Determination method, information processing device, and determination program

Abstract

The present invention suppresses data disclosure when determining the identity of character string data.　An information processing device (10) determines, for each first character included in character string data (13-1, 13-2) of a data list (13), whether the plurality of second characters included in character string data (14-1, 14-2) of a data list (14) include a second character identical to the first character. The information processing device (10) identifies the ordinal number associated with the determined identical second character, from among a series of different ordinal numbers associated with the plurality of second characters. The information processing device (10) determines whether there is any character string data common to the character string data (13-1, 13-2) and the character string data (14-1, 14-2) on the basis of the order of the character string data (13-1, 13-2), the order of each first character within the character string data (13-1, 13-2), and the identified ordinal number.

Description

[Technical field]

[0001] The present invention relates to a determination method, an information processing device, and a determination program. [Background technology]

[0002] The information processing system may compare two pieces of character string data related to secret information and determine whether the two pieces of character string data are identical. The secret information may be personal information such as an individual's name or attributes. The character string data may be a hash value calculated from the secret information using an irreversible hash function. For example, the information processing system may verify the authenticity of a communication partner by confirming that the received character string data is identical to registered character string data. Also, for example, the information processing system may output a warning when the character string data received from different communication partners are identical.

[0003] In addition, a personal information management system has been proposed in which a hash value of personal information is registered on a blockchain, the legitimacy of personal information disclosed by users is then verified by referring to the blockchain, and the verification results are registered on the blockchain. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2019-219780 A Summary of the Invention [Problem to be solved by the invention]

[0005] An information processing system may determine whether or not identical character string data exists in two data lists each including a plurality of character string data related to secret information. However, since the character string data is related to secret information, a method of simply comparing the entirety of two character string data included in different data lists carries a risk of the secret information being leaked through the determination process. Even if the character string data is data converted from secret information, such as a hash value, there is a risk that the original secret information may be inferred from the character string data through a security attack such as a rainbow table attack. Therefore, in one aspect, the present invention aims to suppress data disclosure when determining whether the character string data matches. [Means for solving the problem]

[0006] In one aspect, a determination method is provided in which a computer executes the following process. For each first character included in a plurality of first character string data included in a first data list, it is determined whether a second character identical to each first character is included in a plurality of second character string data included in a second data list. If the same second character is included, an ordinal number associated with the same second character is identified among consecutive different ordinal numbers associated with the plurality of second characters according to the order of the plurality of second character string data and the order of the second characters in each of the second character string data. It is determined whether identical character string data exists between the plurality of first character string data and the plurality of second character string data based on the order of the plurality of first character string data, the order of the first characters in each of the first character string data, and the identified ordinal number. In another aspect, an information processing device having a storage unit and a processing unit is provided. In another aspect, a control program to be executed by a computer is provided. Effect of the Invention

[0007] In one aspect, data disclosure is suppressed when determining the consistency of string data. The above and other objects, features and advantages of the present invention will become apparent from the following description taken in conjunction with the accompanying drawings illustrating preferred embodiments of the present invention. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an information processing device according to a first embodiment. [Diagram 2] FIG. 11 illustrates an example of an information processing system according to a second embodiment. [Diagram 3] FIG. 2 is a block diagram showing an example of hardware of a server device. [Figure 4] FIG. 2 is a block diagram showing an example of the structure of a data capsule. [Diagram 5] FIG. 13 is a diagram illustrating a first example of division of a hash value. [Figure 6] FIG. 11 is a diagram showing a first example of identity determination using ordinal numbers. [Figure 7] FIG. 13 is a diagram illustrating a second example of division of a hash value. [Figure 8] FIG. 13 is a diagram showing a second example of identity determination using ordinal numbers. [Figure 9] FIG. 13 is a diagram illustrating an example of a procedure definition. [Figure 10] FIG. 13 illustrates an example of a monitoring setting table. [Figure 11] FIG. 2 is a block diagram showing an example of functions of the server device; [Figure 12] 13 is a flowchart showing an example of a procedure for determining identity. [Figure 13] 10 is a flowchart illustrating an example of a procedure for detecting a communication failure. [Figure 14] 13 is a flowchart illustrating an example of a procedure for detecting unauthorized login. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] The present embodiment will be described below with reference to the drawings. [First embodiment] A first embodiment will be described.

[0010] FIG. 1 is a diagram for explaining an information processing device according to a first embodiment. The information processing device 10 according to the first embodiment compares two data lists to determine whether identical character string data exists. The information processing device 10 may be a client device or a server device. The information processing device 10 may be called a computer or a determination device.

[0011] The information processing device 10 has a storage unit 11 and a processing unit 12. The storage unit 11 may be a volatile semiconductor memory such as a random access memory (RAM), or may be a non-volatile storage such as a hard disk drive (HDD) or a flash memory. The processing unit 12 is a processor such as a central processing unit (CPU), a graphics processing unit (GPU), or a digital signal processor (DSP). However, the processing unit 12 may include an electronic circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). The processor executes a program stored in a memory such as a RAM (which may be the storage unit 11). A set of processors may be called a multiprocessor or simply a "processor".

[0012] The storage unit 11 stores a data list 13. The data list 13 includes a plurality of character string data such as character string data 13-1, 13-2, etc. Each character string data includes two or more characters arranged in a specific order. The character string data 13-1 includes characters 13a and 13b, in that order. Character 13a is "4" and character 13b is "5". The character string data 13-2 includes characters 13c and 13d, in that order. Character 13c is "5" and character 13d is "6".

[0013] The character string data 13-1 and 13-2 may be hash values ​​calculated from the secret information using an irreversible hash function. The secret information may be personal information. The personal information may include a name, a personal attribute such as a date of birth, or an identification number of an asset or qualification owned by an individual such as a bank account number or a driver's license number. The hash value may be expressed as a character string. When the character string data 13-1 and 13-2 are hash values, the characters 13a, 13b, 13c, and 13d represent unit data of a certain length (for example, 1 byte).

[0014] The storage unit 11 may store a data list 14 to be compared with the data list 13. The data list 14 includes a plurality of character string data such as character string data 14-1, 14-2, etc. The character string data 14-1 includes characters 14a and 14b, in that order. The character 14a is "6" and the character 14b is "9". The character string data 14-2 includes characters 14c and 14d, in that order. The character 14c is "5" and the character 14d is "6".

[0015] However, the data list 14 may be stored in an information processing device different from the information processing device 10. When the data list 14 is stored in the storage unit 11, it is preferable that the data list 14 is protected so that reading of the character string data 14-1 and 14-2 is restricted. For example, the data list 14 is stored in an encrypted database, and the data list 14 is protected by a database management program that restricts reading of the character string data 14-1 and 14-2. When the data list 14 is stored in another information processing device, it is preferable that access from the information processing device 10 to the character string data 14-1 and 14-2 is restricted.

[0016] The processing unit 12 determines whether the data list 14 contains the same character for each of the characters 13a, 13b, 13c, and 13d contained in the data list 13. The processing unit 12 may pass each of the characters 13a, 13b, 13c, and 13d to a database management program and obtain a response indicating the presence or absence of the same character. This eliminates the need for the processing unit 12 to read out the character string data 14-1 and 14-2 themselves. The processing unit 12 may also rearrange the characters 13a, 13b, 13c, and 13d in an order different from the original order and determine the presence or absence of the same character. This reduces the risk that the character string data is inferred from a series of inquiries. In the example of FIG. 1, the character identical to the character 13a is not included in the data list 14, and the characters identical to the characters 13b, 13c, and 13d are included in the data list 14.

[0017] The processing unit 12 identifies an ordinal number (one or more) associated with one or more identical characters in the data list 13 for which one or more identical characters exist in the data list 14. Characters 14a, 14b, 14c, and 14d included in the data list 14 are associated with successive different ordinal numbers through the character string data 14-1 and 14-2. The ordinal number is a natural number indicating the order of the characters. The ordinal number is determined according to the order of the multiple character string data in the data list 14 and the order of two or more characters in each character string data.

[0018] Character 14a is associated with ordinal number 15a (#1), character 14b is associated with ordinal number 15b (#2), character 14c is associated with ordinal number 15c (#3), and character 14d is associated with ordinal number 15d (#4). Character 13b in data list 13 is identical to character 14c, so processing unit 12 identifies ordinal number 15c for character 13b. Character 13c in data list 13 is identical to character 14c, so processing unit 12 identifies ordinal number 15c for character 13c. Character 13d in data list 13 is identical to characters 14a and 14d, so processing unit 12 identifies ordinal numbers 15a and 15d for character 13d.

[0019] At this time, the processing unit 12 may pass each of the characters 13b, 13c, and 13d to the database management program and obtain a response indicating the ordinal number of the same character. This eliminates the need for the processing unit 12 to read out the character string data 14-1 and 14-2 themselves. The processing unit 12 may also rearrange the characters 13b, 13c, and 13d in an order different from the original order to specify the ordinal number of the same character. This reduces the risk that the character string data is inferred from a series of inquiries. Note that the determination of the presence or absence of the same character and the specification of the ordinal number may be executed integrally. For example, the processing unit 12 passes each of the characters 13a, 13b, 13c, and 13d to the database management program and obtains a response indicating the presence or absence of the same character and the ordinal number of the same character.

[0020] The processing unit 12 determines whether identical character string data exists between the data lists 13 and 14 based on the order of the multiple character string data in the data list 13, the order of two or more characters in each character string data, and the above-mentioned specified ordinal number. For example, the processing unit 12 scans the ordinal numbers from the first character to the last character for each character string data in the data list 13, and detects character string data in which consecutive ordinal numbers are specified for all characters. Character string data identical to the detected character string data may exist in the data list 14.

[0021] In the example of FIG. 1, no ordinal number is specified for character 13a in character string data 13-1. Therefore, character string data identical to character string data 13-1 does not exist in data list 14. On the other hand, ordinal numbers 15c and 15d indicating consecutive ordinal numbers #3 and #4 are specified for characters 13c and 13d in character string data 13-1. Therefore, character string data identical to character string data 13-2 may exist in data list 14. In fact, character string data 13-2 in data list 13 and character string data 14-2 in data list 14 are identical.

[0022] The processing unit 12 may further acquire position information indicating the position of a character in the character string data including the character, for the character in the data list 14 indicated by any one of the identified ordinal numbers. The position information may indicate the number of characters existing before the character and the number of characters existing after the character in the same character string data. Any one of the ordinal numbers may be the ordinal number of any one of the characters included in the detected character string data.

[0023] When the position information is consistent with the data list 13, the processing unit 12 may determine that the same character string data as the detected character string data exists in the data list 14. On the other hand, when the position information is not consistent with the data list 13, the processing unit 12 may determine that the same character string data as the detected character string data does not exist in the data list 14. For example, the processing unit 12 obtains position information indicating that the character 14c associated with the ordinal number 15c has zero preceding characters and one succeeding character. The character 13c in the data list 13 for which the ordinal number 15c is specified satisfies the condition that there are zero preceding characters and one succeeding character. Therefore, the processing unit 12 determines that the same character string data as the character string data 13-2 exists.

[0024] As described above, the information processing device 10 of the first embodiment determines, for each character in the data list 13, whether the same character is included in the data list 14, and if the same character is included, identifies an ordinal number associated with the same character. The information processing device 10 determines whether the data lists 13 and 14 contain the same character string data based on the sequence of ordinal numbers corresponding to the original character sequence in the data list 13. In this way, identity determination is performed while suppressing mutual data disclosure between the owner of the data list 13 and the owner of the data list 14. As a result, the risk of leaking confidential information such as personal information is reduced.

[0025] The accuracy of identity determination is improved by further using the above-mentioned position information. Also, by rearranging the characters included in the data list 13 and inquiring about the presence or absence of identical characters and their ordinals, the risk of the original character string data being guessed is reduced. Also, by storing the data list 13 in a database protected by a database management program with limited functions, identity determination is performed while restricting reading of the data list 13. Also, by storing the data list 14 in a database protected by a database management program with limited functions, identity determination is performed while restricting reading of the data list 14. Also, by converting the character string data into a hash value, the risk of confidential information being leaked is reduced.

[0026] [Second embodiment] Next, a second embodiment will be described. FIG. 2 illustrates an example of an information processing system according to the second embodiment.

[0027] The information processing system of the second embodiment has a data processing server 31 and user servers 32 and 33 connected to a network 30. The network 30 may include a LAN (Local Area Network) or the Internet. The user server 32 corresponds to the information processing device 10 of the first embodiment.

[0028] The data processing server 31 is a server computer that generates data capsules (described later) in response to requests from the user servers 32 and 33. The data processing server 31 may be located in a data center, or may be a so-called cloud server.

[0029] The data processing server 31 receives a data capsule creation request from a certain user server. The data capsule creation request specifies the data to be stored in the data capsule and management information indicating the users who can access the data and restrictions on the access method. In accordance with the data capsule creation request, the data processing server 31 generates a data capsule for transferring the data in a protected state and returns it to the user server. The data capsule includes an encrypted database and a database management program (DBMS (Database Management System) program) that provides limited access to the database.

[0030] The user servers 32, 33 are server computers of users who use the services provided by the data processing server 31. The users may be called participants or members, and may be individuals or companies. The user servers 32, 33 may be located in a data center or may be so-called cloud servers. Also, as the user servers 32, 33, client computers may be used instead of server computers.

[0031] Each of the user servers 32 and 33 transmits a data capsule creation request to the data processing server 31 and receives the generated data capsule from the data processing server 31. Each of the user servers 32 and 33 may transmit a data capsule to another user server according to business requirements. For example, the user server 33 transfers the data capsule received from the data processing server 31 to the user server 32.

[0032] Each of the user servers 32, 33 executes data processing on the initial data stored in the data capsule by starting the DBMS program contained in the acquired data capsule. However, the DBMS program restricts data access so that the initial data itself cannot be read from the data capsule. Instead, the DBMS program outputs the data processing result obtained by processing the initial data using a certain processing procedure.

[0033] In the second embodiment, the data capsule is used to determine whether user servers 32 and 33 hold the same personal information. The personal information includes the name of a person engaged in a certain task. For example, user server 32 holds the name of a system administrator who manages the platform of the information processing system. Meanwhile, user server 33 holds the name of a data administrator who manages the data of applications that use the information processing system.

[0034] To prevent unauthorized use of data by an administrator, it is preferable that the system administrator and the data administrator are not the same person. Therefore, the user servers 32, 33 compare the system administrator list with the data administrator list to confirm that the same names are not included. However, the names of the system administrator and the data administrator themselves are confidential information. Therefore, the user servers 32, 33 use a data capsule to perform identity determination while concealing the system administrator list and the data administrator list.

[0035] In order to reduce the risk of personal information leaks, a hash value of personal information is stored in the data capsule instead of the personal information itself. The user servers 32 and 33 agree on parameters for calculating the hash value via the data processing server 31. The parameters include the type of hash function, a character called a pepper to be added to the personal information, and a stretching count indicating the number of times the hash calculation is repeated.

[0036] The user servers 32, 33 convert the personal information into a hash value according to the agreed parameters and transmit the hash value to the data processing server 31. However, the data processing server 31 may convert the personal information into a hash value. The data processing server 31 generates a data capsule by storing the hash value in a database and registering a stored procedure for determining the identity of the hash value in the DBMS program.

[0037] FIG. 3 is a block diagram illustrating an example of hardware of the server device. The user server 32 has a CPU 101, a RAM 102, a HDD 103, a GPU 104, an input interface 105, a media reader 106 and a communication interface 107 connected to a bus. The data processing server 31 and the user server 33 may have the same hardware as the user server 32. The CPU 101 corresponds to the processing unit 12 in the first embodiment. The RAM 102 or the HDD 103 corresponds to the storage unit 11 in the first embodiment.

[0038] The CPU 101 is a processor that executes instructions of a program. The CPU 101 loads at least a part of the program and data stored in the HDD 103 into the RAM 102 and executes the program. The user server 32 may have multiple processors.

[0039] The RAM 102 is a volatile semiconductor memory that temporarily stores the programs executed by the CPU 101 and data used in the calculations by the CPU 101. The user server 32 may have a type of volatile memory other than the RAM.

[0040] The HDD 103 is a non-volatile storage that stores software programs such as an OS (Operating System), middleware, and application software, as well as data. The user server 32 may have other types of non-volatile storage, such as a flash memory or an SSD (Solid State Drive).

[0041] The GPU 104 is a processor that performs image processing in cooperation with the CPU 101 and outputs images to a display device 111 connected to the user server 32. The display device 111 is, for example, a CRT (Cathode Ray Tube) display, a liquid crystal display, an organic EL (Electro Luminescence) display, or a projector. Note that other types of output devices such as a printer may be connected to the user server 32.

[0042] The input interface 105 receives an input signal from an input device 112 connected to the user server 32. The input device 112 is, for example, a mouse, a touch panel, or a keyboard. A plurality of input devices may be connected to the user server 32.

[0043] The medium reader 106 is a reading device that reads programs and data recorded on the recording medium 113. The recording medium 113 is, for example, a magnetic disk, an optical disk, or a semiconductor memory. The magnetic disk includes a flexible disk (FD) and a HDD. The optical disk includes a compact disc (CD) and a digital versatile disc (DVD). The medium reader 106 copies the programs and data read from the recording medium 113 to another recording medium such as the RAM 102 or the HDD 103. The read programs may be executed by the CPU 101.

[0044] The recording medium 113 may be a portable recording medium. The recording medium 113 may be used for distributing programs and data. The recording medium 113 and the HDD 103 may be called computer-readable recording media.

[0045] The communication interface 107 communicates with the data processing server 31 and the user server 33 via the network 30. The communication interface 107 may be a wired communication interface connected to a wired communication device such as a switch or a router, or a wireless communication interface connected to a wireless communication device such as a base station or an access point.

[0046] Next, the data capsule will be described. FIG. 4 is a block diagram showing an example of the structure of a data capsule. The data capsule 130 includes a management information file 131 , a data file 132 , a DBMS program 133 , an erasure program 134 , and a container program 135 .

[0047] The management information file 131 is a file in which management information used for controlling access to a database is written. The management information file 131 includes file paths of data files 132. The management information file 131 also includes a user definition 136, an authority definition 137, a data structure definition 138, and a procedure definition 139.

[0048] User definition 136 indicates users who can access the database. A user may be identified by a user ID, a server name of a server device, or a communication address of a server device. Authority definition 137 indicates the type of data operation permitted for each user. For example, whether data search, data insertion, data update, and data deletion using SQL statements are permitted is defined. In the second embodiment, data search, data update, and data deletion may be prohibited. In addition, stored procedures that each user can execute are defined among the registered stored procedures.

[0049] Data structure definition 138 indicates the table structure of a relational database. Although data capsule 130 uses a relational database, a non-relational database such as a tree-type database or a network-type database may also be used. Procedure definition 139 indicates a stored procedure. A stored procedure is a program that describes a series of data processing operations that are difficult to describe in a single SQL statement. A stored procedure is described using a procedure description language that is an extension of SQL. When a stored procedure call command is received in place of an SQL statement, the stored procedure is executed.

[0050] The management information file 131 is encrypted. The encryption may be performed on a coarse-grained basis, such as the entire management information file 131, or on a fine-grained basis, such as on each item of the management information file 131, such as the user definition 136 or the authority definition 137.

[0051] The data file 132 is a file that contains records of a table of a relational database. The data file 132 is encrypted. The encryption may be performed on a coarse-grained basis, such as on the entire data file 132, or on a fine-grained basis, such as on a table-by-table or record-by-record basis.

[0052] The DBMS program 133 is a limited version of the DBMS program with limited functions compared to a normal DBMS program. The DBMS program 133 does not have a function to change the management information file 131. Furthermore, the DBMS program 133 may not have a function to execute some of the data operations such as data update and data deletion among data search, data insertion, data update, and data deletion.

[0053] DBMS program 133 provides users with restricted access to data file 132. DBMS program 133 receives a request message from a user and verifies that the contents of the request message are within the scope of the user's authority based on user definition 136 and authority definition 137. Then, DBMS program 133 executes the SQL statement contained in the request message or the stored procedure specified by the request message against the relational tables included in data file 132.

[0054] When the data capsule 130 is generated, a management information file 131 and a data file 132 are generated and encrypted using a normal version of the DBMS program with no functional restrictions. At this time, appropriate user definitions 136, authority definitions 137, data structure definitions 138, and procedure definitions 139 are set to realize identity determination, which will be described later. After that, the normal version of the DBMS program is replaced with the DBMS program 133.

[0055] The erasure program 134 is a program that deletes the management information file 131 and the data file 132 in response to an instruction from the container program 135 in order to prevent data leakage. The erasure program 134 first deletes the management information file 131, and then deletes the data file 132. The management information file 131 and the data file 132 are deleted by overwriting specific bits in the storage area in which the management information file 131 and the data file 132 are stored in order to make them unrecoverable.

[0056] The container program 135 is a representative program for encapsulating the data capsule 130 into a single file. When attempting to start the data capsule 130, the container program 135 is executed first. When the container program 135 is started, it performs user authentication using a user ID and password. The container program 135 may hold account information indicating the correspondence between the user ID and the correct password. If the user authentication is successful, the container program 135 starts the DBMS program 133.

[0057] The container program 135 also starts capsule monitoring to continuously check that the data capsule 130 is not being used illegally. If the container program 135 detects an event that may indicate unauthorized use of the data capsule 130, it decides to disable the data capsule 130 and starts the erasure program 134.

[0058] To monitor the capsule, the container program 135 periodically communicates with the data processing server 31 after startup. However, the communication partner may be a specific server device other than the data processing server 31. If a communication failure is detected, the container program 135 decides to invalidate the data capsule 130. The container program 135 also checks that the current time has not passed the expiration date. If the current time has passed the expiration date, the container program 135 decides to invalidate the data capsule 130.

[0059] Furthermore, the container program 135 detects unauthorized intrusion by monitoring the result of user authentication for the data capsule 130. If the result of multiple user authentications matches a specific pattern, the container program 135 determines that there is a possibility of unauthorized intrusion and decides to invalidate the data capsule 130. An example of an unauthorized intrusion pattern is when the number of user authentication failures exceeds a threshold within a time T1, followed by successful user authentication within the following time T2. Capsule monitoring detects the possibility that the data capsule 130 has been transferred to an unauthorized person, or the possibility that an unauthorized person has illegally intruded into the data capsule 130.

[0060] Next, the identity determination of personal information using a data capsule will be described. FIG. 5 is a diagram illustrating a first example of division of a hash value. The data capsule 150 is received by the user server 32 from the data processing server 31. The data capsule 160 is received by the user server 33 from the data processing server 31 and transferred to the user server 32. The data capsules 150 and 160 have a structure similar to that of the above-mentioned data capsule 130. In the following explanation, the user server 32 performs identity determination using the data capsules 150 and 160. However, it is also possible for the user server 32 to transfer the data capsule 150 to the user server 33, and for the user server 33 to perform identity determination using the data capsules 150 and 160.

[0061] Data capsule 150 includes hash value list 151. Hash value list 151 includes a plurality of hash values ​​generated from different personal information. A hash value can be considered as character string data by expressing a unit data of a certain length (e.g., one byte data) as one character. Hash value list 151 corresponds to data list 13 of the first embodiment. For example, hash value list 151 includes a hash value "450" ​​calculated from the name "Sato Taro" and a hash value "56" calculated from the name "Sato Jiro". Different hash values ​​may have different lengths.

[0062] Data capsule 160 includes hash value list 161. Hash value list 161 includes a plurality of hash values ​​generated from different personal information. Hash value list 161 corresponds to data list 14 of the first embodiment. For example, hash value list 161 includes a hash value "69" calculated from the name "Suzuki Jiro" and a hash value "56" calculated from the name "Sato Jiro". The same hash value is calculated from the same name. Hash value lists 151 and 161 include the same hash value "56".

[0063] User server 32 invokes a stored procedure of data capsule 150. Data capsule 150 generates byte matrix 152 from hash value list 151. Data capsule 150 may store generated byte matrix 152 in a database. Byte matrix 152 is generated by dividing the hash values ​​in hash value list 151 into byte values ​​of one byte each and left-justifying them. Rows of byte matrix 152 correspond to hash values, and columns of byte matrix 152 correspond to positions from the beginning of the hash values. Since the length differs depending on the hash value, empty cells in byte matrix 152 are filled with Null values.

[0064] Data capsule 150 generates byte table 153 from byte matrix 152. Data capsule 150 may store generated byte table 153 in a database. Byte table 153 is a table that associates row numbers, column numbers, and byte values. At this time, data capsule 150 randomly shuffles the byte values ​​to rearrange them in an order different from that of byte matrix 152.

[0065] For example, row 1, column 1 of byte matrix 152 is "4", row 1, column 2 is "5", row 1, column 3 is "0", row 2, column 1 is "5", row 2, column 2 is "6", and row 2, column 3 is "N" (Null value). In contrast, the first byte value of byte table 153 corresponds to row 2, column 2, the second byte value to row 1, column 1, the third byte value to row 1, column 3, the fourth byte value to row 2, column 1, the fifth byte value to row 1, column 2, and the sixth byte value to row 2, column 3. Note that byte table 153 may or may not include Null values.

[0066] When determining identity, the stored procedure of the data capsule 150 calls the stored procedure of the data capsule 160. For this purpose, the user server 32 specifies the file path of the data capsule 160 to the data capsule 150. As a result, the data capsule 150 communicates directly with the data capsule 160.

[0067] Data capsule 160 generates byte matrix 162 from hash value list 161. Data capsule 160 may store generated byte matrix 162 in a database. Like byte matrix 152, byte matrix 162 is generated by dividing the hash values ​​in hash value list 161 into byte values ​​of one byte each and left-justifying them.

[0068] Data capsule 160 generates byte table 163 from byte matrix 162. Data capsule 160 may store generated byte table 163 in a database. Byte table 163 is a table that associates ordinals, row numbers, and byte values. Ordinals are consecutive natural numbers that are assigned to byte values ​​according to the order in byte matrix 162. Within the same hash value, consecutive ordinals are assigned from the first byte value to the last byte value. The ordinal number assigned to the first byte value of a hash value is one greater than the ordinal number assigned to the last byte value of the previous hash value.

[0069] The byte values ​​in byte table 163 are sorted in ascending order of ordinal. Thus, unlike byte table 153, the byte values ​​in byte table 163 are not randomly shuffled. For example, row 1, column 1 of byte matrix 162 is "6", row 1, column 2 is "9", row 2, column 1 is "5", and row 2, column 2 is "6". The ordinal number of the byte value in row 1, column 2 is 1, the ordinal number of the byte value in row 1, column 2 is 2, the ordinal number of the byte value in row 2, column 1 is 3, and the ordinal number of the byte value in row 2, column 2 is 4.

[0070] The byte table 163 is created to improve the efficiency of ordinal number searches, which will be described later. However, the data capsule 160 can also perform ordinal number searches using the byte matrix 162 without generating the byte table 163.

[0071] FIG. 6 is a diagram showing a first example of identity determination using ordinal numbers. Data capsule 150 passes byte values ​​contained in byte table 153 one by one to data capsule 160, starting from the top, by calling the stored procedure of data capsule 160. Data capsule 160 searches byte table 163, starting from the top, for a byte value identical to the received byte value, and returns an ordinal number corresponding to the identical byte value. When data capsule 160 reaches the end of byte table 163, i.e., when the same byte value does not exist, it returns a negative number (e.g., -1).

[0072] For one byte value included in byte table 153, there may be a plurality of identical byte values ​​in byte table 163. Therefore, data capsule 150 repeatedly inputs each byte value in byte table 153 to data capsule 160 until a negative value is returned, thereby comprehensively acquiring the ordinal numbers of the identical byte values.

[0073] For example, data capsule 150 inputs the byte value "6" in row 2, column 2 into data capsule 160 and obtains the ordinal number 1,4. Next, data capsule 150 inputs the byte value "4" in row 1, column 1 into data capsule 160 and obtains a negative number. Next, data capsule 150 inputs the byte value "0" in row 1, column 3 into data capsule 160 and obtains a negative number. Next, data capsule 150 inputs the byte value "5" in row 2, column 1 into data capsule 160 and obtains the ordinal number 3. Next, data capsule 150 inputs the byte value "5" in row 1, column 2 into data capsule 160 and obtains the ordinal number 3.

[0074] Note that data capsule 150 may or may not input a null value to data capsule 160. Furthermore, data capsule 150 may input a duplicate byte value, such as the above byte value "5", to data capsule 160 multiple times, or may input it only once. In the latter case, data capsule 150 may reuse the search result for the byte value "5" in row 2, column 1 as the search result for the byte value "5" in row 1, column 2.

[0075] After exhaustively obtaining the ordinals of the byte values, data capsule 150 sorts the byte values ​​in byte table 153 using the row number as a first sort key and the column number as a second sort key. Data capsule 150 groups the byte values ​​in byte table 153 by row number. This recreates the sort order of the byte values ​​in byte matrix 152, and byte values ​​belonging to the same hash value are sorted in the original order.

[0076] Data capsule 150 determines for each hash value, that is, for each column of byte values ​​with the same row number, whether consecutive ordinal numbers have been obtained for all byte values. For hash values ​​for which consecutive ordinal numbers have been obtained for all byte values, there is a possibility that the same hash value is included in hash value list 161. On the other hand, for hash values ​​for which consecutive ordinal numbers have not been obtained for all byte values, the same hash value is not included in hash value list 161.

[0077] For example, the ordinal search results for the hash value "450" ​​are (none), (3), (none). Therefore, the hash value "450" ​​is not included in the hash value list 161. On the other hand, the ordinal search results for the hash value "56" are (3), (1, 4). This search result includes the consecutive ordinal sequence of 3, 4. Therefore, the hash value "56" may be included in the hash value list 161.

[0078] However, the byte value "5" and the byte value "6" may belong to different hash values, that is, they may span different rows of the byte matrix 162. For this reason, it cannot be determined that the hash value "56" is included in the hash value list 161 based on the ordinal number alone.

[0079] Therefore, data capsule 150 inputs to data capsule 160 the ordinal number of any one of the byte values ​​belonging to a hash value that may be included in hash value list 161. The reference byte value may be selected randomly from the hash value to be verified, or may be the first or last byte value included in the hash value to be verified. Data capsule 150 counts byte values ​​having the same row number as the byte value corresponding to the received ordinal number from byte table 163, and responds with the number of byte values ​​located before and after the received ordinal number.

[0080] For example, data capsule 150 inputs ordinal number 3 obtained from byte value "5" in row 2, column 1 to data capsule 160. Data capsule 160 searches byte table 163 for a byte value having the same row number as the byte value of ordinal number 3, and determines that the number of byte values ​​in the front is 0 and the number of byte values ​​in the rear is 1. Data capsule 160 responds to data capsule 150 with information of 0 in the front and 1 in the rear.

[0081] The data capsule 150 determines whether the response from the data capsule 160 is consistent with the byte table 153. Here, among the byte values ​​in the second row and first column that have the same row number, the front byte value is 0 and the rear byte value is 1. Therefore, the response from the data capsule 160 is consistent with the byte table 153. If the response from the data capsule 160 is consistent with the byte table 153, the data capsule 150 determines that the hash value to be verified is included in the hash value list 161. On the other hand, if the response from the data capsule 160 is not consistent with the byte table 153, the data capsule 150 determines that the hash value to be verified is not included in the hash value list 161. In the example of FIG. 6, it is determined that the hash value "56" is included in the hash value list 161.

[0082] FIG. 7 is a diagram illustrating a second example of division of a hash value. 5, data capsule 150 stores hash value list 151. Data capsule 150 generates byte matrix 152 from hash value list 151, and generates byte table 153 from byte matrix 152.

[0083] On the other hand, data capsule 160 stores hash value list 164. Hash value list 164 includes hash value "75" calculated from the name "Suzuki Shiro" and hash value "60" calculated from the name "Takahashi Taro." Hash value lists 151 and 164 do not include the same hash value. Data capsule 160 generates byte matrix 165 from hash value list 164, and generates byte table 166 from byte matrix 165. Row 1, column 2 is "7," row 1, column 2 is "5," row 2, column 1 is "6," and row 2, column 2 is "0." The ordinal number of the byte value in row 1, column 2 is 1, the ordinal number of the byte value in row 1, column 2 is 2, the ordinal number of the byte value in row 2, column 1 is 3, and the ordinal number of the byte value in row 2, column 2 is 4.

[0084] FIG. 8 is a diagram showing a second example of identity determination using ordinal numbers. Data capsule 150 inputs the byte value "6" in row 2, column 2 into data capsule 160 and obtains the ordinal number 3. Next, data capsule 150 inputs the byte value "4" in row 1, column 1 into data capsule 160 and obtains a negative number. Next, data capsule 150 inputs the byte value "0" in row 1, column 3 into data capsule 160 and obtains the ordinal number 4. Next, data capsule 150 inputs the byte value "5" in row 2, column 1 into data capsule 160 and obtains the ordinal number 2. Next, data capsule 150 inputs the byte value "5" in row 1, column 2 into data capsule 160 and obtains the ordinal number 2.

[0085] Data capsule 150 sorts the byte values ​​in byte table 153 and, for each hash value, determines whether consecutive ordinal numbers have been obtained for all byte values. The ordinal search results for hash value "450" ​​are (none), (2), and (4). Therefore, hash value "450" ​​is not included in hash value list 164. On the other hand, the ordinal search results for hash value "56" are (2) and (3). Since this search result includes a string of consecutive ordinal numbers, it is possible that hash value "56" is included in hash value list 164.

[0086] Therefore, data capsule 150 inputs ordinal number 2 obtained from byte value "5" in row 2, column 1 to data capsule 160. Data capsule 160 searches byte table 166 for a byte value having the same row number as the byte value of ordinal number 2, and determines that there is one byte value in the front and zero byte values ​​in the rear. Data capsule 160 responds to data capsule 150 with information of one in the front and zero in the rear.

[0087] In byte table 153, of the byte values ​​with the same row number as the byte value in row 2, column 1, the front byte value is 0 and the rear byte value is 1. Therefore, the response from data capsule 160 is not consistent with byte table 153. Therefore, data capsule 150 determines that hash value "56" is not included in hash value list 164.

[0088] FIG. 9 is a diagram showing an example of a procedure definition. In order to implement the above-mentioned identity determination, stored procedures 141, 142, 143, 144, and 145 are registered in data capsules 150 and 160, respectively. However, stored procedure 141 may be registered only in data capsule 150, and stored procedures 142, 143, 144, and 145 may be registered only in data capsule 160.

[0089] Stored procedure 141 is a program that performs identity determination, and is called from user server 32. Stored procedure 141 receives the file path of the other data capsule as input. While calling stored procedures 142, 143, 144, and 145 of the other data capsule, stored procedure 141 determines whether the databases of the two data capsules contain identical records, and outputs the presence or absence of identical records.

[0090] Stored procedure 142 is a program that shows a bit number comparison. Stored procedure 143 is a program that shows a divided bit number comparison. Before executing the procedures described in Figs. 5 to 8, data capsule 150 performs simple preprocessing to screen out hash values ​​included in hash value list 151 that are unlikely to be included in data capsule 160. The screened out hash values ​​are excluded from the procedures in Figs. 5 to 8. Stored procedures 142 and 143 are used for this preprocessing.

[0091] Stored procedure 142 receives as input the number of ON bits (bits whose value is 1) in the entire bit string representing one hash value. Stored procedure 142 counts the number of ON bits for each hash value stored in the database, and determines whether there is a hash value in the database that has the same number of ON bits as the received number of ON bits. Stored procedure 142 outputs whether there is a hash value with the same number of ON bits. Note that it is difficult to estimate a hash value from the number of ON bits alone.

[0092] The stored procedure 143 receives as an input a string of the number of ON bits. The string of the number of ON bits is calculated by dividing a bit string representing one hash value into N blocks (N is an integer equal to or greater than 2) and counting the number of ON bits for each block. The size of one block is sufficiently larger than the size of the byte value used in FIGS. 5 to 8. The stored procedure 143 calculates the string of the number of ON bits for each hash value stored in the database, and determines whether or not there is a hash value in the database that has a string of the same number of ON bits as the received string of the number of ON bits. The stored procedure 143 outputs whether or not there is a hash value that has the same string of the number of ON bits. By making the size of the block sufficiently large, it becomes difficult to estimate a hash value only from the string of the number of ON bits.

[0093] Stored procedure 144 is a program that demonstrates a byte search. Stored procedure 144 accepts one byte value and a starting position as input. When a new byte value is input, the starting position is 0. When the same byte value as the previous time is input, the starting position is the ordinal number output previously. This searches for an identical byte value that has not yet been searched. Stored procedure 144 searches for a byte value identical to the accepted byte value among the byte values ​​contained in the hash value stored in the database, starting from one position after the starting position toward the end. If an identical byte value is detected, stored procedure 144 outputs the ordinal number, and if an identical byte value is not detected, outputs a specific negative number (e.g., -1).

[0094] Stored procedure 144 may hold an internal state that indicates the state during the search. For example, stored procedure 144 may save the previously output ordinal number in a database. In this case, the start position does not need to be input, and stored procedure 144 may resume the search for identical byte values ​​from where it left off last time. Stored procedure 144 may also output the ordinal numbers of all identical byte values ​​at once.

[0095] Stored procedure 145 is a program that performs a preceding / following byte count search. Stored procedure 145 receives as input the ordinal number of a reference byte value. Stored procedure 145 counts the number of byte values ​​that are ahead of the reference byte value and the number of byte values ​​that are behind the reference byte value among the byte values ​​that belong to the same hash value as the reference byte value. Stored procedure 145 outputs the counted number of forward bytes and number of backward bytes.

[0096] FIG. 10 illustrates an example of the monitoring setting table. The monitoring setting table 146 indicates the settings of the capsule monitoring. The monitoring setting table 146 may be stored in the database or may be stored outside the database. The monitoring setting table 146 associates a parameter name with a parameter value. The parameters include a communication failure time, an authentication failure time, the number of authentication failures, an authentication success time, and an expiration date.

[0097] After being started, the data capsule 130 periodically communicates with the data processing server 31. If the communication disabled state continues beyond the "communication disabled time" after being started, the data capsule 130 disables itself and deletes the management information of the database.

[0098] Furthermore, data capsule 130 requests user authentication using a user ID and password each time it is started. Data capsule 130 monitors the results of this user authentication. If authentication failures occur the number of "authentication failures" during the most recent "authentication failure time" T1, and at least one authentication success occurs during "authentication success time" T2 after the number of authentication failures reaches the "authentication failure count", data capsule 130 considers this authentication success to be an unauthorized intrusion. If data capsule 130 detects an unauthorized intrusion from the user authentication result, it invalidates data capsule 130 itself and deletes the management information in the database.

[0099] Furthermore, when the data capsule 130 is started or periodically, it determines whether the current time has passed the "expiration date." If the current time has passed the "expiration date," the data capsule 130 invalidates itself and deletes the management information in the database.

[0100] Next, the functions and processing procedures of the server device will be described. FIG. 11 is a block diagram illustrating an example of functions of the server device. The data processing server 31 includes a capsule generating unit 121 and a capsule monitoring unit 122. The capsule generating unit 121 and the capsule monitoring unit 122 are implemented using, for example, a CPU, a communication interface, and a program included in the data processing server 31.

[0101] The capsule generation unit 121 receives a data capsule creation request from the user server 32, generates a data capsule 150, and transmits it to the user server 32. The capsule generation unit 121 also receives a data capsule creation request from the user server 33, generates a data capsule 160, and transmits it to the user server 33. The data capsule creation request includes a hash value to be stored in the database and management information to be registered in the DBMS program. However, the capsule generation unit 121 may calculate a hash value from personal information. Also, when identity determination is specified by the user servers 32 and 33 as the purpose of the data capsule, the capsule generation unit 121 may generate appropriate management information for implementing the identity determination.

[0102] The capsule monitor 122 is a server process that periodically communicates with the data capsules 150, 160. The capsule monitor 122 receives random numbers from each of the data capsules 150, 160, and returns a response message including the received random numbers to the data capsules 150, 160. However, the capsule monitor 122 may be located outside the data processing server 31.

[0103] The user server 32 has a capsule acquisition unit 123, a capsule storage unit 124, an identity determination unit 125, and a capsule monitoring unit 126. The capsule storage unit 124 is implemented, for example, using the RAM 102 or the HDD 103. The capsule acquisition unit 123, the identity determination unit 125, and the capsule monitoring unit 126 are implemented, for example, using the CPU 101, the communication interface 107, and a program. The user server 33 may have the same modules as the user server 32.

[0104] The capsule acquisition unit 123 accepts input of personal information, converts the accepted personal information into a hash value, and transmits a data capsule creation request including the hash value to the data processing server 31. The capsule acquisition unit 123 receives the data capsule 150 in which the hash value is stored from the data processing server 31. The capsule acquisition unit 123 also receives a data capsule 160 to be compared from the user server 32. However, the capsule acquisition unit 123 may transfer the data capsule 150 to the user server 33. Also, the data capsules 150 and 160 may communicate with each other while the user server 32 holds the data capsule 150 and the user server 33 holds the data capsule 160.

[0105] The capsule storage unit 124 stores the data capsule 150 received from the data processing server 31 and the data capsule 160 received from the user server 33 . The identity determination unit 125 uses the stored procedures of the data capsules 150, 160 stored in the capsule storage unit 124 to determine whether the two hash value lists contain the same hash value. At this time, the identity determination unit 125 does not read out the hash value lists themselves from the data capsules 150, 160. The identity determination unit 125 outputs the result of the identity determination. The identity determination unit 125 may display the determination result on the display device 111, may store it in non-volatile storage, or may transmit it to another information processing device.

[0106] After the identity determination unit 125 starts the data capsules 150, 160, the capsule monitoring unit 126 monitors the data capsules 150, 160 in accordance with a container program included in the data capsules 150, 160. The capsule monitoring unit 126 periodically transmits a random number to the capsule monitoring unit 122, and receives a response message including the transmitted random number from the capsule monitoring unit 122. The capsule monitoring unit 126 invalidates the data capsules 150, 160 when the communication disabled time exceeds a threshold. Furthermore, the capsule monitoring unit 126 invalidates the data capsules 150, 160 when the results of multiple user authentications match a specific pattern. Furthermore, the capsule monitoring unit 126 invalidates data capsules whose expiration date has passed.

[0107] FIG. 12 is a flowchart showing an example of a procedure for determining identity. The user server 32 starts the data capsules 150 and 160. The following processing is executed using the DBMS program included in the data capsules 150 and 160.

[0108] (S10) The data capsule 150 counts the number of ON bits in each of the multiple hash values ​​stored in the data capsule 150. The data capsule 150 inputs the calculated number of ON bits into the data capsule 160 one by one.

[0109] (S11) Data capsule 160 searches for a hash value having the input number of ON bits from among multiple hash values ​​stored in data capsule 160. Data capsule 160 responds to data capsule 150 as to whether or not there is a corresponding hash value. Data capsule 150 excludes from the following processing any hash values ​​for which a response has been made that there is no corresponding hash value among the multiple hash values ​​stored in data capsule 150.

[0110] (S12) Data capsule 150 divides each of the multiple hash values ​​stored in data capsule 150 into two or more blocks, and counts the number of ON bits in each block. Data capsule 150 inputs a string of the numbers of ON bits, in which the numbers of ON bits in blocks belonging to the same hash value are arranged in order, into data capsule 160 one by one.

[0111] (S13) Data capsule 160 searches for a hash value having the string of the input number of ON bits from among the multiple hash values ​​stored in data capsule 160. Data capsule 160 responds to data capsule 150 as to whether or not there is a corresponding hash value. Data capsule 150 excludes from the multiple hash values ​​stored in data capsule 150 any hash values ​​for which a response is made that there is no corresponding hash value, from the targets of the following processing.

[0112] (S14) The data capsule 150 divides the multiple hash values ​​stored in the data capsule 150 into byte units, and generates a byte matrix by left-justifying the byte values. (S15) The data capsule 160 divides the multiple hash values ​​stored in the data capsule 150 into byte units and generates a byte matrix by left-justifying them. The data capsule 160 assigns consecutive ordinal numbers to the byte values ​​included in the byte matrix. Note that step S15 may be executed when the stored procedure 144 is called for the first time from the data capsule 150. Also, step S15 may be executed in response to a request from the data capsule 150 before the stored procedure 144 is called for the first time, or the byte matrix may be generated when the data capsule 160 is generated. Also, step S15 may be executed every time the stored procedure 144 is called.

[0113] (S16) Data capsule 150 randomly rearranges the byte values ​​and generates a byte table in which row numbers, column numbers, and byte values ​​correspond to each other. (S17) Data capsule 150 preferentially selects one byte value from the top of the byte table, and inputs the selected byte value to data capsule 160.

[0114] (S18) Data capsule 160 scans the byte values ​​starting from the smallest ordinal number and searches for a byte value identical to the input byte value. If an identical byte value is detected, data capsule 160 returns the ordinal number corresponding to the identical byte value to data capsule 150. If an identical byte value is not detected, data capsule 160 returns a negative number.

[0115] (S19) Data capsule 150 determines whether a negative number has been received from data capsule 160. If a negative number has been received, the process proceeds to step S20. If a positive number indicating an ordinal number has been received, the process returns to step S17. In this case, data capsule 150 inputs the previous byte value again to data capsule 160. Data capsule 150 specifies the start position so that the same byte value is searched for continuing from the previous position.

[0116] (S20) Data capsule 150 determines whether all byte values ​​contained in the byte table have been input to data capsule 160. If all byte values ​​have been input, the process proceeds to step S21. If there are byte values ​​that have not been input, the process returns to step S17. Data capsule 150 selects the next byte value from the byte table.

[0117] (S21) Data capsule 150 sorts the byte values ​​included in the byte table based on the row number and column number, and restores the order of the byte values. (S22) Data capsule 150 groups the byte values ​​included in the byte table by row number, and detects hash values ​​that have consecutive ordinal numbers.

[0118] (S23) Data capsule 150 selects one ordinal number from the consecutive ordinal numbers corresponding to the detected hash value, and inputs this to data capsule 160. If multiple hash values ​​are detected, one ordinal number is selected and input for each detected hash value.

[0119] (S24) Data capsule 160 counts the number of byte values ​​before and after the reference byte value in the hash value to which the reference byte value corresponding to the input ordinal number belongs. Data capsule 160 responds to data capsule 150 with the counted number of forward bytes and number of backward bytes.

[0120] (S25) Data capsule 150 determines whether the number of bytes before and after the data capsule 160 received from data capsule 160 is consistent with the byte table. If they are consistent, data capsule 150 determines that the same hash value as the detected hash value is included in data capsule 160. If they are not consistent, data capsule 150 determines that the same hash value as the detected hash value is not included in data capsule 160.

[0121] Data capsule 150 outputs the result of the identity determination. If consecutive ordinal numbers are not obtained for all hash values ​​or the number of bytes before and after does not match, data capsule 150 determines that data capsules 150, 160 do not contain the same hash value. On the other hand, if consecutive ordinal numbers are obtained and the number of bytes before and after match for at least one hash value, data capsule 150 determines that they contain the same hash value. If data capsules 150, 160 contain the same hash value, the user may consider, for example, changing the person in charge of operations, or abandoning or terminating the system usage contract.

[0122] FIG. 13 is a flowchart showing an example of a procedure for detecting a communication failure. The user server 32 starts the data capsules 150 and 160. The following processing is executed using a container program included in the data capsules 150 and 160. The following processing may be executed for each data capsule.

[0123] (S30) The capsule monitoring unit 126 selects one random number. The capsule monitoring unit 126 records the selected random number in association with a timestamp indicating the current time. (S31) The capsule monitoring unit 126 transmits the selected random number to the data processing server 31 (or a specific server device having the capsule monitoring unit 122).

[0124] (S32) Capsule monitoring unit 126 determines whether a response message including the transmitted random number is received within a certain time after transmitting the random number. Whether the random number included in the response message is the same as the one transmitted by capsule monitoring unit 126 is determined by referring to the record of step S30. If an appropriate response message is received, processing proceeds to step S33, and if an appropriate response message is not received, processing proceeds to step S34.

[0125] (S33) The capsule monitoring unit 126 updates the last communication time. If the received random number is the one last transmitted by the capsule monitoring unit 126, the capsule monitoring unit 126 sets the current time as the last communication time. If the received random number is not the one last transmitted by the capsule monitoring unit 126, the capsule monitoring unit 126 sets the transmission time of the next random number after the received random number as the last communication time. Then, the process returns to step S30.

[0126] (S34) The capsule monitoring unit 126 calculates the time that has elapsed since the last communication time. The capsule monitoring unit 126 determines whether the calculated elapsed time has exceeded the communication unavailable time threshold registered in the monitoring setting table 146. If the elapsed time has exceeded the threshold, the process proceeds to step S35, and if the elapsed time has not exceeded the threshold, the process returns to step S30.

[0127] (S35) The capsule monitoring unit 126 starts the erasure program included in the same data capsule as the container program. The capsule monitoring unit 126 decides to invalidate the data capsule, and deletes the management information from the database.

[0128] In this way, the capsule monitoring unit 126 repeatedly selects a random number and transmits it to the data processing server 31 until the time elapsed since the last communication time exceeds the threshold. During that time, due to a temporary communication interruption or delay, the capsule monitoring unit 126 may receive a response message including an old random number. The capsule monitoring unit 126 can appropriately determine the last communication time by recording the transmitted random number and timestamp. The capsule monitoring unit 126 may delete from the record any random number having a timestamp earlier than the last communication time.

[0129] FIG. 14 is a flowchart showing an example of a procedure for detecting unauthorized login. The user server 32 starts the data capsules 150 and 160. The following processing is executed using a container program included in the data capsules 150 and 160. The following processing may be executed for each data capsule.

[0130] (S40) The capsule monitoring unit 126 acquires the result of the current user authentication. (S41) The capsule monitor 126 determines whether the result of the user authentication is authentication failure. If the authentication is failure, the process proceeds to step S42. If the authentication is not failure, that is, if the authentication is success, the process proceeds to step S44.

[0131] (S42) The capsule monitoring unit 126 determines whether the number of authentication failures within the most recent time T1 has reached the threshold value registered in the monitoring setting table 146. If the number of authentication failures has reached the threshold value within the time T1, the process proceeds to step S43. Otherwise, the process of detecting unauthorized logins for the result of the current user authentication ends.

[0132] (S43) The capsule monitoring unit 126 starts a timer that measures time T2 from the point in time when the number of authentication failures reaches the threshold value. Then, the process of detecting unauthorized logins for the result of this user authentication ends.

[0133] (S44) The capsule monitoring unit 126 determines whether the current time is within the period of time T2 measured by the timer in step S43. If it is within the period of time T2, the process proceeds to step S45. If it is not within the period of time T2, the process of detecting unauthorized login based on the result of the current user authentication ends.

[0134] (S45) The capsule monitoring unit 126 starts an erasure program that is included in the same data capsule as the container program. The capsule monitoring unit 126 decides to invalidate the data capsule, and deletes the management information from the database.

[0135] As described above, the information processing system of the second embodiment determines whether the same personal information is included in two data lists owned by different users. This allows the user to make appropriate business decisions based on the personal information. In addition, the information processing system converts the personal information into a hash value and determines whether the same hash value is included in two hash value lists. This reduces the risk of personal information leaks.

[0136] The information processing system also stores the two hash value lists in data capsules in which reading of hash values ​​is prohibited. The information processing system then calls stored procedures in the two data capsules and performs identity determination through communication between the data capsules. This also reduces the risk of hash value leakage. This reduces the risk of personal information being inferred from hash values ​​through rainbow table attacks.

[0137] Furthermore, the stored procedure of one data capsule randomly rearranges the byte values ​​contained in the hash value list held by that data capsule and transmits it to the other data capsule. This reduces the risk that the hash value can be guessed by monitoring the byte values ​​being transmitted. Furthermore, the stored procedure of one data capsule determines whether or not there are identical hash values ​​based on the continuity of the ordinal numbers received from the other data capsule. This allows identity determination to be performed while keeping the hash values ​​themselves secret. Furthermore, the accuracy of identity determination is improved by verifying the number of bytes before and after a certain ordinal number.

[0138] The foregoing merely illustrates the principles of the present invention. Further, since numerous modifications and changes are possible to those skilled in the art, the present invention is not limited to the exact construction and application shown and described above, and all corresponding modifications and equivalents are deemed to be within the scope of the present invention according to the appended claims and their equivalents. [Explanation of symbols]

[0139] 10. Information processing device 11 Storage section 12 Processing section 13,14 Data List 13-1, 13-2, 14-1, 14-2 String data 13a, 13b, 13c, 13d, 14a, 14b, 14c, 14d letters 15a,15b,15c,15d Ordinal number

Claims

1. determining whether or not a second character identical to each of the first characters included in the plurality of first character string data included in the first data list is included in a plurality of second characters included in the plurality of second character string data included in the second data list; if the same second character is included, identifying an ordinal number associated with the same second character from among successive different ordinal numbers associated with the plurality of second characters in accordance with an order of the plurality of second character string data and an order of second characters within each of the second character string data; determining whether or not identical character string data exists between the plurality of first character string data and the plurality of second character string data based on an order of the plurality of first character string data, an order of first characters in each of the first character string data, and the specified ordinal number; A method for determining whether a process is to be performed by a computer.

2. the determination of the identical character string data includes a process of determining, when consecutive ordinal numbers are specified for all first characters included in one first character string data, that there is a second character string data identical to the one first character string data; The method of claim 1.

3. the determination of the identical character string data includes a process of: identifying, for at least one first character, position information indicating a position of the one second character in second character string data including the one second character associated with the identified ordinal number; and determining whether the identical character string data exists by further using the identified position information. The method of claim 1.

4. the determination of the identical second character includes a process of sorting a plurality of first characters included in the plurality of first character string data, and searching the plurality of second character string data for the identical second character for each of the first characters in the sorted order; The method of claim 1.

5. the step of specifying the ordinal number includes a process of executing a database management program that executes a procedure that restricts reading of the plurality of second character string data, receives each of the first characters, and outputs an ordinal number associated with the same second character; The method of claim 1.

6. the determination of the identical character string data includes a process of executing a database management program that executes a procedure for restricting reading of the plurality of first character string data, acquiring the specified ordinal number, and outputting the presence or absence of the identical character string data; The method of claim 1.

7. the plurality of first character string data are a plurality of first hash values, and the plurality of second character string data are a plurality of second hash values; each of the first characters is a first unit data obtained by dividing each of the plurality of first hash values, and each of the plurality of second characters is a second unit data obtained by dividing each of the plurality of second hash values; The method of claim 1.

8. a storage unit that stores a first data list including a plurality of first character string data; a processing unit that determines, for each first character included in the plurality of first character string data, whether a second character identical to each first character is included among a plurality of second characters included in a plurality of second character string data included in a second data list, and if the identical second character is included, identifies an ordinal number associated with the identical second character among consecutive different ordinal numbers associated with the plurality of second characters in accordance with an order of the plurality of second character string data and an order of second characters within each of the second character string data, and determines whether identical character string data exists between the plurality of first character string data and the plurality of second character string data based on the order of the plurality of first character string data, the order of first characters within each of the first character string data, and the identified ordinal number; An information processing device having the above configuration.

9. determining whether or not a second character identical to each of the first characters included in the plurality of first character string data included in the first data list is included in a plurality of second characters included in the plurality of second character string data included in the second data list; if the same second character is included, identifying an ordinal number associated with the same second character from among successive different ordinal numbers associated with the plurality of second characters in accordance with an order of the plurality of second character string data and an order of second characters within each of the second character string data; determining whether or not identical character string data exists between the plurality of first character string data and the plurality of second character string data based on an order of the plurality of first character string data, an order of first characters in each of the first character string data, and the specified ordinal number; A judgment program that causes a computer to execute a process.

Images