Data service providing method and system

Abstract

This data service provision method for providing a data service to a registered user includes: a data acquisition step for acquiring first data; an access policy setting step for setting an access policy for the first data; a data generation step for generating, from the first data, second data to be used in the data service provided to the user, on the basis of the access policy; and a data provision step for providing the data service on the basis of the second data.

Description

[Technical field]

[0001] The present invention relates to a data service providing method and a data service providing system. This application claims priority based on Japanese Patent Application No. 2021-079205 filed on May 7, 2021, the contents of which are incorporated herein by reference. [Background technology]

[0002] There are service businesses that provide services that utilize data, including personal data of users. For example, there is a data service provider that provides customized information optimal for users by using a wide variety of data, such as shopping history and health care information. In such data service providers, it is desirable to be able to handle data seamlessly. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-13193 Summary of the Invention [Problem to be solved by the invention]

[0004] An object of the present invention is to provide a data service providing method and a data service providing system that are capable of handling data seamlessly. [Means for solving the problem]

[0005] The data service providing method of the embodiment is a data service providing method for providing a data service to a registered user, and includes a data acquisition step for acquiring first data, an access policy setting step for setting an access policy for the first data, a data generation step for generating second data to be used in a data service to be provided to the user from the first data based on the access policy, and a data providing step for providing a data service based on the second data. [Brief description of the drawings]

[0006] [Figure 1] FIG. 1 is a configuration diagram of a data service providing system according to a first embodiment. [Diagram 2] FIG. 2 is a diagram showing a specific example of the data service providing system. [Diagram 3] FIG. 2 is a functional block diagram of the data service providing system. [Figure 4] FIG. 2 is a functional block diagram of a provided data control unit of the data service providing system. [Diagram 5] FIG. 2 is a functional block diagram of an access policy control unit of the data service providing system. [Figure 6] 11A and 11B are diagrams showing specific examples of access policies that can be set for each data provision mode in an individual user access policy. [Figure 7] 11A and 11B are diagrams showing specific examples of consent policies in individual user access policies and access policies that can be set for each usage region. [Figure 8] 11A and 11B are diagrams showing specific examples of access policies that can be set for each life cycle of acquired data in an individual user access policy. [Figure 9] 13 is a diagram showing a specific example of an access policy that can set whether or not each data type of acquired data can be combined in an individual user access policy. [Figure 10] FIG. 11 is a diagram showing a specific example of a data type handling policy. [Figure 11] FIG. 13 is a diagram showing an example of a data item newly created based on a combination policy. [Figure 12]FIG. 2 is a functional block diagram of a linkage information recording unit of the data service providing system. [Figure 13] FIG. 13 is a diagram showing an example of a generated virtual table. [Figure 14] FIG. 13 is a diagram showing another example of a generated virtual table. [Figure 15] FIG. 2 is a functional block diagram of a data access control unit of the data service providing system. [Figure 16] 13 is an example of a personal user application display screen. [Figure 17] 13 is an example of a personal user application display screen. [Figure 18] 13 is an example of a personal user application display screen. [Figure 19] 13 is an example of a personal user application display screen. [Figure 20] FIG. 2 is a diagram showing the data service providing system that operates in conjunction with a cooperative application of a service business. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A data service providing method and a data service providing system according to an embodiment will be described below with reference to the drawings.

[0008] (First embodiment) [Data service providing system 100] FIG. 1 is a configuration diagram of a data service providing system 100 according to the first embodiment. The data service providing system 100 is a system that provides data services to registered users (individual users U and service providers SP). "Providing data services" includes not only providing data itself, but also providing data analysis results and various services based on data.

[0009] The data service providing system 100 is composed of one or more servers. The basic infrastructure of the data service providing system 100 is constructed using a known data distributed processing system. The functions of the data service providing system 100 are realized by a program executed in the processor of the server.

[0010] FIG. 2 is a diagram showing a specific example of the data service providing system 100. As shown in FIG. 2 includes servers SV1, SV2, SV3, and SV4. The servers SV1, SV2, SV3, and SV4 include hardware such as a processor such as a CPU, a memory, a recording medium such as a hard disk or a flash memory, and a communication device.

[0011] The servers SV1, SV2, SV3, and SV4 may be servers with different types of OS, software, etc. The servers SV1, SV2, SV3, and SV4 may be operated by different operating entities. The servers SV1, SV2, SV3, and SV4 may be installed in different countries or different regions.

[0012] All of the hardware and software resources of the servers SV1 and SV2 are occupied by the data service providing system 100. On the other hand, only a portion of the hardware and software resources of the servers SV3 and SV4 are provided to the data service providing system 100. In other words, the data service providing system 100 may be a system that combines on-site servers such as the servers SV1 and SV2 with cloud servers such as the servers SV3 and SV4 that provide Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS). In the following description, "server" includes any of the above servers.

[0013] The functional blocks of the data service providing system 100 described below (such as a data acquisition unit 1, an access policy control unit 2, a cooperation control unit 3, a provided data generation unit 4, and a data access control unit 5) are realized by the operation of servers (for example, servers SV1, SV2, SV3, and SV4 illustrated in FIG. 2) that are distributed and arranged via a network NW. Note that the functional blocks of the data service providing system 100 may be realized by the operation of one server.

[0014] 1, the data service providing system 100 is connected to a data device 200 managed by a data provider DP, a terminal 300 (hereinafter referred to as personal terminal 300) such as a smartphone, tablet terminal, or personal computer owned by an individual user U, a management device 400 owned by an administrator A of the data service providing system 100, and a service providing device 500 owned by a service provider SP, via a network NW. The data device 200, the management device 400, and the service providing device 500 may be a system composed of one or more servers.

[0015] The network NW may be a wide area network (WAN) such as the Internet, a private network (LAN) in a building where the data service providing system 100 is installed, or a combination of these. The network NW may be either wired or wireless. Other devices such as access points may be involved in the communication between the devices.

[0016] FIG. 3 is a functional block diagram of the data service providing system 100. As shown in FIG. The data service providing system 100 includes a data acquiring unit 1, an access policy control unit 2, a cooperation control unit 3, a provided data generating unit 4, and a data access control unit 5.

[0017] The data acquisition unit 1 acquires data including personal data of an individual user U from a data device 200 of a data provider DP, and records it as acquired data (first data) D. The data access control unit 5 controls to respond to a data service request from a service provider SP or the like. The provided data generation unit 4 generates provided data (second data) from the acquired data (first data) D in response to a data access request via the data access control unit 5. The access policy control unit 2 controls an access policy for the acquired data (first data) D when generating the provided data (second data). The cooperation control unit 3 controls cooperation with a service business SB (Service business) and a data provision business DB (Data provision business).

[0018] [Data Acquisition Section 1] FIG. 4 is a functional block diagram of the data acquisition unit 1. The data acquisition unit 1 acquires data including personal data of an individual user U from the data device 200 of the data provider DP, and records it as acquired data (first data) D (data acquisition step). In addition, the data acquisition unit 1 provides the acquired data D to the provided data generation unit 4. The data acquisition unit 1 has a data import interface 11 and an acquired data recording unit 12.

[0019] The data import interface 11 is an interface for acquiring data from the data device 200 of the data provider DP. The data device 200 of the data provider DP provides the data, including personal data of an individual user U, acquired based on the consent of the individual user U to the data service providing system 100 via the data import interface 11.

[0020] The data import interface 11 acquires data from the data device 200 of the data provider DP based on a contract with the data provider DP and records the data in the acquired data recording unit 12. For example, the data import interface 11 periodically acquires data in bulk from the data device 200 of the data provider DP and updates the acquired data D recorded in the acquired data recording unit 12 (bulk type). The data import interface 11 may also acquire data in real time from a device connected via an API (Application Programming Interface) (streaming type).

[0021] The acquired data recording unit 12 is a data storage that records acquired data (first data) D acquired from the data provider DP. The acquired data (first data) D may be raw data acquired from the data provider DP, or may be processed data that has been processed into a standard data format by a data processing unit (not shown). The processed data is, for example, statistical data, aggregated data, anonymized data, etc.

[0022] In this embodiment, the data service providing system 100 has three data acquisition units 1. In the following description, when the three data acquisition units 1 are to be distinguished from one another, they are referred to as a first data acquisition unit 1A, a second data acquisition unit 1B, and a third data acquisition unit 1C, respectively.

[0023] The data acquisition unit 1 (first data acquisition unit 1A, second data acquisition unit 1B, and third data acquisition unit 1C) acquires and records acquired data D including multiple data types with different handling policies. Data including multiple data types with different handling policies is also called a "data group."

[0024] The first data acquisition unit 1A acquires and records purchasing data D1 provided by the first data providing business DB1, for example, from a data device 200 (hereinafter also referred to as "data device 200A") managed by the data provider DP1. The purchasing data D1 is, for example, purchasing detail data on a receipt and payment data. The data import interface 11 (hereinafter also referred to as "data import interface 11A") of the first data acquisition unit 1A is an interface capable of acquiring the purchasing data D1 from the data provider DP1.

[0025] The second data acquisition unit 1B acquires and records HR (Human Resources) data D2 provided by the second data providing business DB2, for example, from a data device 200 (hereinafter also referred to as "data device 200B") managed by the data providing business DP2. The HR data D2 is, for example, personnel order data, attendance data, salary data, and training data. The data import interface 11 (hereinafter also referred to as "data import interface 11B") of the second data acquisition unit 1B is an interface capable of acquiring the HR data D2 from the data providing business DP2.

[0026] The third data acquisition unit 1C acquires and records health data D3 provided by the third data providing business DB3, for example, from a data device 200 (hereinafter also referred to as "data device 200C") managed by the data provider DP3. The health data D3 is, for example, health checkup data and daily vital health data. The data import interface 11 (hereinafter also referred to as "data import interface 11C") of the third data acquisition unit 1C is an interface capable of acquiring the health data D3 from the data provider DP3.

[0027] The data import interface 11 (data import interface 11A, data import interface 11B, and data import interface 11C) differs depending on the type of data to be handled and the data provider. Note that the data import interface 11 may be a general-purpose interface that can be used regardless of the type of data to be handled and the data provider.

[0028] The data acquisition unit 1 (first data acquisition unit 1A, second data acquisition unit 1B, and third data acquisition unit 1C) is a distributed storage provided in a distributed manner on different servers, and can store the acquired data D including a plurality of data types with different handling policies in a distributed manner. The data acquisition unit 1 (first data acquisition unit 1A, second data acquisition unit 1B, and third data acquisition unit 1C) may be provided on the same server. The acquired data D may be data including personal data such as three education data (intellectual education data, physical education data, moral education data), education attendance data, qualification acquisition data, medical examination data, power consumption data, gas usage data, water usage data, communication details data, schedule data, music and video viewing data, etc.

[0029] In this embodiment, "purchase data", "HR data", and "health data" are used as examples of multiple data types with different handling policies, but the multiple data types with different handling policies are not limited to this. For example, when purchasing data is acquired from multiple different data providers, the purchasing data may be treated as acquired data including a single data type with different handling policies. In addition, purchasing data obtained by using an electronic receipt mechanism that is difficult for an individual user U to tamper with or counterfeit, and purchasing data input by an individual user U through camera photography or manual input using a predetermined application running on a mobile terminal or the like based on information written on a paper receipt (medium reliability purchasing data) may be treated as acquired data including a data type with different handling policies. Furthermore, the acquired data including a data type with different handling policies is not limited to data acquired from a data provider. Data acquired directly from an individual user U by an operating company of the data service providing system 100 may also be treated as acquired data including a data type with different handling policies.

[0030] [Access policy control section 2] FIG. 5 is a functional block diagram of the access policy control unit 2. As shown in FIG. The access policy control unit 2 controls the access policy for the acquired data D recorded in the acquired data recording unit 12. The access policy refers to whether or not access to the acquired data D is permitted, the access conditions, and the like. The access policy may include information regarding the deletion deadline for the acquired data D, the data usage deadline after conversion, such as anonymization, from the raw data at the time of acquisition, and the life cycle, and the like. The access policy may include information regarding whether or not combined use with different types of data is permitted. The access policy control unit 2 has an access policy interface 21 and an access policy recording unit 24.

[0031] The access policy interface 21 is an interface connected to the personal terminal 300 and the management device 400 owned by the administrator A of the data service providing system 100. Specifically, the access policy interface 21 includes an API that connects the personal terminal 300 and the management device 400 with the access policy recording unit 24. The access policy interface 21 has a personal user interface 22 and an administrator interface 23.

[0032] The personal user interface 22 includes an API that connects the personal terminal 300 and the access policy recording unit 24. The personal user interface 22 also connects the personal terminal 300 and the data access control unit 5, as shown in FIG.

[0033] The administrator interface 23 includes an API that connects the management device 400 owned by the administrator A and the access policy recording unit 24 .

[0034] The access policy recording unit 24 records the access policy for the acquired data D. The access policies recorded in the access policy recording unit 24 are managed by individual users U and administrator A via the access policy interface 21. The access policy recording unit 24 has a first access policy recording unit 25 and a second access policy recording unit 26.

[0035] The first access policy recording unit 25 records the access policy set by the individual user U via the individual user interface 22. The access policies recorded by the first access policy recording unit 25 include an individual user access policy 251 and a comprehensive access policy 252.

[0036] The individual user access policy 251 is an access policy set for each individual user U regarding whether or not the service business S can access the acquired data D including the personal data of the individual user U. The individual user access policy 251 is an access policy set for the personal data of the individual user U for various conditions, such as for each data providing business DB that provided the acquired data D, for each service business SB that uses the acquired data D, for each data type or purpose of use of the acquired data D, for each data providing mode, for each consent policy, for each region of use, and for each life cycle of the acquired data D. The individual user U can set the individual user access policy 251 for all combinations of these conditions.

[0037] The access policy that can be set for each data providing business DB in the individual user access policy 251 is, for example, whether data access is permitted when the data providing business DB that provided the acquired data D is the "first data providing business DB1" or the "second data providing business DB2."

[0038] The access policy that can be set for each service business SB in the individual user access policy 251 is, for example, data access permission when the service business SB is a "first service business SB1" or a "second service business SB2." The access policy may be data access permission that can be set for each service provider SP, such as a "service provider SP1" that provides a "first service business SB1" and a "second service business SB2." In addition, the access policy may be data access permission that can be set for each business category into which the service providers SP are classified, such as "medical care," "finance," "entertainment," and "academic institutions."

[0039] The access policy that can be set for each service business SB in the individual user access policy 251 is, for example, whether data access is permitted based on attribute information such as business category, industry, or business type, such as when the service business SB is a "public utility business" or a "profit-making business."

[0040] The access policy that can be set for each data type in the individual user access policy 251 is, for example, whether or not data access is permitted when the data type is "purchase data D1" or "health data D3."

[0041] The access policy that can be set for each purpose of use in the individual user access policy 251 is, for example, whether data access is permitted when the purpose of use is "statistical use without identifying an individual" or "non-statistical use with identifying an individual." Note that "identifying an individual" may include cases where the personally identifiable information does not identify an individual but can identify different individual users.

[0042] Fig. 6 is a diagram showing a specific example of an access policy that can be set for each data provision mode in the individual user access policy 251. The specific example shown in Fig. 6 is matrix data in which an access policy is set for each data type and data provision mode. The access policy that is set is whether or not the service business SB can access the acquired data D, specifically, "service business SB that agrees to use" and "service business SB that does not agree to use". The contents in parentheses indicate the purpose of use.

[0043] For example, in the specific example shown in Fig. 6, when the data type is purchasing data, consent is given to the corporate service business S0001 (shown as "Company S0001" in Fig. 6) that data can be provided in a form that identifies an individual if the purpose of use is service collaboration. Also, in the specific example shown in Fig. 6, provision of data in a form that identifies an individual is suspended (prohibited) to the corporate service business S1001 (shown as "Company S1001" in Fig. 6) regardless of the purpose of use.

[0044] For example, in the specific example shown in Fig. 6, it is agreed that data can be provided in an anonymous form to the corporate service business 2001 (shown as "Company S2001" in Fig. 6) if the purpose of use is for product development of the company providing the corporate service business 2001. Also, in the specific example shown in Fig. 6, there is no service business SB for which the provision of data in an anonymous form is suspended (prohibited).

[0045] For example, in the specific example shown in Figure 6, if the data type is purchasing data, data provision in the form of statistical data obtained by statistically processing "purchasing data" is comprehensively agreed to for all service businesses SB. Also, in the specific example shown in Figure 6, if the data type is health data, data provision in the form of statistical data obtained by statistically processing "health data" is comprehensively agreed to for medical service businesses SB.

[0046] Fig. 7 is a diagram showing a specific example of an access policy that can be set for each consent policy and region of use in individual user access policy 251. For example, in the specific example shown in Fig. 7, for a member (individual user U) with member ID: #0081100100000002, when the data type of acquired data D is purchase data and raw data that can identify an individual is provided, the consent of the member (consent each time) is required each time the service business SB uses the service, and an access policy is set that limits the region of use to within Japan.

[0047] Fig. 8 is a diagram showing a specific example of an access policy that can be set for each life cycle of acquired data D in individual user access policy 251. For example, in the specific example shown in Fig. 8, for a member (individual user U) with member ID: #0081100100000002, an access policy is set in which the data type of acquired data D is purchase data, the raw data of the purchase data is stored for three years, and the usage period of the raw data of the purchase data that has been pseudonymized is up to three years after withdrawal.

[0048] Fig. 9 is a diagram showing a specific example of an access policy that can set whether or not to allow combinations of each data type of acquired data D in individual user access policy 251. For example, in the specific example shown in Fig. 9, for a member (individual user U) with member ID: #0081100100000002, an access policy is set that allows purchase data to be combined with different data (purchase data, HR data, health data, third education data, education attendance data, qualification acquisition data, communication details data, schedule data, viewing data) and provided (however, depending on the combination, the destination of provision may be limited to health business operators, medical institutions, etc.). Note that the different data referred to here is not limited to data of different data types, but includes data of the same type but from different sources, etc.

[0049] The individual user access policy 251 shown in Fig. 7 and Fig. 8 can also be set for each individual user U. Note that the individual user access policy 251 shown in Fig. 7 and Fig. 8 may be in a form common to individual users U belonging to a set group or to all individual users U.

[0050] The comprehensive access policy 252 is an access policy that comprehensively specifies the individual user access policies 251. The comprehensive access policy 252 roughly indicates whether or not access is permitted to the personal data of an individual user U, for example, by using a gradual index from level 1 to level 5. By setting the comprehensive access policy 252, the individual user U can roughly set the individual user access policy 251 for each individual user U, without having to set all of the individual user access policies 251.

[0051] In the following description, the term “individual user access policy 251 ” includes an individual user access policy 251 that is broadly set by a comprehensive access policy 252 .

[0052] The personal user U can access the personal user access policy 251 using an application implemented using the API of the personal user interface 22. The application may be a native application that runs on the personal terminal 300, or a Web application that runs on the data service providing system 100. In the following description, the application implemented using the API of the personal user interface 22 is also referred to as a "personal user application AP1."

[0053] The second access policy recording unit 26 records the access policy set by the administrator A via the administrator interface 23. The access policy recorded in the second access policy recording unit 26 includes virtual table definition information 261, a data type handling policy 262, a data type combination policy 263, and a service business access policy 264.

[0054] The virtual table definition information 261 is definition information used to set an access policy, and defines the specifications of the virtual table T generated by the provided data generation unit 4. The specifications defined in the virtual table definition information 261 are, for example, a schema indicating the structure and data items (columns) of the virtual table T. The "data items" are the types of data (contents, data types, etc.) handled by the virtual table T.

[0055] A data item that is not defined in the virtual table definition information 261 cannot be accessed from the data access control unit 5. The data item to be defined may be a data item that is included in advance in the acquired data D, or may be a data item that is newly created by combining data items of different acquired data D.

[0056] The data type handling policy 262 is an access policy that sets the handling of acquired data D for each data type. The data type handling policy 262 is, for example, a handling policy for purchase data D1, a handling policy for HR data D2, and a handling policy for health data D3. By setting a handling policy for each data type, the data service providing system 100 can handle a wide variety of acquired data D.

[0057] FIG. 10 is a diagram showing a specific example of the data type handling policy 262. As shown in FIG. The acquired data D is classified into one of five information handling levels based on the data type, as shown in Fig. 10. The data type handling policy 262 sets, for example, a means of identity verification of the individual user U, a means of authenticating the individual user U, a regional restriction on the storage area of ​​the acquired data D, a data storage method, etc. for each of the five information handling levels. Note that the information handling levels shown in Fig. 10 are values ​​indicating that the higher the number, the stricter the restrictions on the handling of the data.

[0058] The data type combination policy 263 is an access policy that sets a combination of different data types of acquired data D. The data type combination policy 263 is, for example, a rule for using the purchase data D1 and the health data D3 in combination.

[0059] FIG. 11 is a diagram showing an example of a data item newly created based on the data type combination policy 263. Data items of acquired data D of different data types are combined and used as a new data item based on the data type combination policy 263. For example, as shown in FIG. 11, "food purchase date and time" and "purchased food name" which are data items of purchase data D1 and "exercise date and time" which is a data item of health data D3 are combined and used as a new data item "food name purchased before and after exercise". By setting the data type combination policy 263, it is possible to easily generate a new data item in which data items of data types with different handling policies are seamlessly associated with each other.

[0060] It is preferable to set the information handling level of data obtained by combining acquired data D with different information handling levels to the highest information handling level of the acquired data D used in the combination. For example, the information handling level of data obtained by combining purchasing data with information handling level 2 and HR data with information handling level 3 is "3." Note that data types may be further subdivided and information handling levels set for each data item. In this way, if the HR data includes a data item that contains My Number information, the data item can be set to an information handling level appropriate for specific personal information handling.

[0061] The data type combination policy 263 may be a rule for combining and using acquired data D with different reliability levels. For example, assume that the acquired data D includes purchase data (highly reliable purchase data, first purchase data) obtained using an electronic receipt mechanism that is difficult for an individual user U to modify or forge, and purchase data (medium-reliable purchase data, second purchase data) input by an individual user U through camera photography or manual input using a predetermined application running on a mobile terminal or the like based on information written on a paper receipt. In this case, the data type combination policy 263 may be a rule for prohibiting the combination of highly reliable purchase data (first purchase data) and medium-reliable purchase data (second purchase data) having different reliability levels. This makes it possible to prohibit the use of highly reliable purchase data (first purchase data), which is difficult to modify or forge and is free from erroneous judgments by applications on a mobile terminal or erroneous inputs by individual users, in combination with the second purchase data having a relatively low reliability level, thereby making it possible to provide a highly reliable data service.

[0062] The service business access policy 264 is an access policy set for each service business SB based on a contract with the service provider SP, etc., regarding whether the service business SB can access the acquired data D. The service business access policy 264 is set for each "data item" defined in the virtual table definition information 261. The service business access policy 264 can be set comprehensively, for example, so as not to permit the first service business SB1 to access all data items related to the HR data D2.

[0063] The administrator A can access the first access policy recording unit 25 and the second access policy recording unit 26 by using an application implemented using the API of the administrator interface 23. The application may be a native application that runs on the management device 400 owned by the administrator A, or a Web application that runs on the data service providing system 100.

[0064] [Coordination Control Unit 3] FIG. 12 is a functional block diagram of the cooperation control unit 3. As shown in FIG. The cooperation control unit 3 controls the mutual cooperation between the individual user U, the service business SB, and the data providing business DB. The cooperation control unit 3 has a cooperation interface 31 and a cooperation information recording unit .

[0065] The linkage interface 31 is an interface connected to the service providing device 500 owned by the service provider SP and the management device 400 owned by the administrator A of the data service providing system 100. Specifically, the linkage interface 31 includes an API that connects the service providing device 500 and the management device 400 with the linkage information recording unit 34. The linkage interface 31 has a service business linkage interface 32 and an administrator linkage interface 33.

[0066] The service business collaboration interface 32 includes an API that connects the service providing device 500 owned by the service provider SP and the collaboration information recording unit 34.

[0067] The administrator collaboration interface 33 includes an API that connects the management device 400 owned by the administrator A and the collaboration information recording unit 34 .

[0068] The link interface 31 may include a data providing business link interface that connects the data device 200 owned by the data provider DP with the link information recording unit 34 .

[0069] The association information recording unit 34 records association information of users of the data service providing system 100. The association information recording unit 34 has a business association information recording unit 35 and an individual user association information recording unit 36. The business association information recording unit 35 records data providing business association information 351 and service business association information 352.

[0070] The data provision business collaboration information 351 includes metadata indicating details such as member ID data (hereinafter referred to as "first linked member ID data") and item code included in the data provided by the data provider DP in the data provision business DB. The data provision business collaboration information 351 also includes contract management information (which may include terms of use and consent data for the terms of use) that specifies the contents of the usage contract with the data provider DP.

[0071] The service business collaboration information 352 is data indicating details such as member ID data (hereinafter referred to as "second linked member ID data") used in the service business SB. The second linked member ID data is used by the service business SB when reading data via the data access control unit 5. The service business SB can update the service business collaboration information 352 and obtain collaboration information via the service business collaboration interface 32. The service business collaboration information 352 also includes contract management information (which may include terms of use and consent data to the terms of use) including the contents of the service contract for the service business SB with the service provider SP.

[0072] The individual user association information recording unit 36 ​​records data such as member ID data of a registered individual user U who uses the data service providing system 100. The administrator A can update the data recorded in the individual user association information recording unit 36 ​​via the administrator association interface 33.

[0073] The linkage control unit 3 generates linkage information that links the first linked member ID data and the second linked member ID data with the member ID data in the related individual user linkage information recording unit 36. This allows the individual user U, the service business SB, and the data providing business DB to link with each other in the data service provided by the data service providing system 100.

[0074] In addition, the first linked member ID data and the second linked member ID data may be data indicating linkage information, rather than the member ID data itself.

[0075] [Provided data generation part 4] The provided data generation unit 4 generates provided data (second data) from the acquired data (first data) D in response to a data access request from a registered user (individual user U and service provider SP) via the data access control unit 5. The data that the registered user (individual user U and service provider SP) can read via the data access control unit 5 is not the acquired data D recorded in the acquired data recording unit 12, but the provided data (second data).

[0076] The provided data generating unit 4 generates a virtual table T corresponding to a data access request as provided data (second data). The virtual table T is a table that is generated for each data access request and is not recorded in its entirety in a non-volatile recording unit. The provided data generating unit 4 responds to a data access request from the data access control unit 5 based on the generated virtual table T. As shown in FIG. 3, the provided data generating unit 4 has an access control integrating unit 41 and a virtual table generating unit 42.

[0077] In response to a data access request from the data access control unit 5, the access control integration unit 41 integrates the access policy recorded in the access policy recording unit 24 and the association information generated in the association information recording unit 34 to generate "access control information."

[0078] The generated access control information includes an individual user access policy 251 for the personal data of a plurality of individual users U contained in the acquired data D acquired from the data access control unit 5 in response to a data access request.

[0079] The generated access control information includes the service enterprise access policy 264 set for the service enterprise SB that made the data access request.

[0080] The generated access control information includes association information that associates the member ID data in the individual user association information recording unit 36 ​​with the first associated member ID data and the second associated member ID data.

[0081] The virtual table generating unit 42 generates a virtual table (second data) T from the acquired acquired data (first data) D based on the access control information generated by the access control integrating unit 41.

[0082] Specifically, the virtual table generating unit 42 acquires from the data acquiring unit 1 the acquisition data D required for responding to the data access request from the data access control unit 5, based on the linkage information and the like included in the access control information.

[0083] Specifically, the virtual table generating unit 42 generates a virtual table (second data) T from the acquired data (first data) D based on the individual user access policy 251 included in the access control information. For example, when an individual user U restricts the use of personal data for the service business SB that has made the data access request or for the purpose of use, the virtual table generating unit 42 generates a virtual table T that does not include and deletes the relevant personal data.

[0084] Specifically, the virtual table generating unit 42 generates a virtual table (second data) T from the acquired data (first data) D based on the service business access policy 264 included in the access control information. For example, when an individual user U restricts the use of a specific data item for the service business SB that has made a data access request, the virtual table generating unit 42 generates a virtual table T that does not include and deletes the relevant data item.

[0085] FIG. 13 is a diagram illustrating an example of the virtual table T that is generated. The virtual table generation unit 42 generates a virtual table T for each service business SB for which a data access request has been made. For example, as shown in FIG. 13, the virtual table generation unit 42 creates a first virtual table T1 for a data access request from a first service business SB1. The virtual table generation unit 42 also creates a second virtual table T2 for a data access request from a second service business SB2. The virtual table generation unit 42 also creates a third virtual table T3 for a data access request from a third service business SB3. However, when the access control information for multiple data access requests is the same, the virtual table generation unit 42 may generate only one virtual table T to respond to multiple data access requests with the same access control information.

[0086] FIG. 14 is a diagram showing another example of the virtual table T to be generated. The virtual table generating unit 42 may generate a hierarchical virtual table T linked in multiple stages. For example, as shown in FIG. 14, the hierarchical virtual table T4 is linked to a virtual table of purchase data (upper layer virtual table), a virtual table in which purchase data of a specific region is extracted from the upper layer virtual table, and a virtual table in which purchase data of a specific product is extracted from the upper layer virtual table. In addition, the hierarchical virtual table T5 is linked to a virtual table (upper layer virtual table) in which purchase data and HR data are merged based on the data type combination policy 263, a virtual table which is statistical data calculated from the upper layer virtual table, and a virtual table in which anonymization processing is performed on the upper layer virtual table based on the individual user access policy 251. By constructing the virtual table T hierarchically, the virtual table generating unit 42 can omit duplicated processing when generating the virtual table T.

[0087] The access policy of the hierarchical virtual table T may inherit the access policy of the upper layer virtual table. For example, in the hierarchical virtual table T4, when the virtual table of the purchasing data (upper layer virtual table) is at the information handling level 2, the lower layer virtual table T linked to the virtual table of the purchasing data (upper layer virtual table) may inherit the information handling level 2.

[0088] In the hierarchical virtual table T5, the virtual table that has been anonymized from the upper virtual table, which has an information handling level of 3, has been changed to information that cannot be used to identify individuals. Therefore, the information handling level of the anonymized virtual table may be lowered to information handling level 2 compared to the upper virtual table.

[0089] [Data Access Control Unit 5] FIG. 15 is a functional block diagram of the data access control unit 5. The data access control unit 5 responds to a data service request from a registered user (individual user U and service provider SP). After receiving the data service request, the data access control unit 5 issues a data access request to the provided data generation unit 4 in order to access the provided data (second data) required to provide the requested data service. The data access control unit 5 provides a data service to the data service requester based on the provided data (second data) acquired from the provided data generation unit 4. The provision of the data service includes not only the provision of the data itself, but also the provision of data analysis results and the provision of various services based on the data. In addition, examples of a method of providing the data service include a method of allowing a user to access the provided data generated in the data service providing system 100, and a method of sending the generated provided data to the user via a predetermined network. Each data service request includes an ID or the like that can be identified by the service provider SP, service business SB, or individual user U that is the access source, and each data service requester can be identified.

[0090] The data access control unit 5 has a service business data access interface 52 and an individual user data access interface 53 .

[0091] The service business data access interface 52 includes an API that connects the service providing device 500 owned by the service business SP and the provided data generation unit 4. The service business SB can receive data services from the data service providing system 100 via the service business data access interface 52.

[0092] The service business data access interface 52 includes, for example, an API for data search, an API for data analysis, and an API for visualizing the results of data analysis.

[0093] The personal user data access interface 53 connects the personal user interface 22 and the provided data generation unit 4. The personal user U can confirm, via the personal user interface 22 and the personal user data access interface 53, in what manner his / her own personal data is being accessed by the service business SB.

[0094] [Operation of data service providing system 100] Next, a description will be given of the operation of the data service providing system 100. Figures 16 to 19 show examples of display screens of the personal user application AP1 operating on the personal terminal 300.

[0095] The personal user application AP1 is an application implemented using the API of the personal user interface 22. A personal user U can use the personal user application AP1 to access the personal user access policy 251. The personal user application AP1 shown in FIG.

[0096] The individual user access policy setting window 301 is composed of a first window 302 for setting an individual user access policy 251 for each service business SB, a second window 303 for setting an individual user access policy 251 for each data type, and a third window 304 for setting an individual user access policy 251 for each purpose of use.

[0097] The individual user U can use the switch button SW in the first window 302 to set whether or not to permit access to the personal data of the individual user U for each service business SB. In the example shown in Fig. 16, access to the personal data from the first service business SB1 and the second service business SB2 is permitted, but access to the personal data from the third service business SB3 and the fourth service business SB4 is not permitted.

[0098] There is a case where the service business SB prepares an integrated application AP2 that runs on the personal terminal 300. In this case, the personal user application AP1 may start an integration between the data service providing system 100 and the integrated application AP2 when the personal user U selects to permit access to the service business.

[0099] The individual user U can use the switch button SW in the second window 303 to set whether or not to permit access to the personal data of the individual user U for each data type. In the example shown in Fig. 16, access to personal data related to purchasing data D1 and health data D3 is permitted, but access to personal data related to HR data D2 is not permitted.

[0100] In the third window 304, the individual user U can set whether or not to permit access to the personal data of the individual user U for each purpose of use by using the switch button SW. In the example shown in Fig. 16, access to the personal data is permitted when the purpose of use is "statistical use without identifying an individual", but access to the personal data is not permitted when the purpose of use is "non-statistical use with identifying an individual".

[0101] The personal user access policy 251 that can be set in the personal user application AP1 may be set so that the permission to access personal data for each purpose of use can be set for each data type. For example, the personal user access policy 251 for purchase data D1 can be set to consent to both "statistical use without identifying an individual" and "non-statistical use with identifying an individual". On the other hand, the personal user access policy 251 for HR data D2 can be set to consent to "statistical use without identifying an individual" but not to "non-statistical use with identifying an individual".

[0102] Data that combines purchasing data D1 and HR data D2 may basically be set as not permitted if access to either one of them is not permitted, but access to the combined data may be permitted if access to either one of them is permitted.

[0103] The setting items for "non-statistical use that identifies individuals" may be subdivided. For example, it may be possible to set whether or not to permit "non-statistical use that identifies individuals" for each "purpose of use A" that uses all data items of a single purchase data, or for each "purpose of use B" that uses purchase data that corresponds to a specific purchase area or specific product.

[0104] Furthermore, the individual user access policy 251 may be set primarily based on the purpose of use, for example, if the purpose of use is medical research, then the use of the purchasing data D1, HR data D2, and health data D3 is in principle "permitted."

[0105] All of the individual user access policies 251 set in the individual user access policy setting window 301 are taken into consideration when the provided data generating unit 4 generates the provided data (second data). If at least one of the set individual user access policies 251 is "not permitted", the corresponding personal data is not used in the provided data (second data).

[0106] 17 displays an access status confirmation window 305. The access status confirmation window 305 displays the access status to the personal data for each service business SB acquired via the personal user data access interface 53.

[0107] The access status confirmation window 305 is composed of a fourth window 306 that displays the access status to personal data from the first service business SB1, and a fifth window 307 that displays the access status to personal data from the third service business SB3.

[0108] The settings in the first window 302 allow the first service business SB1 to access the personal data. However, the settings in the second window 303 do not allow access to the personal data related to the HR data D2. Therefore, in the fourth window 306, the purchasing data D1 and the health data D3 are displayed, and the HR data D2 is not displayed and cannot be used.

[0109] On the other hand, due to the settings in the first window 302, access to the personal data from the third service business SB3 is not permitted, so in the fifth window 307, all data is not displayed and is unavailable.

[0110] An individual user U can use the access status confirmation window 305 to check how the individual user U's own personal data is being accessed by the service business SB, and can easily and reliably set an individual user access policy 251 using the individual user access policy setting window 301 (access policy setting step).

[0111] The access status confirmation window 305 shown in FIG. 17 shows a data display that lists only data items, which is the simplest example. The access status confirmation window 305 may show more complex data displays, such as data analysis results. In addition to the access status, the access status confirmation window 305 may show incentives acquired by the individual user U through the access. For example, the access status confirmation window 305 may show points or virtual currency acquired in one access, the degree of contribution to the global environment, and the degree of contribution to medical research. The access status confirmation window 305 may also show messages or requests from the accessing entity (service business SB) to the individual user U.

[0112] 18 displays a comprehensive access policy setting window 310. An individual user U may not set all of the individual user access policies 251 individually, but may select a comprehensive access policy 252 from a plurality of templates prepared in advance at the individual user U's discretion. In the comprehensive access policy setting window 310, the individual user U can use the radio button RB to select a comprehensive access policy 252 from a plurality of templates prepared in advance.

[0113] In the example shown in Fig. 18, if an individual user U selects mode X, the individual user U sets all of the individual user access policies 251. As shown in Fig. 16, permission or denial of access is set individually for the individual user U, all service businesses, data types, and purposes of use.

[0114] If an individual user U selects mode Y, and the data usage purpose of the service business SB of the service provider SP that uses the acquired data D is "medical research," "drug discovery research," or "earth life research," the comprehensive access policy 252 to which the individual user gives comprehensive consent is selected. If the data usage purpose of the service business SB is anything other than that, the individually set individual user access policy 251 is selected.

[0115] If the individual user U selects mode Z, a template of an individual user access policy previously set by the administrator A or another individual user is referenced and set as the individual user's own individual user access policy 251. The individual user U may customize the selected template and set his / her own individual user access policy 251. The template of the individual user access policy 251 may be created not only by the administrator A or another individual user, but also by a template creation service provider.

[0116] 19 displays a recommended comprehensive access policy window 320. The comprehensive access policy window 320 displays a popular template ranking and recommended template candidates that are recommended based on the attributes and owned data of the individual user, etc. By selecting an appropriate template from the recommended templates, the individual user U can reduce the burden of setting all of the individual user access policies 251.

[0117] FIG. 20 is a diagram showing a data service providing system 100 that operates in conjunction with a cooperative application AP2 of a service business SB.

[0118] The coordinated application AP2 first transmits an authentication request to the data service providing system 100 to receive the provision of a data service (authentication step). The data service providing system 100 receives the authentication request via the service business coordination interface 32, and checks the service business coordination information 352 recorded in the coordination information recording unit 34. If the data service is possible for the service business SB that has requested the authentication request, the service business coordination interface 32 transmits an authentication result to the coordinated application AP2. Here, if the data service is not possible for the service business SB that has requested the authentication request, the data service providing system 100 may transmit an authentication error result to the coordinated application AP2.

[0119] Next, the cooperative application AP2 transmits a data service request to the data service providing system 100. The data service providing system 100 receives the data service request via the service business data access interface 52 and confirms the data service content. The service business data access interface 52 issues a data access request to the provided data generating unit 4 to access the provided data (second data) required to provide the requested data service.

[0120] Next, the provided data generating unit 4 generates a virtual table T as provided data (second data) from the acquired data (first data) D in response to the data access request (data generating step). The provided data generating unit 4 creates a virtual table T each time in response to a data access request, thereby generating a virtual table T that always reflects the access policy that changes from moment to moment. The data access control unit 5 can provide a data service using the provided data that reflects the latest access policy.

[0121] The provided data generating unit 4 may cache the created virtual table T as temporary storage. When the next data access request occurs, the provided data generating unit 4 may reuse the whole or part of the cached virtual table T if the related access policy has not been updated. The provided data generating unit 4 can reduce the processing load of generating the virtual table T by using the cached data (cache data) as temporary storage.

[0122] Next, the service business data access interface 52 provides a data service based on the virtual table T (data providing step).

[0123] According to the embodiment described above, by setting an access policy for each data type and registered user (individual user U and service provider SP) for acquired data D including multiple data types with different handling policies, it is possible to more seamlessly manage a wide variety of acquired data D with different information management methods and handling methods. In addition, acquired data D including personal data of individual user U can be more strictly managed. In addition, even for acquired data including a single data type, it is possible to appropriately manage the data based on each access policy.

[0124] (Modification) In each of the above embodiments, the provided data generating unit 4 generates a virtual table T as the provided data (second data), but the provided data generating unit 4 may generate a real table as the provided data (second data). The real table is a table that is pre-recorded in a non-volatile recording unit before a data access request is made. The provided data generating unit 4 periodically generates or updates the real table as the provided data based on specific specifications (for example, the provided data used for "statistical use without identifying individuals"). By using such a real table, the provided data generating unit 4 can reduce the processing load of generating the provided data.

[0125] The above-mentioned embodiment may be realized by recording the program in a computer-readable recording medium, reading the program recorded in the recording medium into a computer system, and executing the program. The term "computer system" as used herein includes hardware such as an OS and peripheral devices. The term "computer-readable recording medium" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and CD-ROMs, and storage devices such as hard disks built into a computer system. The term "computer-readable recording medium" may also include a medium that dynamically holds a program for a short period of time, such as a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line, and a medium that holds a program for a certain period of time, such as a volatile memory inside a computer system that is a server or client in such a case. The above-mentioned program may be a program for realizing a part of the above-mentioned functions, or may be a program that can realize the above-mentioned functions in combination with a program already recorded in the computer system.

[0126] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents described in the claims, as well as in the scope and spirit of the invention. [Explanation of symbols]

[0127] 100...data service providing system, 1...data acquisition unit, 2...access policy control unit, 3...cooperation control unit, 4...provided data generation unit, 5...data access control unit, 251...individual user access policy, 262...data type handling policy, 263...data type combination policy, 264...service business access policy

Claims

1. A data service providing method for providing a data service to a registered user, comprising the steps of: A data acquisition step of acquiring first data including a plurality of data having different handling policies; an access policy setting step of setting an access policy for the first data; a data generating step of generating second data to be used for a data service to be provided to the user from the first data based on the access policy; a data providing step of providing a data service based on the second data; Equipped with the access policy includes a data combination policy that sets a combination of data of the first data that have different handling policies, The data generating step generates the second data including data obtained by combining data having different handling policies among the first data based on the data combination policy. Data service delivery method.

2. The first data is stored in a distributed manner for each data item having a different handling policy. The data service providing method according to claim 1 .

3. The plurality of data with different handling policies include at least one of purchase data, HR data, and health data.

3. The data service providing method according to claim 1 or 2.

4. The second data includes a new data item obtained by combining data items of the first data having different handling policies. The data service providing method according to claim 1 .

5. The user includes a service provider, the access policy includes a service business access policy in which whether or not the service business of the service provider is allowed to access the first data is set for each of the service businesses; The data service providing method according to any one of claims 1 to 4.

6. The users include individual users and service providers, the access policy includes an individual user access policy in which whether or not the service provider can access the first data through the service business of the service provider is set for each individual user; The data service providing method according to any one of claims 1 to 4.

7. The individual user access policy includes a policy indicating whether the access is permitted for each of the service businesses. The data service providing method according to claim 6.

8. The individual user access policy includes a policy indicating whether the access is permitted for each purpose of use.

8. A method for providing data services according to claim 6 or 7.

9. The access policy setting step includes a step of the individual user setting the individual user access policy. The data service providing method according to any one of claims 6 to 8.

10. the second data includes a virtual table; The data service providing method according to any one of claims 1 to 9.

11. The virtual table has a hierarchical structure linked in multiple stages. The data service providing method according to claim 10.

12. A system for providing a data service to a registered user, comprising: a data acquisition unit that acquires first data including a plurality of data having different handling policies; an access policy control unit that sets an access policy for the first data; a provision data generating unit that generates second data used for a data service to be provided to the user from the first data based on the access policy; a data access control unit that provides a data service based on the second data; Equipped with the access policy includes a data combination policy that sets a combination of data of the first data that have different handling policies, the provision data generation unit generates the second data including data obtained by combining data having different handling policies among the first data based on the data combination policy; Data service provision system.

13. The first data is stored in a distributed manner for each data item having a different handling policy. The data service providing system according to claim 12.

14. The plurality of data with different handling policies include at least one of purchase data, HR data, and health data. The data service providing system according to claim 13.

15. The users include individual users and service providers, the access policy includes an individual user access policy in which whether or not the service provider can access the first data through the service business of the service provider is set for each individual user; The data service providing system according to any one of claims 12 to 14.

16. the access policy control unit has an interface through which the individual user can set the individual user access policy; The data service providing system according to claim 15.

17. the provision data generation unit generates a virtual table as the second data for each request from the user. The data service providing system according to any one of claims 12 to 16.

18. the provision data generation unit records the generated virtual table as temporary cache data, and generates the virtual table using the cache data at the next request of the user.

18. A data service providing system according to claim 17.

Images