How we safely manage and analyze personal information

Abstract

To provide a method for safety management and analysis of personal information that eliminates a risk of leakage and a biased analysis of the personal information.SOLUTION: A whole model includes a user terminal, a company terminal, and a safety environment server where an algorithm that is created by a company and analyzes personal information including a name, a sexuality, a date of birth, and past purchase history information of a user. A hash value of an analysis evaluation result of the algorithm analyzed and evaluated according to a predetermined audit standard by a neutral third party is recorded on a blockchain, and when the user permits an analysis using the personal information, the user terminal records the hash value of the personal information on the blockchain. The algorithm compares and determines whether the hash value of the personal information obtained from the user terminal and the hash value recorded on the blockchain are the same, and if both are the same, the personal information is analyzed according to a predetermined method.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a method for safely managing personal information owned by users and enabling many companies to safely analyze the personal information. [Background technology]

[0002] With the advancement of digitalization of information, personal information is said to be the oil of the 21st century, and the collection and analysis of more personal information is directly linked to the performance of each company. We are now in an era where the amount of analyzed data and the results of the analysis create great economic value.

[0003] Companies that obtain a lot of personal information have an advantage, creating a large gap between them and companies that have not been able to obtain personal information. Currently, a few companies are monopolizing personal information, which means monopolizing the market, and there is a risk that fair competition will be hindered in the future. In addition, when personal information is managed unilaterally by companies, it is difficult for users to grasp the facts even if the information is being used in an inappropriate manner, such as violating privacy.

[0004] On the other hand, even if one were to try to integrate and analyze personal information held by multiple companies, when providing personal information to a third party, information that could identify an individual must be removed under regulations such as the General Data Protection Regulation (GDPR). As a result, while it is possible to analyze overall trends, it is not possible to grasp trends for specific individuals.

[0005] For example, when User X purchases Product B at Retail Store A, if User X has registered his / her name, age, gender, etc. as a member of Retail Store A, Retail Store A can analyze User X's consumption behavior to determine what products he / she often purchases, and use the results of this analysis for more effective advertising and product development.

[0006] However, if retailer A allows a third party other than retailer A to use User X's personal information, any information that can identify an individual must be removed from User X's personal information, making it impossible for the third party to analyze the consumption behavior or consumption trends of a specific individual.

[0007] There is an invention described in Patent No. 6494004 (Patent Document 1) that is a personal information management system that enables target verification using personal information without the user having to go through complicated procedures or manage the information required for the procedures, and without the vendor taking on the risk of leaking the user's personal information. However, this system is an invention that is used to prove the identity of the requesting user before the vendor provides the service, and when proving identity, the personal information must be presented to the service provider once.

[0008] Furthermore, because the analysis of personal information is carried out independently by each individual company, there is concern that incomplete algorithms could lead to unexpected leaks of information, as well as the possibility of biased analysis and misuse. This is one of the reasons why users are hesitant to provide their personal information. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] Patent No. 6494004 Summary of the Invention [Problem to be solved by the invention]

[0010] The present invention aims to provide a method for safely managing and analyzing personal information, which eliminates the low security caused by personal information being centrally managed by a specific company, the difficulty of making appropriate analyses and proposals for specific individuals caused by personal information being separated by company, and the risk of personal information leaking or biased analysis caused by the use of imperfect algorithms.

[0011] In order to achieve the above object, the present invention provides a method for safely managing and analyzing personal information, the personal information including a user's name, sex, date of birth, and past purchase history information, the method comprising: a user terminal for managing the personal information; a corporate terminal of a company that wishes to analyze the personal information; an algorithm for analyzing the personal information, which is created by a company having the corporate terminal; and a safe environment server in which the algorithm is recorded, the algorithm being analyzed and evaluated by a neutral third party in accordance with a predetermined audit standard, and a hash value of the analysis and evaluation result being recorded on a blockchain; the corporate terminal transmits information requesting an analysis of the personal information to the user terminal, and if the user permits an analysis using the personal information, the user terminal records the hash value of the personal information on the blockchain; safety environment The server uses a stored processing program to compare and determine whether the hash value of the personal information obtained from the user terminal is identical to the hash value recorded on the blockchain, and also verifies whether the hash value of the algorithm used for analysis is identical to the hash value recorded by the third-party agency. If both are identical, the algorithm analyzes the personal information according to a predetermined method. Effect of the Invention

[0012] According to the present invention having the above configuration, personal information of each user can be safely processed using an algorithm whose safety is guaranteed by an audit and evaluation by a neutral third-party organization, without the personal information of the user being disclosed to the company. Since the method provides only the analysis results of the algorithm to the company, users can safely and securely manage their own personal information, while the company can receive the analysis results without directly obtaining the personal information. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a schematic diagram showing an overview of the overall model of the present invention; [Diagram 2] Network diagram of user terminals, corporate terminals, etc. [Diagram 3] User device configuration diagram [Figure 4] Diagram showing the flow of collecting personal information [Diagram 5] A diagram showing how personal information collection and algorithms are audited [Figure 6] Flow of personal information analysis DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, the embodiments of the present invention will be described in detail. Note that the embodiments described below are merely examples for explaining the present invention, and the present invention is not limited to the embodiments. Various modifications of the present invention are possible without departing from the gist of the present invention.

[0015] FIG. 1 is a schematic diagram showing an overview of an overall model (overall system) for realizing a method for safely managing and analyzing personal information according to the present invention. This system is composed of a user terminal 1 on which application software related to this system (hereinafter referred to as the "app") is installed, a corporate terminal 2 on which an app related to this system is similarly installed, a safety management server 3 which collects and analyzes personal information transmitted from the user terminal 1, and a neutral third-party organization (auditing organization) which audits the algorithms used to collect and analyze personal information.

[0016] Algorithms created by individual companies to analyze the personal information of each user are provided in advance to a neutral third-party organization (auditor) and audited according to predetermined evaluation criteria. After the audit, the hash value of the evaluation result is recorded on the blockchain10.

[0017] The standards for algorithm audit by the third-party organization (auditing organization) include, for example, that the algorithm does not threaten the safety of the safe environment server, that the personal information does not leak outside during the processing process, that the output is anonymous, and that the output complies with social ethics, but other standards may also be set. In other words, it is sufficient that the content is such that users can safely decide to provide their personal information.

[0018] The user terminal 1 records personal information such as the user's name, gender, date of birth, and past purchasing history. When a user receives a request from a company to use their personal information, they obtain the audit results of the above-mentioned algorithm on the user terminal 1 to check its safety. If they determine that there are no problems, they send the personal information recorded on the user terminal 1 to the company terminal 2.

[0019] In this case, the user terminal 1 hashes the personal information and records it in the blockchain 10, and at the same time transmits the information in encrypted form to the safe environment server 3, where it is recorded in the personal information database 4 in the complete environment server 3 and temporarily stored only while the analysis of the personal information is being carried out. Note that this safe environment server 3 is owned by a service provider company that performs the analysis on behalf of companies that wish to have their personal information analyzed.

[0020] When analyzing personal information on the safe environment server 3, the hash values ​​of the personal information provided by the user terminal 1 and the algorithm provided by the corporate terminal 2 are calculated, and it is confirmed that these hash values ​​match the hash values ​​recorded in the blockchain 10, and the personal information and algorithm have not been altered.

[0021] After the safe environment server 3 has completed analyzing the personal information, the analysis results are sent to the company terminal 2, and the personal information temporarily recorded in the personal information database 4 is simultaneously erased. The company that receives the analysis results can use them to carry out advertisements and product suggestions based on the user's consumption trends.

[0022] 2 is a schematic diagram showing a connection network of a user terminal 1, a corporate terminal 2, etc., involved in this system. This system is configured by connecting the user terminal 1, the corporate terminal 2, the safe environment server 3, and the blockchain 10 to each other via a network such as the Internet. The user terminal 1 is an information processing device with a function of transmitting and receiving personal information including past purchase history to the safe environment server 3 or the blockchain 10 via the network, and is a smartphone, PC, tablet terminal, etc.

[0023] Fig. 3 is a block diagram showing an example of the configuration of the user terminal 1. As shown in Fig. 3, the user terminal 1 includes a control unit 1-1 including a CPU and a memory, a communication unit 1-2 for connecting to a network, an input unit 1-3 for accepting user operations, a display unit 1-4 for displaying as a screen, a user information DB1-5 for storing personal information of the user, a login information DB1-6 for storing an ID required for logging in to an EC site, and a purchase history information DB1-7 for storing purchase history information acquired from the EC site. The purchase history information may be not only purchase history on an EC site, but also POS data available from a retail store.

[0024] FIG. 4 is a diagram showing the flow of collecting personal information, and illustrates an example of acquiring purchase history information of a user who has made a purchase on a specific EC site. The user inputs the ID and password required to log in to the EC site on the user terminal, and records them in the login information DB1-6. Using the saved ID, the user accesses the EC site from an application on the user terminal 1, acquires the user's purchase history information, and saves the acquired purchase history information in the purchase information DB1-7 on the user terminal 1. A hash value of the acquired purchase history information is calculated by the application recorded on the user terminal, and this is recorded in the blockchain 10.

[0025] FIG. 5 is a diagram showing the flow when a company that wishes to analyze personal information analyzes the personal information of a user. A company that wishes to analyze personal information requests the collection and analysis of personal information from an agency service company that owns a safe environment server 3, and also provides the safe environment server 3 with an algorithm to be used for the analysis. As mentioned above, the algorithm is an algorithm that has been evaluated by a neutral third-party organization (audit organization). The company notifies the user terminal 1 to be analyzed, using an app, that it is requesting permission to use and analyze the personal information. After checking the personal information and the audit results of the algorithm requested by the company, the user allows his / her personal information to be used for analysis by the algorithm (the user terminal 1 sends a permission signal to the safety management server 3).

[0026] If the user allows the use of their personal information, a copy of the personal information to be used for analysis is encrypted and stored in the personal information DB4. The safe environment server 3 , by a stored processing program. The necessary personal information is obtained from the personal information DB4, and it is confirmed that the hash value matches the hash value recorded by the user in the blockchain 10, and it is also confirmed that the hash value of the algorithm used for analysis matches the hash value in the blockchain 10 recorded by the third-party (auditing agency) auditing agency.

[0027] If the hash value of the personal information and the algorithm matches the hash value of the blockchain 10, a specified analysis is carried out using the personal information and the algorithm, and the analysis results are sent to the requesting company.

[0028] Companies can use the analysis results to make various proposals and develop products for users. In addition, companies may offer incentives such as points or discounts to users who provide personal information.

[0029] As described above, according to the present invention, personal information of each user can be safely processed using an algorithm whose safety is guaranteed by an audit and evaluation by a neutral third party, without the personal information being disclosed to the company, and only the analysis results obtained by the algorithm are provided to the company. As a result, users can safely and securely manage their own personal information, while the company can receive the analysis results without directly obtaining the personal information. [Explanation of symbols]

[0030] 1 User terminal 2. Corporate terminals 3. Safe Environment Server 4 Personal Information Database 10. Blockchain 20 Third Party Organization (Auditing Organization)

Claims

1. A method for safely managing and analyzing personal information, comprising: The personal information includes the user's name, gender, date of birth, and past purchase history information. A user terminal for managing the personal information; A corporate terminal of a company that wishes to analyze the personal information; An algorithm created by a company having the company terminal and performing an analysis of the personal information; a safe environment server on which the algorithm is recorded; The algorithm is analyzed and evaluated by a neutral third party in accordance with a predetermined audit standard, and the hash value of the analysis and evaluation result is recorded on the blockchain; transmitting information on which the company wishes to analyze the personal information to the user terminal; If the user permits analysis using the personal information, the user terminal records a hash value of the personal information on the blockchain; The safe environment server compares and determines whether the hash value of the personal information acquired from the user terminal by the stored processing program is the same as the hash value recorded on the blockchain, and verifies whether the hash value of the algorithm used for analysis is the same as the hash value recorded by the third party organization. If both are the same, the algorithm analyzes the personal information according to a predetermined method. A method for safely managing and analyzing personal information, comprising:

2. The predetermined audit criteria for the third-party organization to analyze and evaluate the algorithm include that the algorithm does not threaten the security of the safe environment server, that there is no external leakage of the personal information during the processing process, that the output is anonymous, and that the output complies with social ethics.

2. The method for safely managing and analyzing personal information according to claim 1.

3. The algorithm provides incentives, including points, to users who have permitted analysis using the personal information.

3. The method for safely managing and analyzing personal information according to claim 1 or 2.

Images