Data management device, data management system, and data management method

Abstract

A data management device, a data management system, and a data management method are provided that can contribute to reducing the number of steps required for data preparation. [Solution] The data management device includes a determination unit that determines whether secondary data generated from source data to be processed conforms to data handling rules that use statistical information, and a data processing unit that performs processing in accordance with the determination result by the determination unit. Prior to generating the secondary data, the determination unit estimates statistical information from the source data to be processed, and determines whether the secondary data generated based on the estimated statistical information conforms to the data handling rules based on whether the secondary data satisfies the statistical values ​​of the statistical information. The data processing unit performs processing to generate secondary data if it determines that the data conforms to the data handling rules, and does not perform processing if it determines that the data does not conform to the data handling rules.

Description

[Technical field]

[0001] The present invention relates to a data management device, a data management system, and a data management method, and more particularly, to a server or the like that processes (extracts data from a database, combines information, etc.) sensitive data that requires careful handling. [Background technology]

[0002] In recent years, in connection with social issues such as the leakage of various data due to hacking, etc., there has been an increasing demand for strengthening legal protection of private information (sensitive data) of individuals and corporations.

[0003] On the other hand, for example between related companies or in medical networks, the distribution of sensitive data between multiple companies is progressing in order to realize DFFT (Data Free Flow with Trust), i.e., the free distribution of data with trust.

[0004] Furthermore, in systems that output huge amounts of information during operation, such as sensor data from a robot during the production process in a factory, and treat such information (so-called big data) as the subject of analysis for improving productivity, increasing data processing times due to the large volume of data also poses a problem.

[0005] Similarly, in systems used by large corporations and government offices that store a large amount of information about members (individuals) and their families in databases, the increase in data processing time due to the large volume of data poses a technical challenge.

[0006] To address these issues, the technology described in Patent Document 1 aims to improve the efficiency of managing confidential documents scattered throughout an organization by managing metadata, such as identifying electronic files whose metadata needs to be updated.

[0007] On the other hand, the technology described in Patent Document 1 is limited to a configuration in which the value of metadata is propagated to derived data using lineage, which is thought to have the following problems.

[0008] That is, in the technology described in Patent Document 1, when processing sensitive data, the processing is performed even if the sensitive data and the rules (such as k value) applied to the processing are not satisfied. For this reason, there are cases in which the technology described in Patent Document 1 does not contribute to reducing the amount of data preparation work. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] JP 2011-238165 A Summary of the Invention [Problem to be solved by the invention]

[0010] An object of the present invention is to provide a data management device, a data management system, and a data management method that can contribute to reducing the number of steps required for data preparation. [Means for solving the problem]

[0011] The data management device according to the present invention comprises: a determination unit that determines whether or not secondary data generated from source data to be processed complies with data handling rules that use statistical information; a data processing unit that performs processing according to a result of the determination by the determination unit, the determination unit estimates the statistical information from the source data to be processed prior to generating the secondary data, and determines whether the secondary data generated based on the estimated statistical information complies with the data handling rules based on whether the secondary data satisfies a statistical value of the statistical information; The data processing unit executes the processing to generate the secondary data if it is determined that the data complies with the data handling rules, and does not execute the processing if it is determined that the data does not comply with the data handling rules.

[0012] A data management system according to the present invention includes the above-mentioned data management device, a user terminal that communicates with the data management device and requests the processing of the source data; After generating the secondary data, the data management device sets an access right to the secondary data in the user terminal.

[0013] Another aspect of the present invention is a data management method that is executed by an information processing device having a determination unit and a data processing unit, in which the determination unit determines whether or not secondary data generated from source data to be processed conforms to data handling rules that use statistical information, and the data processing unit performs processing in accordance with a result of the determination, the determination unit estimates the statistical information from the source data to be processed prior to generating the secondary data, and determines whether the secondary data generated based on the estimated statistical information complies with the data handling rules based on whether the secondary data satisfies a statistical value of the statistical information; The data processing unit executes the processing to generate the secondary data if it is determined that the data complies with the data handling rules, and does not execute the processing if it is determined that the data does not comply with the data handling rules. Effect of the Invention

[0014] In the present invention, whether or not the secondary data generated from the source data to be processed complies with the data handling rules is determined prior to the processing, and if it is determined that the data does not comply with the data handling rules, the processing is not performed and the secondary data is not generated. Therefore, the present invention can contribute to reducing the number of steps required for data preparation. [Brief description of the drawings]

[0015] [Figure 1] 1 is a schematic functional block diagram showing a specific example of an information processing system according to an embodiment of the present invention. [Diagram 2] 2 is a block diagram illustrating an example of a hardware configuration of a database management server, a data processing server, and a client terminal that constitute the information processing system. FIG. [Diagram 3] 11 is a block diagram illustrating further details of the data processing server in the information processing system. FIG. [Figure 4] FIG. 2 is a block diagram illustrating further details of a client terminal in the information processing system. [Diagram 5] FIG. 2 is a block diagram illustrating further details of a database management server in the information processing system. [Figure 6] 13 is a diagram showing an example of a data handling regulations management table held by the data processing server; FIG. [Figure 7] 13 is a diagram showing an example of a processing method / rule handover method management table held by the data processing server; FIG. [Figure 8] 13 is a diagram illustrating an example of a lineage management table held by the data processing server. [Figure 9] 13 is a flowchart illustrating an example of processing executed by a query execution / rule compliance determination unit of the data processing server. [Figure 10] 13 is a flowchart illustrating the processing of a second program executed by a query execution / rule compliance determination unit. [Figure 11] 13 is a flowchart illustrating the processing of a third program executed by a query execution / rule compliance determination unit. [Figure 12] 13 is a flowchart illustrating the processing of a fourth program executed by a query execution / rule compliance determination unit. [Figure 13] 13 is a flowchart illustrating the processing of a fifth program executed by a query execution / rule compliance determination unit. [Figure 14]13 is a flowchart illustrating the processing of a sixth program executed by a query execution / rule compliance determination unit. [Figure 15] 13 is a flowchart illustrating the processing of a seventh program executed by the query execution / rule compliance determination unit. [Figure 16] 13 is a flowchart illustrating the processing of an eighth program executed by the query execution / rule compliance determination unit. [Figure 17] FIG. 11 is a flow diagram showing an example of a process for calculating whether secondary data complies with a rule. [Figure 18] FIG. 11 is a flow diagram showing an example of a process for checking whether secondary data complies with a rule. [Figure 19] 13 is a flow diagram illustrating an example of a process for determining whether or not rule inheritance of source data is necessary; [Figure 20] 13 is a flowchart illustrating an example of a rule handover necessity determining process. [Figure 21] FIG. 11 is a flow diagram showing the flow of a process for checking whether secondary data complies with the rules. [Figure 22] 13 is a flowchart illustrating an example of an access right setting process. [Figure 23] FIG. 13 is a diagram illustrating a specific example of a rule registration screen for registering rules regarding processing and handling of processed data. [Figure 24] FIG. 13 is a diagram illustrating a specific example of a display screen for inputting a single data operation (query). [Diagram 25] FIG. 13 is a diagram illustrating a specific example of a display screen for inputting a plurality of independent (non-chronological) data operations (queries). [Figure 26] FIG. 13 is a diagram illustrating a specific example of a display screen for inputting a plurality of continuous (time-series) data operations (queries). [Figure 27] FIG. 13 is a diagram showing an example of a warning screen displayed on a display unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] The present embodiment will be described in detail with reference to the drawings.

[0017] Generally speaking, the embodiment described below is a system using a computer, (1) Estimate the statistical values ​​of the secondary data generated; (2) determine the processing rules that will apply to the secondary data; (3) From the statistical information value of the data estimated in (1) above, estimate whether the data satisfies the handling rules, (4) When a data operation (query) is received, it determines the handling rules for the data to be generated, calculates the statistical information value of the data, estimates whether the data satisfies the handling rules, and executes the data operation (query) to generate secondary data only if the data satisfies the handling rules.

[0018] With the above configuration, data manipulation (query) is not performed on data that is estimated not to satisfy the handling rules, so that the number of steps required for data preparation can be reduced.

[0019] Among the above, a representative, non-limiting example of a "statistical information value" is the k value. As is well known, the larger the k value of the information constituting the secondary data, the more difficult it is to identify an individual, etc., and the smaller the k value, the easier it is to identify an individual, etc.

[0020] Fig. 1 is a schematic functional block diagram showing a specific example of an information processing system according to an embodiment to which the present invention is applied. As shown in Fig. 1, the information processing system 1 in this embodiment includes a database management server 2 that manages a database, a data processing server 3 that processes data in the database, a client terminal 100 that accesses the database, and a communication line 200 that connects these to each other.

[0021] Of the above, the information processing system 1 corresponds to the "data management system" of the present invention, the data processing server 3 corresponds to the "data management device" of the present invention, and the client terminal 100 corresponds to the "user terminal" of the present invention.

[0022] The database management server 2 of the information processing system 1 includes a database management system 21, a database (DB) 22 in which various data are registered, and DB statistical information 23 which is the result of statistical processing of the data registered in the database (DB) 22 (aggregated information, etc.).

[0023] In the following explanation, it is assumed that two types of databases, a first DB (hereinafter referred to as "NDB") and a second DB (hereinafter referred to as "KDB"), are stored as database (DB) 22, and different handling rules are applied to data processing for the NDB and data processing for the KDB.

[0024] However, the above assumptions are made with consideration for simplifying the explanation, and in actual operation, more types of databases may be stored as database (DB) 22, or conversely, a configuration in which only one type of database (in other words, a DB to which one type of rule is applied) is stored may also be used.

[0025] The data processing server 3 of the information processing system 1 (hereinafter, sometimes referred to as "this system") includes a query execution / rule compliance determination unit 31, a data handling regulations management table 32, a lineage management table 33, and a processing method / rule handover method management table 34. Details of each of these units will be described later.

[0026] The client terminal 100 also includes a data operation (query) input unit 101 that inputs queries for operations (e.g., viewing, aggregating (list display), printing, etc.) on data in the database managed in this system, and a processing method / rule transfer method registration unit 102, the details of which will be described later.

[0027] Note that, technically, the client terminal 100 can be realized, for example, as a personal PC or a mobile terminal, but in this embodiment, it is assumed that a dedicated terminal is used in order to strengthen the management of sensitive data.

[0028] Next, an outline of how to use this system and its main configuration will be explained. A user operates the data operation (query) input unit 101 of the client terminal 100 to access the database 22 (here, NDB or KDB) of the database management server 2. Here, the user (client terminal 100) is provided with the data (source data) of the database 22 in the form of processed secondary data. Non-limiting representative examples of data processing include data extraction, joining (combination), and aggregation. In this embodiment, such data processing is executed by the data processing server 3.

[0029] In other words, the user (client terminal 100) accesses the database 22 of the database management server 2 via the data processing server 3. In addition, data handling rules, which will be described later with reference to Figures 6 and 7, are set in advance in the database 22 (NDB, KDB) of the database management server 2, and the user (client terminal 100) can access the database within the scope of the set data handling rules.

[0030] In this embodiment, the data processing server 3 in this system determines whether the query entered at the client terminal 100 and the secondary data generated by the processing process comply with the above-mentioned data handling rules, and performs processing according to the determination result.

[0031] More specifically, the data processing server 3 includes a query execution / rule compliance determination unit 31 (corresponding to the "determination unit" of the present invention) that determines whether or not secondary data generated from source data that is the subject of processing (e.g., extraction, joining, aggregation) complies with data handling rules that use statistical information, and a data processing unit that performs processing according to the determination result. The functions of these units can be realized by the CPU 301 of the data processing server 3, which will be described later in FIG. 2.

[0032] The query execution / rule compliance determination unit 31 (determination unit) of the data processing server 3 estimates the statistical information from the source data to be processed prior to generating the secondary data, and determines whether the secondary data generated based on the estimated statistical information complies with the data handling rules based on whether the secondary data satisfies the statistical value (mainly the k value) of the statistical information. The data processing unit of the data processing server 3 executes processing to generate secondary data when it is determined that the data handling rules are complied with, and does not execute the processing when it is determined that the data handling rules (hereinafter may be simply abbreviated as "rules") are not complied with. According to this embodiment having such a configuration, it is possible to reduce the amount of data preparation work while strengthening the management of sensitive data.

[0033] Next, a description will be given of the flow of signals or information in the information processing system 1 according to the present embodiment. In this system, a query input to a data operation (query) input unit 101 of a client terminal 100 is passed to a query execution / rule compliance determination unit 31 of a data processing server 3 via a communication line 200 .

[0034] The query execution / rule compliance determination unit 31 of the data processing server 3 that has acquired the query executes a predetermined program (described later in FIG. 9 to FIG. 16) to determine whether the query complies with the rules, to inquire of the database management server 2 (database management system 21), to acquire the query result, and to return the acquired result to the data operation (query) input unit 101 of the client terminal 100. In one specific example, the query execution / rule compliance determination unit 31 returns processed secondary data to the data operation (query) input unit 101 if the data generated in response to the query complies with the rules, or returns a warning to the effect that the data does not comply with the rules if the data does not comply. In another specific example, the query execution / rule compliance determination unit 31 sets an access right to the client terminal 100 if the data generated in response to the query complies with the rules, and issues the above warning without setting an access right if the data does not comply.

[0035] In this embodiment, the rules applied to the secondary data generated by the above-mentioned processing are set for each process (for each type of processing) through the processing / rule transfer method registration unit 102 of the client terminal 100, which is a dedicated terminal. In this embodiment, the information inputted to the processing / rule transfer method registration unit 102 of the client terminal 100 is registered in the processing / rule transfer method management table 34 of the data processing server 3.

[0036] 1, the database management server 2 and the data processing server 3 are illustrated as separate terminals, but the database management server 2 and the data processing server 3 may be one device, i.e., the same server. Alternatively, the database management server 2 and the client terminal 100 may be configured as one device, the data processing server 3 and the client terminal 100 may be configured as one device, or the database management server 2, the data processing server 3 and the client terminal 100 may be configured as one device.

[0037] Next, an example of the hardware configuration of the above-mentioned database management server 2, data processing server 3, and client terminal 100 will be described with reference to FIG. 2 is a block diagram showing a hardware configuration of the information processing system 1 of this embodiment. A specific example of the hardware configuration of this system will be described below mainly with reference to FIG.

[0038] The database management server 2, data processing server 3, and client terminal 100 described above in Fig. 1 can be realized by general information processing devices such as a server device, a personal computer, a workstation, etc. For ease of explanation, the database management server 2, data processing server 3, and client terminal 100 may be abbreviated as simply "devices 2, 3, 100" below.

[0039] 2, the hardware configuration of these devices 2, 3, 100 can generally be configured to include, in the order of devices 2, 3, 100, CPUs 201, 301, 1001, communication interfaces 205, 305, 1005, memories 202, 302, 1002, storage units (storage) 203, 303, 1003, and buses 204, 304, 1004 connecting these. These devices 2, 3, and 100 are connected to each other via a network 200.

[0040] In FIG. 2, the client terminal 100 is configured with a connection interface 1006, an input unit 1007 such as a keyboard or mouse, and a display unit 1008 such as an LCD, but each of these units may be provided in the database management server 2 or the data processing server 3.

[0041] The following describes the hardware components of these devices 2, 3, and 100, taking the data processing server 3 as a representative example. The hardware components of the other devices 2 and 100 are similar to the hardware components of the data processing server 3, and therefore descriptions thereof will be omitted where appropriate.

[0042] The CPU 301 of the data processing server 3 is a hardware processor that controls each part of the data processing server 3. The CPU 301 also performs various functions as the "data management device" of the present invention, such as the functions of a "determination unit," a "data processing unit," and a "data statistical information calculation unit."

[0043] The memory 302 of the data processing server 3 may be various storage media (hardware memories), such as a ROM or HDD. Similarly, the storage unit 303 of the data processing server 3 may be various storage media (hardware memories). The communication interface 305 may be various devices, such as a modem or a communication card, for communicating with other terminals via the communication line 200. These units are connected to each other via a bus 304.

[0044] Fig. 3 is a block diagram showing details of the data processing server 3. As shown in Fig. 3, the data processing server 3 stores a query execution / rule compliance determination unit 3021 as a software program in a memory 302. In addition, a storage unit 303 of the data processing server 3 stores a data handling regulations management table 32, a lineage management table 33, and a processing / rule handover method management table 34.

[0045] Generally, the CPU 301 of the data processing server 3 functions as a query execution / rule compliance determination unit (3021) by reading and executing the query execution / rule compliance determination unit 3021 (software program) stored in the memory 302. At this time, the CPU 301 determines whether or not the user can access the data desired by referring to the above tables (32 to 34) in the storage unit 303. Then, depending on the result of such determination, if the CPU 301 approves access to the data, it issues (sets) an access right for the client terminal 100 to access the data, and if the CPU 301 does not approve access, it does not issue (set) the access right.

[0046] Fig. 4 is a block diagram showing details of the client terminal 100 operated by a user. As shown in Fig. 4, the client terminal 100 stores in a memory 1002 a data operation (query) input unit 1003 and a processing / rule transfer method registration unit 1004 (each of which is a software program).

[0047] Generally speaking, the CPU 1001 of the client terminal 100 realizes these functions by reading and executing the data operation (query) input unit 1003 and the processing / rule handover method registration unit 1004 in the memory 1002, and displays an input screen for data desired by the user. The CPU 1001 of the client terminal 100 then transmits information inputted into the input screen by the user's operation to the data processing server 3 via the communication interface 1005 and the network 200.

[0048] Thereafter, as described above, when the data processing server 3 approves access to the data and issues (sets) an access right, the CPU 1001 of the client terminal 100 performs processing to display a screen for the user to perform an operation to access the data. Note that the screen and processing procedure for such data access are not related to the features of this embodiment and publicly known techniques can be used, so that the description will be omitted as appropriate. The above-mentioned input screen (query input screen) will be described later with reference to FIG.

[0049] Fig. 5 is a block diagram showing details of the database management server 2. As shown in Fig. 5, the database management server 2 includes a database management system 2021 as a software program in a memory 202. In addition, a database 22 and statistical information 23 of the database are stored in a storage unit 302 of the database management server 2.

[0050] Generally speaking, the database management server 2 performs various functions as the database management server 2 by the CPU 201 reading and executing the database management system 3021 in the memory 302 .

[0051] For example, under the control of the CPU 201, the database management server 2 receives an instruction (command) sent from the data processing server 3 via the network 200 (see FIG. 2) and the communication interface 205. Then, the CPU 201 of the database management server 2 searches for and reads out data specified in the received command (specified by the command) from the storage unit 203, and transmits the read data to the data processing server 3.

[0052] <Example of data handling regulations management table> 6 is a diagram showing an example of the data handling regulations management table 32 stored in the storage unit 303 of the data processing server 3. The data handling regulations management table 32 corresponds to the "data handling rules" of the present invention.

[0053] 6 specifies rules for handling data in each of the two types of databases (NDB, KDB) held by the above-mentioned database management server 2. In a non-limiting example, the NDB held by the database management server 2 is a database storing medical information of citizens (e.g., a database of medical receipt information and specific medical checkup information), and the KDB is a database that registers data that is k-anonymous, i.e., data that should be anonymized.

[0054] 6, three rules R1, R2, and R3 regarding the handling of data registered in the NDB are registered in the data handling policy management table 32. In addition, two rules R4 and R5 regarding the handling of data registered in the KDB are registered in the data handling policy management table 32.

[0055] Specifically, the three rules for the above NDB are: First rule (R1): Number of copies is limited to 1. Second rule (R2): Matching with other information is prohibited. Third rule (R3): Access to data that does not satisfy a predetermined k value (eg, k>3) is prohibited.

[0056] In one specific example, the data registered in the NDB is set to apply one or more of the rules R1 to R3. For rule R3, the k value can be set differently for each type of data. However, to avoid complicating the explanation, the k value of rule R3 is set as above unless otherwise specified.

[0057] Also, the two rules regarding the above KDB are as follows: Fourth rule (R4): If the application is not a predetermined one (XXX), access to data that does not satisfy k value > 10 is prohibited. Fifth rule (R5): If used by a company, the k value must be greater than 5.

[0058] In one specific example, the data registered in the KDB is set to apply one or more of the rules R4 and R5 described above. Similarly, the k value of rules R4 and R5 can be set differently for each type of data, but unless otherwise specified, the k value of rules R4 and R5 is as described above.

[0059] Furthermore, the five rules and the method of setting them described above are merely examples, and it goes without saying that in actual operation, more rules or more complex rules can be created and set.

[0060] <Example of processing method / rule transfer method management table> 7 is a diagram showing an example of the processing method / rule transfer method management table 34 stored in the storage unit 303 of the data processing server 3. The processing method / rule transfer method management table 34 corresponds to the "data handling rule" of the present invention.

[0061] In the example shown in FIG. 7, the processing method / rule transfer method management table 34 specifies the types of processing for data registered in the above-mentioned databases (NDB, KDB), as well as the handling rules and rule transfer methods for the secondary data generated by the processing.

[0062] In the example shown in Figure 7, four types of processing are exemplified: extraction, combination, aggregation, and AI model construction, but in actual operation, more types of processing can be specified. For simplicity, processing may be abbreviated to simply "processing" below.

[0063] In the specific example shown in Fig. 7, the rule applied to the process "extract" is "ALL", that is, all rules (in this example, R1 to R5 shown in Fig. 6), and the inheritance method is to inherit the rule applied to the source data ("source" in Fig. 7, the same below). This is also true for the process "combine".

[0064] Note that "source data" refers to data that is the direct target of processing (e.g., merging), and is not limited to raw data. Therefore, even processed data (e.g., data in which two data sets are merged) can become the "source data" for the next processing (e.g., aggregation).

[0065] On the other hand, the handover method applied to the process "aggregation" differs between when rule R4 is applied to the source data and when a rule other than R4 (ie, when rules R1 to R3 and R5 are applied) is applied to the source data.

[0066] In other words, when rules R1 to R3 or rule R5 are applied to the process "aggregation", the inheritance method inherits the rules of the source data. On the other hand, when rule R4 is applied to the process "aggregation" and a certain k value is satisfied, the rules of the source data are not inherited. The same is true for the process "AI model construction".

[0067] Specifically, in the case of AI model construction to which rules R1 to R3 or rule R5 are applied, the rules of the source data are inherited. In contrast, when rule R4 is applied to the process "AI model construction" and the k value of the explanatory factor is satisfied, the source data is not inherited.

[0068] FIG. 8 is a diagram showing an example of the lineage management table 33 stored in the storage unit 303 of the data processing server 3. As shown in FIG. 8 is a table in which the history (lineage) of data processing performed by the data processing server 3 in response to one query requested by a user (client terminal 100) is registered in chronological order from the top. In this example, it can be seen that the data processing server 3 performed the following processing in response to the above query.

[0069] That is, the data processing server 3 first extracted data from the NDB in accordance with the handling rules R1, R2, and R3 (see FIG. 6 as appropriate) to generate data D1 as secondary data. Next, the data processing server 3 extracted data from the KDB in accordance with the handling rules R4 and R5 (see FIG. 6 as appropriate) to generate data D2 as secondary data.

[0070] Furthermore, the data processing server 3 generated data D3 (i.e., a combination of data D1 and D2) by combining the generated data D1 and D2 as source data. The handling rules applied during this combination (when generating data D3) are R1, R2, R3, R4, and R5, and if the data D3 does not comply with any of the rules when it is generated, the data processing server 3 does not generate data D3. In other words, the generated secondary data, data D3, was generated by being determined to comply with all handling rules during processing.

[0071] Finally, the data processing server 3 aggregated the generated data D3 as source data and generated data D4 as secondary data. The handling rules applied during such aggregation (when generating data D4) are R1, R2, R3, and R5, and if the data D4 does not comply with any of the rules when generated, the data processing server 3 does not generate data D4. In other words, the generated secondary data, data D4, was generated by determining that it complies with the above rules at the time of aggregation processing. Also, as can be seen with reference to Figures 8 and 7, rule R4 was not carried over when data D4 was generated because it satisfied the predetermined k value.

[0072] By configuring the system to have a lineage table 33 as described above, it is possible to check the content of the processing performed by the data processing server 3, the processing order, the rules followed, etc. as needed, which allows for improved maintenance and strengthened data management, etc.

[0073] <Processing flow of the query execution and rule compliance determination unit> 9 to 16 are flowcharts showing various specific examples of the processing contents executed by the query execution / rule compliance determination unit 31 of the data processing server 3. For convenience of explanation, the flowcharts shown in Figs. 9 to 16 may be hereinafter referred to as the first to eighth programs.

[0074] First, an overview of the process shown in Fig. 9 will be described. The query execution / rule compliance determination unit 31 of the data processing server 3 checks whether the secondary data generated by a single data operation (query) complies with the rules. More specifically, the query execution / rule compliance determination unit 31 calculates whether the rules are complied with before the secondary data is generated (i.e., before processing the source data) using the DB statistical information 23 in the database management server 2, and even if it is determined that the rules are complied with (when generating secondary data), it checks whether the rules are complied with again after the data is generated (secondary determination), and if it is determined (calculated, etc.) that the rules are not complied with in the second determination, data generation is not executed.

[0075] The following is a more detailed explanation. In step S301, the query execution / rule compliance determination unit 31 acquires a data operation (query). Typically, this query is acquired by the data processing server 3 receiving a query input (instruction) by a user via the data operation (query) input unit 101 of the client terminal 100 described above in FIG. 1. The same applies to query acquisition in other flowcharts such as FIG. 10, and the description thereof will be omitted below as appropriate.

[0076] In step S302, the query execution / rule compliance determination unit 31 acquires source data included in the query.

[0077] In step S303, the query execution / rule compliance determination unit 31 acquires an aggregation key string included in the query (see FIG. 24 etc. as appropriate).

[0078] In step S304, the query execution / rule compliance determination unit 31 obtains the rules of the source data obtained in the previous step. At this time, the query execution / rule compliance determination unit 31 can obtain the rules of the source data by referring to the lineage management table 33 described above in FIG.

[0079] In step S305, the query execution / rule compliance determination unit 31 calculates a statistical information value (k value) of the data to be generated. Here, the query execution / rule compliance determination unit 31 executes the calculation of the statistical information value (k value) of the data to be generated by using the statistical information 23 of the database of the database management server 2 described above in FIG.

[0080] In step S306, the query execution / rule compliance determination unit 31 determines the rule to be applied to the data to be generated. At this time, the query execution / rule compliance determination unit 31 can acquire the rule to be applied to the data to be generated (secondary data) by referring to the processing method / rule transfer method management table 34 described above in FIG.

[0081] In step S307, the query execution / rule compliance determination unit 31 executes pre-processing (calculation) for determining whether the data to be generated complies with the rule.

[0082] In step S308, the query execution / rule compliance determination unit 31 determines whether the data to be generated complies with the rule.

[0083] Here, if the query execution / rule compliance determination unit 31 determines that the data to be generated complies with the rule (step S308, YES), the process proceeds to step S309. On the other hand, if the query execution / rule compliance determination unit 31 determines that the data to be generated does not comply with the rule (step S308, NO), the query execution / rule compliance determination unit 31 determines that access to the user should not be granted, and ends this routine.

[0084] In step S309, the query execution / rule compliance determination unit 31 executes a data generation operation (query).

[0085] In step S310, the query execution / rule compliance determination unit 31 rechecks whether the generated data complies with the rule, and then sets the access right for the user to the generated data.

[0086] In one specific example, the query execution / rule compliance determination unit 31 issues a password of a predetermined number of digits as the access right, and transmits the password to the client terminal 100 described above in FIG.

[0087] Thereafter, the user can access the data by a process (for example, “view”) input through the data operation (query) input unit 101 of the client terminal 100.

[0088] <Second Program> FIG. 10 is a flowchart illustrating another process (second program) executed by the query execution / rule compliance determination unit 31 of the data processing server 3. As shown in FIG. In the flowchart of FIG. 10, the process contents of the process group A from step S301 to step S307 and steps S309 and S310 described above in FIG. 9 are the same, so the same step numbers are used and the description thereof will be omitted.

[0089] In step S308, the query execution / rule compliance determination unit 31 determines whether the data to be generated (secondary data) complies with the rule.

[0090] Here, if the query execution / rule compliance determination unit 31 determines that the data to be generated complies with the rule (step S308, YES), it issues access rights to the user after processing steps S309 and S310, as described above, and terminates the processing.

[0091] On the other hand, if the query execution / rule compliance determination unit 31 determines that the data to be generated does not comply with the rule (step S308, NO), the process proceeds to step S311.

[0092] In step S311, the query execution / rule compliance determination unit 31 displays a warning on the data operation (query) input unit 101 of the client terminal 100 described above in Fig. 1 (described later in Fig. 27). In the following step S312, the query execution / rule compliance determination unit 31 monitors a signal (user instruction) output from the data operation (query) input unit 101 of the client terminal 100. Here, when the query execution / rule compliance determination unit 31 acquires an execution instruction from the data operation (query) input unit 101 of the client terminal 100, it issues an access right to the user through the processes of steps S309 and S310 and ends the process.

[0093] <Third Program> FIG. 11 is a flowchart illustrating the processing content of yet another program (third program) executed by the query execution / rule compliance determination unit 31 of the data processing server 3. As shown in FIG.

[0094] In step S321, similarly to step S301 described above, the query execution / rule compliance determination unit 31 acquires a user's data operation (query) transmitted from the client terminal 100. However, in this step S321, it is assumed that the query execution / rule compliance determination unit 31 has acquired a plurality of queries (a set of queries). Also, in step S321, it is assumed that the acquired plurality of queries are independent of each other, in other words, queries that will give the same result even if the execution order is changed (see FIG. 25 as appropriate).

[0095] In this case, the query execution / rule compliance determination unit 31 transitions to a repeat mode (S322) in which it repeatedly performs processing for each data process (query) that constitutes the set, and repeatedly performs the following steps S323 to S327 for each query.

[0096] In step S323, the query execution / rule compliance determination unit 31 acquires one data process (query) that has not yet been processed.

[0097] In step S324, the query execution / rule compliance determination unit 31 calculates the rules for the data generated by the acquired data processing (query) and whether the generated data complies with the rules. This process corresponds to part of the process group A described above in FIG. 9 (S302 to S307), and therefore a description thereof will be omitted.

[0098] In step S325, the query execution / rule compliance determination unit 31 determines whether or not the data to be generated (secondary data) complies with the rule.

[0099] If query execution / rule compliance determination unit 31 determines that the data to be generated complies with the rule (YES in step S325), it decides that the data to be generated should be provided to the user, and proceeds to step S326. Then, in step S326, query execution / rule compliance determination unit 31 registers the data processing (query) in a list (hereinafter referred to as an "executable query list") as an executable query (see FIG. 11), and then proceeds to step S327.

[0100] On the other hand, if the query execution / rule compliance determination unit 31 determines that the data to be generated does not comply with the rule (step S325, NO), it decides that access to the user should not be granted, skips the above-mentioned step S326, and proceeds to step S327.

[0101] In step S327, the query execution / rule compliance determination unit 31 determines whether or not all queries in the set of queries acquired in the above-mentioned step S321 have been processed.

[0102] Here, if the query execution / rule compliance determination unit 31 determines that all queries have been processed (YES in step S327), the process proceeds to step S328.

[0103] On the other hand, if the query execution / rule compliance determination unit 31 determines that processing has not yet been performed for all queries (step S327, NO), the process returns to step S322, and the processing from step S323 to step S327 described above is repeated.

[0104] In step S328, the query execution / rule compliance determination unit 31 executes executable queries, that is, queries registered in the above-mentioned executable query list.

[0105] In step S329, the query execution / rule compliance determination unit 31 reconfirms whether or not the generated data complies with the rules, and then ends the process.

[0106] According to this processing example, only queries determined to be executable are selectively executed (step S328). Moreover, the data generated by such selective execution is provided to the user (the operator of the client terminal 100) after being reconfirmed as to whether it complies with predetermined rules (step S329) in order to ensure that the data is handled safely as sensitive data.

[0107] In this manner, by configuring in such a way that data operations (queries) are not executed on data that is estimated not to satisfy the predetermined handling rules, it is possible to reduce or minimize the amount of data preparation work.

[0108] <Fourth Program> FIG. 12 is a flowchart illustrating the processing contents of yet another processing example (fourth program) executed by the query execution / rule compliance determination unit 31 of the data processing server 3.

[0109] In the flowchart of FIG. 12, the processing contents of the processing group B from step S321 to step S324 described above in FIG. 11, and steps S328 and S329 are the same or similar, so the same step numbers are used and their descriptions are omitted as appropriate.

[0110] In step S321, the query execution / rule compliance determination unit 31 acquires a plurality of queries (a set of queries) input by a user and transmitted from the client terminal 100, similarly to the case of Fig. 11 described above. Furthermore, unlike the case of Fig. 11, this assumes that the acquired plurality of queries are queries that constitute a data flow, in other words, a set of queries that will produce different results (will not produce the same results) if the execution order is changed (see Fig. 26 as appropriate).

[0111] For this reason, as can be seen by comparing with Fig. 11, the process of step S326 described above (i.e., the process of registering the executable query in the list) is not performed in the flowchart shown in Fig. 12. Also, in the flowchart shown in Fig. 12, the process performed after the determination in step S325 described above has the following flow.

[0112] In step S325, the query execution / rule compliance determination unit 31 determines whether the data to be generated complies with the rule.

[0113] Here, if the query execution / rule compliance determination unit 31 determines that the data to be generated complies with the rule (step S325, YES), it decides that the data to be generated should be provided to the user, and proceeds to the determination process of step S327 described above.

[0114] In step S327, the query execution / rule compliance determination unit 31 determines whether or not all queries in the set of queries acquired in the above-mentioned step S321 have been processed.

[0115] Then, similarly to the above, if the query execution / rule compliance determination unit 31 determines that all queries have been processed (step S327, YES), the process proceeds to step S328. On the other hand, if the query execution / rule compliance determination unit 31 determines that all queries have not yet been processed (step S327, NO), the process returns to step S322 and repeats the processes of steps S323 to S327 described above.

[0116] In step S328, the query execution / rule compliance determination unit 31 executes executable queries, here all queries determined as YES in the above-mentioned step S325, as executable queries.

[0117] In step S329, the query execution / rule compliance determination unit 31 reconfirms whether or not the generated data complies with the rules, and then ends the process.

[0118] On the other hand, in step S325, if the query execution / rule compliance determination unit 31 determines that the data to be generated does not comply with the rule (step S325, NO), it determines that access to the user should not be granted, and performs the above-mentioned steps S327 to S329, thereby completing the series of processes.

[0119] In this way, in the processing example shown in Fig. 12, unlike the example in Fig. 11, if there is even one query in the set of data operations (queries) that is estimated not to conform to the predetermined rules, even if all other queries are estimated to conform to the rules, all queries in the set will not be executed, and data will not be provided to the user. As a result, in this embodiment, it is possible to strengthen the protection of sensitive data.

[0120] Also, as with the other examples, by configuring the system not to perform data operations (queries) on data that is estimated not to satisfy predetermined handling rules, it is possible to reduce or minimize the amount of data preparation work.

[0121] <Fifth Program> FIG. 13 is a flowchart illustrating the processing contents of yet another example (fifth program) executed by the query execution / rule compliance determination unit 31 of the data processing server 3.

[0122] In the flowchart of Figure 13, some of the processes that make up the process group A (steps S301 to S307) described above in Figure 9 are different, so the corresponding series of processes are described as process group A' and similar step numbers are assigned to the different processes.

[0123] In step S305A following the above-mentioned step S304, the query execution / rule compliance determination unit 31 confirms the statistical information value (k value) of the data to be generated by obtaining the corresponding data from the statistical information 23 of the DB in the database management server 2, and proceeds to the above-mentioned step S306.

[0124] In addition, in step S307A following the above-mentioned step S306 (determining the rule to be applied), the query execution / rule compliance determination unit 31 performs preprocessing to check whether the data to be generated (secondary data) complies with the rule.

[0125] The process contents of step S308 (determination and branching of processing based on the determination result) following step S307A and step S309 (execution of a query) are the same as those described above.

[0126] Furthermore, in step S310A following the above-mentioned step S309, the query execution / rule compliance determination unit 31 sets the user's access rights for the data generated by the executed query in the same manner as described above (without rechecking the rules). After this, the query execution / rule compliance determination unit 31 ends the series of processes.

[0127] Thus, the user can access the data by a process (for example, “view”) input through the data operation (query) input unit 101 of the client terminal 100.

[0128] According to this processing example, the processing is simpler than the flow in FIG. 9, and the number of steps required for data preparation can be further reduced.

[0129] <Sixth Program> FIG. 14 is a flowchart illustrating the processing contents of yet another example (sixth program) executed by the query execution / rule compliance determination unit 31 of the data processing server 3.

[0130] It should be noted that the same processes as those described above with reference to FIGS. 9 to 13 are denoted by the same step numbers, and the description thereof will be omitted as appropriate.

[0131] As can be seen by appropriately comparing with Figures 9 to 13, generally, the processing from the start to step S307A and the final processing of step S310A in the flowchart shown in Figure 14 are the same as the example shown in Figure 13. Also, in the flowchart shown in Figure 14, the processing after the determination of NO in step S308 (steps S311 and S312) are the same as the example shown in Figure 10.

[0132] <Seventh Program> FIG. 15 is a flowchart illustrating the processing contents of yet another example (seventh program) executed by the query execution / rule compliance determination unit 31 of the data processing server 3.

[0133] The processing from steps S321 to S323 is the same as that in the third program described above with reference to FIG.

[0134] In the next step S324A, the query execution / rule compliance determination unit 31 performs preprocessing (calculation) to determine the rules of the data generated by the acquired data processing (query) and whether the generated data complies with the rules. Specifically, in step S324A, the query execution / rule compliance determination unit 31 performs the processes of steps S302 to S307 described above in Fig. 9, and proceeds to step S325.

[0135] In step S325, the query execution / rule compliance determination unit 31 determines whether the data to be generated complies with the rule.

[0136] If query execution / rule compliance determination unit 31 determines that the data to be generated complies with the rule (YES in step S325), it decides that the data to be generated should be provided to the user, and proceeds to step S326. Then, in step S326, query execution / rule compliance determination unit 31 registers the data processing (query) as an executable query in an executable query list (see FIG. 15), and then proceeds to step S327.

[0137] On the other hand, if the query execution / rule compliance determination unit 31 determines that the data to be generated does not comply with the rule (step S325, NO), it decides that access to the user should not be granted, skips the above-mentioned step S326, and proceeds to step S327.

[0138] In step S327, the query execution / rule compliance determination unit 31 determines whether or not all queries in the set of queries acquired in the above-mentioned step S321 have been processed.

[0139] Here, if the query execution / rule compliance determination unit 31 determines that all queries have been processed (YES in step S327), the process proceeds to step S328.

[0140] On the other hand, if the query execution / rule compliance determination unit 31 determines that processing has not yet been performed for all queries (step S327, NO), the process returns to step S322, and the processing from step S323 to step S327 described above is repeated.

[0141] In step S328, the query execution / rule compliance determination unit 31 executes the executable queries, that is, the queries registered in the above-mentioned executable query list, and ends the series of processes.

[0142] According to this processing example, the process (recheck) of S329 is not performed, as compared with the flow of FIG. 11, so that the number of steps required for data preparation can be further reduced.

[0143] <8th Program> FIG. 16 is a flowchart illustrating the processing contents of yet another example (eighth program) executed by the query execution / rule compliance determination unit 31 of the data processing server 3.

[0144] 15, the process of step S326 (registering a query in the executable query list) is omitted in the example shown in Fig. 16. This makes it possible to further reduce or minimize the number of steps required for data preparation.

[0145] <Calculation of rule compliance> Fig. 17 is a flow diagram showing the flow of a process for calculating whether data complies with the rules, which is executed by the query execution / rule compliance determination unit 31 of the data processing server 3. This flow diagram corresponds to the subroutine of step S307 in Fig. 9. Also, for easier understanding, please refer to Fig. 24 etc. as necessary.

[0146] In step S3071, the query execution / rule compliance determination unit 31 acquires the tally key included in the query sent from the client terminal 100 (in the example of FIG. 24, the tally key is composed of three key values ​​k1, k2, and k3).

[0147] In step S3072, the query execution / rule compliance determination unit 31 acquires the conditions (query conditions) included in the query. The query conditions include conditions for each process when processing source data, such as extraction conditions when extracting data from source data, and combination conditions when combining data (two or more pieces of information) of source data.

[0148] In step S 3073 , the query execution / rule compliance determination unit 31 refers to the DB statistical information 23 of the database management server 2 to obtain a histogram of key values ​​in the database 22 .

[0149] In step S3074, query execution / rule compliance determination unit 31 calculates the number of rows for each key (such as k value) based on the query conditions and histogram obtained in steps S3072 and S3073, saves the calculation results, and ends the series of processes.

[0150] <Checking whether or not the rules are met> Fig. 18 is a flow diagram showing the flow of a process for checking whether secondary data complies with the rules, which is executed by the query execution / rule compliance determination unit 31 of the data processing server 3. This flow diagram corresponds to the subroutine of step S307A in Fig. 13. For easier understanding, please refer to Fig. 24 etc. as necessary.

[0151] As described above in FIG. 17, the query execution / rule compliance determination unit 31 acquires the tally key from the query (step S3071), and then acquires the query condition (step S3072).

[0152] In the next step S3075, the query execution / rule compliance determination unit 31 acquires corresponding data from the database 22 of the database management server 2 using the query condition acquired in the previous step.

[0153] In step S3076, the query execution / rule compliance determination unit 31 checks the number of rows for each key value (such as k value) of the data acquired in the previous step.

[0154] <Processing to determine whether or not to transfer rules> FIG. 19 is a flow diagram showing an example of a process for determining whether or not the rules of the source data need to be inherited when the secondary data is generated.

[0155] In step S1021, the query execution / rule compliance determination unit 31 acquires the rules of the source data constituting the secondary data (that is, all the rules that are applied to the source data included in the generated secondary data).

[0156] Thereafter, the query execution / rule compliance determination unit 31 repeats the processing of steps S1022 to S1028 for the rules of the acquired source data, and terminates the processing of this routine when it has completed the processing of steps S1023 to S1028 for all such rules.

[0157] Specifically, in step S1022, the query execution / rule compliance determination unit 31 acquires any one rule that has not yet been checked among the rules acquired in the previous step, and performs the following process.

[0158] In step S1023, the query execution / rule compliance determination unit 31 identifies or determines the processing (type of data processing to be performed) from the source of the data specified by the query (e.g., whether it is an NDB or a KDB) and the aggregation key string (see Figure 24, etc. as appropriate).

[0159] In step S1024, the query execution and rule compliance determination unit 31 searches the processing and rule handover method management table 34 using one rule acquired in step S1022 and the processing (type of data processing) identified (determined) in the previous step as keys to acquire the handover method (see Figure 7 as appropriate).

[0160] In step S1025, the query execution / rule compliance determination unit 31 determines whether or not to inherit the rules of the source based on the acquired inheritance method, and executes processing according to the determination result. In one specific example, if the query execution / rule compliance determination unit 31 determines that the rules of the source are not to be inherited if k (a predetermined k value) is satisfied, the process proceeds to step S1026, and if the query execution / rule compliance determination unit 31 determines that the rules of the source are to be inherited, the process proceeds to step S1027.

[0161] In step S1026, the query execution / rule compliance determination unit 31 determines whether the rule satisfies k (k value) or not, and if it determines that the rule does not satisfy (NO), proceeds to step S1027, and if it determines that the rule does satisfy (YES), skips the process to step S1028.

[0162] In step S1027 after it is determined that the rules of the source are to be inherited, the query execution / rule compliance determination unit 31 performs a setting for inheriting the rules, and the process proceeds to step S1028.

[0163] In step S1028, the query execution / rule compliance determination unit 31 determines whether or not processing has been performed for all of the rules acquired in step S1021. If it determines that processing has not been performed (NO), it returns to step S1022 and repeats the above-mentioned processing; if it determines that processing has been performed (YES), it terminates the series of processing.

[0164] FIG. 20 is a flowchart showing an example of a process executed by the query execution / rule compliance determination unit 31 of the data processing server 3 to register all rules applied to the generated secondary data.

[0165] Generally, the query execution / rule compliance determination unit 31 performs the processing of steps S1031 to S1038 for one rule out of all the rules corresponding to the source data contained in the secondary data, and terminates the processing of this routine when the processing for all the rules has been completed.

[0166] Specifically, in step S1031, the query execution / rule compliance determination unit 31 acquires any one rule from among all the above rules, and executes the following process.

[0167] In step S1032, the query execution / rule compliance determination unit 31 obtains the condition clause (when) and the action clause (then) of the rule.

[0168] For example, in the case of rule R4 described above in FIG. 6, “if the app (application) is not XXX” is the condition clause (when), and “prohibit access to data that does not satisfy the k value” is the action clause (then). Alternatively, as described above in FIG. 7, the rule for the processing operation "aggregation" corresponds to the condition clause (when) "rules R1 to R3, R5" or "R4 and a predetermined k value are satisfied." The same applies to the rule for the processing operation "AI model construction."

[0169] In step S1033, the query execution / rule compliance determination unit 31 determines whether a rule having the same condition clause (when) and action clause (then) as the acquired rule has already been registered as an execution target. If the query execution / rule compliance determination unit 31 determines that such a rule has not yet been registered (step S1033, NO), it skips to step S1036. On the other hand, if the query execution / rule compliance determination unit 31 determines that the rule has already been registered (step S1033, YES), it proceeds to step S1034.

[0170] In step S1034, the query execution / rule compliance determination unit 31 determines whether a rule having a different (not matching) condition clause (when) from the one acquired in step S1032 but the same action clause (then) has already been registered as an execution target. If the query execution / rule compliance determination unit 31 determines that such a rule has not yet been registered (step S1034, NO), it skips to step S1036. On the other hand, if the query execution / rule compliance determination unit 31 determines that the above rule has already been registered (step S1034, YES), it proceeds to step S1035.

[0171] In step S1035 after it is determined that rules with different condition clauses (when) but the same action clause (then) have been registered, the query execution / rule compliance determination unit 31 checks whether there is an inclusion relationship between the condition clauses (when) of these two rules (one rule is stricter) and proceeds to a processing step according to the result of the check.

[0172] Specifically, if there is no inclusion relationship between the rule acquired in step S1031 (hereinafter referred to as "the rule") and a rule that has already been registered (hereinafter referred to as "registered rule"), the query execution / rule compliance determination unit 31 registers the rule as a target for execution in step S1036, and proceeds to step S1038.

[0173] Here, cases where there is no inclusion relationship of a condition clause (when) correspond to, for example, "rules R1 to R3, R5 (in the case of)" or "R4 and a predetermined k value is satisfied (in the case of)" for the processing operation "aggregation" described above in Figure 7.

[0174] In addition, if the rule in question has stricter conditions than the registered rule, the query execution / rule compliance determination unit 31 performs a process of replacing the already registered rule with the (stricter) rule in question (step S1037), and then proceeds to step S1038.

[0175] On the other hand, if the registered rule has stricter conditions than the current rule, the query execution / rule compliance determination unit 31 determines that there is no need to newly register the current rule, and skips to step S1038.

[0176] In step S1038, the query execution / rule compliance determination unit 31 determines whether or not all rules have been processed. If the query execution / rule compliance determination unit 31 determines that all rules have not been processed yet (step S1038, NO), the process returns to step S1031 and repeats the above-mentioned processes. On the other hand, if the query execution / rule compliance determination unit 31 determines that all rules have been processed (step S1038, YES), this routine ends.

[0177] By carrying out the above-mentioned processing, it is possible to strengthen the management of sensitive data while reducing the amount of data preparation work.

[0178] Fig. 21 is a flow diagram showing the flow of a process for checking whether the secondary data complies with the rules, which is executed by the query execution / rule compliance determination unit 31 of the data processing server 3. In this example, it is assumed that the secondary data is data of an NDB (see Fig. 6).

[0179] In step S1041, the query execution / rule compliance determination unit 31 acquires all rules inherited by the generated secondary data (for example, a combination of information in source data), and transitions to a confirmation mode in steps S1042 and onward.

[0180] Thereafter, the query execution / rule compliance determination unit 31 repeats the processes of steps S1042 to S1050 for the inherited rules, and when such processes have been completed for all rules, ends the processing of this routine.

[0181] Specifically, in step S1042, the query execution / rule compliance determination unit 31 acquires any one of all the inherited rules. In this example, any one of rules R1, R2, and R3 described above in FIG. 6 is acquired.

[0182] In the next step S1043, the query execution / rule compliance determination unit 31 checks the content of the rule acquired in the previous step (here, whether it is any one of rules R1, R2, or R3). If the acquired rule is R1, the query execution / rule compliance determination unit 31 proceeds to step S1044, if it is R2, the query execution / rule compliance determination unit 31 proceeds to step S1045, and if it is R3, the query execution / rule compliance determination unit 31 proceeds to step S1046.

[0183] In step S1044, if the acquired rule is R1, the query execution / rule compliance determination unit 31 confirms that the generated secondary data (here, a combination of source data information) does not contain any copies that deviate from the rules (here, two or more copies), and proceeds to step S1047.

[0184] In step S1045, if the acquired rule is R2, the query execution / rule compliance determination unit 31 checks whether the query that is the basis of the generated secondary data (here, a combination of information from source data) includes matching (joining) with other information, and proceeds to step S1047. Here, matching (joining) with other information includes, for example, a combination of two or more pieces of information that makes it easier to identify a specific individual, facility name, place, etc. (such as "last name" + "first name", "hospital name" + "visit date" + "disease name").

[0185] In step S1046, if the acquired rule is R3, the query execution / rule compliance determination unit 31 confirms that the generated secondary data (in this example, each piece of constituent information) satisfies the minimum k value (here, the number of pieces of information to be combined (k value) is 4 or more), and proceeds to step S1047.

[0186] In step S1047, the query execution / rule compliance determination unit 31 checks whether the generated secondary data complies with the rule acquired in step S1042 (whether it is OK or not). If it is OK (step S1047, YES), the query execution / rule compliance determination unit 31 determines that the rule is satisfied (step S1048) and proceeds to step S1050. On the other hand, if it is not OK (step S1047, NO), the query execution / rule compliance determination unit 31 determines that the rule is not satisfied (step S1049) and proceeds to step S1050.

[0187] In step S1050, the query execution / rule compliance determination unit 31 checks whether or not all the rules acquired in step S1041 (each rule carried over in the secondary data) have been checked, and if YES, ends the routine in Fig. 21. On the other hand, if NO, returns to step S1042 and repeats the above-mentioned processing.

[0188] By carrying out such processing, it is possible to strengthen the management of sensitive data when the secondary data is NDB data, while reducing the amount of data preparation work.

[0189] <Access rights settings> Fig. 22 is a flowchart showing an example of an access right setting process executed by the query execution / rule compliance determination unit 31 of the data processing server 3. This flowchart corresponds to the subroutine of step S310 in Fig. 9. In this example, it is assumed that the secondary data is data in the KDB (see Fig. 6).

[0190] In step S3101, the query execution / rule compliance determination unit 31 acquires the rules for the generated secondary data (here, a combination of information of source data).

[0191] Thereafter, the query execution / rule compliance determination unit 31 repeats the processing from step S3102 onwards (steps S3103 to S3107) for the acquired rules, and terminates the processing of this routine when the series of processing has been completed for all rules.

[0192] Specifically, the query execution / rule compliance determination unit 31 determines whether or not there is an application condition for any one rule (a rule for which the determination processes in steps S3103 and S3105 have not yet been performed) (step S3103).

[0193] In the example (rule R4) described above in FIG. 6, rule R4 is applied when the application is not the specified one (XXX), so rule R4 is irrelevant when the application is the specified one (XXX).

[0194] If the query execution / rule compliance determination unit 31 determines that there is an application condition (step S3103, YES), the process proceeds to step S3103. On the other hand, if the query execution / rule compliance determination unit 31 determines that there is no application condition (step S3103, NO), the process proceeds to step S3105.

[0195] In step S3104, the query execution / rule compliance determination unit 31 sets the access rights to the data for the application (for example, a predetermined command or a password) so as to satisfy the condition.

[0196] In step S3105, the query execution / rule compliance determination unit 31 determines whether or not there is a user condition for the rule (for example, the user must be an employee of a company).

[0197] If the query execution / rule compliance determination unit 31 determines that the user's condition exists (step S3105, YES), the process proceeds to step S3106. On the other hand, if the query execution / rule compliance determination unit 31 determines that the user's condition does not exist (step S3105, NO), the process proceeds to step S3107.

[0198] In step S3106, the query execution / rule compliance determination unit 31 sets the access rights to the data for the user (for example, input of a company name or employee number) so as to satisfy the condition.

[0199] In step S3107, query execution / rule compliance determination unit 31 determines whether or not all the rules acquired in step S3101 have been processed. If query execution / rule compliance determination unit 31 determines that all the rules have not been processed yet (step S3107, NO), it returns to step S3102 and repeats the above-described processes from step S3103 onward.

[0200] On the other hand, if the query execution / rule compliance determination unit 31 determines that all the processes have been performed (step S3107, YES), it ends this routine.

[0201] By carrying out such processing, it is possible to strengthen the management of sensitive data when the secondary data is KDB data, while reducing the amount of data preparation work.

[0202] <Examples of various display screens> An example of a display screen displayed on the display unit of this system will be described below with reference to Fig. 23 to Fig. 27. Note that the display screens shown in Fig. 23 and subsequent figures are mainly shown as examples of screens displayed on the display unit 1008 of the client terminal 100, but they may be configured to be displayed on the display unit of another terminal, for example, the database management server 2 or the data processing server 3.

[0203] <Registration screen for handling processing and processed data> Fig. 23 is a diagram for explaining a specific example of a display screen for registering rules concerning the processing and handling of secondary data after processing (hereinafter, also referred to as a rule registration screen). In other words, the processing method / rule transfer method management table 34 explained in Fig. 7 can be created or updated by repeatedly performing the setting registration process via the rule registration screen shown in Fig. 23.

[0204] As can be seen by comparing with Figure 7, the specification registration screen shown in Figure 23 displays input fields (Edit Boxes) EB1, EB2 and EB3 for setting (inputting) the "processing process", "rule" and "handover method" corresponding to each column of the processing method / rule handover method management table 34, and a "Register" button RB for registering the information entered in each of these columns.

[0205] FIG. 23 shows an example of the state of the rule registration screen in which, when "aggregation" is executed as the processing, the above-mentioned rule "R4" is applied as the rule, and, as the handover method, when k (a predetermined k value) is satisfied (when), no handover is performed (then) (see FIG. 7 as appropriate).

[0206] When the registration button RB is selected in the state shown in FIG. 23, the input information is sent from the client terminal 100 to the data processing server 3, and the processing method / rule handover method management table 34 is updated.

[0207] <Single data operation (query) input screen> 24 is a diagram showing a specific example of a display screen P-2 (hereinafter, also referred to as an input screen) for inputting a single data operation (query). On the input screen for such a single data operation (query), input fields EB4, EB5, EB6, EB7, and EB8 for setting (inputting) the "output column", "output column (aggregation key)", "source data", "source data extraction condition", and "source data join condition", and an "Execute" button ExB for executing the query set in each of these fields are displayed.

[0208] When the execute button ExB is selected in the state shown in FIG. 24, the input information is sent from the client terminal 100 to the data processing server 3, and the process described above with reference to FIG.

[0209] <Multiple data operation (query) input screen (independent queries)> Fig. 25 is a diagram showing a specific example of a display screen P-3 for inputting a plurality of independent (non-chronological, for example, the same result can be obtained even if the execution order of each process is reversed) data operations (queries). In the example shown in Fig. 25, an input screen for a single data operation (query) 1 is displayed on the upper side of the screen, and an input screen for another independent single data operation (query) 2 is displayed on the lower side.

[0210] In addition, the lower right side of the screen displays an "Add" button AdB for adding input screens for further independent single data operations (queries) 3 and below, and an "Execute" button M-ExB for executing multiple queries set in these screens.

[0211] For example, when the “Add” button AdB is selected from the state shown in FIG. 25, the screen showing single data operations (queries) 1 and 2 moves (scrolls) upward, and further independent single data operations (queries) 3 and 4 are displayed in the positions of 1 and 2.

[0212] In addition, the input screen for each single data operation (query) has fields for setting (inputting) the "output column," "output column (aggregation key)," "source data," "source data extraction condition," and "source data join condition." In Fig. 25, the input fields corresponding to the input fields EB4, EB5, EB6, EB7, and EB8 described above in Fig. 24 are indicated by the symbols EB4-1, EB5-1, EB6-1, EB7-1, and EB8-1 for the input screen for query 1, and by the symbols EB4-2, EB5-2, EB6-2, EB7-2, and EB8-2 for the input screen for query 2, respectively.

[0213] When the execute button M-ExB is selected in the state shown in FIG. 25, the input information is sent from the client terminal 100 to the data processing server 3, and the process described above in FIG.

[0214] <Multiple data operation (query) input screen (data flow)> Fig. 26 is a diagram showing a display screen P-4 for inputting a plurality of consecutive (chronological, for example, the order of execution of processes is predetermined) data operations (queries). In the example shown in Fig. 26, an input screen (first query input screen CS-01) for a single data operation (query) 1 to be executed first is displayed on the left side of the screen, and an input screen (second query input screen CS-02) for a single data operation (query) 2 to be executed next is displayed on the right side. Also displayed in the lower right corner of the screen are an “Add” button AdB for adding input screens for further subsequent single data operations (queries) 3 and below, and an “Execute” button M-ExB for executing multiple queries set in these screens.

[0215] In addition, the input screens (CS-01, CS-02) for each single data operation (query) are provided with input fields (EB4-1 to EB8-1, EB4-2 to EB8-2) for setting (inputting) the "output column," "output column (aggregation key)," "source data," "source data extraction conditions," and "source data join conditions."

[0216] When the execute button M-ExB is selected in the state shown in FIG. 26, the input information is sent from the client terminal 100 to the data processing server 3, and the process described above in FIG.

[0217] <Warning screen> Fig. 27 is a diagram showing a display screen P-5 as a warning screen displayed on the data operation (query) input unit 101 or the display unit 1008 of the client terminal 100. As shown in Fig. 27, in one specific example of the warning screen, a warning message indicating the content of the error is displayed, and a "Continue" button CNB and a "Cancel" button STB are also displayed.

[0218] The example shown in Figure 27 shows a case where the k value for the secondary data to be generated must be 10 or more, but the query entered (specified) by the user results in a calculated k value (the k value calculated by the data processing server 3) of 8, making it easier to identify individuals, etc., and therefore a warning screen is displayed.

[0219] Here, in one specific example where the "Continue" button CNB is selected by the user, the data processing server 3 performs processing to display the previous query input screen (e.g., see Fig. 24) again. In this case, if the user selects the Execute button EXB with the previous input values ​​as shown in Fig. 24, for example, it is expected that a warning screen will be displayed again, so the user is prompted to change the input values ​​and select the Execute button EXB.

[0220] As described above in detail, the data processing system 1 (data management system) and data processing server 3 (data management device) to which the present invention is applied can strengthen the management of sensitive data while reducing the amount of work required for data preparation.

[0221] The various configuration examples described above can be appropriately combined depending on the purpose, etc.

[0222] In addition, the above-mentioned embodiments and examples are merely examples of the embodiment of the present invention, and the technical scope of the present invention should not be interpreted as being limited by them. In other words, the present invention can be embodied in various forms without departing from the gist or main characteristics thereof. [Explanation of symbols]

[0223] 1. Information processing system (data management system) 2 Database Management Server 21 Database Management Systems 22 Database (DB) 23 DB Statistics 3 Data processing server (data management device) 31 Query execution and rule compliance determination unit (determination unit) 32 Data handling regulations management table (data handling rules) 33 Lineage Management Table 34 Processing method / rule transfer method management table (data handling rules) 100 client terminals 101 Data manipulation (query) input section 102 Processing method and rule transfer method registration section 200 communication lines 301 CPU (judgment unit, data statistical information calculation unit) 1007 Input section 1008 Display section P-1, P-2, P-3, P-4, P-5 display screen EB1~EB8, EB4-1~EB8-1, EB4-2~EB8-2 input fields RB Registration button ExB, M-ExB execution button AdB Add button CNB Continue button STB Stop button CS-1, CS-2, CS-01, CS-02 query input screen

Claims

1. A determination unit that determines whether secondary data generated from source data to be processed complies with data handling rules; a data processing unit that performs processing according to a result of the determination by the determination unit; a processing / handling rule management table for registering, for each type of processing, the data handling rule for the secondary data generated by the processing; The determination unit determines, prior to generation of the secondary data, whether or not the secondary data generated from the source data to be processed complies with the data handling rules; the data processing unit executes the processing to generate the secondary data when it is determined that the data is in compliance with the data handling rules, and does not execute the processing when it is determined that the data is not in compliance with the data handling rules; Furthermore, the determination unit determines whether or not to issue an access right to the generated secondary data depending on whether or not the data conforms to the data handling rules registered in the processing / handling rule management table. Data management device.

2. 2. The data management device according to claim 1, Furthermore, the determination unit determines whether or not to take over the data handling rules registered in the processing / handling rule management table as rules to be applied to the secondary data. Data management device.

3. 2. The data management device according to claim 1, an interface for updating the processing / handling rule management table; Data management device.

4. In the data management device according to claim 1, The data handling rules use statistical information, The determination of whether the generated secondary data complies with the data handling rules is made by estimating statistical information from the source data to be processed and based on the estimated statistical information. Data management device.

5. In the data management device according to claim 1, a data statistical information calculation unit that calculates statistical values ​​of the generated secondary data; Data management device.

6. The data management device according to claim 1 ; a user terminal that communicates with the data management device and requests the processing of the source data; and if the determination unit determines, after generating the secondary data, that the generated secondary data complies with the data handling rules registered in the processing and handling rule management table, the data management device decides to issue an access right to the generated secondary data and sets an access right to the secondary data in the user terminal. Data management system.

7. A data management method executed by an information processing device having a determination unit, a data processing unit, and a processing / handling rule management table for registering data handling rules for secondary data generated by each type of processing, the data management method comprising: the determination unit determining whether or not the secondary data generated from source data to be processed complies with the data handling rules; and the data processing unit performing processing in accordance with a result of the determination, The determination unit determines, prior to generation of the secondary data, whether or not the secondary data generated from the source data to be processed complies with the data handling rules; the data processing unit executes the processing to generate the secondary data when it is determined that the data is in compliance with the data handling rules, and does not execute the processing when it is determined that the data is not in compliance with the data handling rules; Furthermore, the determination unit determines whether or not to issue an access right to the generated secondary data depending on whether or not the data conforms to the data handling rules registered in the processing / handling rule management table. Data management methods.

Images