COMMUNICATION SYSTEM, RELAY PROCESSING DEVICE, INFORMATION PROCESSING METHOD, AND PROGRAM

Abstract

To provide a communication system, in which an information processing system configured in a private network can be used from a remote terminal device while maintaining a safe state.SOLUTION: A communication system 1 includes a first information processing system 901, a second information processing system 902, and a relay processing device 10. The relay processing device 10 includes a session control unit configured to start an encryption session when a first condition or a second condition corresponding to a remote terminal device 602 is satisfied, respectively, a first relay unit configured to relay the communication between the remote terminal device 602 and the first information processing system 901 in a first encryption session, and a second relay unit configured to relay the communication between the remote terminal device 602 and the second information processing system 902 in a second encryption session.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a communication system having two or more information processing systems and a relay processing device, a relay processing device, an information processing method, and a program. [Background technology]

[0002] 2. Description of the Related Art Conventionally, there is an information processing device that is used to refer to the contents of a database such as a customer management database (for example, see Patent Document 1 below). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2007-060225 A Summary of the Invention [Problem to be solved by the invention]

[0004] In recent years, attention has been focused on measures that allow workers to work in remote locations far from designated offices, such as the active introduction of telework. Such measures allow workers to work without having to go to or gather in an office, and can therefore be an effective solution in business continuity plans in the event of a disaster. In addition, such measures are also useful for realizing work sharing and enhancing the work-life balance, which is becoming increasingly important among workers as the so-called work style reform is promoted.

[0005] Incidentally, from the viewpoint of security, information processing systems using the information processing device described in Patent Document 1 are often configured in a network with a low risk of being accessed from the outside. In order to enable such information processing systems to be used from terminal devices participating from remote locations while maintaining a secure state, various measures must be taken, such as constructing a virtual private network that can be safely connected to the network.

[0006] Thus, there is a demand for making it possible to use an information processing system configured in a private network or the like from a terminal device in a remote location easily while maintaining a secure state. [Means for solving the problem]

[0007] The communication system of the first invention includes a first information processing device of a first information processing system configured in a first private network, a second information processing device of a second information processing system configured in a second private network, and a relay processing device communicatively connected to the first information processing device and communicatively connected to the second information processing device, and the relay processing device is configured to associate a remote identifier that identifies a remote terminal device used by a connecting party and that is connected to the relay processing device via a network different from the first private network and the second private network with a preset first condition that is a condition for relaying between the remote terminal device and the first information processing device, and a preset second condition that is a condition for relaying between the remote terminal device and the second information processing device. a session control unit that initiates a first encryption session for relaying communication between the remote terminal device and the first information processing device when a first condition corresponding to the remote identifier accepted by the remote reception unit is satisfied, and initiates a second encryption session for relaying communication between the remote terminal device and the second information processing device when a second condition corresponding to the remote identifier accepted by the remote reception unit is satisfied, a first relay unit that relays communication between the remote terminal device and the first information processing device in the first encryption session, and a second relay unit that relays communication between the remote terminal device and the second information processing device in the second encryption session.

[0008] With this configuration, an information processing system configured in a private network can be used easily from a remote terminal device while maintaining a secure state.

[0009] In addition, the communication system of the second invention is a communication system further including a session information storage unit that stores session information regarding the initiated first encrypted session or second encrypted session in a database when the first encrypted session or the second encrypted session is initiated by the session control unit.

[0010] With this configuration, the start of an encrypted session between the remote terminal device and the information processing device is recorded, thereby preventing unauthorized access, etc., and making it easy to confirm that the information processing system is operating securely.

[0011] In addition, the communication system of the third invention is a communication system according to the second invention, in which the database is a distributed ledger database realized in the communication system.

[0012] With this configuration, the start of an encrypted session between the remote terminal device and the information processing device is reliably recorded, thereby preventing unauthorized access, etc., from occurring and making it easy to confirm that the information processing system is operating securely.

[0013] Furthermore, a communication system of the present fourth invention is a communication system according to any one of the first to third inventions, wherein the first information processing system has two or more databases distributed and stored in two or more storage units, and each of the two or more databases stores first user information including a user identifier for one user and second user information including an attribute value different from the first user information for the one user in association with each other, and the first information processing device has a user information storage unit in which user information is stored, a user information accumulation unit that acquires two or more pieces of first user information included in each of the two or more databases in association with record identifiers that identify records of the database in which each piece of first user information is stored and accumulates the first user information in the user information storage unit, an access request information receiving unit that receives access request information for accessing the second user information associated with the user identifier, and an access control unit that accesses the second user information stored in the corresponding database based on the record identifier corresponding to the user identifier associated with the access request information received by the access request information receiving unit.

[0014] With this configuration, in response to an access request from a remote terminal device, information stored in each of two or more databases can be appropriately accessed.

[0015] In addition, the communication system of the fifth invention is a communication system according to the fourth invention, further comprising an access record storage unit that stores access records by the access control unit in a distributed ledger database realized in the first information processing system.

[0016] With this configuration, access records for access requests from remote terminal devices are reliably recorded, thereby preventing the occurrence of unauthorized access, etc., and making it easy to confirm that the information processing system is operating securely.

[0017] Furthermore, a communication system of the present sixth invention is a communication system in which, compared to any of the first to third inventions, a first information processing system has two or more databases stored in a distributed manner in two or more storage units, and the first information processing device has a user information storage unit in which user information is stored, a user information accumulation unit that acquires two or more pieces of user information each including a user identifier for a user stored in each of the two or more databases, corresponding to a record identifier that identifies the record of the database in which each piece of user information is stored, and accumulates the user information in the user information storage unit, a search request information receiving unit that receives search request information input by a requester for the user information, a search execution unit that searches for user information based on the search request information received by the search request information receiving unit, and a search result output unit that outputs the search results by the search execution unit.

[0018] With this configuration, it is possible to appropriately search for information stored in each of two or more databases in response to an access request from a remote terminal device.

[0019] In addition, the communication system of the seventh invention is a communication system in which, with respect to any of the first to sixth inventions, at least one of the first condition and the second condition includes a condition regarding the time during which the remote terminal device to be the relay target is allowed to connect.

[0020] With this configuration, it is possible to change the information processing systems in which a remote terminal device can participate, depending on time conditions.

[0021] In addition, the communication system of the eighth invention is a communication system in which, with respect to any one of the first to seventh inventions, at least one of the first condition and the second condition includes a condition related to information indicating the status of the remote terminal device to be relayed.

[0022] With this configuration, it is possible to change the information processing systems in which the remote terminal device can participate, depending on the conditions related to the information indicating the state of the remote terminal device.

[0023] A relay processing device of the ninth aspect of the present invention is a relay processing device constituting a communication system together with a first information processing device of a first information processing system configured in a first private network and a second information processing device of a second information processing system configured in a second private network, the relay processing device being communicatively connected to the first information processing device and communicatively connected to the second information processing device, the relay processing device including a remote identifier for identifying a remote terminal device used by a connecting party and connected to the relay processing device via a network different from the first private network and the second private network, a preset first condition which is a condition for relaying between the remote terminal device and the first information processing device, and a preset second condition which is a condition for relaying between the remote terminal device and the second information processing device. The relay processing device includes a relay device storage unit in which two or more associated pairs are stored; a remote reception unit that receives a remote identifier that identifies a remote terminal device to be relayed; a session control unit that initiates a first encryption session for relaying communication between the remote terminal device and a first information processing device when a first condition corresponding to the remote identifier received by the remote reception unit is satisfied, and initiates a second encryption session for relaying communication between the remote terminal device and a second information processing device when a second condition corresponding to the remote identifier received by the remote reception unit is satisfied; a first relay unit that relays communication between the remote terminal device and the first information processing device in the first encryption session; and a second relay unit that relays communication between the remote terminal device and the second information processing device in the second encryption session.

[0024] With this configuration, an information processing system configured in a private network can be used easily from a remote terminal device while maintaining a secure state. Effect of the Invention

[0025] The communication system, relay processing device, information processing method, and program of the present invention make it possible to easily use an information processing system configured in a private network from a remote terminal device while maintaining a secure state. [Brief description of the drawings]

[0026] [Figure 1] FIG. 1 is a diagram showing an overview of a communication system according to an embodiment of the present invention. [Diagram 2] A diagram showing an overview of the information processing system of the communication system. [Diagram 3] Block diagram of the information processing system [Figure 4] Block diagram of the information processing device [Diagram 5] Block diagram of the terminal device [Figure 6] FIG. 13 is a diagram illustrating an example of the operation of the information processing device. [Figure 7] A flowchart showing an example of the operation of the information processing device. [Figure 8] A flowchart showing an example of an index information generating and storing process of the information processing apparatus. [Figure 9] A flowchart showing an example of a search process of the information processing apparatus. [Figure 10] A flowchart showing an example of an access process of the information processing device. [Figure 11] FIG. 13 is a diagram showing a specific example of requester information stored in a requester information storage unit of the information processing device. [Figure 12] FIG. 13 is a diagram showing a specific example of authority information stored in an authority information storage unit of the information processing device. [Figure 13] 1 is a block diagram of a relay processing device according to an embodiment of the present invention. [Figure 14] FIG. 13 is a diagram showing an example of condition information used in the relay processing device; [Figure 15] FIG. 13 is a diagram showing another example of condition information used in the relay processing device; [Figure 16] A flowchart showing an example of the operation of the relay processing device. [Figure 17] FIG. 1 is a first sequence diagram showing an example of an operation of the communication system; [Figure 18] FIG. 2 is a second sequence diagram showing an example of an operation of the communication system; [Figure 19] A flowchart showing a modified example of the operation of the relay processing device. [Figure 20] Overview of the computer system according to the above embodiment. [Figure 21] Block diagram of the computer system DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0027] Hereinafter, an embodiment of a communication system and the like will be described with reference to the drawings. In the embodiments, components with the same reference numerals perform similar operations, so that repeated description may be omitted.

[0028] The terms used in the description of the embodiments are generally defined as follows. The meanings of these terms should not always be interpreted as shown here, but should be interpreted in light of the explanations given below for the embodiments, if any.

[0029] A requester is a person who uses an information processing system. For example, a requester is a person who uses an information processing system to view and operate information related to users. A user here refers exclusively to a target person (customer) who receives services, etc., through a business carried out using an information processing system. A connection party is a requester who uses an information processing system using a remote terminal device.

[0030] An identifier for an item is a character or code that uniquely identifies that item. An identifier is, for example, an ID, but any type of information is acceptable as long as it can identify the corresponding item. In other words, an identifier may be the name of the thing it represents, or a combination of codes that uniquely correspond to the thing. A combination of two or more pieces of information (for example, attribute values ​​of records recorded in a database) may also be used as an identifier.

[0031] User information refers to information about a user. User information may include various pieces of information corresponding to the user, such as a user identifier for identifying the user, the user's name, and information about the user's address (which may be the address number or location information indicating longitude and latitude, etc.). User information may be recorded as records in a database, and in that case, each piece of information included in the user information may be included as an attribute value of the record.

[0032] The term "acquisition" may include acquiring items input by a user or the like, or may include acquiring information stored in one's own device or another device (which may be information stored in advance or information generated by information processing performed in the device). Acquiring information stored in another device may include acquiring information stored in the other device via an API or the like, or may include acquiring the contents of a document file provided by another device (including the contents of a web page, etc.).

[0033] Also, the so-called machine learning technique may be used to acquire information. The machine learning technique can be used, for example, as follows. That is, a learning device that receives a specific type of input information as an input and outputs a type of output information to be acquired is configured using the machine learning technique. For example, two or more sets of input information and output information are prepared in advance, and the two or more sets of information are provided to a module for configuring a machine learning learning device to configure the learning device, and the configured learning device is stored in a storage unit. The learning device can also be called a classifier. Note that the machine learning technique may be, for example, deep learning, random forest, SVR, or the like. For machine learning, functions in various machine learning frameworks such as fastText, tinySVM, random forest, and TensorFlow, and various existing libraries can be used.

[0034] Regarding information, selecting and deciding are concepts including obtaining certain information, obtaining a link to certain information, setting a flag regarding certain information, and the like.

[0035] Outputting information is a concept that includes displaying on a display, projecting using a projector, printing on a printer, outputting sound, transmitting to an external device, storing on a recording medium, passing the processing results to another processing device or another program, etc. Specifically, it includes, for example, enabling information to be displayed on a web page, transmitting as e-mail, etc., and outputting information to be printed.

[0036] The concept of accepting information includes the acceptance of information input from input devices such as a keyboard, mouse, or touch panel, the reception of information transmitted from other devices via wired or wireless communication lines, and the acceptance of information read from recording media such as optical disks, magnetic disks, and semiconductor memories.

[0037] With regard to various types of information stored in information processing devices, etc., the term "update" is a concept that includes not only changing the stored information, but also adding new information to the stored information and deleting some or all of the stored information.

[0038] (Embodiment)

[0039] The outline of this embodiment is as follows. That is, in this embodiment, a communication system 1 includes two information processing systems 901, 902 and a relay processing device 10. The relay processing device 10 starts an encrypted session for relaying to a corresponding one of the two information processing systems 901, 902 based on a first condition and a second condition.

[0040] In addition, in this embodiment, as a typical example, each of the information processing systems 901, 902 has two or more databases distributed and arranged. Each of the two or more databases stores user information including first user information and second user information associated with each other. The information processing device 100 of the information processing systems 901, 902 enables access to the second user information stored in the corresponding second database based on an access request corresponding to the first user information. At this time, the information processing device 100 may control access to the second user information based on the authority information of the requester who requested the access, and for example, at least one of restricting access to some attribute values ​​and restricting the access method based on the authority information. The authority information may be defined for each of the two or more databases. In addition, the access record to the second user information may be stored in a distributed ledger database.

[0041] In this embodiment, the information processing systems 901 and 902 may search for and output user information, which is either the first user information or the second user information, based on search request information input by the requester. Here, the user information included in the search result may be output in association with identification information for visually indicating the database from which the information was obtained. Note that a search may be performed for a different search target for each requester. For example, a search may be performed using index information corresponding to the requester, or a search may be performed using user information or information derived therefrom in a database selected corresponding to the requester as the search target. Also, the content of the reception screen displayed to the requester may be changed depending on the requester.

[0042] The configuration of the communication system 1 thus configured will be described below.

[0043] Fig. 1 is a diagram showing an overview of a communication system 1 according to the present embodiment. Fig. 2 is a diagram showing an overview of an information processing system 900 of the communication system 1.

[0044] As shown in FIG. 1, in this embodiment, the communication system 1 includes a relay processing device 10, a remote terminal device 602, a first information processing system 901, a second information processing system 902, and a fourth external device 940.

[0045] In this embodiment, the first information processing system 901 and the second information processing system 902 have substantially the same hardware configuration and software configuration. Although the two are different and independent information processing systems, a device included in one of the information processing systems 901 and 902 may also be included in the other one. In this case, the device may be configured to independently operate as a device constituting the first information processing system 901 and as a device constituting the second information processing system 902.

[0046] In the following description, the first information processing system 901 and the second information processing system 902 may be referred to as information processing system 900 without distinction between them.

[0047] As shown in FIG. 2, each information processing system 900 includes a first external device 910, a second external device 920, a third external device 930, the information processing device 100, a local terminal device 601, and the like.

[0048] In this embodiment, the first external device 910 and the second external device 920 are devices used for different businesses. The first external device 910 is a device used for a business of supplying liquefied petroleum gas (LPG) for home use, for example (for example, the business of delivering gas cylinders, meter reading, and security of facilities are performed for users). On the other hand, the second external device 920 is a device used for a business of supplying water to each household (for example, the business of reading water usage and accounting such as collection of fees are performed for users). In addition, the present invention is not limited to this, and the device may be used for a business of selling and maintaining equipment, etc., associated with the business of supplying gas and water. In addition, these businesses may be operated by a single organization, or may be operated by separate organizations such as separate companies. In addition, the first external device 910 and the second external device 920 may be devices used by different organizations and used for the same business.

[0049] The third external device 930 is, for example, a node used to manage a distributed ledger database using block chain technology etc. The third external device 930 holds and manages the distributed ledger database together with other devices etc. connected via a network.

[0050] In this embodiment, the fourth external device 940 is configured in the same manner as the third external device 930. That is, the fourth external device 940, together with other devices connected via a network, holds and manages the distributed ledger database as one node. The distributed ledger database managed by the third external device 930 of the first information processing system 901, the distributed ledger database managed by the third external device 930 of the second information processing system 902, and the distributed ledger database managed by the fourth external device 940 may be the same as each other, any two of the distributed ledger databases may be the same, or all the distributed ledger databases may be different. In addition, when blockchain technology is used for the distributed ledger database, a so-called public blockchain may be constructed to realize the distributed ledger database, or it may be a permissioned blockchain in which only multiple authorized devices participate. A permissioned blockchain in which only multiple devices participate, each of which is managed by a specific entity different from each other, may be called a consortium blockchain.

[0051] In this embodiment, the devices included in the first information processing system 901 can communicate with each other via a first private network. That is, the first information processing system 901 is configured in the first private network. Also, the devices included in the second information processing system 902 can communicate with each other via a second private network. That is, the second information processing system 902 is configured in the second private network. The first private network and the second private network are physically independent networks such as, for example, a local area network (LAN), but are not limited to this. For example, they may be virtually constructed network segments regardless of the physical connection form. Note that, in each information processing system 900, some devices may be communicably connected to the private network via a public network such as the Internet. For example, the first external device 910 and the second external device 920 may be connected to the information processing system 900 from different organizations via the Internet, etc.

[0052] 1, in the communication system 1, the remote terminal device 602, the relay processing device 10, and the fourth external device 940 can communicate with each other via a network different from the first private network and the second private network. That is, the remote terminal device 602 can be connected to the relay processing device 10 via a network different from the first private network and the second private network. Here, the network different from the first private network and the second private network is, for example, the Internet, but is not limited to this.

[0053] In this embodiment, the relay processing device 10 is communicatively connected to a first private network. That is, the relay processing device 10 is connected to a first information processing system 901. The relay processing device 10 is communicatively connected to a second private network. That is, the relay processing device 10 is connected to a second information processing system 902. The relay processing device 10 and each private network may be communicatively connected via another information processing device or the like.

[0054] The configuration of the communication system 1 and the configuration of each information processing system 900 are not limited to those described above. The number of devices included in the communication system 1 and the information processing system 900 does not matter, and other devices may be included in the communication system 1 and the information processing system 900.

[0055] In this embodiment, the remote terminal device 602 and the local terminal device 601 are devices having the same configuration. In the following description, the remote terminal device 602 and the local terminal device 601 may be referred to as the terminal device 600 without being distinguished from each other. In addition, in FIG. 1 and FIG. 2, a personal computer (PC) such as a laptop computer is shown as the terminal device 600, but the terminal device 600 may be a so-called mobile information terminal device such as a smartphone, a tablet-type information terminal device, or other devices. The requester can use the information processing system 900 by using the terminal device 600. In the following example, it is assumed that the terminal device 600 is a so-called personal computer having a keyboard, a display, etc., but the present invention is not limited to this.

[0056] In this embodiment, the relay processing device 10 can establish an encrypted session with the remote terminal device 602. The encrypted session is a communication path for relaying communication between the remote terminal device 602 and one of the first information processing system 901 and the second information processing system 902. Such an operation of the relay processing device 10 will be described later. When the encrypted session is started, the remote terminal device 602 can function in the same manner as the local terminal device 601 in the first information processing system 901 or the second information processing system 902 through the relay processing device 10.

[0057] As an example, in the communication system 1, the information processing device 100 and the local terminal device 601 constituting each information processing system 900 may be located at a base such as a business office where a predetermined business is performed using the information processing system 900, such as a predetermined data center or a call center. The remote terminal device 602 may be located at a location of a connecting person that is physically and geographically separated from the base where each information processing system 900 is located, such as a residence or a predetermined satellite office. However, this is not limited, and each device may be connected to other devices as described above and may be used in various places. For example, the information processing device 100 and the local terminal device 601 constituting each information processing system 900 may be distributed at multiple bases. The remote terminal device 602 may be located at the same base as the information processing system 900 to which it is connected, and even in this case, the remote terminal device 602 may be connected to the relay processing device 10 via a network different from the private network. Furthermore, the remote terminal device 602 may be a terminal device connected to a third private network (not shown) different from those used in the first information processing system 901 and the second information processing system 902. That is, in this case, the remote terminal device 602 may be connected to the relay processing device 10 via a network outside the third private network, such as the Internet, while remaining connected to the third private network.

[0058] In the following description, the information processing device 100 included in the first information processing system 901 may be referred to as the first information processing device 100. Also, the information processing device 100 included in the second information processing system 902 may be referred to as the second information processing device 100.

[0059] Prior to describing the communication system 1, the configuration of the information processing system 900 will be described.

[0060] Fig. 3 is a block diagram of the information processing system 900. Fig. 4 is a block diagram of the information processing device 100. Fig. 5 is a block diagram of the terminal device 600.

[0061] First, the configurations of the first external device 910, the second external device 920, and the third external device 930 will be described.

[0062] 3, the first external device 910 includes a first external device storage unit 911, a first external device processing unit 915, a first external device transmitting unit 916, and a first external device receiving unit 917. The first external device 910 is, for example, a server device having a general configuration, but is not limited thereto, and may be another type of electronic computer, or may be a device realized by connecting a plurality of devices to each other. The first external device 910 is connectable to a network, and is configured to be able to communicate with other devices connected to the network.

[0063] The first external device storage unit 911 is preferably a non-volatile recording medium, but may also be a volatile recording medium. Various information, programs, and the like are stored in the first external device storage unit 911. The process by which this information, etc. is stored does not matter. For example, information may be stored in the first external device storage unit 911 via a recording medium, information transmitted via a communication line, etc. may be stored in the first external device storage unit 911, or information inputted via an input device may be stored in the first external device storage unit 911.

[0064] The first external device storage unit 911 includes a first database storage unit 912 .

[0065] The first database is stored in the first database storage unit 912. The first database will be described later.

[0066] The first external device processing unit 915 can usually be realized by an MPU, a memory, etc. The processing procedure of the first external device processing unit 915 is usually realized by software, and the software is recorded in a recording medium such as a ROM. However, it may also be realized by hardware (dedicated circuit). The first external device processing unit 915 performs, for example, acquisition of information in the first external device 910. For example, it performs operations on various databases stored in the first external device storage unit 911 based on the acquired SQL statements, etc.

[0067] The first external device transmission unit 916 transmits information read from the first external device storage unit 911 or the like by the first external device processing unit 915. For example, the first external device transmission unit 916 transmits user information read from the first external device storage unit 911 based on the operation of the first external device processing unit 915 to the information processing device 100, the terminal device 600, or the like via a network.

[0068] The first external device receiving unit 917 receives information transmitted from the information processing device 100 or other devices via a network. The first external device receiving unit 917 accumulates the received information, for example, in the first external device storage unit 911, so that the first external device processing unit 915 and the like can acquire the information.

[0069] The second external device 920 is also a server device configured similarly to the first external device 910. That is, the second external device 920 includes a second external device storage unit 921 having a hardware configuration similar to that of the first external device storage unit 911. The second external device 920 also includes a second external device processing unit 925, a second external device transmitting unit 926, and a second external device receiving unit 927. The second external device processing unit 925, the second external device transmitting unit 926, and the second external device receiving unit 927 are configured similarly to the first external device processing unit 915, the first external device transmitting unit 916, and the first external device receiving unit 917, respectively, and detailed description thereof will be omitted.

[0070] The second external device storage unit 921 includes a second database storage unit 922. The second database storage unit 922 stores a second database.

[0071] In this embodiment, each of the first database and the second database includes user information about two or more users (customers). In this embodiment, the user information includes at least a user identifier for identifying the user and one or more attribute values ​​(sometimes called user attribute values) related to the user. For example, the user information includes a user identifier consisting of a code that uniquely identifies the user, and information such as the user's name, address, and telephone number. In addition to these pieces of information, the user information may include other user attribute values ​​for each user. The user attribute values ​​may include various information such as user location information (user location information; for example, the address and latitude and longitude information of the user's home), memo information recorded about the user, and the like. Note that, when something other than the user's name is the user identifier, it is preferable that the user's name is included as another user attribute value. The user's name may be the user identifier.

[0072] At least one of the first database and the second database may be provided inside the information processing device 100, rather than being provided in an external device of the information processing device 100.

[0073] In this embodiment, the user information is information in which first user information including a user identifier related to one user is associated with second user information including an attribute value different from the first user information about one user. For example, the user information may be one record stored in any database. Also, the first user information and the second user information may be stored as records in different tables. The second user information may be called user detail information. That is, in this embodiment, it can be said that each of two or more databases stores the first user information including a user identifier related to one user and the second user information including an attribute value different from the first user information about one user in association with each other.

[0074] In this embodiment, the first user information includes a user identifier and some attribute values ​​(e.g., the user's address, etc.). The second user information includes other attribute values. For example, the user attribute values ​​included in the second user information include information that is relatively more sensitive than the information included in the first user information, such as the user's family structure, the user's contract information, the user's usage information (e.g., gas and water usage), and the user's payment information, but are not limited to this.

[0075] Here, it is preferable that the first database and the second database distributed in the first external device 910 and the second external device 920 are interconnected using an inter-system linking platform called "X-Road" (https: / / e-estonia.com / solutions / interoperability-services / x-road / ) or the like. This allows the information processing device 100 to access each database in an easily executable manner without having to deal with the differences in the arrangement and system configuration of two or more distributed databases individually.

[0076] The third external device 930 is also a server device having a hardware configuration similar to that of the first external device 910. That is, the third external device 930 includes a third external device storage unit 931 having a hardware configuration similar to that of the first external device storage unit 911. In addition, like the first external device 910, the third external device 930 includes various units such as a third external device processing unit 935, a third external device transmitting unit 936, and a third external device receiving unit 937, but detailed description thereof will be omitted.

[0077] The third external device storage unit 931 includes a third database storage unit 932. A distributed ledger database is stored in the third database storage unit 932. It is desirable that the distributed ledger database be managed using a distributed ledger technology that uses, for example, so-called blockchain technology or other timestamp technology using hashed information.

[0078] It should be noted that the first external device 910, the second external device 920, and the third external device 930 may be interpreted as not being included in the information processing system 900. In this case, for example, each device of the information processing system 900 may be configured to be able to communicate with two or more other external devices having the same configuration as the first external device 910 and the second external device 920 via a network. That is, the information processing system 900 may be configured to be able to access two or more databases that are stored in a distributed manner. In addition, the third external device 930 may not be provided, and the function of the third external device 930 may be performed by another device of the information processing system 900.

[0079] 4, the information processing device 100 includes a storage unit 110, a receiving unit 120, a reception unit 130, a processing unit 140, and an output unit 160. The information processing device 100 is, for example, a server device.

[0080] The storage unit 110 includes a user information storage unit 111 , an index information storage unit 112 , a requester information storage unit 113 , and an authority information storage unit 114 .

[0081] The storage unit 110 is preferably a non-volatile recording medium, but may also be a volatile recording medium. Each part of the storage unit 110 stores information acquired by the receiving unit 120 or the processing unit 140, for example, but the process by which information is stored in each part of the storage unit 110 is not limited to this. For example, information may be stored in the storage unit 110 via a recording medium, information transmitted via a communication line or the like may be stored in the storage unit 110, or information inputted via an input device may be stored in the storage unit 110.

[0082] The user information storage unit 111 stores the user information acquired by the user information accumulation unit 141 .

[0083] The index information storage unit 112 stores the index information acquired by the index information accumulation unit 142 .

[0084] The requester information storage unit 113 stores requester information related to a requester who uses the information processing system 900. The requester information includes, for example, two or more pieces of information in which a requester identifier that identifies one requester and an attribute value that indicates information about the requester are associated with each other, but is not limited to this. The attribute value includes, for example, information that identifies the terminal device 600 used by the requester. The attribute value also includes, for example, information that identifies the role of the requester, such as the group to which the requester belongs, the type of job, or the position of the job, or an identifier corresponding to the information. Note that the attribute value may include other attribute values. Note that the requester information storage unit 113 may be provided in a storage unit of an external device. That is, the requester information does not need to be stored in the storage unit 110 of the information processing device 100.

[0085] The authority information storage unit 114 stores authority information. In this embodiment, the authority information is information on the access authority that each requester has for the records of each database. The access authority may be defined for each requester (each requester identifier), for example. Also, the access authority may be defined in association with information that identifies the role of the requester or an identifier corresponding to the information. In this case, the access authority corresponding to each requester identifier can be specified based on the requester information. The access authority may be set with respect to at least one of restricting access to some attribute values ​​of the second user information (restricting the target that can be operated) and restricting the access method for the second user information that is the target of the access request (type of operation that can be performed on the second user information).

[0086] In this embodiment, the authority information collectively defines the access authority for two or more records stored in the database for each of two or more databases. That is, the authority information for one requester includes information indicating the content of the access authority to the user information stored in the first database and information indicating the content of the access authority to the user information stored in the second database. Note that the authority information may collectively define the access authority for all records in two or more databases, or may define different access authority for each record, such as access authority corresponding to a specific attribute value of each record.

[0087] The receiving unit 120 receives information transmitted from another device. The receiving unit 120 stores the received information in the storage unit 110, for example.

[0088] The receiving unit 130 includes an access request information receiving unit 131 , a search request information receiving unit 132 , and a display request information receiving unit 133 .

[0089] The accepting unit 130 accepts information received by the receiving unit 120. The accepting unit 130 may accept information input using an input means connected to the information processing device 100, or information input by an input operation (including information read by a device, for example) performed using a reading device (for example, a code reader, etc.) connected to the information processing device 100. The accepted information is stored in the storage unit 110, for example.

[0090] The access request information receiving unit 131 receives access request information. The access request information is, for example, information input by a requester for accessing second user information, and is information associated with a user identifier. In other words, the access request information is information for designating a target user and accessing the second user information of the user. In this embodiment, when the access request information receiving unit 131 receives access request information, it also receives a requester identifier that identifies the requester who input the access request information. In other words, the access request information received by the access request information receiving unit 131 is associated with a requester identifier that identifies the requester who requested access.

[0091] The input of the access request information may be performed in various ways. For example, an operation of designating one piece of first user information among the first user information related to a plurality of users displayed on a display in order to request confirmation of the second user information (regardless of the operation type, such as an operation using a keyboard or a pointing device, an operation by voice, etc.) may correspond to the input of the access request information. Also, for example, an operation for inputting, changing, deleting, etc. an attribute value of the second user information of one or more users displayed on a display may correspond to the input of the access request information. In other words, the input of the access request information may be said to be the input of information for requesting the acquisition, change, etc. of the attribute value of the second user information corresponding to one user identifier to a database including a record corresponding to the user identifier.

[0092] The search request information receiving unit 132 receives search request information for user information that is either the first user information or the second user information. The search request information is information provided to the information processing device 100 to narrow down user information that can be output in the information processing device 100 by searching. The search request information may include, for example, various information specifying a character string or conditions for a search. In this embodiment, when the search request information receiving unit 132 receives the search request information, the search request information receiving unit 132 also receives a requester identifier that identifies the requester who inputted the search request information. In other words, the search request information received by the search request information receiving unit 132 is associated with a requester identifier that identifies the requester who requested the search.

[0093] The display request information receiving unit 133 receives reception screen display request information input from a requester, which requests the display of a reception screen for receiving search request information. In this embodiment, the information processing device 100 is a web server, and can output information that can be displayed by a web browser operating on the terminal device 600. The reception screen display request information is information output from the terminal device 600 to display the reception screen in a web browser operating on the terminal device 600. Note that the information processing device 100 does not have to be a web server, and the reception screen display request information may be information output from the terminal device 600 to display the reception screen in another application operating on the terminal device 600. Note that in this embodiment, when the display request information receiving unit 133 receives the reception screen display request information, it also receives a requester identifier that identifies the requester who inputs the reception screen display request information. In other words, the reception screen display request information received by the display request information receiving unit 133 is associated with a requester identifier that identifies the requester who requested the display of the reception screen.

[0094] Note that the input of access request information, search request information, and reception screen display request information means that the requester indirectly inputs the information to the information processing device 100 via the terminal device 600 or the like, but may also be interpreted as meaning that the requester directly inputs the information to the information processing device 100 using an input means. Also, the access request information, search request information, and reception screen display request information do not necessarily have to be information generated based on the requester's direct action (input operation, etc.). In other words, the input of the request information may include various actions that cause the request information to be provided to the information processing device 100, such as executing a program that automatically generates the request information or providing various information to cause it to function.

[0095] The processing unit 140 includes a user information storage unit 141, an index information storage unit 142, a search execution unit 143, an access control unit 144, and an access record storage unit 145. The processing unit 140 performs various types of processing. The various types of processing are, for example, processing performed by each unit of the processing unit 140 as follows.

[0096] The user information accumulation unit 141 acquires two or more pieces of user information contained in at least one of the first database and the second database. That is, the user information accumulation unit 141 acquires two or more pieces of user information contained in at least one of the two or more databases, which are stored in a distributed manner and include a database stored in at least one or more external devices. The user information accumulation unit 141 accumulates the acquired user information in the user information storage unit 111.

[0097] In this embodiment, the user information accumulation unit 141 acquires and accumulates the first user information from among the user information. The user information accumulation unit 141 acquires two or more pieces of first user information contained in each of two or more databases in association with a record identifier that identifies a record in the database in which each piece of first user information is stored, and accumulates the pieces in the user information storage unit 111. In this embodiment, the record identifier is associated with a database identifier that identifies an acquisition source database (referring to a database from which the user information accumulation unit 141 acquires the record) in which the record identified by the record identifier is stored, but is not limited to this. That is, in this embodiment, the first user information stored in the user information storage unit 111 is associated with information that can identify the acquisition source database and the records stored therein. In addition, the database identifier may be a device identifier that identifies an external device in which the acquisition source database is managed.

[0098] The index information accumulation unit 142 generates index information for searching for user information corresponding to each first user information based on two or more pieces of first user information stored in the user information storage unit 111, and accumulates the generated index information in the index information storage unit 112. In generating the index information, searchable information is acquired from among the user information corresponding to the first user information recorded in each database (user information corresponding to a user identifier), and the acquired information is included in the index information. The index information is, for example, information having a data structure suitable for a search of a predetermined search algorithm by the search execution unit 143, but is not limited thereto, and may be, for example, information including the acquired user information as it is. By using such index information, the information processing device 100 does not need to access the first external device 910 and the second external device 920 every time a search is performed. Therefore, the user information can be searched at high speed, and the load on the information processing system 900 during the search can be reduced.

[0099] Here, in this embodiment, the index information is stored in association with the requester identifier. That is, the index information storage unit 142 stores index information generated in association with each requester identifier so as to make user information in a range corresponding to the access authority held by the requester searchable. That is, the index information storage unit 142 acquires two or more pieces of index information including different contents for searching user information, and stores them in the index information storage unit 112 in association with the corresponding requester identifier. Such index information in a range corresponding to the access authority is generated based on the authority information stored in the authority information storage unit 114. Note that, when there are two or more requester identifiers having the same access authority, the index information storage unit 142 may generate index information in a range corresponding to the access authority once, and store the generated index information in association with the two or more requester identifiers. Also, the index information storage unit 142 may acquire authority information corresponding to the requester identifier for each of all requester identifiers based on the requester information, generate index information, and store the generated index information in association with the requester identifier.

[0100] The index information is generated periodically. For example, the index information is generated at a predetermined time every day. The index information may be generated according to another predetermined schedule, or may be generated when the receiving unit 130 receives information requesting the generation of the index information.

[0101] The search execution unit 143 searches for user information by generating a search query, etc., based on the search request information accepted by the search request information acceptance unit 132. For example, the search execution unit 143 searches for a different search target for each requester who inputs the search request information, based on a requester identifier that identifies the requester who inputs the search request information.

[0102] In this embodiment, the search execution unit 143 searches for user information using index information stored in the index information storage unit 112. For example, based on a requester identifier that identifies a requester who inputs search request information, the search execution unit 143 searches using one of two or more pieces of index information stored in the index information storage unit 112 that corresponds to the requester identifier. That is, the search execution unit 143 searches for user information within a range according to the access authority of the requester who inputs the search request information. Note that the search execution unit 143 may directly search for user information stored in the user information storage unit 111 or the user information stored in the first database or the second database without using index information.

[0103] The search execution unit 143 may search for user information stored in a specific database associated with a requester identifier that identifies the requester who inputs the search request information, or information derived therefrom. For example, if the requester is particularly related to the first database, when the requester inputs the search request information, the first database may be accessed and searched for with the user information stored in the first database as the search target. In addition, when the requester inputs the search request information, the search may be performed with index information (an example of information derived from user information stored in a specific database) that is generated in advance based on the user information stored in the first database as the search target, or with first user information (an example of information derived from user information stored in a specific database) that is acquired in advance from the first database and accumulated in the user information storage unit 111 and stored in the user information storage unit 111 as the search target.

[0104] The access control unit 144 accesses the second user information stored in the corresponding database based on the record identifier corresponding to the user identifier associated with the access request information accepted by the access request information accepting unit 131. The access means, for example, using an SQL query or the like to cause the management program of each database to execute database operations such as browsing (an example of acquisition), updating, adding, deleting, and the like (access method) of information included in the record, but is not limited thereto. The access control unit 144 may be configured to access the second user information stored in the corresponding database using an API, or may be configured to access the second user information using a function or the like.

[0105] In this embodiment, specifically, when the access request information receiving unit 131 receives access request information, the access control unit 144 acquires authority information regarding the access authority of a requester identified by a requester identifier corresponding to the access request information. Based on the acquired authority information, the access control unit 144 generates a query for access when the requester has access authority. Then, the access control unit 144 executes access to the corresponding database using the generated query. In other words, the access control unit 144 restricts access to and an access method for the second user information that is the target of the access request according to the access authority of the requester. More specifically, the access control unit 144 may be configured to be able to restrict access to some attribute values ​​of the second user information that is the target of the access request, and to restrict the type of operation (select, update, append, delete, etc.) that is allowed for the second user information that is the target of the access request, according to the access authority of the requester.

[0106] The access record storage unit 145 is configured to be able to store information in a distributed ledger database managed by the third external device 930 or the like. The access record storage unit 145 stores access records relating to accesses made by the access control unit 144 in a distributed ledger database realized in the information processing system 900. As a result, the access trails such as the act of acquiring user information from each of the first database and the second database are recorded by the information processing device 100 in a state that makes it difficult to tamper with them.

[0107] The output unit 160 includes a search result output unit 161 and a reception screen information output unit 162. In the present embodiment, the output unit 160 outputs information by transmitting the information to another device using the transmission unit 170 or the like, but is not limited to this, and may output information by displaying the information on a display device provided in the information processing device 100, for example.

[0108] The search result output unit 161 outputs information indicating the search results by the search execution unit 143. Specifically, the search result output unit 161 outputs, for example, user information included in the search results (such as a user identifier corresponding to the user information hit by the search) in association with identification information for visually indicating the database from which the user information was acquired. The identification information may be, for example, an image indicating a predetermined mark or code, a code string that can be displayed as a character, or information for indicating the user information in a character color or background color corresponding to the database from which the user information was acquired. For example, the identification information stored in the storage unit 110 in association with a record identifier or a database identifier may be output based on a user identifier corresponding to the user information included in the search results. For the user information included in the search results, second user information may be acquired as necessary and included in the search results. In other words, the search result output unit 161 may output the user information included in the search results so that it is displayed on the terminal device 600 or the like in a visual form corresponding to the database from which the user information was acquired.

[0109] The information indicating the search results is, for example, information that can display the search results as a web page on the terminal device 600 (for example, an HTML format document, or information used in a web page generation system (such as a content management system) that functions on the information processing device 100 or the terminal device 600), but is not limited to this.

[0110] The reception screen information output unit 162 outputs reception screen information for displaying a reception screen, based on reception screen display request information accepted by the display request information accepting unit 133. The reception screen information is, for example, information used to display the reception screen as a web page and stored in advance in the storage unit 110 (for example, a document in HTML format, or information used in a web page generation system (such as a content management system) functioning in the information processing device 100 or the terminal device 600), but is not limited thereto.

[0111] The reception screen information output unit 162 may output reception screen information based on a requester identifier that identifies a requester who inputs reception screen display request information. Specifically, for example, reception screen information may be output so that the contents of the access authority according to the requester identifier are visually displayed, or reception screen information for displaying a reception screen that allows search request information to be input only in a predetermined mode according to the access authority may be output.

[0112] The transmitting unit 170 transmits information to other devices constituting the information processing system 900 via a network. The transmitting unit 170 transmits, for example, information output by the output unit 160. The information output by the search result output unit 161 is transmitted to the terminal device 600 of the requester who inputted the search request information, based on the requester identifier of the requester. Furthermore, the information output by the reception screen information output unit 162 is transmitted to the terminal device 600 of the requester who inputted the reception screen display request information, based on the requester identifier of the requester.

[0113] Next, the configuration of the terminal device 600 will be described.

[0114] As shown in FIG. 5, the terminal device 600 includes a terminal storage unit 610, a terminal receiving unit 620, a terminal acceptance unit 630, a terminal processing unit 640, a terminal output unit 660, and a terminal transmission unit 670.

[0115] The terminal device 600 is, for example, a general personal computer, and has a display as an output device, an input device (for example, a keyboard, a pointing device, etc.) used for input operations by the requester, etc., but is not limited to these. The terminal device 600 is connectable to a network, and is configured to be able to communicate with other devices connected to the network.

[0116] The terminal storage unit 610 is preferably a non-volatile recording medium, but may also be a volatile recording medium. Various information, programs, etc. are stored in the terminal storage unit 610. The process by which this information, etc. is stored is not important. For example, information may be stored in the terminal storage unit 610 via a recording medium, information transmitted via a communication line, etc. may be stored in the terminal storage unit 610, or information inputted via an input device may be stored in the terminal storage unit 610.

[0117] The terminal receiving unit 620 includes a reception screen information receiving unit 621. The terminal receiving unit 620 receives information transmitted from the information processing device 100 or other devices via a network. The terminal receiving unit 620 accumulates the received information, for example, in the terminal storage unit 610, so that the device processing unit 640 or the like can acquire the information.

[0118] The reception screen information receiving unit 621 receives the reception screen information transmitted from the information processing device 100 and stores it in the terminal storage unit 610 .

[0119] The terminal reception unit 630 receives various input operations for the terminal device 600 by a requester who uses the terminal device 600. The operations are performed, for example, using an input device (not shown), but are not limited to this. For example, the terminal reception unit 630 may receive an input operation by voice input through a microphone, or may receive an input operation performed using a reading device (for example, a code reader) connected to the terminal device 600.

[0120] The terminal processing unit 640 uses each unit of the terminal device 600 to perform various information processing operations.

[0121] The terminal output unit 660 outputs information, for example, by displaying it on a display device. Note that the method of outputting information is not limited to this, and information may be output by outputting sound or the like from a speaker or the like.

[0122] The terminal transmitting unit 670 includes an access request information transmitting unit 671, a reception screen display request information transmitting unit 672, and a search request information transmitting unit 673. The terminal transmitting unit 670 transmits, for example, information acquired by the device processing unit 640 or the like via a network.

[0123] When the terminal reception unit 630 receives an input operation of access request information by a requester, the access request information transmission unit 671 transmits the access request information to the information processing device 100 .

[0124] The reception screen display request information transmitting unit 672 transmits reception screen display request information to the information processing device 100 when an input operation by a requester requesting display of a reception screen is received by the terminal receiving unit 630.

[0125] When the terminal reception unit 630 receives an input operation of search request information by a requester, the search request information transmission unit 673 transmits the search request information to the information processing device 100 .

[0126] FIG. 6 is a diagram illustrating an example of the operation of the information processing device 100. In FIG.

[0127] 6, the user information storage unit 141 of the information processing device 100 acquires and stores first user information from a first external device 910 and a second external device 920 that are located at different locations. That is, the user information storage unit 141 acquires the first user information contained in the first database from the first external device 910, and acquires the second user information contained in the second database from the second external device 920.

[0128] Furthermore, the index information storage unit 142 generates and stores index information based on information acquired from the first external device 910 and the second external device 920. For example, if there are two types of access authority of a requester (temporarily called authority A and authority B), two pieces of index information corresponding to the respective types are generated.

[0129] Assume that, for example, a terminal device 600 used by a requester having authority A and a terminal device 600 used by a requester having authority B each transmit search request information (sometimes simply referred to as a search request) and access request information for second request information corresponding to first user information (sometimes simply referred to as an access request) to such an information processing device 100.

[0130] When a search request is made from the terminal device 600 used by a requester having the A authority, the search execution unit 143 performs a search using index information generated for the A authority. The search result is transmitted to the terminal device 600, and the search result according to the access authority of the requester of the terminal device 600 is output in the terminal device 600. When an access request is made from the terminal device 600 used by a requester having the A authority, the access control unit 144 accesses the first database or the second database based on the access request according to the A authority if access is possible, and performs processing such as obtaining second user information. This makes it possible to view the second user information on the terminal device 600.

[0131] On the other hand, when a search request is made from the terminal device 600 used by a requester having authority B, the search execution unit 143 performs a search using index information generated for authority B. As a result, a search result according to the access authority of the requester of the terminal device 600 is output in the terminal device 600. Also, when an access request is made from the terminal device 600 used by a requester having authority B, the access control unit 144 performs processing such as acquiring second user information based on the access request if access is possible according to authority B, and enables the second user information to be viewed in the terminal device 600.

[0132] An access trail indicating that the information processing device 100 has accessed the first external device 910 or the second external device 920 is recorded in the third database by the access record storage unit 145 of the information processing device 100. By recording the access trail in a recording mode that makes it difficult to tamper with, it becomes possible to verify, for example, even the access records to sensitive user information and the like.

[0133] FIG. 7 is a flowchart showing an example of the operation of the information processing device 100.

[0134] The information processing device 100 performs various operations, for example, as follows: Note that such operations may be terminated, for example, when the power supply of the information processing device 100 is turned off.

[0135] (Step S101) As shown in FIG. 7, the user information accumulation unit 141 acquires, from each of two or more databases, the first user information recorded in the database, and accumulates it in the user information storage unit 111.

[0136] (Step S102) The processing unit 140 judges whether or not the timing for generating index information has arrived. If the timing for generating index information has arrived, the processing proceeds to step S103, and if not, the processing proceeds to step S104.

[0137] (Step S103) Index information accumulation unit 142 performs index information generation and accumulation processing. As a result, index information corresponding to each requester identifier is stored in index information storage unit 112. When the index information generation and accumulation processing ends, the process proceeds to step S104.

[0138] (Step S104) The processing unit 140 judges whether or not the display request information receiving unit 133 has received the reception screen display request information. If the reception screen display request information has been received, the process proceeds to step S105, and if not, the process proceeds to step S106.

[0139] (Step S105) The reception screen information output unit 162 outputs reception screen information for displaying a reception screen, based on the reception screen display request information accepted by the display request information accepting unit 133. The transmitting unit 170 transmits the reception screen information to the terminal device 600 of the requester who inputs the reception screen display request information, based on the requester identifier of the requester.

[0140] (Step S106) Processing unit 140 judges whether or not search request information has been received by search request information receiving unit 132. If search request information has been received, the process proceeds to step S107, and if not, the process proceeds to step S108.

[0141] (Step S107) The search execution unit 143 performs a search process based on the search request information accepted by the search request information acceptance unit 132. As a result, the search result is transmitted to the terminal device 600 of the requester.

[0142] (Step S108) Processing unit 140 judges whether or not access request information has been received by access request information receiving unit 131. If access request information has been received, the process proceeds to step S109, and if not, the process returns to step S102.

[0143] (Step S109) The access control unit 144 performs access processing based on the access request information accepted by the access request information accepting unit 144. When the access processing ends, the process returns to step S102.

[0144] FIG. 8 is a flowchart showing an example of the index information generating and storing process of the information processing device 100. As shown in FIG.

[0145] The index information accumulation unit 142 accumulates the index information in the index information storage unit 112 in association with each requester identifier included in the requester information, for example, as follows.

[0146] (Step S121) The index information storage unit 142 sets a counter i to 1.

[0147] (Step S122) The index information accumulation unit 142 acquires, from the authority information storage unit 114, authority information corresponding to the i-th requester identifier among the requester identifiers included in the requester information.

[0148] (Step S123) The index information accumulation unit 142 acquires user information within a range corresponding to the authority information from the user information acquired from each of the two or more databases, and generates index information using the acquired user information.

[0149] (Step S124) The index information accumulation unit 142 accumulates the generated index information in the index information storage unit 112 in association with the i-th requester identifier.

[0150] (Step S125) The index information storage unit 142 judges whether the counter i is the total number of requester identifiers included in the requester information. If i is the total number of requester identifiers, the index information generation and storage process ends and returns to the process shown in Fig. 7, otherwise proceeds to step S126.

[0151] (Step S126) The index information accumulation unit 142 increments the counter i by 1. The process returns to step S122.

[0152] In addition, without being limited to the above processing, index information may be generated for each access right granting pattern (mode of granting access right for one requester), and each requester identifier may be associated with the index information corresponding to the mode of granting access right for that requester and stored.

[0153] FIG. 9 is a flowchart showing an example of the search process of the information processing device 100.

[0154] (Step S141) The search execution unit 143 acquires a requester identifier corresponding to the search request information. The requester identifier is, for example, a requester identifier accepted by the search request information accepting unit 132 and identifying the requester who input the search request information.

[0155] (Step S142) The search execution unit 143 identifies, from among the index information stored in the index information storage unit 112, the index information that corresponds to the requester identifier.

[0156] (Step S143) The search execution unit 143 searches the index information using the search request information, thereby obtaining the search results.

[0157] (Step S144) The search result output unit 161 acquires and outputs the search results by the search execution unit 143. For example, the search result output unit 161 generates user information hit by the search in association with identification information for visually indicating the database from which the user information was acquired. Note that the search result output unit 161 may acquire second user information related to the user information hit by the search from each database and include it in the search results.

[0158] (Step S145) The transmitting unit 170 transmits the search result to the terminal device 600 corresponding to the requester identifier. This makes it possible for the search result to be displayed in the form of a web page or the like in the terminal device 600. Return to the processing shown in FIG.

[0159] FIG. 10 is a flowchart showing an example of the access process of the information processing device 100. As shown in FIG.

[0160] (Step S161) The access control unit 144 acquires a requester identifier and a record identifier corresponding to the access request information.

[0161] (Step S162) The access control unit 144 acquires authority information based on the requester identifier.

[0162] (Step S163) The access control unit 144 judges whether or not the requester who inputted the access request information has the access authority to perform the access as requested based on the authority information. If the requester has the access authority, the process proceeds to step S165, and if not, the process proceeds to step S164.

[0163] (Step S164) Access control unit 144 does not perform access, and generates error information indicating that access has not been performed. Transmission unit 170 transmits the error information to terminal device 600 corresponding to the requester identifier. Note that generation and transmission of error information do not have to be performed. When the process of step S164 ends, the process returns to the process shown in FIG. 7.

[0164] (Step S165) The access control unit 144 creates a query for performing access based on the access request information and the record identifier.

[0165] (Step S166) The access control unit 144 uses the query to access the database.

[0166] (Step S167) The access control unit 144 acquires information indicating a result of the access. For example, when an access is made to acquire second user information, the second user information is acquired.

[0167] (Step S168) The transmission unit 170 transmits information (e.g., second user information, etc.) acquired as a result of the access by the access control unit 144 to the terminal device 600 corresponding to the requester identifier. Note that information indicating the result of the access may be generated by the output unit 160, and the generated information may be output by the transmission unit 170. For example, the output unit 160 may generate information for displaying the acquired information as a web page on the terminal device 600 (e.g., a document in HTML format, or information used in a web page generation system (such as a content management system) functioning on the information processing device 100 or the terminal device 600). In this way, the result of the access can be displayed in the form of a web page or the like on the terminal device 600. Return to the process shown in FIG. 7.

[0168] Specific examples of functions that the requester can use using the information processing device 100 will be described below.

[0169] In the following specific example, it is assumed that the information processing device 100 is used to integrate customer databases of two different companies and provide a customer management service that enables a requester to view, search, and the like for customer information (user information). In this specific example, the first external device 910 is, for example, a device of a gas company that operates an LPG supply business. The first database is, for example, a customer information database of the gas company. The second external device 920 is, for example, a device of a water company that operates a water supply business. The second database is, for example, a customer information database of the water company. Each customer information database records information about users of the respective company.

[0170] In this specific example, the scope of access to user information and searches, etc. vary depending on the access authority of each of the two or more requesters who use the information processing device 100. For example, the access authority can be set as follows. That is, a requester employed by a gas company has relatively broad access authority to user information contained in the first database and relatively narrow access authority to user information contained in the second database. On the other hand, a requester employed by a water company has relatively narrow access authority to user information contained in the first database and relatively broad access authority to user information contained in the second database. The access authority can be set as appropriate.

[0171] In this specific example, each requester who uses the information processing device 100 is configured to be able to use the customer management service realized by the information processing device 100 by logging in to the customer management service with a preset account. Each account can be said to correspond to a requester identifier.

[0172] FIG. 11 is a diagram showing a specific example of requester information stored in requester information storage unit 113 of information processing device 100. As shown in FIG.

[0173] As shown in FIG. 11, in this specific example, the requester information storage unit 113 contains a plurality of pieces of requester information. In each piece of requester information, attribute values ​​are recorded for each attribute, such as the name, the requester ID, the password used for login, and the terminal identifier (terminal ID) of the terminal device 600 used (the terminal device 600 used for login). Any of these attribute values ​​may not be included, and attribute values ​​of attributes other than these may also be included. For example, an identifier identifying an organization to which the requester belongs may be included. In this specific example, for example, the requester ID is also used as the requester identifier, but this is not limited thereto. For example, a terminal identifier may be configured to be used as the requester identifier. In this case, when the terminal in which the requester logs in with his / her account is changed, the requester identifier identifying the requester is changed, but it is sufficient that the requester's account and the terminal identifier of the terminal device 600 used for login are always associated with each other.

[0174] FIG. 12 is a diagram showing a specific example of authority information stored in the authority information storage unit 114 of the information processing device 100. As shown in FIG.

[0175] As shown in FIG. 12, in this specific example, the authority information storage unit 114 includes authority information for each requester ID. That is, in each authority information, for example, a requester ID which is a requester identifier, the contents of the access authority for the first database, and attribute values ​​for each attribute of the contents of the access authority for the second database are recorded. Any of these attribute values ​​may not be included, and attribute values ​​of attributes other than these may also be included. The attribute value of the access authority may be set appropriately, for example, so that only the first user information can be searched, each attribute value of the user information can be searched, acquired, and changed, or each attribute value can be accessed including deletion. In addition, a range in which access is not permitted may be defined.

[0176] As described above, in each information processing system 900, when access request information is received for user information stored in each of two or more databases, the information processing device 100 can access the user information. Therefore, the user information stored in two or more databases in a distributed manner can be appropriately handled, improving convenience. Since access is performed according to the access authority of the requester, requests from two or more requesters with different access authorities can be appropriately handled.

[0177] Next, a description will be given of the relay processing device 10 having a relay function. Here, the relay performed by the relay processing device 10 refers to the transmission of information transmitted from a device connected to one network to a device on another network.

[0178] 1, in this embodiment, the relay processing device 10 is communicatively connected to a first information processing device 100 via a first private network, and is communicatively connected to a second information processing device 100 via a second private network. Note that the relay processing device 10 may be connected to the information processing device 100 of each information processing system 900 without going through a private network.

[0179] The relay processing device 10 is, for example, a general personal computer, and has a display as an output device, and an input device (for example, a keyboard, a pointing device, etc.) used for input operations by the requester, but is not limited to these. The relay processing device 10 is connectable to a network, and is configured to be able to communicate with other devices connected to the network.

[0180] FIG. 13 is a block diagram of relay processing device 10 in this embodiment.

[0181] The relay processing device 10 includes a relay device storage unit 11, a relay device receiving unit 20, a relay device accepting unit 30, a relay device processing unit 40, a relay device output unit 60, and a relay device transmitting unit .

[0182] The relay device storage unit 11 is preferably a non-volatile recording medium, but may also be a volatile recording medium. Various information, programs, etc. are stored in the relay device storage unit 11. The process by which this information, etc. is stored does not matter. For example, information may be stored in the relay device storage unit 11 via a recording medium, information transmitted via a communication line, etc. may be stored in the relay device storage unit 11, or information inputted via an input device may be stored in the relay device storage unit 11.

[0183] In this embodiment, the relay device storage unit 11 stores condition information. The condition information includes, for example, two or more pairs of a remote identifier for identifying the remote terminal device 602 used by the connecting party, a preset first condition, and a preset second condition, which are associated with each other. The first condition is a condition for relaying between the remote terminal device 602 and the first information processing device 100. The second condition is a condition for relaying between the remote terminal device 602 and the second information processing device 100. It is preferable that the first condition and the second condition corresponding to one remote identifier are set so that when one is satisfied, the other is not satisfied. This ensures that the remote terminal device 602 used by the connecting party functions as the terminal device 600 of the first information processing system 901 or the terminal device 600 of the second information processing system 902 under a certain situation.

[0184] Specifically, for example, the first condition includes a condition regarding the time during which the remote terminal device 602 corresponding to the remote identifier corresponding to the first condition is permitted to connect to the first information processing system 901. The second condition includes a condition regarding the time during which the remote terminal device 602 is permitted to connect to the second information processing system 902. Here, the time during which connection is permitted refers to a period from a predetermined start time to an end time, or a period specified by a time period on each day, a day of the week, a date, or a month. Note that at least one of the first condition and the second condition may include a condition regarding time as described above.

[0185] For example, the first condition may include a condition related to information indicating the state of the remote terminal device 602 corresponding to the remote identifier corresponding to the first condition. The second condition may also include a condition related to information indicating the state of the remote terminal device 602. Here, the information indicating the state may be, for example, information indicating the nature of the remote terminal device 602, information indicating the connection environment of the remote terminal device 602 to the network, or information indicating the surrounding environment in which the remote terminal device 602 is located. The information indicating the nature may be, for example, hardware provided in or connected to the remote terminal device 602, or a type or identification number of software executed in the remote terminal device 602. The information indicating the nature may include information stored in an authentication security key provided in or connected to the remote terminal device 602. The information indicating the connection environment to the network may be, for example, an IP address of the remote terminal device 602, an identifier of the connected wireless LAN network (for example, a service set ID, etc.), etc. The information indicating the surrounding environment may be, for example, information indicating the location of the remote terminal device 602, etc. The information indicating the location may be obtained by the remote terminal device 602 using a known method, for example.

[0186] Here, the remote identifier is one that can identify the remote terminal device 602 used by the connecting party. In this embodiment, for example, a unique terminal name or the like that is preset for each remote terminal device 602 can be used as the remote identifier. The remote identifier is not limited to this. For example, a connecting party name or the like that is preset for each connecting party may be used as the remote identifier. In this case, for example, when the connecting party uses the remote terminal device 602, the connecting party name or the like that the connecting party inputs to the remote terminal device 602 may be used as the remote identifier. Also, the remote identifier does not necessarily have to be one that can identify one device from other devices. In other words, it may be one that is set so that one remote identifier corresponds to each group of devices that have the same type of conditions for relaying in the relay processing device 10.

[0187] The relay device receiving unit 20 receives information transmitted from the information processing device 100 and other devices via the network. The relay device receiving unit 20 stores the received information, for example, in the relay device storage unit 11, so that the relay device processing unit 40 and the like can acquire the information.

[0188] The relay device receiving unit 30 receives the information received by the relay device receiving unit 20. The received information is stored in the relay device storage unit 11, for example.

[0189] In this embodiment, the relay device reception unit 30 includes a remote reception unit 31. The remote reception unit 31 receives a remote identifier that identifies the remote terminal device 602 to be the relay target. For example, when the remote terminal device 602 transmits information for requesting relay for communication with the information processing system 100 (for example, a command including an identifier that identifies the information processing system 100 to be the relay destination), the relay device reception unit 20 receives the information. Then, the remote reception unit 31 receives the information for requesting relay and the remote identifier that identifies the remote terminal device 602 that made the request.

[0190] The relay device processing unit 40 includes a session control unit 43, a first relay unit 45, a second relay unit 46, and a session information storage unit 49. The relay device processing unit 40 uses each unit of the relay processing device 10 to perform various information processing operations.

[0191] The session control unit 43 judges whether or not the first condition and the second condition corresponding to the remote identifier accepted by the remote acceptance unit 31 are satisfied. Then, based on the judgment result, the session control unit 43 performs control regarding a session for relaying communication between the remote terminal device 602 corresponding to the remote identifier and the information processing system 900. More specifically, in this embodiment, when the first condition corresponding to the remote identifier accepted by the remote acceptance unit 31 is satisfied, the session control unit 43 starts a first encrypted session for relaying communication between the remote terminal device 602 corresponding to the remote identifier and the first information processing device 100. Also, when the second condition corresponding to the remote identifier accepted by the remote acceptance unit 31 is satisfied, the session control unit 43 starts a second encrypted session for relaying communication between the remote terminal device 602 corresponding to the remote identifier and the second information processing device 100.

[0192] In this embodiment, the first encrypted session and the second encrypted session are established between the remote terminal device 602 and the relay processing device 10 using a known technology such as E2EE (end-to-end encryption). Encrypted information is transmitted and received via the tunnel established between the remote terminal device 602 and the relay processing device 10, thereby enabling secure communication via the Internet.

[0193] The first relay unit 45 relays communication between the remote terminal device 602 and the first information processing system 901 when the first encryption session is established. That is, the first relay unit 45 relays communication between the remote terminal device 602 and the first information processing device 100 in the first encryption session. Specifically, for example, when information is transmitted from the remote terminal device 602 to the first information processing device 100 and the relay device receiving unit 20 receives it, the first relay unit 45 transmits the information to the first information processing device 100 on behalf of the remote terminal device 602. Also, when information is transmitted from the first information processing device 100 to the remote terminal device 602 and the relay device receiving unit 20 receives it, the first relay unit 45 transmits the information to the remote terminal device 602 on behalf of the first information processing device 100. The transmission may be performed using the relay device transmitting unit 70.

[0194] The second relay unit 46 relays communication between the remote terminal device 602 and the second information processing system 902 when the second encryption session is established. That is, the second relay unit 46 relays communication between the remote terminal device 602 and the second information processing device 100 in the second encryption session. Specifically, for example, when information is transmitted from the remote terminal device 602 to the second information processing device 100 and the relay device receiving unit 20 receives it, the second relay unit 46 transmits the information to the second information processing device 100 on behalf of the remote terminal device 602. Also, when information is transmitted from the second information processing device 100 to the remote terminal device 602 and the relay device receiving unit 20 receives it, the second relay unit 46 transmits the information to the remote terminal device 602 on behalf of the second information processing device 100. The transmission may be performed using the relay device transmitting unit 70.

[0195] When the first encrypted session or the second encrypted session is started by the session control unit 43, the session information storage unit 49 stores session information related to the started first encrypted session or the second encrypted session in a database. In this embodiment, the session information storage unit 49 records the session information in a distributed ledger database stored in the fourth external device 940. The distributed ledger database is preferably managed using a distributed ledger technology using, for example, a so-called block chain technology or other time stamp technology using hashed information. The session information preferably includes, for example, a remote identifier of the remote terminal device 602 and an identifier for identifying the information processing system 900 that is the relay destination. By recording such session information in a distributed ledger database that is difficult to tamper with, the usage history of the communication system 1 can be reliably managed. Therefore, a strong deterrent effect can be exerted against unauthorized attempts such as unauthorized access using the communication system 1.

[0196] The relay device output unit 60 outputs information, for example, by displaying it on a display device. Note that the method of outputting information is not limited to this, and information may be output by outputting sound or the like from a speaker or the like.

[0197] The relay device transmitting unit 70 transmits information acquired by, for example, the relay device processing unit 40 via the network.

[0198] The above-mentioned relay device processing unit 40, processing unit 140, and terminal processing unit 640 can usually be realized by an MPU, memory, etc. The processing procedures of the relay device processing unit 40, processing unit 140, and terminal processing unit 640 are usually realized by software, and the software is recorded in a recording medium such as a ROM. However, they may also be realized by hardware (dedicated circuit).

[0199] Furthermore, the input means that can be used to input information that can be accepted by the relay device acceptance unit 30, the acceptance unit 130, and the terminal acceptance unit 630 may be anything, such as a numeric keypad, a keyboard, a mouse, a menu screen, etc. The relay device acceptance unit 30, the acceptance unit 130, and the terminal acceptance unit 630 can be realized by a device driver for an input means such as a numeric keypad or a keyboard, or control software for a menu screen, etc.

[0200] In addition, the first external device receiving unit 917, the second external device receiving unit 927, the third external device receiving unit 937, the relay device receiving unit 20, the receiving unit 120, and the terminal receiving unit 620 are typically realized by wireless or wired communication means, but may also be realized by means for receiving broadcasts.

[0201] In addition, the first external device transmitting unit 916, the second external device transmitting unit 926, the third external device transmitting unit 936, the relay device transmitting unit 70, the transmitting unit 170, and the terminal transmitting unit 670 are typically realized by wireless or wired communication means, but may also be realized by broadcasting means.

[0202] Furthermore, the relay device output unit 60, the output unit 160, and the terminal output unit 660 may or may not include an output device such as a display, a speaker, etc. The relay device output unit 60, the output unit 160, and the terminal output unit 660 may be realized by driver software for an output device, or a combination of driver software for an output device and an output device, etc.

[0203] Each of the relay processing device 10, the information processing device 100, the first external device 910, the second external device 920, the third external device 930, and the fourth external device 940 may be configured as one server, may be configured as a plurality of servers operating in cooperation with each other, or may be a computer built into another device, etc. It goes without saying that the server may be a so-called cloud server, an ASP server, etc., and the type is not limited.

[0204] FIG. 14 is a diagram showing an example of condition information used in the relay processing device 10. As shown in FIG.

[0205] As shown in FIG. 14, the condition information is, for example, an attribute value that is setting information related to a first condition and an attribute value that is setting information related to a second condition, which are recorded in association with a remote identifier. In the figure, for example, setting information indicating a time period during which connection is permitted is recorded for each of four remote identifiers. That is, for example, for "XXXXX11", the first condition is the time from 8:50 to 17:40, and the second condition is the time from 12:50 to 17:40. Also, for example, for "XXXXX22", the first condition is the time from 8:50 to 17:40, and the second condition is not set for any time (none of the times satisfies the second condition). Also, for example, for "XXXXX33", the first condition is Monday, Tuesday, or Wednesday, and the second condition is Thursday or Friday. For example, for "XXXXX77," the first condition is that no time is set, and the second condition is that the time is between 0:00 and 24:00 (i.e., continuous connection is possible). With such condition information, it is possible to determine whether the first condition or the second condition is met.

[0206] FIG. 15 is a diagram showing another example of the condition information used in the relay processing device 10. In FIG.

[0207] In FIG. 15, for example, values ​​related to the location of the remote terminal device 602 are recorded for each of the four remote identifiers. For example, for "XXXXX11", the first condition is that it is at the first location (a location indicated by 34.68XX, 135.51XXX in a coordinate system indicating a location using a predetermined method), and the second condition is that it is at the second location (a location indicated by 34.73XX, 135.41XXX in a coordinate system indicating a location using a predetermined method). In this case, for example, when it is determined that the remote terminal device 602 is at the first location, it becomes possible to connect to the first information processing system 901, and when it is determined that the remote terminal device 602 is at the second location, it becomes possible to connect to the second information processing system 902. That is, for example, a location that is previously recognized as a facility for using the first information processing system 901 can be set as the first location, and a location that is previously recognized as a facility for using the second information processing system 902 can be set as the second location. Also, for example, for "XXXXX22", the first condition is that the global IP address is within a predetermined range, and the second condition is not set at any time. For example, an IP address or the like according to a pre-recognized Internet connection environment for using the first information processing system 901 can be set. Also, for example, for "XXXXX33", the first condition is set to be at the first location, and for "XXXXX77", the second condition is set to be at the second location. With such condition information, it is possible to determine whether the first condition or the second condition is satisfied. For example, only when the remote terminal device 602 is in a pre-recognized situation, it is possible to make it possible to connect to each information processing system 900, and the information processing system 900 can be maintained in a secure state.

[0208] Next, an example of the operation of the communication system 1 will be described.

[0209] FIG. 16 is a flowchart showing an example of the operation of the relay processing device 10.

[0210] (Step S501) As shown in FIG. 16, the remote reception unit 31 receives a connection request to the information processing system 900 transmitted from the remote terminal device 602.

[0211] (Step S502) The session control unit 43 acquires, from the relay device storage unit 11, the first condition and the second condition corresponding to the remote identifier accepted by the remote acceptance unit 31.

[0212] (Step S503) Session control unit 43 judges whether or not the first condition is satisfied. If it is judged that the first condition is satisfied, the process proceeds to step S504, and if not, the process proceeds to step S505.

[0213] (Step S504) The session control unit 43 starts a first encrypted session between the remote terminal device 602 corresponding to the remote identifier and the first relay unit 45. This enables the first relay unit 45 to execute relay operation of communication between the remote terminal device 602 and another device of the first information processing system 901. Then, proceed to step S507.

[0214] (Step S505) On the other hand, session control unit 43 judges whether or not the second condition is satisfied. If it is judged that the second condition is satisfied, the process proceeds to step S506, and if not, the process proceeds to step S508.

[0215] (Step S506) The session control unit 43 starts a second encryption session between the remote terminal device 602 corresponding to the remote identifier and the second relay unit 46. This enables the second relay unit 46 to execute relay operation of communication between the remote terminal device 602 and another device in the second information processing system 902. Then, proceed to step S507.

[0216] (Step S507) The session information accumulation unit 49 accumulates the session information related to the first encrypted session or the second encrypted session started by the session control unit 43 in the distributed ledger database of the fourth external device 940.

[0217] (Step S508) The session control unit 43 transmits a message to the remote terminal device 602 corresponding to the remote identifier indicating that the connection is not possible.

[0218] When the process of step S507 or the process of step S508 ends, the series of processes ends.

[0219] Fig. 17 is a first sequence diagram showing an example of the operation of the communication system 1. Fig. 18 is a second sequence diagram showing an example of the operation of the communication system 1.

[0220] In this embodiment, a specific example of communication that is performed after an encrypted session is started in the communication system 1 is as follows. In the following specific example, the remote terminal device 602 can transmit information to the communication system 1 and display acquired information using a predetermined application (e.g., a web browser). Note that FIG. 18 is a continuation of FIG. 17.

[0221] As shown in the figure, first, a login request is sent from the remote terminal device 602 to the session control unit 43 (S11). Then, the session control unit 43 sends a notice of access to the session information storage unit 45. The session information storage unit 45 records the notice of access in the database (S12). The session control unit 43 also sends information for displaying a login page for login to the remote terminal device 602 (S13). The remote terminal device 602 inputs information such as an account for using the communication system 1 into the login page and sends it to the session control unit 43 (S14). The session control unit 43 performs login processing using the information received from the remote terminal device 602 (S15). When the login processing is completed, information (user information) of the connection person who has logged in is sent from the session control unit 43 to the session information storage unit 45, and the session information storage unit 45 records the user information in the database (S16). The session control unit 43 also sends information to the remote terminal device 602 that the login was successful (S17).

[0222] The login process can be performed in various ways. For example, the session control unit 43 may be configured with a module having a function as a relay server and a module having a function as an ID provider for performing so-called SAML authentication, and the latter module may communicate with the remote terminal device 602 to authenticate a connecting party using the remote terminal device 602 and enable the connecting party to log in. Another device included in the communication system 1 may be configured to function as an ID provider for performing SAML authentication.

[0223] Next, the remote terminal device 602 transmits a connection request to the session control unit 43 (S20). Then, the session control unit 43 determines whether the first condition is satisfied or not, or whether the second condition is satisfied or not. Then, the session control unit 43 transmits the connection request to the first relay unit 45 or the second relay unit 46 corresponding to the relay destination (S22). In this case, for example, information such as a connection ID (peer node ID) indicating the connection destination, a service ID, and a terminal session ID is transmitted from the remote terminal device 602 to the session control unit 43. Also, for example, information such as a connection ID, a service ID, and a control unit session ID is transmitted from the session control unit 43 to the relay units 45 and 46. Here, the following description will be continued assuming that the connection request is transmitted to the first relay unit 45. The first relay unit 45 requests the first information processing device 100 to connect by TCP (S23). In response to this, the first information processing device 100 responds to the first relay unit 45 (S24). Then, the first relay unit 45 responds to the session control unit 43 (S25), and the session control unit 43 responds to the remote terminal device 602 (S26). The first relay unit 45 transmits, to the session control unit 43, information including, for example, the relay unit session ID and the previously received control unit session ID. The session control unit 43 transmits, to the remote terminal device 602, information including, for example, the received control unit session ID and the previously received terminal session ID. This starts a session for communication between the remote terminal device 602 and the first relay unit 45. Then, session information related to the session is sent to the session information storage unit 49, and the session information storage unit 45 records it in the database (S27).

[0224] When the session is started, a handshake for performing encrypted communication is performed between the remote terminal device 602 and the first relay unit 45 (S28). As a result, it can be said that an encrypted session is started between the remote terminal device 602 and the first relay unit 45. Here, for example, a handshake for performing TLS communication is performed. For example, after a so-called three-way handshake is performed, a handshake for performing TLS communication (TLS Client Hello, TLS Server Hello) is performed. Note that the protocol for performing the handshake is not limited to this.

[0225] Thereafter, the remote terminal device 602 can transmit information to the first information processing device 100 by transmitting information to the first relay unit 45. That is, for example, the remote terminal device 602 requests the first relay unit 45 to establish a connection by HTTPS (S41). The request is transmitted by performing a temporary TLS communication in an encrypted session. In response to this, the first relay unit 45 makes an HTTP connection request to the first information processing device 100 (S42). The first information processing device 100 transmits a response to the first relay unit 45 (S43). Then, the first relay unit 45 transmits the response to the remote terminal device 602 (S44).

[0226] Next, for example, the remote terminal device 602 transmits an HTTP request to the first relay unit 45 (S45). In this case, the HTTP request is transmitted by performing a provisional TLS communication in the encrypted session. In response to this, the first relay unit 45 transmits the HTTP request to the first information processing device 100 (S46). That is, the first relay unit 45 transmits the HTTP request to the first information processing device 100 on behalf of the remote terminal device 602.

[0227] In response to the HTTP request, the first information processing device 100 transmits an HTTP response to the first relay unit 45 (S47). Then, the first relay unit 45 transmits the HTTP response to the remote terminal device 602 (S48). In this case, the HTTP response is transmitted from the first relay unit 45 to the remote terminal device 602 by performing a provisional TLS communication in the encrypted session. That is, the first relay unit 45 transmits the HTTP response to the remote terminal device 602 on behalf of the first information processing device 100.

[0228] In addition, instead of sending and receiving requests etc. directly between the first information processing device 100 and the first relay unit 45, sending and receiving requests etc. with the first relay unit 45 may be performed via a proxy server (which can be configured using Sqiid, etc.) functioning in any device of the first information processing system 901, for example.

[0229] As described above, according to this embodiment, the relay device processing unit 40 performs tunneling so that the remote terminal device 602 can function in the information processing system 900 as a relay destination in the same manner as the local terminal device 601. Moreover, encrypted information is transmitted and received between the remote terminal device 602 and the relay processing device 10, so that the remote terminal device 602 can participate in each information processing system 900 securely via the Internet.

[0230] A remote terminal device 602 at a remote location can safely participate in each information processing system 900 in the same way as the local terminal device 601, and in each information processing system 900, when access request information is received from the remote terminal device 602 for user information stored in each of two or more databases, the information processing device 100 can access the user information. Since access is performed according to the access authority of the requester, requests from two or more requesters with different access authority can be appropriately handled. In other words, user information in two or more databases stored in a secure and distributed manner can be appropriately handled from the remote terminal device 602, improving convenience.

[0231] It is possible to allow a remote terminal device 602 at a remote location to connect to an appropriate information processing system 900 according to the condition information. Therefore, even in a case where one remote terminal device 602 or its connecter is engaged in a business by switching between an employment form in which the remote terminal device 602 participates in a first information processing system 901 and an employment form in which the remote terminal device 602 participates in a second information processing system 902, the remote terminal device 602 can easily connect to each information processing system 900 while maintaining a secure state. According to the setting of the condition information, it is possible to switch the information processing system 900 to be engaged in depending on time, or to switch the information processing system 900 depending on the situation in which the remote terminal device 602 is used, thereby improving the convenience of the communication system 1.

[0232] In the above description, the case where a connection is made from one remote terminal device 602 has been described, but the relay processing device 10 may function in the same manner even when the remote terminal device 602 is connected to a third private network different from the one used in the first information processing system 901 and the second information processing system 902. In such a case, by uniformly setting condition information for each device belonging to the third private network, it is possible to uniformly control which information processing system these devices can connect to. This can be applied, for example, to an organization having a plurality of remote terminal devices 602 connected to private networks. For example, an organization having a plurality of remote terminal devices 602 and their operators can switch the information processing system 900 to which they are connected depending on the time of day, etc., and safely perform a task using the information processing system 900. In addition, in one information processing system 900, the organization to be connected to the information processing system 900 can be switched depending on the time of day, etc., and safely perform a task using the information processing system 900 (consign the task to be performed). In this case, the same remote identifier may be configured to correspond to each device connected to the third private network.

[0233] The processing in this embodiment may be realized by software. This software may be distributed by software download or the like. This software may also be recorded on a recording medium such as a CD-ROM and distributed. The software that realizes relay processing device 10 in this embodiment is the following program. In other words, the program of the relay processing device 10 causes the computer of the relay processing device 10 to function as a remote reception unit 31 that receives a remote identifier identifying the remote terminal device 602 to be relayed, a session control unit 43 that initiates a first encryption session for relaying communication between the remote terminal device 602 and the first information processing device 100 when a first condition corresponding to the remote identifier accepted by the remote reception unit 31 is satisfied, and initiates a second encryption session for relaying communication between the remote terminal device 602 and the second information processing device 100 when a second condition corresponding to the remote identifier accepted by the remote reception unit 31 is satisfied, a first relay unit 45 that relays communication between the remote terminal device 602 and the first information processing device 100 in the first encryption session, and a second relay unit 46 that relays communication between the remote terminal device 602 and the second information processing device 100 in the second encryption session.

[0234] For example, when a connection request is made from the remote terminal device 602 specifying the information processing system 900 to be connected, the communication system 1 may be configured to operate as follows.

[0235] FIG. 19 is a flow chart showing a modified example of the operation of the relay processing device 10. In FIG.

[0236] 19, the remote reception unit 31 receives a connection request to a specified information processing system 900 transmitted from the remote terminal device 602. The connection request to the specified information processing system 900 includes, for example, a system identifier for identifying the specified information processing system 900, but is not limited to this.

[0237] (Step S512) The session control unit 43 acquires, from the relay device storage unit 11, one of the first condition and the second condition corresponding to the remote identifier accepted by the remote acceptance unit 31, which corresponds to the accepted system identifier. That is, when a connection request is made to the first information processing system 901, the first condition is acquired, and when a connection request is made to the second information processing system 902, the second condition is acquired.

[0238] (Step S513) Session control unit 43 judges whether or not the acquired condition is satisfied. If it is judged that the condition is satisfied, the process proceeds to step S514, and if not, the process proceeds to step S516.

[0239] (Step S514) The session control unit 43 starts an encrypted session between the remote terminal device 602 corresponding to the remote identifier and the relay units 45 and 46 corresponding to the system identifier. This enables the relay units 45 and 46 to execute relay operation of communication between the remote terminal device 602 and a device of the specified information processing system 900.

[0240] (Step S515) The session information accumulation unit 49 accumulates the session information related to the first encrypted session or the second encrypted session started by the session control unit 43 in the distributed ledger database of the fourth external device 940.

[0241] (Step S516) The session control unit 43 transmits a message to the remote terminal device 602 corresponding to the remote identifier indicating that the connection is not possible.

[0242] When the process of step S515 or step S516 ends, the series of processes ends.

[0243] Even when the relay processing device 10 operates as described above, the same effects as those of the above-described embodiment can be obtained.

[0244] (others)

[0245] Fig. 20 is a schematic diagram of a computer system 800 in the above embodiment, and Fig. 21 is a block diagram of the computer system 800.

[0246] These figures show the configuration of a computer that executes the programs described in this specification to realize the communication system and the like of the above-mentioned embodiment. The above-mentioned embodiment can be realized by computer hardware and a computer program executed thereon.

[0247] Computer system 800 includes a computer 801 including a CD-ROM drive, a keyboard 802, a mouse 803, and a monitor 804.

[0248] In addition to the CD-ROM drive 8012, the computer 801 includes an MPU 8013, a bus 8014 connected to the CD-ROM drive 8012 etc., a ROM 8015 for storing programs such as a boot-up program, a RAM 8016 connected to the MPU 8013 for temporarily storing instructions of application programs and providing a temporary storage space, and a hard disk 8017 for storing application programs, system programs, and data. Although not shown here, the computer 801 may further include a network card for providing a connection to a LAN.

[0249] A program for causing computer system 800 to execute the functions of the information processing device or the like of the above-mentioned embodiments may be stored on CD-ROM 8101, inserted into CD-ROM drive 8012, and further transferred to hard disk 8017. Alternatively, the program may be transmitted to computer 801 via a network (not shown) and stored on hard disk 8017. The program is loaded into RAM 8016 at the time of execution. The program may be loaded directly from CD-ROM 8101 or the network.

[0250] The program does not necessarily include an operating system (OS) or a third party program that causes the computer 801 to execute the functions of the information processing device of the above-mentioned embodiment. The program only needs to include an instruction portion that calls appropriate functions (modules) in a controlled manner to obtain a desired result. How the computer system 800 operates is well known, and a detailed description will be omitted.

[0251] In addition, in the above program, the transmitting step of transmitting information and the receiving step of receiving information do not include processing performed by hardware, such as processing performed by a modem or interface card in the transmitting step (processing that is performed only by hardware).

[0252] The program may be executed by a single computer or a plurality of computers. That is, the program may be executed by a centralized processing or a distributed processing.

[0253] In the above-described embodiments, two or more components present in one device may be physically realized on one medium.

[0254] Furthermore, in the above embodiments, each process (each function) may be realized by centralized processing by a single device (system), or may be realized by distributed processing by multiple devices (in this case, the entire system made up of multiple devices performing distributed processing can be considered as a single "device").

[0255] In addition, in the above embodiments, the transfer of information between each component may be performed, for example, by one component outputting information and the other component receiving information if the two components transferring the information are physically different, or, if the two components transferring the information are physically the same, by shifting from a processing phase corresponding to one component to a processing phase corresponding to the other component.

[0256] In the above embodiment, information related to the processing performed by each component, such as information accepted, acquired, selected, generated, transmitted, or received by each component, and information such as thresholds, formulas, and addresses used by each component in processing, may be temporarily or long-term stored in a recording medium (not shown) even if not specified in the above description. Furthermore, each component or a storage unit (not shown) may store information in the recording medium (not shown). Furthermore, each component or a reading unit (not shown) may read information from the recording medium (not shown).

[0257] In the above embodiment, if the information used by each component, such as the thresholds, addresses, and various setting values ​​used by each component in processing, may be changed by the user, the user may or may not be able to change the information as appropriate, even if not specified in the above description. If the information is changeable by the user, the change may be realized, for example, by a reception unit (not shown) that receives a change instruction from the user, and a change unit (not shown) that changes the information in response to the change instruction. The reception unit (not shown) may receive the change instruction from an input device, may receive information transmitted via a communication line, or may receive information read from a predetermined recording medium.

[0258] The present invention is not limited to the above-described embodiment, and various modifications are possible, which are also included within the scope of the present invention.

[0259] Some of the components and functions of the above-mentioned embodiments may be omitted. In the above-mentioned embodiments, an example is shown in which two information processing systems are provided in the communication system, but more information processing systems may be provided so as to be connectable from a remote terminal device via a relay processing device. In addition, at least one of the two or more information processing systems included in the communication system may have a configuration different from that shown in the above-mentioned embodiments. For example, at least one information processing system may be a server-client system or the like that is realized by searching and operating a database stored in a server from a terminal device. [Industrial Applicability]

[0260] As described above, the communication system of the present invention has the effect of enabling an information processing system configured in a private network to be used easily and securely from a remote terminal device, and is useful as a communication system, etc. [Explanation of symbols]

[0261] 1. Communication Systems 10 Relay processing device 11 Relay device storage section 20 Relay device receiving section 30 Relay device reception 31 Remote Reception 40 Relay device processing section 43 Session Control Section 45, 49 Session information storage unit 45 Relay Section 60 Relay device output section 70 Relay device transmitter 100 Information processing device 110 Storage area 111 User information storage section 112 Index information storage section 113 Requester information storage unit 114 Authority information storage section 120 Receiving unit 130 Reception 131 Access request information reception unit 132 Search request information reception unit 133 Display request information reception unit 140 Processing section 141 User information storage unit 142 Index information storage unit 143 Search execution unit 144 Access control section 145 Access record storage unit 160 Output section 161 Search result output section 162 Reception screen information output section 170 Transmitter 600 Terminal Equipment 601 Local Terminal Equipment 602 Remote Terminal Equipment 610 Terminal storage section 620 Terminal receiving unit 621 Reception screen information receiving unit 630 Terminal Reception 640 Terminal Processing Unit 660 Terminal Output Unit 670 Terminal Transmitter 671 Access request information transmission unit 672 Reception screen display request information transmission unit 673 Search request information transmission unit 900 Information Processing Systems 901 First Information Processing System 902 Second Information Processing System

Claims

1. a first information processing device of a first information processing system configured in a first private network; a second information processing device of a second information processing system configured in a second private network; a relay processing device that is communicatively connected to the first information processing device and is communicatively connected to the second information processing device; The relay processing device includes: a relay device storage unit for storing two or more pairs of associated remote identifiers each identifying a remote terminal device used by a connecting party and connected to the relay device via a network different from the first private network and the second private network, a first predetermined condition being a condition for relaying between the remote terminal device and the first information processing device, and a second predetermined condition being a condition for relaying between the remote terminal device and the second information processing device; a remote reception unit that receives a remote identifier that identifies a remote terminal device that is a relay target; a session control unit that starts a first encryption session for relaying communication between the remote terminal device and the first information processing device when the first condition corresponding to the remote identifier accepted by the remote acceptance unit is satisfied, and starts a second encryption session for relaying communication between the remote terminal device and the second information processing device when the second condition corresponding to the remote identifier accepted by the remote acceptance unit is satisfied; a first relay unit that relays communication between the remote terminal device and the first information processing device in the first encryption session; a second relay unit that relays communication between the remote terminal device and the second information processing device in the second encryption session.

2. 2. The communication system according to claim 1, further comprising a session information storage unit configured to store, when the first encrypted session or the second encrypted session is started by the session control unit, session information related to the started first encrypted session or the second encrypted session in a database.

3. The communication system of claim 2 , wherein the database is a distributed ledger database implemented in the communication system.

4. the first information processing system has two or more databases stored in a distributed manner in two or more storage units; Each of the two or more databases stores first user information including a user identifier related to one user and second user information including an attribute value different from the first user information for the one user in association with each other; The first information processing device is a user information storage unit in which user information is stored; a user information storage unit that acquires two or more pieces of the first user information included in each of the two or more databases by associating them with record identifiers that identify records in the databases in which the first user information is stored, and stores the information in the user information storage unit; an access request information receiving unit that receives access request information for accessing the second user information, the access request information being associated with the user identifier; The communication system according to any one of claims 1 to 3, further comprising an access control unit that accesses the second user information stored in a corresponding database based on a record identifier corresponding to a user identifier associated with the access request information accepted by the access request information accepting unit.

5. The communication system according to claim 4 , further comprising an access record storage unit that stores the access record by the access control unit in a distributed ledger database realized in the first information processing system.

6. the first information processing system has two or more databases stored in a distributed manner in two or more storage units; The first information processing device is a user information storage unit in which user information is stored; a user information storage unit that acquires two or more pieces of user information, each of which includes a user identifier related to one user and is stored in each of the two or more databases, by associating the pieces with record identifiers that identify records in the databases in which the respective pieces of user information are stored, and stores the pieces of user information in the user information storage unit; a search request information receiving unit that receives search request information input by a requester regarding the user information; a search execution unit that searches for the user information based on the search request information received by the search request information receiving unit; The communication system according to claim 1 , further comprising a search result output unit that outputs a search result obtained by said search execution unit.

7. 7. The communication system according to claim 1, wherein at least one of the first condition and the second condition includes a condition regarding a time during which the remote terminal device to be the relay target is permitted to connect.

8. The communication system according to claim 1 , wherein at least one of the first condition and the second condition includes a condition related to information indicating a state of the remote terminal device that is the relay target.

9. A relay processing device constituting a communication system together with a first information processing device of a first information processing system configured in a first private network and a second information processing device of a second information processing system configured in a second private network, a first information processing device that is communicatively connected to the first information processing device and a second information processing device that is communicatively connected to the second information processing device; a relay device storage unit for storing two or more pairs of associated remote identifiers each identifying a remote terminal device used by a connecting party and connected to the relay device via a network different from the first private network and the second private network, a first predetermined condition being a condition for relaying between the remote terminal device and the first information processing device, and a second predetermined condition being a condition for relaying between the remote terminal device and the second information processing device; a remote reception unit that receives a remote identifier that identifies a remote terminal device that is a relay target; a session control unit that starts a first encryption session for relaying communication between the remote terminal device and the first information processing device when the first condition corresponding to the remote identifier accepted by the remote acceptance unit is satisfied, and starts a second encryption session for relaying communication between the remote terminal device and the second information processing device when the second condition corresponding to the remote identifier accepted by the remote acceptance unit is satisfied; a first relay unit that relays communication between the remote terminal device and the first information processing device in the first encryption session; a second relay unit that relays communication between the remote terminal device and the second information processing device in the second encryption session.

10. An information processing method implemented by a relay device storage unit, a remote reception unit, a session control unit, a first relay unit, and a second relay unit included in a relay processing device constituting a communication system together with a first information processing device of a first information processing system configured in a first private network and a second information processing device of a second information processing system configured in a second private network, the method comprising: the relay processing device is communicatively connected to the first information processing device and is communicatively connected to the second information processing device; the relay device storage unit stores two or more pairs of associated remote identifiers each identifying a remote terminal device used by a connecting party and connected to the relay processing device via a network different from the first private network and the second private network, a first condition set in advance as a condition for relaying between the remote terminal device and the first information processing device, and a second condition set in advance as a condition for relaying between the remote terminal device and the second information processing device; a remote reception step in which the remote reception unit receives a remote identifier that identifies a remote terminal device to be a relay target; a session control step in which the session control unit initiates a first encryption session for relaying communication between the remote terminal device and the first information processing device when the first condition corresponding to the remote identifier accepted by the remote acceptance unit is satisfied, and initiates a second encryption session for relaying communication between the remote terminal device and the second information processing device when the second condition corresponding to the remote identifier accepted by the remote acceptance unit is satisfied; a first relay step in which the first relay unit relays communication between the remote terminal device and the first information processing device in the first encryption session; a second relay step of the second relay unit relaying communication between the remote terminal device and the second information processing device in the second encryption session.

11. A program for a relay processing device constituting a communication system together with a first information processing device of a first information processing system configured in a first private network and a second information processing device of a second information processing system configured in a second private network, the program comprising: the relay processing device is communicatively connected to the first information processing device and is communicatively connected to the second information processing device; a computer of the relay processing device that can access a relay device storage unit that stores two or more pairs of corresponding pairs of a remote identifier that identifies a remote terminal device used by a connecting party and that is connected to the relay processing device via a network different from the first private network and the second private network, a first condition that is a predetermined condition for relaying between the remote terminal device and the first information processing device, and a second condition that is a predetermined condition for relaying between the remote terminal device and the second information processing device; a remote reception unit that receives a remote identifier that identifies a remote terminal device that is a relay target; a session control unit that starts a first encryption session for relaying communication between the remote terminal device and the first information processing device when the first condition corresponding to the remote identifier accepted by the remote acceptance unit is satisfied, and starts a second encryption session for relaying communication between the remote terminal device and the second information processing device when the second condition corresponding to the remote identifier accepted by the remote acceptance unit is satisfied; a first relay unit that relays communication between the remote terminal device and the first information processing device in the first encryption session; a program that causes the remote terminal device to function as a second relay unit that relays communication between the remote terminal device and the second information processing device in the second encryption session.

Images