Cloud system for protecting specific information

Abstract

The risk of information leakage is reduced by properly managing access paths from user terminals to the database. [Solution] The cloud system is connected to an administrator terminal 20 operated by an administrator and a user terminal 30 operated by a user. The cloud system includes a database 11 that stores specific data including specific information and non-specific data not including specific information, an access management unit 13 that grants a dedicated role for accessing the specific data to a user designated by the administrator, a specific operation springboard server 16 to which a user terminal 30(a) of a user granted a dedicated role is connected and which is permitted to access the specific data and non-specific data, and a normal operation springboard server 17 to which a user terminal 30(b) of a user not granted a dedicated role is connected and which is permitted to access only the non-specific data.

Description

[Technical field]

[0001] The present invention relates to a cloud system for protecting specific information such as personal information by appropriately controlling users who can access data including the specific information. [Background technology]

[0002] Systems development companies, known as system integrators (SIers), receive requests from customers and plan, develop, design, and operate systems in accordance with their needs. In recent years, development companies often use cloud systems such as Amazon Web Services (registered trademark) to design and develop systems that meet customer needs.

[0003] In developing such systems, clients may provide the development company with highly confidential data, such as personal information of users of the services the client provides, and the data may be stored and managed in a cloud database. In such cases, the development company must develop the system with the utmost care to ensure that the highly confidential data does not leak to the outside. One possible measure to achieve this is to reduce the risk of information leaks by restricting the users (employees of the development company) who can access the highly confidential data in the database.

[0004] For example, Patent Document 1 discloses a method for managing a business server that can access personal information by setting access rights for accessing the personal information. Specifically, in the method disclosed in Patent Document 1, when a business server, which is a user of personal information, requests personal information from a personal information server, the personal information server checks a personal database and determines whether the business server has access rights. If the access rights to the business server have not been set, the personal information server queries a customer terminal operated by a provider of personal information and adds field-specific access rights to fields as necessary. In addition, the personal information server configures only the fields that have been permitted access based on the set access rights as response data and returns the response data to the business server.

[0005] Furthermore, Patent Document 2 discloses a method for blocking access from unauthorized applications to files containing personal information. Specifically, in the method disclosed in Patent Document 2, the information protection terminal identifies files containing personal information based on input from a user or a file pattern received from an information protection server, and identifies applications that can access each of the identified files containing personal information. The information protection terminal also detects access from an application to the identified files containing personal information, and blocks the access if the detected access is not from an accessible application. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2002-324194 A [Patent Document 2] JP 2015-121935 A Summary of the Invention [Problem to be solved by the invention]

[0007] Here, for example, in the conventional systems described in Patent Document 1 and Patent Document 2, a terminal (user terminal) that wishes to access highly confidential specific information such as personal information is basically configured to be directly connected to a server that holds the specific information. In this case, for example, when the user terminal or the server is exposed to a malicious attack, there is a risk that the specific information may be leaked, and there is a concern that when such information leakage occurs, it may be difficult to identify the scope of the impact of the leakage, its cause, and its route.

[0008] Furthermore, the information stored in the server's database includes not only highly confidential information such as personal information, but also a lot of low confidentiality information that is not particularly related to personal information (for example, login date and time, operation history, publicly available company information, product information, event information, weather information, traffic information, etc.). In this case, it is possible to distinguish between users who can access each piece of data according to the level of confidentiality. However, if the access path from each user's terminal to the server is the same, there is a risk of a system error occurring that allows users who do not actually have access rights to access highly confidential data. In this case, it becomes difficult to properly manage who accessed the highly confidential data, when, and for what purpose.

[0009] Therefore, the main object of the present invention is to reduce the risk of information leakage by restricting the users who can access specific information in the database and by appropriately managing the access paths from each user terminal to the database. [Means for solving the problem]

[0010] The inventor of the present invention has earnestly studied means for solving the problems of the above-mentioned conventional inventions, and has come to the knowledge that by assigning a dedicated role to a user who needs to access specific information in a database, and by using a different springboard server for connecting each user's user terminal to the database depending on whether or not the user has this role, it is possible to properly manage the access path to the database and reduce the risk of leakage of specific information. Based on the above knowledge, the inventor has come to the conclusion that the problems of the conventional technology can be solved, and has completed the present invention. Specifically, the present invention has the following configuration.

[0011] The present invention relates to a cloud system. A cloud system is a system that includes a plurality of server devices connected via a communication line such as the Internet, and that can provide services to terminal devices by processing in cooperation with each other. The cloud system according to the present invention is connected to an administrator terminal operated by an administrator and a user terminal operated by a user via a communication line. In the present invention, it is assumed that the administrator provides predetermined data to the user, and the user accesses the predetermined data as necessary. An example of the administrator is an employee of a client company that has been entrusted with system development. An example of the user is an employee of a development company that has been entrusted with system development. In addition, in the present invention, a case in which the user accesses data held by the administrator when the administrator provides some service to the user can be assumed. Note that the administrator terminal and the user terminal are terminals that use the system provided by the cloud system by connecting to this cloud system, and basically these terminals are not included in the cloud system. However, the administrator terminal, the user terminal, and the cloud system can also be interpreted as one client-server type system.

[0012] The cloud system according to the present invention includes a database, an access management unit, a specific operation springboard server, and a normal operation springboard server. The database stores specific data including specific information and non-specific data not including the specific information. An example of the specific data is table data including personal information, but is not limited thereto. Data including information other than personal information that needs to be kept confidential can also be set as the specific data. It is possible to arbitrarily specify which data is the specific data. The access management unit grants a dedicated role to a user designated by the administrator based on an instruction from the administrator terminal to access the specific data in the database. Note that "access" to data here means both or either of reading (viewing, etc.) data and writing (editing, etc.) data. The specific operation springboard server is a server device to which a user terminal operated by a user to whom a dedicated role has been assigned can be connected. In addition, the specific operation springboard server is permitted to access the specific data and non-specific data in the database. On the other hand, the normal operation springboard server is a server device to which a user terminal operated by a user to whom a dedicated role has not been assigned can be connected. In addition, the normal operation springboard server is permitted to access only the non-specific data among the specific data and non-specific data in the database.

[0013] As in the above configuration, the cloud system according to the present invention separates the path for a user terminal to access data in a database into a specific operation springboard server and a normal operation springboard server depending on the presence or absence of a dedicated role. The specific operation springboard server has access authority to specific information, while the normal operation springboard server does not have such authority, so by physically separating these servers, security risks can be separated. For example, even if the normal operation springboard server is attacked, access to the specific operation springboard server and the impact on the specific information can be minimized. Separating the springboard servers also makes it easier to restrict which users can connect to which springboard server. In particular, by strictly managing users who have connection authority (dedicated role) to the specific operation springboard, the risk of unauthorized access can be reduced. Note that, depending on the customer (administrator), physical separation of access paths to a database may be required under the Personal Information Protection Act and other data protection regulations, but by separating the springboard servers as in the above configuration, it becomes easier to meet regulatory requirements and to comply with compliance.

[0014] In the cloud system according to the present invention, it is preferable that the specific operation springboard server stores information about users who have accessed the specific data and information about the operation history of the specific data by the users. In this way, by storing history information of when users access the specific information in the specific operation springboard server, in the unlikely event that the specific information is leaked, it becomes possible to know who accessed which information and when, making it easier to identify the scope of impact, cause, and route of the information leak.

[0015] The cloud system according to the present invention preferably further comprises a first session management unit and a second session management unit. The first session management unit connects a user terminal operated by a user to whom a dedicated role has been assigned to a specific operation springboard server, and manages a session from when the user terminal is connected to the specific operation springboard server until when it is disconnected. The second session management unit connects a user terminal operated by a user to whom a dedicated role has not been assigned to a normal operation springboard server, and manages a session from when the user terminal is connected to the normal operation springboard server until it is disconnected. By providing a session management unit for each springboard server, the session can be managed safely and efficiently, and security and operability can be improved when a user accesses a springboard server. Each session management unit may provide a function that allows a user terminal to access each springboard server without requiring a VPN or specific network settings, for example, by using an Internet browser or the like.

[0016] The cloud system according to the present invention preferably further comprises a key management unit. The key management unit manages an encryption key used for encryption of at least the specific data in the database. In this case, the specific operation springboard server has a reference authority to the encryption key held by the key management unit. The specific operation springboard server uses the encryption key to decrypt the specific data when downloading the specific data from the database, and uses the encryption key to encrypt the specific data when uploading the specific data to the database. In this way, by transparently encrypting / decrypting the specific data, the user can easily access the specific data via the specific operation springboard server. On the other hand, since the normal operation springboard server does not have a reference authority to the encryption key, even if the user accesses the specific data via this normal operation springboard server, the specific data is not decrypted or encrypted, resulting in an error. This can improve security. Effect of the Invention

[0017] According to the present invention, the risk of information leakage can be reduced by restricting users who can access specific information in a database and by appropriately managing the access paths from each user terminal to the database. [Brief description of the drawings]

[0018] [Figure 1] FIG. 1 shows an overall view of a client-server system. [Diagram 2] FIG. 2 is a block diagram mainly showing the configuration of a cloud system. [Diagram 3] FIG. 3 is a schematic diagram showing the flow of each user accessing a database. [Figure 4] FIG. 4 is a schematic diagram showing a flow of encryption / decryption of specific data. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] Hereinafter, the embodiments of the present invention will be described with reference to the drawings. The present invention is not limited to the embodiments described below, and includes appropriate modifications of the embodiments described below within the scope obvious to those skilled in the art.

[0020] FIG. 1 shows an overall view of a client-server system 100. As shown in FIG. 1, the client-server system 100 includes a cloud system 10 and a plurality of terminals 20 and 30 connected to the cloud system 10 via the Internet. In this embodiment, the plurality of terminals 20 and 30 include an administrator terminal 20 and a user terminal 30. The administrator terminal 20 is a terminal operated by an administrator who manages data stored in a database in the cloud system 10. The user terminal 30 is a terminal operated by a user who accesses the data stored in the database with permission from the administrator. The data in the database is divided into specific data that includes specific information with high confidentiality such as personal information, and non-specific data that does not include this specific information. It should be noted that whether the data is specific data or non-specific data can be arbitrarily specified by, for example, the administrator via the administrator terminal 20. 1, among the multiple user terminals that can be connected to the cloud system 10, a user terminal 30(a) operated by a user permitted by an administrator to access specific data and non-specific data, and a user terminal 30(b) operated by a user permitted only to access non-specific data, are denoted by different reference symbols. In this specification, for convenience, the former is referred to as a specific operation terminal 30(a) and the latter is referred to as a normal operation terminal 30(b).

[0021] FIG. 2 is a block diagram of a client-server system 100, and mainly shows the configuration of a cloud system 10. The cloud system 10 includes a plurality of server devices connected via a communication line such as the Internet, and is configured to provide services to terminal devices by these server devices performing processes in cooperation with each other. An example of the cloud system 10 is Amazon Web Services (registered trademark). In the cloud system 10, users can use software and data held by server devices on a network through the network. The cloud system 10 is a system that uses so-called cloud computing, and in cloud computing, users can use resources on a network without being aware of specific hardware resources.

[0022] Each server device constituting the cloud system 10 is an information processing device (computer), and mainly includes a processing unit, a storage unit, and a communication unit. The processing unit is, for example, composed of a processor and a memory. Examples of the processor are a known CPU or GPU. The processor performs a predetermined arithmetic processing or image processing according to a program or data stored in the memory, and executes various control processes while writing the results of the processing in the working space of the memory. The memory is, for example, composed of a volatile memory such as a RAM (Random Access Memory), and is used for the arithmetic processing by the above-mentioned processor. The storage unit is an element (storage) for storing data mainly used for the arithmetic processing in the processing unit. The storage unit is composed of a non-volatile memory such as a ROM (Read Only Memory) or a flash memory, or a HDD (Hard Disk Drive). The storage unit may also store a computer program for causing the processing unit to execute a predetermined process. The communication unit may be any unit capable of transmitting and receiving data by wire or wirelessly in accordance with a known standard. In addition, when performing wireless communication, a communication module conforming to a known wireless communication standard such as 4G, 5G, or Wi-Fi (registered trademark) is adopted as the communication unit.

[0023] The administrator terminal 20 and the user terminal 30 are both general personal computers, and mainly include a processing unit, a storage unit, a communication unit, an input unit, and an output unit. The processing unit is composed of, for example, a processor and a memory. Examples of the processor are known CPUs and GPUs. The processor performs predetermined arithmetic processing and image processing according to the programs and data stored in the memory, and executes various control processes while writing the results of the processing in the working space of the memory. The memory is composed of, for example, a volatile memory such as a RAM, and is used for the arithmetic processing by the above-mentioned processor. The storage unit is an element (storage) for storing data mainly used for the arithmetic processing in the processing unit. The storage unit is composed of non-volatile memory such as a ROM or a flash memory, and a HDD. In addition, the storage unit stores a computer program for causing the processing unit to execute a predetermined process. The computer program implemented in each of the terminals 20 and 30 is, for example, an Internet browser. Each of the terminals 20 and 30 can connect to the cloud system 10 by this browser. In addition, each of the terminals 20 and 30 may have a dedicated application program installed therein for connecting to the cloud system 10. The communication unit may be any unit capable of transmitting and receiving data by wire or wirelessly in accordance with a known standard. When performing wireless communication, a communication module conforming to a known wireless communication standard such as 4G, 5G, or Wi-Fi (registered trademark) is adopted as the communication unit. The input unit is an element for an administrator or user to input information or operation commands to each terminal 20, 30. Examples of the input unit are a keyboard, a mouse, a touch panel, and a microphone. The output unit is an element for outputting the results of arithmetic processing in each terminal 20, 30. Examples of the output unit are a display device for outputting images such as an LCD (Liquid Crystal Display) or an OELD (Organic Electro Luminescence Display), and a speaker for outputting sound.

[0024] The cloud system 10 realizes a predetermined function by utilizing the hardware resources of a plurality of server devices connected via a network. Specifically, in this embodiment, the cloud system 10 includes a database 11, a database management system 12, an access management service 13 (access management unit), a first session manager 14 (first session management unit), a second session manager 15 (second session management unit), a specific operation springboard server 16, a normal operation springboard server 17, a predetermined application 18, and a key management service 19 (key management unit). The cloud system 10 also includes various other functions, but the following description focuses on the functions used in this embodiment.

[0025] The database 11 is a collection of information that is structured to store data in a systematically organized manner and to efficiently perform searches, acquisitions, and operations. In the database 11, a plurality of data items are organized as associated records and entries, and these data items are structured as a plurality of tables. In this embodiment, the database 11 includes table data that includes specific information such as personal information, and table data that does not include this specific information, the former being called specific data, and the latter being called non-specific data. Whether the plurality of table data included in the database 11 is specific data or non-specific data is identified, for example, based on data attribute information attached to each table data. Specifically, by referring to tags and metadata set for each data item in each table data, if it is specified that the data item includes specific information such as personal information, the table data is determined to be specific data, and if not, it is determined to be non-specific data. The data attribute information for identifying whether the data is specific data or non-specific data may be manually attached by an administrator, or may be automatically attached by the cloud system 10 based on information included in the table data.

[0026] When data attribute information indicating whether or not the data is specific data is automatically added to the table data, the cloud system 10 may, for example, analyze the data items in the table data and determine whether the data items are specific data or non-specific data based on the contents and format of the data items. Specifically, the content of the data items is analyzed using natural language processing technology, and if the data items contain data that matches a specific format or pattern, such as a personal name, address, telephone number, email address, or credit card number, the data items are determined to be specific information. The cloud system 10 may also use a keyword list or regular expression pattern defined in advance for the data items to check whether the data items contain content that corresponds to personal information, and classify the data items as specific data if the content corresponds to personal information, and classify the data items as non-specific data if the content does not correspond to personal information. Furthermore, the cloud system 10 may employ a method of learning the characteristics of a data item using a machine learning model and predicting whether the data items are specific data or non-specific data. The machine learning model is trained using past data analysis results, and is capable of automatically making judgments about new data items by learning characteristic patterns of specific information.

[0027] The database management system 12 (DBMS) is software for constructing, managing, and operating the database 11. The database management system 12 provides functions for efficiently performing operations such as saving, searching, updating, and deleting data, and manages the data so that multiple users and applications can access the data while maintaining the consistency, integrity, and security of the data in the database 11.

[0028] The access management service 13 (IAM: Identity and Access Management) is software for managing user identification and access control in the entire system, and executes a function of ensuring that users and applications have appropriate access rights to various resources such as the database 11. The access management service 13 realizes access control to resources by allocating individual authentication information (user ID, password, access key, etc.) to each user and setting access rights for each individual user or for each group of users. In this embodiment, the access management service 13 manages which users can access specific data in the database 11 based on an instruction from the administrator terminal 20. Specifically, the access management service 13 grants a dedicated role (corresponding to access rights) for accessing specific data to a user designated by the administrator. The access management service 13 stores which users are granted the dedicated role. A user granted the dedicated role can access both the specific data and the non-specific data in the database 11. On the other hand, a general user who is not granted the dedicated role cannot access the specific data in the database 11 and can only access the non-specific data.

[0029] The first session manager 14 is software for connecting a user terminal (specific operation terminal) 30(a) operated by a user to which a dedicated role has been assigned to the specific operation springboard server 16, and for managing a session from the time the specific operation terminal 30(a) is connected to the specific operation springboard server 16 until it is disconnected. The term "session" refers to a period during which data is exchanged between the specific operation terminal 30(a) and the specific operation springboard server 16 via a communication path established between the specific operation terminal 30(a) and the specific operation springboard server 16, and includes a series of operations from its start to its end. The first session manager 14 receives a connection request from the specific operation terminal 30(a) at the start of a session, and verifies the user and the dedicated role to verify that the user operating the specific operation terminal 30(a) has a legitimate connection authority to the specific operation springboard server 16. This limits the users who can connect to the specific operation springboard server 16 to those authorized by the administrator, making it possible to prevent unauthorized access. The first session manager 14 also has a function for recording the user's operations during the session and generating a connection log to the specific operation terminal 30(a) as necessary. This makes it possible to provide data that is useful for security audits and fraud detection. The first session manager 14 has a timeout function that automatically terminates a session if no operation is performed after a certain period of time has elapsed, thereby improving security. Also, multiple users can simultaneously connect to the specific operation springboard server 16 via the first session manager 14. Furthermore, when the session ends, the first session manager 14 disconnects the connection between the specific operation terminal 30(a) and the specific operation springboard server 16 and releases resources related to the session, thereby improving resource efficiency of the entire system. In this way, the first session management unit plays a role in improving the security and operation efficiency of the system by managing a series of operations related to the establishment, maintenance, and termination of a session.

[0030] On the other hand, the second session manager 15 is software for connecting a user terminal (normal operation terminal) 30(b) operated by a user who is not assigned a dedicated role to the normal operation springboard server 17, and managing a session from when the normal operation terminal 30(b) is connected to the normal operation springboard server 17 to when it is disconnected. Here, a session refers to a period including a series of data exchanges performed via a communication path established between the normal operation terminal 30(b) and the normal operation springboard server 17, and covers operations from the start to the end of the session. The second session manager 15 receives a connection request from the normal operation terminal 30(b) at the start of the session, and performs user authentication to confirm that the user has a regular connection authority to the normal operation springboard server 17. In this authentication process, confirmation of a dedicated role is not required, and a user with general connection authority is sufficient to connect to the normal operation springboard server 17. This makes it possible to ensure security and appropriately separate connection restrictions to the specific operation springboard server 16. Similarly to the first session manager 14, the second session manager 15 has a function of recording user operations during a session and generating a connection log. This makes it possible to provide information for auditing and troubleshooting operations performed on the normal operation springboard server 17. The second session manager 15 also has a timeout function that automatically terminates a session if the user does not perform any operation for a certain period of time, thereby reducing the risk of leaving the session unattended. In addition, multiple users can simultaneously connect to the normal operation springboard server 17 via the second session manager 15. In this case, the second session manager 15 supports efficient use of server resources by disconnecting the connection between the normal operation terminal 30(b) and the normal operation springboard server 17 at the end of the session and releasing resources related to the session. In this way, the second session manager 15 plays a role in ensuring the operational efficiency and safety of the entire system through the management of sessions during normal operation.

[0031] The specific operation springboard server 16 is a physical server device that is permitted to access the specific data and non-specific data in the database 11. As described above, the specific operation springboard server 16 is configured to accept connections only from the specific operation terminal 30(a) operated by a user to whom a dedicated role has been assigned through a session managed by the first session manager 14, and this makes it possible to control access to the specific data and non-specific data in the database 11 while ensuring security. In addition, the specific operation springboard server 16 has an access control function that can set access rights to each of the specific data and non-specific data in detail, and may be capable of applying different access levels based on data items in the database 11. The specific operation springboard server 16 provides an interface for efficiently and safely accessing the specific data and non-specific data, and enables a user to whom a dedicated role has been assigned to perform operations such as searching, acquiring, updating, and deleting the specific data, etc. in the database 11. In addition, the specific operation springboard server 16 has an audit log generation function that records operations by the connected specific operation terminal 30(a), and prevents information leakage and unauthorized operations by tracking access operations and change history of specific data and non-specific data. This log includes information such as the type of operation performed by the user, the identifier of the accessed data, and the connection time, and is appropriately managed according to the access control policy. This audit log is saved and accumulated in the specific operation springboard server 16 for later verification, and is used by the administrator to check the access status of the specific data. In addition, the specific operation springboard server 16 may protect data by using, for example, SSL / TLS encryption protocol to ensure security in communication with the database 11.

[0032] The normal operation springboard server 17 is a physical server device that is permitted to access only non-specific data in the database 11. The normal operation springboard server 17 is prohibited from accessing highly confidential specific data such as personal information, and is set to be able to operate only non-specific data in the database 11. Only normal operation terminals 30(b) that are not assigned a dedicated role can connect to the normal operation springboard server 17 via the second session manager 15, and this connection is controlled based on the access authority assigned to the terminal. The normal operation springboard server 17 provides an interface for efficiently and safely accessing non-specific data, and enables normal operation users to search, acquire, update, or delete non-confidential data in the database 11. The normal operation springboard server 17 also has a function of recording the identification information of the connected normal operation terminal 30(b) and generating a security log. This log includes information such as the type of operation performed by the user, the identifier of the accessed data, and the connection time, and is appropriately managed according to the access control policy. This audit log is saved and accumulated in the normal operation springboard server 17.

[0033] In this way, the specific operation springboard server 16 and the normal operation springboard server 17 have different configurations for the access function and control function to the data in the database 11. The specific operation springboard server 16 is a server device that is permitted to access specific data including personal information, etc., and is capable of accessing both specific data and non-specific data, so stricter security measures are taken. Specifically, a connection from a specific operation terminal 30(a) of a user with a dedicated role is permitted, and at that time, identity verification using multi-factor authentication (MFA) and auditing is strengthened by detailed recording of access logs. In addition, the specific operation springboard server 16 is required to record logs regarding operations on personal information and confidential data in the database 11. This reduces the risk of unauthorized data access. Furthermore, the access management policy is set in detail by the access management service 13 (IAM), and a mechanism is provided in which only users with specified authority are permitted to access the database 11 through switching to a dedicated role related to the specific operation. On the other hand, the normal operation springboard server 17 is a server device that is permitted to access only non-specific data that does not include personal information, etc., and access authority is set for only non-specific data. In this normal operation springboard server 17, security measures are simpler than those in the specific operation springboard server 16, and for example, the use of multi-factor authentication may not be required. Also, in the normal operation springboard server 17, although access logs are recorded, the level of detail in the access logs may be lowered and the storage period for the access logs may be shortened compared to the specific operation springboard server 16. In this way, since the normal operation springboard server 17 does not handle highly confidential data, audit requirements can also be relaxed.

[0034] By physically separating the server devices constituting the specific operation springboard server 16 and the normal operation springboard server 17, there is an advantage in that security measures can be optimized according to the confidentiality of the data handled by each springboard server 16, 17. Specifically, since the specific operation springboard server 16 is a server device permitted to access specific data including personal information, it is preferable to implement high-level security measures (e.g., strict access control, multi-factor authentication, detailed audit log recording, etc.) in response to this. On the other hand, since the normal operation springboard server 17 is only permitted to access non-specific data, relatively loose security measures can be adopted. This allows the specific operation springboard server 16 to ensure high security while improving the business efficiency of the normal operation springboard server 17. In addition, by physically separating the respective springboard servers 16, 17, it is possible to reduce the risk that a security incident occurring in the specific operation springboard server 16 will affect the normal operation springboard server 17. Even if unauthorized access is attempted to the specific operation springboard server 16, the physical isolation prevents the impact from spreading to the normal operation springboard server 17, improving the security of the entire system. Furthermore, the physically separated server configuration allows the hardware and software settings of each springboard server 16, 17 to be individually optimized. Such an architecture can, for example, increase the flexibility in introducing dedicated hardware and software to enforce the performance requirements and access control policies of the specific operation springboard server 16, and improve the cost efficiency of the normal operation springboard server 17.

[0035] The application 18 is software for executing various services provided by the cloud system 10. The cloud system 10 is equipped with various types of applications 18, and some of these applications 18 require access to the database 11 to provide the service. The applications 18 are given the authority to access the specific data and non-specific data in the database 11, similar to the specific operation springboard server 16 described above. Each application 18 is designed to provide a specific function or service, including data analysis, user authentication, and implementation of business logic. Specifically, similar to the specific operation springboard server 16, these applications 18 are required to handle highly confidential information safely in accordance with an access control policy when accessing specific data. The access authority for each application is managed via the access management service 13 (IAM), and user roles and policies are applied as necessary. In addition, the administrator can arbitrarily specify to the access management service 13 via the administrator terminal 20 which application is to be given the access authority to the specific data. In addition, the application 18 may protect data using SSL / TLS encryption protocol to ensure security in communication with the database 11.

[0036] The key management service 19 (KMS) is software for managing encryption keys used for encrypting and decrypting specific data stored in the database 11. The database management system 12 holds at least specific data among the data in the database 11 in an encrypted state using the encryption key of the key management service 19. The key management service 19 has functions for generating, storing, rotating, and controlling access to encryption keys in order to strengthen the protection of the specific data in the database 11. The key management service 19 is configured so that only a springboard server or application having access rights to the encryption key can access the encryption key. The key management service 19 strictly controls the subjects that can access the specific data in the database 11 by granting the encryption key only to subjects having access rights to the encryption key.

[0037] Specifically, the specific operation springboard server 16 has the authority to refer to the encryption key managed by the key management service 19. When the specific operation springboard server 16 downloads specific data from the database 11, it can decrypt the specific data encrypted using this encryption key. When the specific operation springboard server 16 uploads specific data to the database 11, it performs a process of encrypting the specific data using the encryption key. This ensures confidentiality in data storage and communication, and reduces the risk of unauthorized access or leakage of data. In this embodiment, the key management service 19 provides a transparent encryption function within the cloud system 10. With this transparent encryption function, the specific data stored in the database 11 of the cloud system 10 is automatically encrypted using the encryption key managed by the key management service 19, and only entities with appropriate authority (specifically, the specific operation springboard server 16 and the application 18) can read and write the specific data. In this way, the key management service 19 plays a central role in improving security. The access rights to this key management service 19 are strictly controlled based on the security policy, and in this embodiment, only the specific operation springboard server 16 and the application 18 are granted the right to refer to the encryption key. This allows only those entities authorized by the key management service 19 to encrypt and decrypt specific data. On the other hand, if an entity (e.g., the normal operation springboard server 17) that is not granted the right to refer to the key management service 19 accesses the specific data, the encrypted data cannot be decrypted and an error occurs. In this way, the key management service 19 is responsible for managing the encryption of data, thereby contributing to the safety of the entire system and strengthening data protection while maintaining a high level of security for the specific data.

[0038] It should be noted that the functions of encrypting and decrypting specific data described here are optional functions in this embodiment, and the present invention can also be embodied in a form that does not include these functions.

[0039] FIG. 3 is a schematic diagram showing a flow of each user accessing a database using the cloud system 10 according to the present embodiment. First, the administrator operates the administrator terminal 20 to start an Internet browser or a dedicated application, and connects the administrator terminal 20 to the access management service 13 on the cloud system 10 using the browser or the like. In the access management service 13, the administrator can set users who can access the database 11. With normal access permission, a user cannot access data (specific data) that includes specific information in the database 11, and can only access data (non-specific data) that does not include specific information. In addition, in the access management service 13, the administrator can set users who can access specific data in the database 11. A dedicated role is given by the access management service 13 to a user who is permitted to access specific data by the administrator.

[0040] A user to whom a dedicated role has been assigned can operate a user terminal (specific operation terminal) 30(a) to launch an Internet browser or a dedicated application, and connect the specific operation terminal 30(a) to the first session manager 14 on the cloud system 10 using the browser or the like. At that time, the user can select either the specific operation springboard server 16 or the normal operation springboard server 17 to connect. However, only users to whom a dedicated role has been assigned by the access management service 13 can connect to the specific operation springboard server 16. When a user to whom a dedicated role has been assigned operates the user terminal (specific operation terminal) 30(a) to select a connection to the specific operation springboard server 16, the connection is made via the first session manager 14. When a connection is made from the specific operation terminal 30(a), the first session manager 14 checks with the access management service 13 whether the user has been assigned a dedicated role, and when the dedicated role has been confirmed, connects the specific operation terminal 30(a) to the specific operation springboard server 16. This specific operation springboard server 16 has the authority to access both the specific data and the non-specific data in the database 11. Therefore, the specific operation terminal 30(a) can read and write the specific data and the non-specific data in the database 11 via the specific operation springboard server 16. Depending on the presence or absence of a dedicated role, the springboard servers 16, 17 to which the user terminal 30 is connected may be automatically selected or switched by the session managers 14, 15.

[0041] In addition, among the applications 18 in the cloud system 10, those that have been granted access rights to specific data in the database 11 by the access management service 13 can read and write the specific data and non-specific data in the database 11, similar to the specific operation springboard server 16.

[0042] On the other hand, even if a user is not assigned a dedicated role, if the user has the authority to access the database 11, the user can operate the user terminal (normal operation terminal) 30(b) to launch an Internet browser or a dedicated application, and connect the normal operation terminal 30(b) to the cloud system 10 using the browser or the like. In this case, however, the normal operation terminal 30(b) is connected to the second session manager 15 on the cloud system 10. At that time, the user can select either the specific operation springboard server 16 or the normal operation springboard server 17 to connect. However, only users who have been assigned a dedicated role by the access management service 13 can connect to the specific operation springboard server 16. When a connection is made from the normal operation terminal 30(b), the second session manager 15 queries the access management service 13 to confirm whether the user has the authority to access the database 11, and when the access authority is confirmed, connects the normal operation terminal 30(b) to the normal operation springboard server 17. This normal operation springboard server 17 does not have access authority to specific data in database 11, but only has access authority to non-specific data. Therefore, the normal operation terminal 30(b) is prohibited from accessing the specific data in database 11, but can read and write non-specific data in database 11 via normal operation springboard server 17.

[0043] FIG. 4 also shows a schematic flow of encryption / decryption of specific data using the key management service 19. The key management service 19 holds an encryption key for encrypting / decrypting specific data. The database management system 12 associated with the database 11 encrypts and manages the specific data in the database 11 using this encryption key. The specific operation springboard server 16 also has the authority to refer to the encryption key held by the key management service 19. Therefore, when the specific operation springboard server 16 reads (downloads, etc.) specific data from the database 11, it decrypts the encrypted specific data by referring to this encryption key. Furthermore, when the specific operation springboard server 16 writes (uploads, etc.) specific data to the database 11, it encrypts the specific data by referring to this encryption key. This allows a user who is permitted to perform specific operation work to view and edit the specific data in the database 11. Furthermore, the application 18 in the cloud system 10 is also given the authority to refer to the encryption key held by the key management service 19. Therefore, the application 18 can also decrypt and encrypt specific data in the same way as the specific operation springboard server 16.

[0044] On the other hand, as shown in FIG. 4, the normal operation springboard server 17 does not have the authority to refer to the encryption key held by the key management service 19. Therefore, the normal operation springboard server 17 cannot decrypt the specific data encrypted and managed in the database 11. Similarly, the normal operation springboard server 17 cannot upload specific data to the database 11 that involves encryption with an encryption key. Therefore, even if the normal operation springboard server 17 accesses specific data in the database 11, an error occurs because the specific data cannot be decrypted or encrypted. Therefore, a user who is permitted only for normal operation cannot view or edit the specific data in the database 11. The encryption and decryption functions of the specific data described here are optional functions in this embodiment.

[0045] In the above, in order to express the contents of the present invention, the present specification has described the embodiments of the present invention with reference to the drawings. However, the present invention is not limited to the above-mentioned embodiments, and includes modifications and improvements that are obvious to a person skilled in the art based on the matters described in the present specification. [Explanation of symbols]

[0046] 10. Cloud system 11. Database 12...Database Management System 13...Access Management Service (Access Management Department) 14...First session manager (first session management unit) 15...Second session manager (second session management part) 16…Specific operational stepping stone server 17…Normal operation springboard server 18…Application 19...Key management service (Key management department) 20...Administrator terminal 30...User terminal 30(a)…Specific operation terminal 30(b)…Normal operation terminal 100...Client-server system

Claims

1. A cloud system connected via a communication line to an administrator terminal operated by an administrator and a user terminal operated by a user, A database storing specific data including specific information and non-specific data not including the specific information; an access management unit that grants a dedicated role for accessing the specific data in the database to the user designated by the administrator based on an instruction from the administrator terminal; a specific operation springboard server to which the user terminal operated by the user to which the dedicated role is assigned can be connected and to which access to the specific data and the non-specific data in the database is permitted; a normal operation springboard server to which the user terminal operated by the user to which the dedicated role is not assigned can be connected and to which access to only the non-specific data out of the specific data and the non-specific data in the database is permitted; Cloud system.

2. The specific operation springboard server stores information about the user who accessed the specific data and information about the operation history of the specific data by the user. The cloud system according to claim 1 .

3. a first session management unit that connects the user terminal operated by the user to which the dedicated role has been assigned to the specific operation springboard server and manages a session from when the user terminal is connected to the specific operation springboard server until when the user terminal is disconnected; The system further includes a second session management unit that connects the user terminal operated by the user to which the dedicated role is not assigned to the normal operation springboard server and manages a session from when the user terminal is connected to the normal operation springboard server to when the user terminal is disconnected from the normal operation springboard server. The cloud system according to claim 1 .

4. a key management unit for managing an encryption key used in an encryption operation of at least the specific data in the database; The specific operation springboard server has a reference authority to the encryption key held by the key management unit, and when downloading the specific data from the database, the specific data is decrypted using the encryption key, and when uploading the specific data to the database, the specific data is encrypted using the encryption key. The cloud system according to claim 1 .

Images