Information Protection System

Abstract

To provide an information protection system capable of suitably protecting predetermined information contained in a data file even if the data file is leaked. [Solution] The information protection system disclosed herein is a system for protecting information by dividing a first data file containing predetermined information and storing the divided data in a database, and includes a generating unit that generates a second data file in which the information has been deleted from the first data file, a third data file for identifying the deleted information, and a predetermined identification key based on the information, and an erasing unit that erases the first data file. The generating unit stores the identification key and the second data file in association with each other, and stores the information and the third data file in association with each other.

Description

[Technical Field]

[0001] The present invention relates to an information protection system that divides a data file containing predetermined information, stores the divided data in a database, and protects the information. [Background technology]

[0002] Conventionally, organizations such as companies have encrypted data containing confidential information, such as the private information of individuals belonging to the organization and information on customers and business partners, in order to prevent such information from leaking to the outside.

[0003] In order to improve security against leakage of electronic data, various systems have been proposed that use encryption to manage data.

[0004] For example, Patent Document 1 discloses a data management device that improves security against leakage of electronic data by encrypting a cryptographic key that encrypts a data block and erasing the original data block and the cryptographic key before encryption. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2007-199974 Summary of the Invention [Problem to be solved by the invention]

[0006] According to the technology described in Patent Document 1, when a data block is encrypted and stored, not only is the data block encrypted, but the encryption key used for the encryption is also encrypted, and the original data block and encryption key are erased. This makes it possible to prevent the data block from being leaked before encryption. Even if the encrypted data block is leaked, it is difficult to identify the encryption key for decrypting the data block, which appears to enhance security against leakage of electronic data.

[0007] However, as in the technology described in Patent Document 1, when not only data blocks but also encryption keys are encrypted, the process of decrypting information contained in the original data blocks when properly reading them tends to become complicated, and the information decryption process may significantly reduce the throughput of the system. This may result in a risk of information not being provided to users promptly. In this way, a system that manages data using encryption may seem to protect the information contained in the encrypted electronic data against leakage, but the above-mentioned problems may arise in the proper decryption process of the encrypted electronic data.

[0008] An object of the present disclosure is to provide an information protection system that can suitably protect a data file containing predetermined information even if the data file is leaked. [Means for solving the problem]

[0009] The information protection system disclosed herein protects information by dividing a first data file containing predetermined information and storing the divided data in a database. The information protection system includes an acquisition unit that acquires the first data file and stores the divided data in a predetermined first database; a first generation unit that generates a second data file based on the acquired first data file, the second data file being a data file in which the information has been deleted from the first data file, and stores the second data file in a predetermined second database; a second generation unit that generates a third data file for identifying the information deleted from the first data file by the first generation unit and stores the third data file in a predetermined third database; a third generation unit that generates a predetermined identification key based on the information; and an erasure unit that erases the first data file stored in the first database from the first database. The first generation unit associates the identification key generated by the third generation unit with the second data file and stores the second data file in the second database. The second generation unit associates the information with the third data file and stores the third data file in the third database.

[0010] According to the information protection system, a second data file and a third data file are generated based on the acquired first data file, and a data file containing confidential information, such as the private information of individuals belonging to an organization such as a company and customer / business partner information, is divided into a data file in which the confidential information has been concealed and a data file for identifying the confidential information. The first data file, which is the original data file containing the confidential information to be protected, is not stored, and the second data file from which the confidential information has been deleted and the third data file configured to identify the confidential information are stored in different databases. As a result, even if the data file is leaked, private information that could identify an individual will not be leaked from the second data file, and an individual cannot be identified from the private information in the third data file.

[0011] In the above information protection system, the first generation means may store the second data file in the second database with the identification key as the file name of the second data file, and the second generation means may store the third data file in the third database with a name included in the information as the file name of the third data file. In this case, the third generation means may convert the name included in the information into hexadecimal numbers based on a predetermined conversion pattern, and generate the identification key as the identification key.

[0012] The conversion pattern may be configured by a plurality of patterns including permutation of a character string of a name included in the information, permutation of bits in data obtained by converting the permuted character string into binary numbers, and conversion of the data having the permuted bits into hexadecimal numbers.The third generation means may determine the conversion pattern from the plurality of patterns based on predetermined time information, and generate the identification key.

[0013] The information protection system of the present disclosure may further include a search unit that searches for the third data file corresponding to the second data file based on the identification key, and a display unit that restores the information deleted from the first data file to the second data file based on the searched third data file and displays the restored information so that it can be viewed on a predetermined terminal. This makes it possible to properly read and display all information contained in the original first data file without decrypting the data file, and to quickly provide all information to the user.

[0014] In this case, the information protection system may further include an editing means for storing a data file displayed based on the second data file and the third data file as an editing record in the memory of the terminal and accepting editing of the data file. When the data file is edited in this manner, the edited data file is treated as a new first data file, and the information included in the new first data file is protected by the acquisition means, first generation means, second generation means, third generation means, and erasure means performing their respective processes. [Effects of the Invention]

[0015] According to the present disclosure, for a data file containing predetermined information, even if the data file is leaked, the information can be suitably protected. [Brief explanation of the drawings]

[0016] [Figure 1] 1 is a diagram showing a schematic configuration of an information protection system according to a first embodiment. [Figure 2] FIG. 2 is a diagram showing in more detail the components of a server included in the information protection system according to the first embodiment, and also showing the components of a user terminal that communicates with the server. [Figure 3] FIG. 2 is a diagram illustrating an example of the flow of operations of the information protection system in the first embodiment. [Figure 4] FIG. 2 is a diagram for explaining a second data file generated based on a first data file. [Figure 5] FIG. 10 is a diagram for explaining a third data file generated based on the first data file. [Figure 6] FIG. 10 is a diagram illustrating a conversion pattern for generating an identification key. [Figure 7] FIG. 4 is a diagram illustrating a plurality of conversion patterns for converting a character string of a name into hexadecimal numbers in the first embodiment. [Figure 8]4 is a diagram for explaining data files stored in a database in each process shown in FIG. 3. FIG. [Figure 9] FIG. 10 is a diagram illustrating an example of the flow of operations of the information protection system in the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0017] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. The configurations of the following embodiments are examples, and the present disclosure is not limited to the configurations of the embodiments.

[0018] First Embodiment An overview of the information protection system according to the first embodiment will be described with reference to FIG. 1. FIG. 1 is a diagram showing a schematic configuration of the information protection system according to this embodiment. The information protection system 100 according to this embodiment includes a network 200, a server 300, and a user terminal 400. The information protection system according to the present disclosure is a system that divides a first data file containing predetermined information, stores the divided data in a database, and protects the information, and the process for protecting the information is executed by the server 300. The information is confidential information such as the privacy information of individuals belonging to an organization such as a company, and customer / business partner information.

[0019] Network 200 is, for example, an IP network. As long as network 200 is an IP network, it may be wireless, wired, or a combination of wireless and wired. For example, in the case of wireless communication, user terminal 400 may access a wireless LAN access point (not shown) and communicate with server 300 via a LAN or WAN. Furthermore, network 200 is not limited to these examples and may be, for example, a public switched telephone network, an optical fiber line, an ADSL line, a satellite communication network, etc.

[0020] Server 300 is connected to user terminal 400 via network 200. Here, server 300 and user terminal 400 connected via network 200 constitute an information system in an organization such as a company, and personnel belonging to the organization use user terminal 400, and information input using user terminal 400 can be centrally managed by server 300. Note that, for the sake of simplicity, one server 300 and four user terminals 400 are shown in FIG. 1, but it goes without saying that the number is not limited to this.

[0021] Server 300 may be any electronic device having the processing power for arithmetic and processing operations such as data acquisition, generation, and updating, including personal computers, servers, mainframes, and other electronic devices. That is, server 300 may be configured as a computer having a processor such as a CPU or GPU, a main memory such as RAM or ROM, and an auxiliary memory such as an EPROM, a hard disk drive, or removable media. The removable media may be, for example, a USB memory or a disk recording medium such as a CD or DVD. The auxiliary memory stores an operating system (OS), various programs, various tables, and the like.

[0022] Furthermore, the server 300 may appropriately use SaaS (Software as a Service), Paas (Platform as a Service), or IaaS (Infrastructure as a Service) using a cloud server, without providing software, hardware, an OS, etc., dedicated to the information protection system 100 of this embodiment.

[0023] The user terminal 400 may be any electronic device such as a mobile terminal owned by a user (personnel belonging to an organization such as a company in which the information protection system 100 has been introduced) who uses the information protection system 100, and may be, for example, a mobile terminal, a tablet terminal, a smartphone, a wearable terminal, a personal computer, or other terminal device.

[0024] Next, the components of the server 300 will be mainly described in detail with reference to Fig. 2. Fig. 2 shows the components of the server 300 included in the information protection system 100 in more detail in the first embodiment, as well as the components of the user terminal 400 that communicates with the server 300.

[0025] The server 300 has, as functional units, a communication unit 301, a storage unit 302, and a control unit 303. The server 300 loads a program stored in an auxiliary storage device into a working area of ​​a main storage device and executes it. The execution of the program controls each functional unit, thereby realizing each function that matches the predetermined purpose of each functional unit. However, some or all of the functions may be realized by hardware circuits such as ASICs and FPGAs.

[0026] Here, the communication unit 301 is a communication interface for connecting the server 300 to the network 200. The communication unit 301 is configured to include, for example, a network interface board and a wireless communication circuit for wireless communication. The server 300 is connected to the user terminal 400 and other external devices via the communication unit 301 so as to be able to communicate with them.

[0027] The storage unit 302 is configured to include a main storage unit and an auxiliary storage unit. The main storage unit is a memory in which programs executed by the control unit 303 and data used by the control programs are developed. The auxiliary storage unit is a device in which programs executed by the control unit 303 and data used by the control programs are stored. The storage unit 302 stores a first database, a second database, and a third database, which will be described later. The storage unit 302 also stores data transmitted from the user terminal 400, etc., and these databases may store data files and conversion patterns, which will be described later. The server 300 can acquire data transmitted from the user terminal 400, etc., via the communication unit 301.

[0028] The control unit 303 is a functional unit that controls the server 300. The control unit 303 can be realized by an arithmetic processing unit such as a CPU. The control unit 303 further includes five functional units: an acquisition unit 3031, a first generation unit 3032, a second generation unit 3033, a third generation unit 3034, and an erasure unit 3035. Each functional unit may be realized by the CPU executing a stored program.

[0029] The acquisition unit 3031 acquires a first data file that includes confidential information such as private information of individuals belonging to an organization such as a company and customer business partner information. Here, the acquisition unit 3031 acquires a first data file that is input to the user terminal 400 and transmitted from the user terminal 400, and stores the first data file in a first database. The first database is a database stored in the storage unit 302 of the server 300, and is, for example, a database in which temporary files are stored.

[0030] Here, the user terminal 400 in this embodiment has, as functional units, a communication unit 401, an input / output unit 402, and a storage unit 403. The communication unit 401 is a communication interface for connecting the user terminal 400 to the network 200, and is configured to include, for example, a network interface board and a wireless communication circuit for wireless communication. The input / output unit 402 is a functional unit for displaying information transmitted from the outside via the communication unit 401, and for inputting information when transmitting the information to the outside via the communication unit 401. The storage unit 403 is configured to include a main storage device and an auxiliary storage device, similar to the storage unit 302 of the server 300.

[0031] The input / output unit 402 further includes a display unit 4021, an operation input unit 4022, and an image / audio input / output unit 4023. The display unit 4021 has a function of displaying various information and is realized, for example, by an LCD (Liquid Crystal Display) display, an LED (Light Emitting Diode) display, an OLED (Organic Light Emitting Diode) display, or the like. The operation input unit 4022 has a function of accepting operation input from a user and is realized, specifically, by soft keys or hard keys on a touch panel or the like. The image / audio input / output unit 4023 has a function of accepting input of images such as still images and videos and is realized, specifically, by a camera using an image sensor such as a Charged-Coupled Device (CCD), a Metal-Oxide-Semiconductor (MOS), or a Complementary Metal-Oxide-Semiconductor (CMOS). The image / audio input / output unit 4023 has a function of accepting input and output of audio and is realized, specifically, by a microphone or speaker.

[0032] Then, a user of the information protection system 100 can create the first data file described above and transmit it to the server 300 using the user terminal 400 configured in this way.

[0033] The first generating unit 3032 generates a second data file based on the first data file acquired by the acquiring unit 3031. Here, the second data file is a file obtained by deleting the confidential information from the first data file. The first generating unit 3032 then stores the generated second data file in a second database. The second database is a database stored in the storage unit 302 of the server 300, and is, for example, a database designated by a user in accordance with data management rules for an information system in an organization such as a company.

[0034] The second generating unit 3033 generates a third data file for identifying the confidential information deleted from the first data file by the above-described process performed by the first generating unit 3032. The second generating unit 3033 then stores the generated third data file in a third database. The third database is any database stored in the storage unit 302 of the server 300. Details of the process performed by the second generating unit 3033 will be described later with reference to FIG. 3.

[0035] The third generating unit 3034 generates an identification key based on the confidential information. Details of the process executed by the third generating unit 3034 will be described later with reference to FIG.

[0036] The deleting unit 3035 executes a process of deleting the first data file acquired by the acquiring unit 3031 from the first database.

[0037] Here, the flow of operations of the information protection system 100 in this embodiment will be described. Fig. 3 is a diagram illustrating the flow of operations of the information protection system 100 in this embodiment. Fig. 3 explains the flow of operations between the server 300 and the user terminal 400 in the information protection system 100 in this embodiment, and the processing executed by the server 300 and the user terminal 400.

[0038] In this embodiment, first, a first data file is input to the user terminal 400 (S101). In this flow, the first data file is an Excel file containing private information of individuals belonging to a company. Then, the first data file is transmitted from the user terminal 400 to the server 300 by an information system in the company.

[0039] Then, the server 300 acquires the first data file transmitted from the user terminal 400 (S102), and generates a second data file based on the first data file (S103).

[0040] Here, Figure 4 is a diagram for explaining a second data file generated based on a first data file. Figure 4(a) shows an example of the first data file in this flow, and Figure 4(b) shows an example of the second data file in this flow.

[0041] The file interface SC1 shown in Figure 4(a) displays a table SC11 in which private information of individuals belonging to a company is entered. Table SC11 includes personal information such as name, date of birth, address, and telephone number, and emergency contact information such as the name, address, and telephone number of a spouse.

[0042] As such, since the first data file contains private information that can identify an individual, if the first data file were to be leaked from a company's information system to the outside, the individual's privacy could be threatened.

[0043] Therefore, the server 300 deletes the confidential information to be protected from the first data file and generates it as a second data file.

[0044] The file interface SC1 illustrated in Figure 4(b) displays a table SC11 in which the private information of individuals belonging to a company has been entered, similar to that in Figure 4(a). In the second data file illustrated in Figure 4(b), part of the name and telephone number in the personal information and part of the name and telephone number in the emergency contact information in the first data file illustrated in Figure 4(a) have been deleted, as these pieces of information are deemed to be confidential information that must be protected as described above.

[0045] According to this, even if the second data file from which the confidential information to be protected has been deleted is leaked, the confidential information to be protected can be protected.

[0046] 3, the server 300 generates a third data file based on the first data file (S104). Here, the third data file is a data file for identifying the confidential information to be protected that has been deleted from the first data file.

[0047] 5 is a diagram for explaining the third data file generated based on the first data file. Note that the third data file in this flow is a text file containing a predetermined character string.

[0048] The interface SC2 of the third data file shown in Fig. 5 displays a character string SC21 that has been deleted from the second data file (deleted from the first data file) as the confidential information to be protected. In detail, the third data file shown in Fig. 5 displays, as text information, part of the name and phone number of the personal information and part of the name and phone number of the emergency contact in the table SC11 shown in Fig. 4(a).

[0049] In this way, the character string deleted from the second data file (deleted from the first data file) as confidential information to be protected can be identified by the third data file. Even if such a third data file is leaked, the information contained in the third data file alone cannot be used to identify an individual as private information, thereby preventing threats to individual privacy.

[0050] 3, the server 300 generates an identification key based on the first data file (S105). Here, the identification key is obtained by converting the name of the personal information deleted from the first data file as confidential information to be protected into a hexadecimal number based on a predetermined conversion pattern.

[0051] Here, FIG. 6 is a diagram for explaining the conversion pattern for generating the identification key in this flow.

[0052] In the conversion pattern of this flow, as shown in Fig. 6, first, a process is executed to replace the character string of the name (Tokyo Taro) of the personal information that was deleted from the first data file as the confidential information to be protected (S1). In the example shown in Fig. 6, the first and second characters are replaced.

[0053] Next, the character string (Kyoto Taro) replaced by the process in S1 is converted into a hexadecimal number (S2). Furthermore, the hexadecimal number (4EAC 6771 592A 90CE) generated by the process in S2 is converted into a binary number and divided into groups of 4 bits (S3).

[0054] Next, the binary number generated by the process in S3 is subjected to a process of swapping every four bits (S4). In the example shown in Figure 6, the first and second bits of every four bits are swapped.

[0055] Furthermore, the binary number whose bits have been swapped by the process of S4 is subjected to a process of inverting one bit for every four bits divided (S5). In the example shown in Fig. 6, the first, second, third, and fourth bits of every four bits divided are inverted in order, and once the fourth bit is inverted, the process of inverting bits again is repeated from the first bit.

[0056] Then, the binary number whose bits have been inverted by the process of S5 is converted into a hexadecimal number (S6), and the server 300 generates the hexadecimal number obtained by the process of S6 as an identification key.

[0057] According to this conversion pattern, even if an identification key based on the name in the personal information is used as the file name of the second data file, as described below, the leakage of the name in the personal information from the identification key is minimized.

[0058] The above-mentioned conversion patterns include a plurality of patterns for permuting the character string of the name, permuting bits, and inverting bits.

[0059] Fig. 7 is a diagram illustrating a plurality of conversion patterns for converting a character string of a name into a hexadecimal number in this embodiment. Note that Fig. 7 illustrates a plurality of conversion patterns for the conversion process corresponding to each of the processes S1 to S6 shown in Fig. 6 above.

[0060] As shown in Fig. 7, pattern 1 is the conversion pattern described in the explanation of Fig. 6 above, where the first and second characters are swapped in the process of S1, the first and second bits are swapped for every four bits in the process of S4, and the first, second, third, and fourth bits are inverted in order for every four bits in the process of S5.

[0061] In pattern 2, the first and third characters are swapped in a process corresponding to the process in S1 above. Then, the first and third bits are swapped for every four bits in a process corresponding to the process in S4 above, and the second, third, fourth, and first bits are inverted in order for every four bits in a process corresponding to the process in S5 above.

[0062] Similarly, in pattern 3, in a process corresponding to the process in S1 above, the second and third characters are swapped. Then, in a process corresponding to the process in S4 above, the first and fourth bits of every four bits are swapped, and in a process corresponding to the process in S5 above, the third, fourth, first, and second bits of every four bits are inverted in order.

[0063] In pattern 4, in a process corresponding to the process in S1 above, the first and third characters are swapped, and then the first and second characters are swapped again. Then, in a process corresponding to the process in S4 above, the second and third bits are swapped for every four bits, and in a process corresponding to the process in S5 above, the fourth, first, second, and third bits are inverted in order for every four bits.

[0064] Server 300 may determine a conversion pattern from the above multiple patterns (Pattern 1 to Pattern 4) based on predetermined time information. In this case, the time information uses the machine seconds of server 300 at any timing, and for example, when the machine seconds are 0 to 15 seconds, Pattern 1 may be determined, when the machine seconds are 16 to 30 seconds, Pattern 2 when the machine seconds are 31 to 45 seconds, and Pattern 3 when the machine seconds are 46 to 59 seconds.

[0065] Then, returning to Figure 3, the server 300 associates the identification key generated in the process of S105 with the second data file generated in the process of S103, and executes a process to store the second data file in the second database (S106).

[0066] More specifically, in the process of S106, the server 300 stores the second data file in the second database, using the identification key as the file name of the second data file.

[0067] In addition, the server 300 associates the confidential information to be protected that was deleted from the second data file generated in the processing of S103 with the third data file generated in the processing of S104, and executes a process to store the third data file in the third database (S107).

[0068] More specifically, in the process of S107, the server 300 stores the name of the personal information deleted from the second data file as the file name of the third data file in the third database.

[0069] Then, the server 300 executes a process of deleting the first data file stored in the first database by the process of S102 from the first database (S108).

[0070] FIG. 8 is a diagram for explaining data files stored in the database in each process shown in FIG.

[0071] In the process of S102 shown in FIG. 3, the first data file is stored in the first database as shown in FIG. 8(a).

[0072] Then, based on the first data file stored in the first database, in the processes of S106 and S107 shown in Fig. 3, the second data file is stored in the second database and the third data file is stored in the third database, as shown in Fig. 8(b). As described above, the file name of the second data file stored in the second database is the hexadecimal identification key generated in the process of S105, and the file name of the third data file stored in the third database is the name of the personal information deleted from the second data file.

[0073] Then, in the process of S108 shown in FIG. 3, the first data file stored in the first database is deleted as shown in FIG. 8(c).

[0074] In this way, the first data file, which is the original data file containing the confidential information to be protected, is not stored in the storage unit 302 of the server 300, but the second data file from which the confidential information has been deleted and the third data file configured to identify the confidential information are stored in different databases. As a result, even if a data file is leaked from the server 300, private information that could identify an individual will not be leaked from the second data file, and private information that could identify an individual will not be leaked from the third data file. Furthermore, unless the conversion pattern of the above-mentioned identification key is known, the relationship between these data files cannot be found, so the confidential information to be protected will be appropriately protected even if these data files are leaked.

[0075] According to the information protection system 100 described above, even if a data file containing confidential information to be protected is leaked, the confidential information can be suitably protected.

[0076] Second Embodiment The second embodiment will be described with reference to FIG.

[0077] Fig. 9 is a diagram illustrating an example of the flow of operations of the information protection system 100 in this embodiment. Fig. 9 explains the flow of operations between the server 300 and the user terminal 400 in the information protection system 100 in this embodiment, and the processes executed by the server 300 and the user terminal 400. Note that, in each process shown in Fig. 9, processes that are substantially the same as the processes shown in Fig. 3 above are assigned the same reference numerals, and detailed descriptions thereof will be omitted.

[0078] The flow shown in FIG. 9 shows an example in which data is viewed and edited from the user terminal 400 for the data file described in the first embodiment above.

[0079] In the flow shown in FIG. 9, after the processing of S 108 , in S 201 , a request to view and edit data is input to the user terminal 400 and transmitted to the server 300 .

[0080] Then, the server 300 executes a process to search for data corresponding to the request input by the process of S201 (S202). At this time, the server 300 first identifies a second data file corresponding to the originally requested first data file. However, since confidential information to be protected has been deleted from this second data file, the server 300 searches for a third data file corresponding to this second data file based on the identification key associated as the file name of the second data file. In this search process, the hexadecimal identification key associated as the file name of the second data file is reversely converted into a name from the personal information by performing each process in the conversion pattern shown in FIG. 6 in reverse. Then, a search is performed for a third data file having the name from the personal information reversely converted from this identification key as its file name.

[0081] Next, the server 300 restores the information of the first data file by restoring the information that was deleted from the second data file as confidential information to be protected based on the third data file found in the process of S202 (S203), and generates it as a temporary file (S204). By generating the temporary file in this manner, the server 300 can display it so that it can be viewed on the user terminal 400. The generated temporary file is then transmitted from the server 300 to the user terminal 400.

[0082] Then, the user terminal 400 acquires the temporary file transmitted from the server 300 and accepts viewing and editing of the data contained in the temporary file (S205). The temporary file transmitted from the server 300 is stored in the memory of the user terminal 400 as an editing record, and is deleted from the memory when the user has finished viewing and editing.

[0083] As described above, according to this embodiment, all information contained in the original first data file can be read and displayed normally without decrypting the data file, and all information can be quickly provided to the user. Furthermore, if the user edits the temporary file, the edited file is treated as a new first data file, and the server 300 executes the processes described in Fig. 3 above, thereby protecting the information contained in the new first data file.

[0084] <Other variations> The above-described embodiment is merely an example, and the present disclosure may be modified as appropriate within the scope of the present disclosure. For example, the processes and means described in the present disclosure may be freely combined and implemented as long as no technical contradiction occurs.

[0085] Furthermore, a process described as being performed by one device may be shared and executed by multiple devices. In this case, these arithmetic processing devices are configured to be able to cooperate with each other. Furthermore, a process described as being performed by different devices may be executed by a single device. In a computer system, the hardware configuration (server configuration) by which each function is realized can be flexibly changed.

[0086] The present disclosure can also be realized by providing a computer program implementing the functions described in the above embodiments to a computer, and having one or more processors in the computer read and execute the program. Such a computer program may be provided to the computer via a non-transitory computer-readable storage medium connectable to the computer's system bus or via a network. Non-transitory computer-readable storage media include, for example, any type of disk, such as a magnetic disk (e.g., a floppy disk, a hard disk drive (HDD), etc.), an optical disk (e.g., a CD-ROM, a DVD disk, a Blu-ray disk), a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic card, a flash memory, an optical card, or any type of medium suitable for storing electronic instructions. [Explanation of symbols]

[0087] 100···Information Protection System 200···Network 300 Server 301···Communications Department 302...Storage section 303 Control section 400 User terminal

Claims

1. An information protection system that divides a first data file containing predetermined information, stores the divided data in a database, and protects the information, an acquisition means for acquiring the first data file and storing the first data file in a predetermined first database; a first generating means for generating a second data file based on the acquired first data file, the second data file being obtained by deleting the information from the first data file, and storing the second data file in a predetermined second database; a second generating means for generating a third data file for identifying the information deleted from the first data file by the first generating means, and storing the third data file in a predetermined third database; a third generating means for generating a predetermined identification key based on the information; an erasing means for erasing the first data file stored in the first database from the first database, the first generating means associates the identification key generated by the third generating means with the second data file and stores the second data file in the second database; the second generation means associates the information with the third data file and stores the third data file in the third database; a search means for searching the third data file corresponding to the second data file based on the identification key; and a display means for identifying the information deleted from the first data file for the second data file based on the searched third data file, for storing a temporary file in which the identified information for the second data file has been restored in a memory of a predetermined terminal, thereby displaying the temporary file so that it can be viewed on the terminal, and for erasing the temporary file from the memory when viewing is completed. Information protection system.

2. the first generating means stores the second data file in the second database using the identification key as a file name of the second data file; the second generation means stores the third data file in the third database with the name included in the information as the file name of the third data file; The information protection system of claim 1 .

3. the third generation means converts the name included in the information into a hexadecimal number based on a predetermined conversion pattern, and generates the result as the identification key; The information protection system of claim 2 .

4. The conversion pattern is composed of a plurality of patterns including permutation of character strings of a name included in the information, permutation of bits in data obtained by converting the permuted character string into binary numbers, and conversion of the data having the permuted bits into hexadecimal numbers. The information protection system of claim 3 .

5. the third generation means determines the conversion pattern from the plurality of patterns based on predetermined time information, and generates the identification key. The information protection system of claim 4.

Images