Data distribution mediation device and data distribution mediation method

Abstract

To enable usage of data based on terms concluded with a user, and achieve both promotion of usage of personal data and privacy protection related to the personal data.SOLUTION: A data distribution intermediary device acquires personal data metadata and generates service usage data metadata based on terms of service related to distribution and usage of the personal data. The data distribution intermediary device detects a difference between the personal data metadata and the service usage data metadata, determines necessity of conversion processing of the personal data based on the difference from the metadata, and converts the personal data to corresponding service usage data based on the service usage data metadata when the necessity to convert the personal data is determined.SELECTED DRAWING: Figure 11B

Description

[Technical field]

[0001] The present invention relates to a data distribution intermediation device and a data distribution intermediation method, and in particular to a data distribution intermediation device and a data distribution intermediation method that enable the use of data based on a contract between a service provider that provides a service based on personal data and a user, and that are suitable for use in applications that simultaneously promote the use of personal data and protect privacy regarding the personal data. [Background technology]

[0002] In recent years, various data, including personal data, collected by companies to provide services for corporations and individuals has been actively discussed and examined for distribution and utilization across companies and industries. In particular, as exemplified by the EU's General Data Protection Regulation (GDPR), a law on privacy protection, the importance of individual users, who are the sovereigns of data, controlling their own data and mechanisms for this purpose are being considered for personal data. Since it is difficult for individual users to control all data, a model that supports data distribution and the management of data and procedures for data distribution by establishing a system that acts as an intermediary for data distribution, such as an information bank or a personal data store (PD), as an independent institution different from the companies that use the data and the individuals who are the sovereigns of the data, is attracting attention. In such cases, there may be differences in the content of the data collected and held by the data provider and the data handled by the service provider that provides new services to users, and this is one of the issues that must be resolved in order to realize data distribution.

[0003] For example, Patent Document 1 is a prior art related to data distribution using a data distribution intermediary system. Patent Document 1 discloses a system related to data distribution control that introduces a mechanism for providing incentives to individuals who are data sovereigns, data intermediaries, and data providers, and stimulates data distribution. Patent Document 1 also describes that, when distributing data, the data provider converts the data into a predetermined data format and transmits it to the data distribution intermediary system (paragraphs

[0066] and

[0128] ). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-129311 A Summary of the Invention [Problem to be solved by the invention]

[0005] In the system related to data distribution control described in the above Patent Document 1, it is stated that the server of the data provider converts the data into the specified format when the format of the provision conditions is specified in the provision request. This Patent Document 1 only describes the data format conversion by the data provider, and does not specifically mention the method of converting the data content itself. Here, the data format refers to data formats such as CSV (Comma Separated Value) and XML (eXtensible Markup Language), and the data content itself does not change even if the data format is converted. Furthermore, the above Patent Document 1 does not specify the conversion process of the data content that changes dynamically according to the service content provided by the service provider and the data specifications held by the data provider, or the method of determining whether conversion is necessary for the conversion process.

[0006] Therefore, no consideration is given to the provision of data by data providers based on the terms of agreement with users (owners of personal data), or the processing of data in response to changes in circumstances. For example, there are cases where user privacy is protected strictly under normal circumstances, and privacy protection is relaxed in emergencies to increase safety by using data, or where public use of data is required.

[0007] The object of the present invention is to provide a data distribution intermediation system that enables the use of data based on terms and conditions between users and service providers who provide services based on personal data, thereby promoting the use of personal data while protecting privacy regarding the personal data. [Means for solving the problem]

[0008] The configuration of the data distribution intermediary device of the present invention is preferably a data distribution intermediary device that mediates data exchange between a data providing device of a data provider that collects and provides personal data provided by a data owner, and a data utilization device of a service provider that provides service utilization data related to the personal data, and is provided with a personal data metadata management unit that acquires personal data metadata, which is metadata of the personal data held by the data providing device, a service utilization data attribute management unit that generates service utilization data metadata, which is metadata related to the service utilization data, based on terms of use for the distribution utilization of the personal data, a metadata attribute difference detection unit that detects differences between the personal data metadata and the service utilization data metadata, a personal data conversion determination unit that determines whether conversion processing of the personal data is required from the metadata difference detected by the metadata attribute difference detection unit, and a personal data conversion processing unit that converts the personal data into the corresponding service utilization data, and the personal data conversion determination unit determines whether conversion of the personal data is required, and when it is determined that the personal data requires conversion, the personal data conversion processing unit converts the personal data into the service utilization data based on the service utilization data metadata. Effect of the Invention

[0009] According to the present invention, it is possible to provide a data distribution intermediation system that enables the use of data based on the terms and conditions between the user and a service provider that provides services based on personal data, thereby promoting the use of personal data while protecting privacy regarding the personal data. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a schematic configuration diagram of a data distribution intermediation system. [Diagram 2] 1 is a functional configuration diagram of a data distribution intermediary device according to a first embodiment. [Diagram 3] FIG. 2 is a diagram showing the hardware and software configuration of the data distribution intermediary device. [Figure 4] 11 is a diagram showing an example of personal data provided by a data providing device to a data distribution intermediary device; FIG. [Diagram 5] 11 is a diagram showing an example of service utilization data provided by a data distribution intermediate device to a data utilization device; FIG. [Figure 6] FIG. 4 is a diagram showing an example of a terms of use table according to the first embodiment. [Figure 7] FIG. 13 is a diagram showing an example of personal data metadata. [Figure 8] FIG. 13 is a diagram illustrating an example of service usage data metadata. [Figure 9] FIG. 11 is a diagram illustrating an example of data distribution control data. [Figure 10] FIG. 4 is a diagram illustrating an example of a script management table according to the first embodiment. [Figure 11A] 1 is a sequence chart illustrating the processing of the data distribution intermediation system (part 1). [Figure 11B] 13 is a sequence chart illustrating the processing of the data distribution intermediation system (part 2). [Figure 12] FIG. 11 is a functional configuration diagram of a data distribution intermediary device according to a second embodiment. [Figure 13] FIG. 11 is a diagram illustrating an example of privacy rank data. [Figure 14] FIG. 11 is a diagram showing an example of a terms of use table according to the second embodiment. [Figure 15] FIG. 11 is a diagram illustrating an example of a script management table according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, each embodiment of the present invention will be described with reference to FIGS.

[0012] [Embodiment 1] Hereinafter, a first embodiment of the present invention will be described with reference to FIGS. 1 to 11B. First, the configuration of a data distribution intermediation system according to a first embodiment of the present invention will be described with reference to FIGS.

[0013] First, the schematic configuration of the data distribution intermediation system will be described with reference to FIG. As shown in Fig. 1, the data distribution intermediation system has a configuration in which a data distribution intermediation device 100, data providing devices 200 (in Fig. 1, shown as data providing devices 200a, 200b, ..., 200m), data utilizing devices 300 (in Fig. 1, shown as data utilizing devices 300a, 300b, ..., 300n), and data owner terminals 10 (in Fig. 1, shown as owner terminals 1a, 10b, ..., 10l) are connected via a network 5. The network 5 may be wired or wireless, and may be a global network such as the Internet, or a LAN (Local Area Network). Alternatively, the network may have a configuration in which the data distribution intermediation device 100, the data providing devices 200, the data utilizing devices 300, and the data owner terminals 10 are each individually connected.

[0014] The data distribution intermediary device 100 is a device that mediates data distribution between the data providing device 200 and the data utilizing device 300, and converts and selects the necessary data. The data providing device 200 is a device that provides the data owner's data (personal data, described in detail later) to the data utilizing device 300. The data utilizing device 300 is a device that receives service utilization data (described in detail later) from the data providing device 200 and utilizes it for the service. The data owner terminal 10 is a device that allows the data owner to configure data settings, agree to terms and conditions regarding data utilization with the data provider and data user, and upload personal data to the data providing device 200. The personal data may be provided to the data providing device 200 by a different route, instead of being uploaded from the data owner terminal 10.

[0015] In the description of this embodiment, an emergency call service system on a motorway will be mainly taken as an example. The emergency call service is a service in which, when a car accident occurs on a motorway, an emergency call service provider grasps the situation from vehicle data and requests an ambulance or the like depending on the situation. In this case, the data owner is the driver of the car, and the personal data is the accident damage situation data and the personal medical data of the driver of the car (blood type, allergies, medical history). When the personal data is the accident damage situation, the data provider is the car manufacturer, and the data user is the police, insurance company, hospital, road service provider such as JAF, and when the personal data is personal medical data, the data provider is the driver's attending hospital, and the data user is the insurance company and the hospital to which the driver is transported in the event of an accident.

[0016] Data owner terminal 10 may be realized by dedicated hardware, or may be configured with a CPU (Central Processing Unit) and memory, etc., and may realize the functions of each part by the CPU executing a computer program for realizing the function. For example, data owner terminal 10 may be a mobile communication terminal device such as a smartphone, a car navigation system, or a smart device built into a vehicle to collect driving information, or may be a stationary communication terminal (for example, a personal computer).

[0017] Next, the functional configuration of the data distribution intermediate device will be described with reference to FIG. As shown in FIG. 2, the data distribution intermediary device 100 is composed of a data provider management unit 101, a service provider management unit 102, a personal data conversion unit 110, a terms of use management unit 121, a consent procedure management unit 122, a data distribution control unit 130, a communication unit 140, and a memory unit 150.

[0018] The data provider management unit 101 is a functional unit that manages information on data providers who provide data via the data providing device 200 and information on personal data provided by the data providing device 200.

[0019] The service provider management unit 102 is a functional unit that manages various information relating to the services used by the user through the data owner terminal 10, that is, the content of the service, information about the provider providing the service, the usage status of the service, and the like.

[0020] The personal data conversion unit 110 is a functional unit that determines whether or not the contents of the user's personal data need to be converted when controlling the distribution of the user's personal data collected and stored by the data providing device 200 to the data utilization device 300, and performs the conversion process if necessary.

[0021] The personal data conversion unit 110 is composed of sub-functional units: a personal data metadata management unit 111, a service usage data metadata management unit 112, a metadata attribute difference detection unit 113, a scenario-specific service usage data metadata identification unit 114, a personal data conversion determination unit 115, and a personal data conversion processing unit 116.

[0022] The personal data metadata management unit 111 is a functional unit that acquires from the data providing device 200 and manages metadata of the user's personal data (hereinafter simply referred to as “personal data metadata”; details will be described later) that is collected and accumulated in the data providing device 200.

[0023] The service usage data metadata management unit 112 is a function for managing metadata related to personal data of users used in services (hereinafter, simply referred to as "service usage data metadata", details of which will be described later).

[0024] The service usage data metadata is metadata generated based on service terms information including collection, storage, and usage of user's personal data managed by the terms of use management unit 121, and the result of user's consent managed by the consent procedure management unit 122. The service usage data metadata management unit 112 can manage metadata of user's personal data corresponding to a service customized for each user (data used in the service differs for each user). In addition, even if the service usage data metadata is not generated by the data distribution intermediation device 100, metadata related to the user's personal data used in the service generated by the service provider or the data utilization device 300 may be acquired and managed. In addition, the service usage data metadata may be generated by the operation / management of the data distribution intermediation device 100.

[0025] The metadata attribute difference detection unit 113 is a functional unit that detects differences between the personal data metadata managed in the personal data metadata management unit 111 and the service usage data metadata managed in the service usage data metadata management unit 112. The metadata attribute difference detection unit 113 detects differences for specific attributes (metadata attributes) of the metadata in the personal data metadata and the service usage data metadata, and detects the differences from the setting values ​​of the metadata attributes.

[0026] The scenario-by-scenario service usage data metadata specification unit 114 is a functional unit that specifies service usage data metadata used for each scenario (details of which will be described later) of a service provided by a service provider.

[0027] The personal data conversion determination unit 115 is a functional unit that determines whether or not the user's personal data collected and stored in the data providing device 200 needs to be converted based on the difference in the setting values ​​of the metadata attributes detected by the metadata attribute difference detection unit 113.

[0028] The personal data conversion processing unit 116 is a functional unit that performs appropriate conversion processing based on the settings of the personal data metadata attributes and the settings of the service usage data metadata attributes when the personal data conversion determination unit 115 determines that the user's personal data needs to be converted.

[0029] The terms of use management unit 121 is a functional unit that acquires, from the data utilization device 300, the terms of use of the service agreed upon between the user and the service provider for the service provided by the data utilization device 300 that the user wishes to use, verifies whether there are any defects, and manages the terms to be disclosed to the user.

[0030] The consent procedure management unit 122 is a functional unit that generates a consent request notification to be sent to the data owner terminal 10 based on the service terms of use of the service provider, determines whether or not the user who receives the notification will give consent on the data owner terminal 10, and obtains and manages the user's consent results.

[0031] The data distribution control unit 130 controls the data flow for distributing the user's personal data, collected and stored in the data providing device 200, to the data utilization device 300 based on data distribution control data (described in detail later) in accordance with the service terms of use agreed to by the user and managed by the consent procedure management unit 122.

[0032] The communication unit 140 is a functional unit that communicates with the data providing device 200, the data utilization device 300, and the data owner terminal 10 via the network 5. The communication unit 140 receives, for example, the terms of use of a service that the user wishes to use from the data utilization device 300, and transfers it to the terms of use management unit 121. The communication unit 140 also transmits the terms of use of the service received by the terms of use management unit 121 to the data owner terminal 10, communicates to request consent to the service terms of use, and receives the result of the consent from the data owner terminal 10.

[0033] The memory unit 150 is a functional unit that stores data generated or used by the data provider management unit 101, the service provider management unit 102, the personal data conversion unit 110, the terms of use management unit 121, the consent procedure management unit 122, and the data distribution control unit 130 when realizing the functions of each unit.

[0034] The storage unit 150 holds personal data 401, service usage data 402, personal data metadata 411, service usage data metadata 412, data provision / data usage information data 420, terms of use table 421, consent procedure information data 422, data circulation control data 431, script data 441, and script management table 442. Details of each data will be described later.

[0035] Next, the hardware and software configuration of the data distribution intermediary device will be described with reference to FIG. The hardware configuration of the data distribution intermediation device 100 is realized by, for example, a general information processing device such as a personal computer shown in FIG.

[0036] The data distribution intermediary device 100 comprises a CPU (Central Processing Unit) 502, a main memory device 504, a network I / F (Interface) 506, a display I / F 508, an input / output I / F 510, and an auxiliary memory I / F 512, all connected via a bus.

[0037] The CPU 502 controls each unit of the data distribution intermediation device 100, and loads necessary programs into the main memory device 504 and executes them.

[0038] The main storage device 504 is generally configured as a volatile memory such as a RAM, and stores the programs executed by the CPU 502 and data referenced by the CPU 502.

[0039] The network I / F 506 is an interface for connecting to the network 5 .

[0040] The display I / F 508 is an interface for connecting a display device 520 such as an LCD (Liquid Crystal Display).

[0041] The input / output I / F 510 is an interface for connecting an input / output device, and in the example of Fig. 5, a keyboard 530 and a mouse 532 which is a pointing device are connected.

[0042] The auxiliary storage I / F 512 is an interface for connecting an auxiliary storage device such as a hard disk drive (HDD) 550 or a solid state drive (SSD).

[0043] The HDD 550 has a large storage capacity and stores programs for executing the present embodiment. A data provider management program 561, a service provider management program 562, a personal data conversion processing program 570, a terms of use management program 581, an agreement procedure management program 582, and a data distribution control program 590 are installed in the data distribution intermediary device 100.

[0044] The data provider management program 561, the service provider management program 562, the personal data conversion processing program 570, the terms of use management program 581, the consent procedure management program 582, and the data distribution control program 590 are programs which respectively realize the functions of the data provider management unit 101, the service provider management unit 102, the personal data conversion unit 110, the terms of use management unit 121, the consent procedure management unit 122, and the data distribution control unit 130.

[0045] In addition, although not shown, the HDD 550 stores personal data 401, service usage data 402, personal data metadata 411, service usage data metadata 412, terms of use table 421, consent procedure information data 422, data distribution control data 431, and script data 441.

[0046] In the above examples, the data distribution intermediary device 100 has been described as an information processing device that realizes its functions by having the CPU execute a computer program to realize the functions of each part, but the functions may also be realized by dedicated hardware.

[0047] Next, the data used in the data distribution intermediation system will be described in detail with reference to FIGS.

[0048] Personal data 401 is data that is collected by the data providing device 200 from personal data of a data owner and provided to the data distribution intermediary device 100. Fig. 4 shows, as an example of personal data 401, vehicle driving data described in JSON (JavaScript Object Notation) format as driving information of the data owner's vehicle, and in the example of Fig. 4, includes vehicle data time stamp 401a, vehicle position data (latitude) 401b, vehicle position data (longitude) 401c, vehicle driving speed data 401d, and vehicle braking operation information 401e.

[0049] The service utilization data 402 is data that the data distribution intermediary device 100 converts the personal data 401 as necessary and provides to the data utilization device 300 .

[0050] In the example of this embodiment, it is assumed that different conversions are performed depending on the service scenario and the data is provided to the data utilization device 300.

[0051] For example, in the example of Figure 5, Figure 5(a) shows data provided during normal times when the data owner's vehicle is being driven and no accidents have occurred, and Figure 5(b) shows data provided during an emergency when an accident has occurred while the data owner's vehicle is being driven.

[0052] The data provided in the normal state in Fig. 5(a) includes only a vehicle data time stamp 402a and a vehicle position data (area code) 402f. On the other hand, the data provided in the emergency state in Fig. 5(b) is more detailed data, including a vehicle data time stamp 402a, a vehicle position data (latitude) 402b, a vehicle position data (longitude) 402c, a vehicle travel speed data 402d, and a vehicle brake operation information 402f. The service usage data in Fig. 5 is based on a terms of use table 421 (particularly, terms IDs A3, A4, and A6 are relevant) which will be described later.

[0053] The terms of use table 421 is a table for storing information on the terms of use agreed between the data owner and the data provider or data user, and as shown in Fig. 6, is composed of fields of a terms of use ID 422a, a terms of use name 422b, and terms of use content 422c. The terms of use ID 422a stores an ID that uniquely identifies each record of the terms of use. The terms of use name 422b stores the name of the terms of use. The terms of use content 422c stores the specific content of the terms of use.

[0054] The names of the terms of use shown in Figure 6 include service overview, business operator, data used, data acquisition method, purpose of use, processing and use, provision to third parties, storage period, individual involvement, and contact information.

[0055] The example of the terms of use table shown in Fig. 6 uses an accident emergency report service as an example, and the terms of use for "usage data" (terms ID 422a "A3") are vehicle driving data, etc. The terms of use for "data acquisition method" (terms ID 422a "A4") differ between normal times (no accidents have occurred) and emergency times (accidents have occurred). The acquisition interval is shorter in emergency times than normal times, and if the data collection interval from data providing device 200 is 50 milliseconds, the same as in emergency times, this shows that in normal times, data distribution intermediate device 100 provides data that has been thinned out to data utilizing device 300. In addition, as for "processing use" (Regulations ID 422a "A6"), the standard stipulates that during normal times, location information data will be anonymized to area code information, and only the minimum amount of location information and time stamp data necessary to confirm the safety of the vehicle will be collected, and during emergencies, location information data will not be anonymized and data that can identify the detailed location such as latitude, longitude and road ID will be collected, and vehicle driving data such as location information, time stamp data, vehicle driving speed, brake presence / absence information, and acceleration / deceleration information necessary for accident investigation will be collected, and contact information will be anonymized and collected regardless of whether the state is normal or emergency, and the specific data to be used for the service and the anonymization and anonymization processing will be stipulated.

[0056] As an example of a service scenario in this embodiment, as shown by way of a normal state when the data owner is driving his / her vehicle and an emergency state when an accident occurs, if multiple service provision scenarios are to be supported, this must be stated in the terms of use agreed upon between the data owner and the data provider or data user.

[0057] The personal data metadata 411 is data that indicates items of the personal data 401 and their description format. The personal data metadata 411 of this embodiment is metadata when the personal data is vehicle driving data, and is data in JSON format that includes a vehicle data timestamp data item 411a, a vehicle position data item 411b, and a vehicle driving speed data item 411c, for example, as shown in Fig. 7.

[0058] The vehicle data timestamp data item 411a indicates that UNIX time is used as the method of expressing the vehicle data timestamp. Also, the vehicle position data item 411b indicates that the method of expressing the vehicle position data is expressed as latitude and longitude, and that the N-ary system is 10 (decimal system). Furthermore, the vehicle speed data item 411c indicates that the unit of the vehicle speed data is km / h. Note that the specific expression format of the metadata on the system may be other than the JSON format shown in this example.

[0059] The service usage data metadata 412 is data that indicates the items of the service usage data 402 and their description formats. When the personal data is vehicle driving data, the service usage data metadata 412 of this embodiment is metadata of the service usage data 402 converted from the personal data, and as shown in Fig. 8, a plurality of metadata corresponding to the service scenarios are defined as a service scenario list 412A. In the example of Fig. 8, examples of metadata used in two types of scenarios, a normal list 412A1 and an emergency list 412A2 of an accident emergency call service, are described as sub-lists of the service scenario list 412A.

[0060] The normal state list 412A1 at the top of the service scenario list 412A includes a vehicle data timestamp data item 412A1a and a vehicle position data item 412A1b. The vehicle data timestamp is expressed using UTC time. The vehicle position data is expressed using an area code and the N-ary notation is NULL, which means that the N-ary notation is not used.

[0061] The next emergency list 412A2 includes a vehicle data timestamp data item 412A2a, a vehicle position data item 412A2b, and a vehicle speed data item 412A2b. The vehicle data timestamp is expressed using UTC time. The vehicle position data is expressed in latitude and longitude, and the N-ary system is 10 (decimal system). The vehicle speed data is expressed in m / sec. Multiple metadata can be defined by such a list, and the metadata to be used can be switched for each service scenario. The specific format of the metadata on the system may be other than the JSON format shown in this example.

[0062] The data distribution control data 431 is data describing the procedure and data format related to data exchange between the data distribution control unit 130 and other components, and is data describing rules for data access control using an XML-based markup language such as XACML (eXtensible Access Control Markup Language) as shown in Fig. 9, for example, and describing information for controlling data flow in accordance with the rules. Note that the description of the data distribution control data 431 may be in a description format other than XACML.

[0063] The script management table 442 is a table that describes, for each data item, a pair of pre-conversion and post-conversion data attributes and information on a script for realizing the conversion, and is composed of fields for a data ID 442a, a pre-conversion attribute 442b, a post-conversion attribute 442c, and a conversion script 442d, as shown in Fig. 10. The data ID 442a stores an ID that uniquely identifies the type of data. The pre-conversion attribute 442b stores the pre-conversion attribute of the data of the data ID 442a. The post-conversion attribute 442c stores the pre-conversion attribute of the data of the data ID 442a. The conversion script 442d stores the name and ID of the script for realizing the conversion.

[0064] Although not shown, the data provision / data utilization information data 420 is network addresses and other logical information for the data distribution intermediary device 100 to utilize the data provision device 200 and data utilization device 300.

[0065] Although not shown, the consent procedure information data 422 is data regarding information related to the consent of the data owner, such as whether or not the data owner has consented to the terms of use, and the date and time of consent.

[0066] Although not shown, the script data 441 is data describing a script for converting the personal data 401 into the service usage data 402 .

[0067] Next, the processing of the data distribution intermediation system will be described with reference to FIGS. 11A and 11B.

[0068] First, the data owner terminal 10 transmits a service utilization request message M01 provided by the data utilization device 300 to the data distribution intermediary device 100 in response to an operation by a user (data owner) (FIG. 11A). Although not shown, the service utilization request message M01 is a message including a service ID and a user ID, etc. Here, the service ID is an identifier for identifying a service provided by the data utilization device 300, and the user ID is an identifier for identifying a user.

[0069] The data distribution intermediation apparatus 100 receives the service use request message M01 from the communication unit 140, and holds information related to the received service use request message M01.

[0070] Next, the data provision / data usage information data 420 has information that associates a service ID with a data usage device 300 defined in advance, and the data distribution intermediary device 100 transmits a service terms of use request message M02 for that service ID via the communication unit 140 to the data usage device 300 corresponding to the service ID included in the received service usage request message M01.

[0071] The data utilization device 300 receives the transmitted service terms of use request message M02, and returns a service terms of use response R01 to the data distribution intermediary device 100, the response including information on the service terms of use data corresponding to the service ID included in the received service terms of use request message M02.

[0072] Here, the service terms of use data corresponding to the service ID is data including information expressing the terms of use established by a service provider that provides the service corresponding to the service ID.

[0073] Next, the terms of use management unit 121 checks whether there are any deficiencies in the terms of use of the service in the service terms of use data, and if there are any deficiencies, modifies the terms of use of the service, finalizes the terms to be disclosed to the user (S01), and stores the information of the service terms of use data as terms of use table 421 shown in Figure 6 (S02).

[0074] The data distribution intermediary apparatus 100 then transmits a terms of service confirmation notice N01 to the data utilization apparatus 300 via the communication unit 140, and sends a terms of service notice N02 including the contents of the terms of service to the data owner terminal 10.

[0075] Next, the consent procedure management unit 122 transmits to the data owner terminal 10 a consent request message M03 requesting consent to the service terms of use transmitted by the data owner.

[0076] The data owner terminal 10 informs the data owner of the contents of the service terms of use and that it has received the consent request message M03, and displays the received contents of the service terms of use and the contents of the consent request message M03 on the display screen. The data owner indicates whether or not he or she agrees to the terms of use of the new service he or she wishes to use, based on the contents of the service terms of use displayed on the displayed screen and the contents of the consent request message M03 (S03), and if the data owner terminal 10 agrees, it transmits a consent notification N03 to the data distribution intermediary device 100.

[0077] Next, the consent procedure management unit 122 obtains information regarding the agreed-upon service from the consent notification N03 via the communication unit 140, and stores, for example, which data owner agrees to which service and what terms of use as consent procedure information data 422 (S04).

[0078] Next, the personal data metadata management unit 111 transmits a personal data metadata provision request message M11 to the data providing device 200, requesting the provision of personal data metadata 411 (FIG. 11B). The personal data metadata 411 has been made public as a data catalog of personal data held by the data providing device 200. On the other hand, even if the personal data has not been made public as a data catalog, the data owner can request the data providing device 200 to provide the personal data metadata 411 from the data owner terminal 10 via the data distribution intermediary device 100 as a right of the data owner.

[0079] Next, the personal data metadata management unit 111 receives a personal data metadata response R11 including the personal data metadata 411 provided from the data providing device 200, and stores the received personal data metadata 411 shown in FIG. 7 (S11).

[0080] Next, the service usage data metadata management unit 112 generates the service usage data metadata 412 shown in FIG. 8 based on the information in the terms of use table, including the collection, storage, and usage of personal data, and the consent procedure information data 422 (S12), and stores the service usage data metadata 412 (S13).

[0081] Next, the data distribution intermediary device 100 receives a service utilization data request message M12 from the data utilization device 300, and the data distribution control unit 130 judges the validity of the contents of the data request, thereby determining whether the data distribution intermediary device 100 should send a personal data request message M13 to the data providing device 200, or should send a rejection response to the data request to the data utilization device 300.

[0082] When the data circulation control unit 130 judges that the contents of the data request are valid, it transmits to the data providing device 200 a personal data request message M13 required for the new service that the data owner wishes to use.

[0083] Incidentally, even if there is no data request message M12 from the data utilization device 300, when a service request message M01 is received from the data owner terminal 10, a personal data request message M13 to the data providing device 200 may be transmitted.

[0084] Next, in response to a request from the data distribution intermediary device 100, the data providing device 200 refers to the consent procedure information data 422 to confirm that the user has given consent, searches for the necessary personal data using the user ID and data items, and sends a personal data provision response R12 including the personal data 401 to the data distribution intermediary device 100.

[0085] Next, the metadata attribute difference detection unit 113 detects the difference between the personal data metadata 411 in Fig. 7 and the service utilization data metadata 412 shown in Fig. 8 (S14). As shown in Fig. 8, the scenario-specific service utilization data metadata specification unit 114 detects which scenario's service is currently being provided, and specifies which metadata should be used from the metadata list in Fig. 8 based on the detected information. As a method of detecting which scenario's service is currently being provided, for example, it is possible to detect it from the contents of the service utilization data request message M12 from the data utilization device 300 (for example, by adding "normal time" or "emergency time" to the parameters). Then, the personal data conversion determination unit 115 determines whether or not the personal data needs to be converted based on the metadata difference detection result by the metadata attribute difference detection unit 113 in S14 (S15). If it is determined that personal data conversion is necessary (S15: Yes), the personal data conversion processing unit 116 performs a personal data conversion process (S16), whereas if it is determined in S16 that personal data conversion is not necessary (S15: No), the personal data conversion process S16 is skipped.

[0086] For example, the personal data conversion process in S16 can be realized by, for example, referring to the script management table 442 shown in Fig. 10 and executing the corresponding script according to the relevant data item and conversion specifications. Also, conversion of all data items may be performed by one conversion program.

[0087] Next, the data distribution intermediary device 100 refers to the data provision / data usage information data 420 regarding the received personal data necessary for the newly desired service, and generates data distribution control data 431 shown in FIG. 9 to provide to the data usage device 300 (S17).

[0088] Next, the data distribution intermediary device 100 transmits a service utilization data transfer response R12 including the service utilization data 402 to the data utilization device 300 without converting the personal data 401 or by using the data converted in S16 as the service utilization data 402. The service utilization data transfer response R12 includes a user ID for identifying the data owner, a service ID for identifying the service, and data items of the service utilization data 402 required for the service.

[0089] Next, the data distribution intermediary device 100 updates the history of data provided to the data utilization device 300 (S18). The data provision history includes a time stamp, a user ID, a service ID, and a data item.

[0090] Next, the data utilization device 300 utilizes the data to provide a service (S19), and transmits a service provision notification to the data owner terminal 10 (N11).

[0091] According to this embodiment, when there is a difference between the contents of data collected and held by a data provider and data handled by a service provider providing a new service, the necessity of data conversion is determined, and appropriate data conversion processing is performed, and then the data can be distributed. In addition, when the specifications of data held by the data provider are changed, when a service provider starts providing a new service, when a service to be provided has multiple scenarios, etc., the necessity of data conversion is determined and appropriate data conversion processing is performed in response to dynamic changes in the data held by the data provider and the data used in the service, and data can be distributed. This prevents data that cannot be used in providing a service from being distributed, and activates data distribution. In addition, the embodiment has been described using an example regarding the distribution of personal data, but it is not limited to personal data, and the present invention can also be applied to corporate data held by a company, and the same effects as those described above can be obtained.

[0092] [Embodiment 2] A second embodiment of the present invention will be described below with reference to FIGS.

[0093] In the first embodiment, an example of a data distribution intermediation system was described in which, when there is a difference in content between the data collected and held by a data provider and the data handled by a service provider offering a new service, the data distribution intermediation device determines whether data conversion is necessary and performs appropriate data conversion processing.

[0094] This embodiment relates to a system based on the data distribution intermediation system of the first embodiment, which introduces the concept of privacy rank for protecting the privacy of data owners.

[0095] The following description will focus on the differences from the data distribution intermediation system of the first embodiment.

[0096] First, a functional configuration diagram of the data distribution intermediary device according to the second embodiment will be described with reference to FIG. The data flow intermediary device according to the second embodiment differs from the first embodiment in that it holds privacy rank data 423 .

[0097] The privacy rank data 423 will be described in detail below with reference to FIG. The privacy rank data 423 is data describing how to convert data according to the rank for protecting individual privacy, and for example, as shown in FIG. 13, has fields for privacy rank 423a and vehicle position data 423b.

[0098] A code representing a privacy rank is stored in the privacy rank 423a. A form of data expression in the service usage data 402 is stored in the vehicle position data 423b.

[0099] In the example of Fig. 13, the smaller the number of the privacy rank, the stronger the privacy protection is set. For example, when the privacy rank 423a has a value of "1", only the country code is used as the service usage data, but when the privacy rank 423a has a value of "5", only the country code is used as the service usage data, but detailed information about where the vehicle is traveling, such as "road ID + road section ID + latitude and longitude", is disclosed.

[0100] Next, an example of a terms of use table according to the second embodiment will be described with reference to FIG. The terms of use table 421 according to the second embodiment differs from the terms of use table 421 according to the first embodiment shown in FIG. 6 only in the value of the terms of use content 422c corresponding to the terms of use ID 422a "A6" and the terms of use ID 422b "processing use."

[0101] In the content of the relevant terms of use in the terms of use table 421 of this embodiment, processing of stationary position information data and contact information are described using privacy ranks.

[0102] Next, an example of a script management table according to the second embodiment will be described with reference to FIG. In this embodiment, the script management table indicates that, in accordance with the processing content stipulated in the terms of use table 421 in FIG. 14, the attribute of the conversion of personal data of data ID 442a “D200” is expressed from “latitude and longitude”, which is an expression with a privacy rank of 4 in pre-conversion attribute 442b, to “area code”, which is an expression with a privacy rank of 3 in post-conversion attribute 442c.

[0103] As described above, according to this embodiment, by introducing the privacy rank, when the terms of use are revised, only the privacy rank data 423 needs to be modified, so that system modifications can be kept to a minimum and maintainability can be improved. [Explanation of symbols]

[0104] 5...network, 10...data owner terminal, 100...data distribution intermediary device, 200...data providing device, 300...data utilization device, 101...data provider management unit, 102...service provider management unit, 110...personal data conversion unit, 111...personal data metadata management unit, 112...service utilization data metadata management unit, 113...metadata attribute difference detection unit, 114...service utilization data metadata identification unit for each scenario, 115...personal data conversion determination unit, 116...personal data conversion processing unit , 121... terms of use management unit, 122... consent procedure management unit, 130... data distribution control unit, 140... communication unit, 150... storage unit, 401... personal data, 402... service usage data, 411... personal data metadata, 412... service usage data metadata, 420... data provision / data usage information data, 421... terms of use table, 422... consent procedure information data, 423... privacy rank data, 431... data distribution control data, 441... script data, 442... script management table

Claims

1. A data distribution intermediary device that mediates data exchange between a data provider's data providing device that collects and provides personal data provided by a data owner and a data utilization device of a service provider that provides service utilization data related to the personal data, comprising: a personal data metadata management unit that acquires personal data metadata, which is metadata of the personal data held by the data providing device; a service usage data attribute management unit that generates service usage data metadata, which is metadata related to the service usage data, based on terms of use regarding the distribution and use of the personal data; a metadata attribute difference detection unit that detects a difference between the personal data metadata and the service usage data metadata; a personal data conversion determination unit that determines whether or not conversion processing is required for the contents of the personal data based on the difference in metadata detected by the metadata attribute difference detection unit; a personal data conversion processing unit that converts the content of the personal data into the content of the corresponding service usage data, A data distribution intermediary device characterized in that the personal data conversion determination unit determines whether the contents of the personal data need to be converted, and when it is determined that the contents of the personal data need to be converted, the personal data conversion processing unit converts the contents of the personal data to the contents of the service usage data based on the service usage data metadata.

2. the terms of use regarding the distribution and use of the personal data are acquired by mutual communication between the data providing device and the data utilizing device; The mutual communication is a service usage request message including a service ID and transmitted from a data owner terminal to the data distribution intermediation device; a service terms of use request message including a service ID and transmitted by the data distribution intermediary device to the data utilization device; a service terms of use response that includes a service terms of use corresponding to the service ID and is transmitted by the data utilization device to the data distribution intermediary device; 2. The data distribution intermediary device according to claim 1, wherein the terms of use are determined by a service provider that provides a service corresponding to the service ID.

3. The data distribution intermediation device according to claim 1, characterized in that the personal data conversion processing unit converts the contents of the personal data into values ​​of the contents of the service usage data so as to match the attributes defined for each data item defined in the service usage data metadata.

4. 2. The data distribution mediation device according to claim 1, wherein the personal data conversion determination unit determines whether or not the contents of the personal data need to be converted based on a scenario of a service provided by the data utilization device.

5. 5. The data distribution mediation device according to claim 4, wherein said personal data conversion determination section changes the contents to be converted based on a scenario of a service provided by said data utilization device.

6. 2. The data distribution intermediary device according to claim 1, further comprising: privacy rank data; and information regarding terms of use for distributing and using said personal data based on a privacy rank defined in said privacy rank data.

7. Receive information from an external source as to whether or not the user has agreed to the terms of use regarding the distribution and use of the personal data; after receiving a service utilization data request message from the data utilization device, the personal data conversion determination unit determines whether or not the content of the personal data needs to be converted, and when it is determined that the content of the personal data needs to be converted, the personal data conversion processing unit converts the content of the personal data into the content of the service usage data based on the service usage data metadata; 2. The data distribution intermediary device according to claim 1, wherein the service utilization data is transmitted to the data utilization device.

8. 2. The data distribution intermediary device according to claim 1, wherein the personal data metadata is acquired based on a data catalog held by a data providing device.

9. 1. A data distribution intermediation method performed by a data distribution intermediation device that mediates data exchange between a data providing device of a data provider that collects and provides personal data provided by a data owner and a data utilization device of a service provider that provides service utilization data related to the personal data, comprising: a step of the data distribution intermediary device acquiring personal data metadata, which is metadata of the personal data held by the data providing device; a step in which the data distribution intermediary device generates service usage data metadata, which is metadata regarding the service usage data, based on terms of use regarding the distribution and use of the personal data based on a contract concluded between the data owner and the data provider or the service provider; a step of the data distribution intermediary device detecting a difference between the personal data metadata and the service usage data metadata; a step of the data distribution intermediary device determining whether or not conversion processing of the contents of the personal data is required based on the difference in metadata detected by the step of detecting the difference between the personal data metadata and the service usage data metadata; a step of converting the content of the personal data into the content of the service usage data based on the service usage data metadata when it is determined that the conversion is necessary in the step of determining whether the content of the personal data needs to be converted; the terms of use regarding the distribution and use of the personal data are acquired by mutual communication between the data providing device and the data utilizing device; The mutual communication is a service usage request message including a service ID and transmitted from a data owner terminal to the data distribution intermediation device; a service terms of use request message including a service ID and transmitted by the data distribution intermediary device to the data utilization device; a service terms of use response that includes a service terms of use corresponding to the service ID and is transmitted by the data utilization device to the data distribution intermediary device; the terms of use are determined by a service provider that provides a service corresponding to the service ID, A data distribution mediation method characterized in that, in a step of converting the content of the personal data into the content of the service usage data, the content of the personal data is converted to the content of the service usage data so as to match the attributes defined for each data item defined in the service usage data metadata.

Images