 11 returns the processing to step S101 and repeats the processing from step S101 to step S127.

[0293] The condition registration determination step includes a procedure for determining whether to register the condition when, for example, a user of terminal T gives an instruction to register the condition by input via an input unit.

[0294] [Step S125: Obtain conditions related to mutual data use and exchange] The data server control unit 11 executes a process of acquiring conditions related to the targets of mutual data use and exchange by the mutual use condition setting unit 129 (condition acquisition step). The data server control unit 11 moves the process to step S126. The condition acquisition step includes a procedure of storing the acquired conditions in the data server storage unit 13.

[0295] (About the conditions) The conditions related to the condition acquisition step are not particularly limited as long as they are conditions for trust negotiation or incentive matching related to the mutual use of mesh data. Such conditions include, for example, the conditions under which one's own data will be made public, conditions for available counterparts, conditions related to the purpose of use, conditions for the disclosure level, whether or not costs will be incurred and price conditions, conditions for the possibility of mutual information provision (exchange), data holders, transfer conditions, etc.

[0296] [Step S126: Identify other users who meet the conditions] The data server control unit 11 executes a process of identifying other users who satisfy the conditions acquired in the condition acquisition step (user identification step) using the mutual use condition setting unit 129. The data server control unit 11 moves the process to step S127.

[0297] The user identification step includes, for example, a procedure for identifying other users who share common ground with one or more conditions related to the trust negotiation or incentive matching described above. For example, for a user who has registered a mutual information provision (exchange) possibility condition of "mutually usable," a use purpose of "academic use," and a cost condition to be paid to the other party of "less than △△△△ yen per data file," this procedure identifies another user who has registered a mutual information provision (exchange) possibility condition of "mutually usable," a use condition of "academic use only," and a cost condition for provision of "△△△△ yen per data file" as another user with common ground.

[0298] [Step S127: Setting as a target for mutual data use and exchange] The data server control unit 11 executes a process of setting the other user identified in the user identification step as a target for mutual data use and exchange (mutual use setting step) by the mutual use condition setting unit 129. The data server control unit 11 returns the process to step S101 and repeats the processes from step S101 to step S127.

[0299] [Mesh data generation process effect] In the mesh data generation process, the mesh data generation unit 123 acquires an individual record and generates mesh data (steps S101 to S103), thereby allowing the user to use the mesh data generated from the individual record.

[0300] In the mesh data generation process, the safety specification acquisition unit 124 acquires the desired safety when generating mesh data and the specification of the process to be executed to ensure the safety (steps S104 to S105). This allows the distributed mesh data server 1 to perform the process based on the specification and provide only mesh data that satisfies the specified safety.

[0301] In the mesh data generation process, the mesh data integration unit 125 integrates mesh data with low anonymity below the k-anonymity threshold n with neighboring mesh data, preventing such mesh data with low anonymity from being provided (steps S106 to S109). This allows the distributed mesh data server 1 to provide only mesh data that satisfies the k-anonymity specifications, ensuring the safety and confidentiality of the mesh data itself.

[0302] In the mesh data generation process, the noise adding unit 126 adds noise to the mesh data so that the mesh data satisfies the standard of differential privacy (steps S110 to S112). As a result, the distributed mesh data server 1 provides only mesh data to which noise has been added so that personal information cannot be identified from the differences between multiple mesh data, thereby ensuring the safety and confidentiality of the mesh data itself.

[0303] In the mesh data generation process, the mesh data provision control unit 127 integrates mesh data with low anonymity below the k-anonymity threshold n with neighboring mesh data, and in addition to processing to prevent such mesh data with low anonymity from being provided, controls to provide only hierarchies that satisfy the l-diversity threshold m (steps S113 to S116). In this way, the distributed mesh data server 1 makes it difficult for someone who tries to learn the privacy of an individual related to an individual record to use sensitive attributes to identify an individual from a group of people with the same attributes other than the sensitive attributes, thereby ensuring the safety and confidentiality of the mesh data itself.

[0304] Therefore, the mesh data generation process not only protects the confidentiality of user information related to users who use the distributed mesh data server group, but also increases the anonymity of individual records in the provided mesh data itself, ensuring safety and confidentiality, without unnecessarily increasing the processing load and processing time.

[0305] In the mesh data generation process, the API unit 128 provides the mesh data generation program via the API (steps S118 to S119). This allows the distributed mesh data server 1 to generate mesh data in a local environment without uploading individual data to an external mesh data server group, thereby supporting the user in verifying the security of the generated mesh data.

[0306] In the mesh data generation process, the API unit 128 acquires information related to the generation of mesh data as private information and provides an index related to the relationship with the mesh data under its management (steps S120 to S123). This allows the distributed mesh data server 1 to confirm the benefits of using the MeshStats platform for analysis purposes based on the index before the user provides the mesh data. Based on this confirmation, the distributed mesh data server 1 can help the user decide whether to upload the data to a production environment where the mesh data will be made public and proceed with the analysis work.

[0307] In the mesh data generation process, the mutual use condition setting unit 129 acquires conditions relating to targets for mutual data use and exchange, and sets other users who satisfy the conditions as targets for mutual data use and exchange (steps S124 to S127). In this way, the distributed mesh data server 1 can support mutual data use and exchange on the platform between parties that match the user's desires, based on the conditions set by the user himself, without the user having to use and exchange data with all parties.

[0308] Therefore, the mesh data generation process not only protects the confidentiality of user information related to users who use the distributed mesh data server group, but also ensures safety and confidentiality in the mesh data provision process, without unnecessarily increasing the processing load and processing time.

[0309] <Example of use of the distributed mesh data server 1 of the second embodiment> The following is an example of how the distributed mesh data server 1 of the second embodiment is used.

[0310] [Designation to ensure safety] A user who generates and provides mesh data specifies the safety of the mesh data generation and the processing to be executed to ensure the safety via terminal T. The distributed mesh data server 1 receives information related to the specification from terminal T.

[0311] [K-anonymity processing] If the above specification includes a k-anonymity threshold n, the distributed mesh data server 1 generates mesh data to satisfy the threshold n, for example by integrating mesh data with low anonymity that falls below the k-anonymity threshold n with nearby mesh data and preventing such mesh data with low anonymity from being provided.

[0312] [Differential privacy processing] If the above specification includes a standard for differential privacy, the distributed mesh data server 1 generates mesh data to satisfy the standard by adding noise, etc. Note that this processing may be performed on mesh data that has been processed for k-anonymity, or on mesh data that has not been processed for k-anonymity.

[0313] [l-Diversity Processing] If the above specification includes an l-diversity threshold m, the distributed mesh data server 1 controls the provision of mesh data so that only layers that satisfy the l-diversity threshold m are provided. Note that this process may be performed on mesh data that has undergone one or more of the above-mentioned various processes, or on mesh data that has not undergone any of the above-mentioned various processes.

[0314] [Provision of generated mesh data] The user issues a command to start providing the generated mesh data via the terminal T. The distributed mesh data server 1 starts providing the generated mesh data based on the command.

[0315] [Search and display mesh data] The user searches for and displays mesh data using the same procedure as in the example of use of the first embodiment.

[0316] [Start Session] The user starts a session by performing authentication using the same procedure as in the use example of the first embodiment. The distributed mesh data server 1 obtains a common secret key from the certificate authority server 3 and executes processing while protecting the user's privacy. Specifically, the distributed mesh data server 1 encrypts user information to prevent personal information such as mesh data usage from leaking to the outside. The distributed mesh data server 1 also achieves further privacy protection by using a one-time common secret key that is updated within a certain period of time as needed. The user searches for mesh data while their privacy is protected, and the search results are displayed on a terminal T or the like.

[0317] [END OF SESSION] At the end of a session, the distributed mesh data server 1 commands the storage of user information. This user information includes data related to usage, such as the number of times the mesh data has been accessed. The system S then bills the user for system usage fees based on the stored user information.

[0318] [Mesh data generation and provision variations] Users can use a variety of methods to generate and provide mesh data based on individual records and personal data while ensuring their security.

[0319] [Variation 1: Generate mesh data locally using a conversion API] The user issues a command via terminal T to provide a mesh data generation program via API (conversion API). The distributed mesh data server 1 provides the mesh data generation program via API. The user runs the program in their local environment to generate mesh data from individual records.

[0320] [Variation 2: Obtaining indicators related to relationships with other mesh data] A user provides information related to the generation of mesh data as confidential information via terminal T, and commands the provision of relationships between the information and indicators related to the relationships between the information and other mesh data. The distributed mesh data server 1 acquires information related to the generation of mesh data as confidential information, and provides relationships between the information and indicators related to the relationships between the information and other mesh data. The user references the relationships and confirms the benefits of providing the mesh data. The user then commands the start of provision of mesh data that the user determines will be beneficial.

[0321] [Variation 3: Set conditions for mutual data use and exchange] The user sets the conditions for mutual data use and exchange via terminal T and issues a command to start providing the generated mesh data. Based on the command, the distributed mesh data server 1 starts providing the mesh data so that data can be mutually used and exchanged with parties that meet the above conditions.

[0322] It should be noted that within the scope of the concept of the present invention, those skilled in the art may conceive of various modifications and alterations. Therefore, it is understood that such modifications and alterations fall within the scope of the present invention. For example, even if a person skilled in the art appropriately adds, deletes, or modifies components of the above-described embodiment, or adds, omits, or modifies the conditions of a process, such modifications are also included within the scope of the present invention as long as they maintain the gist of the present invention. [Explanation of symbols]

[0323] S System 1. Distributed mesh data server 11 Data Server Control Unit 111 User authentication request receiving unit 112 User authentication section 113 Session Start 114 Common secret key acquisition unit 115 Encrypted information acquisition unit 116 Decoding unit 117 Mesh code receiver 118 Mesh Data Provider 119 User Information Update Section 120 Encryption section 121 Encryption Information Providing Department 122 Session End 123 Mesh data generation unit 124 Safety Designation Acquisition Department 125 Mesh Data Integration Unit 126 Noise Addition Unit 127 Mesh data provision control unit 128 API Department 129 Mutual use conditions setting section 13 Data Server Storage Unit 131 Mesh Data Database 132 Multimedia Database 14 Data Server Communication Unit 2. User information management server 21 Management server control unit 211 User authentication request receiving unit 212 User authentication execution unit 213 User Information Department 214 User information receiving unit 215 User information storage execution unit 22 Management Server Memory 221 Server Database 222 User Information Database 23 Management Server Communication Unit 3 Certificate Authority Server 31 Certification authority server control unit 311 Server authentication request receiver 312 Server Identification Unit 313 Common secret key provider 32 Certificate Authority Server Storage 321 Server Database N Network T-Terminal

Claims

1. a mesh data providing unit that provides mesh data corresponding to a mesh code; a user information update unit that updates user information related to the user when the mesh data providing unit provides mesh data to the user; a common secret key acquisition unit that acquires a common secret key used by a plurality of servers; an encryption unit that encrypts the user information using the common secret key; an encrypted information providing unit that provides the encrypted user information to another server; an encrypted information acquisition unit that acquires the encrypted user information from another server; a decryption unit that decrypts the encrypted user information; A distributed mesh data server comprising:

2. the common secret key acquisition unit acquires a one-time common secret key that is updated within a certain period of time using a server-specific secret key associated with the distributed mesh data server; The distributed mesh data server of claim 1 .

3. The user information includes a user API key that identifies the user and an access count that is the number of times the user has accessed the distributed mesh data server; the user information update unit updates the number of accesses when the mesh data providing unit provides mesh data to the user. The distributed mesh data server of claim 1 .

4. a user authentication request receiving unit that receives an authentication request from the user; a user authentication unit that authenticates the user when the user authentication request receiving unit receives the authentication request; a session initiation unit that initiates a user session for the user when the user authentication unit has successfully authenticated the user; Further provided with The distributed mesh data server of claim 1 .

5. a session termination unit that terminates the user session related to the user when a request to terminate the user session is received; the session termination unit instructs storage of the user information; 5. The distributed mesh data server of claim 4.

6. On your device, a location information acquisition step of acquiring location information indicating a current location of the terminal; a mesh code generation step of generating a mesh code corresponding to the current location based on the location information; a mesh data request step of requesting an external device to provide mesh data corresponding to the mesh code; A program that executes the following.

7. 2. The distributed mesh data server of claim 1, further comprising: a safety designation acquisition unit that acquires a designation of desired safety when generating mesh data and a process to be executed to ensure safety; a mesh data generation unit that generates hierarchical mesh data; a mesh data integration unit that, when the designation includes a k-anonymity threshold n, integrates mesh data of an order k=n or less related to k-anonymity with neighboring mesh data; a noise addition unit that, when the designation includes a differential privacy criterion, adds noise to individual data of mesh data that does not satisfy the criterion; and a mesh data provision control unit that, when the designation includes an l-diversity threshold m, controls a hierarchical level of mesh data of an order l=m or less related to l-diversity so that the hierarchical level is not provided, wherein the safety designation acquisition unit acquires the designation including at least one of the k-anonymity threshold n, the differential privacy criterion, or the l-diversity threshold m.

8. The distributed mesh data server according to claim 1 , further comprising an API unit that provides a mesh data generation program that generates mesh data from individual records.

9. The distributed mesh data server according to claim 1, further comprising an API unit that acquires information related to the generation of mesh data as confidential information and provides an indicator related to the relationship between the information and the mesh data under its management.

10. The distributed mesh data server of claim 1 further comprises a mutual use condition setting unit that acquires conditions related to targets for mutual data use and exchange and sets other users who meet the conditions as targets for mutual data use and exchange.

Images