Cloud server, information processing system, management method, and program

Abstract

An apparatus-connecting cloud server (20) that manages an IoT apparatus for collecting and storing privacy data related to user privacy comprises, in a control unit (23), a consent content acquisition means (231) and a setting means (232). The consent content acquisition means (231) acquires consent content pertaining to the use of privacy data from a terminal operated by the user. The setting means (232) sets, to the IoT apparatus, a security level that corresponds to the consent content acquired by the consent content acquisition means (231).

Description

Cloud server, information processing system, management method, and program

[0001] The present disclosure relates to a cloud server, an information processing system, a management method, and a program.

[0002] In recent years, various technologies have been proposed for remotely controlling IoT (Internet of Things) devices installed in homes from outside via the Internet. These IoT devices often store private data related to users' privacy. Therefore, there is a risk that the private data may be leaked from the IoT devices or tampered with.

[0003] Therefore, a technology that allows a user to select a privacy protection method has also been disclosed. For example, in the technology disclosed in Patent Literature 1, by selecting or rejecting a privacy option, the user can prevent data associated with a personal workspace from being collected, collect the data but prevent it from being linked to the personal workspace, or limit the purpose of use of the data. In other words, Patent Literature 1 discloses a technology that allows a user to change the data collection method or usage method.

[0004] Japanese Patent Application Laid-Open No. 2018-056128

[0005] The technology disclosed in the above-mentioned Patent Document 1 allows users to change the data collection method or usage method, but does not fully consider the security of the device that collects the data. Therefore, even if the technology disclosed in Patent Document 1 is applied, there remains a risk that private data will be leaked from the IoT device or that private data stored in the IoT device will be tampered with.

[0006] The present disclosure has been made to solve the above-mentioned problems, and aims to provide a cloud server, an information processing system, a management method, and a program that can appropriately protect privacy data stored in IoT devices.

[0007] In order to achieve the above object, the cloud server according to the present disclosure is a cloud server that manages IoT devices that collect and store privacy data related to users' privacy, and includes: a consent content acquisition means that acquires consent content regarding the use of the privacy data from a terminal operated by the user; and a setting means that sets a security level in the IoT device according to the consent content acquired by the consent content acquisition means.

[0008] In the cloud server according to the present disclosure, a consent acquisition means acquires consent regarding the use of privacy data from a terminal operated by a user. Then, a setting means sets a security level for the IoT device according to the consent acquired by the consent acquisition means. Therefore, services using privacy data are provided only after ensuring the security of the IoT device. As a result, privacy data stored in the IoT device can be appropriately protected.

[0009] FIG. 1 is a diagram showing an example of the overall configuration of an information processing system according to a first embodiment of the present disclosure. FIG. 1 is a diagram showing an example of the configuration of an IoT device. FIG. 1 is a diagram showing an example of the configuration of a device connection cloud server. FIG. 1 is a diagram showing an example of a service management table. FIG. 1 is a diagram showing an example of a level management table. FIG. 1 is a diagram showing an example of a consent screen displayed on a terminal. Sequence diagram for explaining the process flow for setting a security level. Sequence diagram for explaining the process flow for checking a security level. Sequence diagram for explaining the process flow for displaying items that can be set on the consent screen. FIG. 1 is a diagram showing an example of another consent screen displayed on a terminal. Sequence diagram for explaining the process flow for deleting privacy data. FIG. 1 is a diagram showing an example of privacy data.

[0010] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Hereinafter, a case where the IoT device is an air conditioning device will be described as an example. However, as will be described later, the present disclosure can also be applied to the management of other types of devices, such as lighting devices. In other words, the embodiments described below are for illustrative purposes only and do not limit the scope of the present disclosure. Therefore, those skilled in the art can adopt embodiments in which each or all of these elements are replaced with equivalents, and these embodiments are also within the scope of the present disclosure. Furthermore, in each figure described in the following embodiments, common elements will be designated by the same reference numerals.

[0011] 1 is a diagram illustrating an example of the overall configuration of an information processing system 1 according to a first embodiment of the present disclosure. As illustrated in Fig. 1, the information processing system 1 includes an IoT device 10, a device connection cloud server 20, a service operation cloud server 30, and a terminal 40, which are communicably connected via the Internet N.

[0012] The IoT device 10 is, for example, an air conditioning device installed in a user's home, and is capable of collecting and storing privacy data relating to the user's privacy using a sensor camera, which will be described later.

[0013] The device connection cloud server 20 is, for example, a server computer, and cooperates with the service operation cloud server 30 to manage the IoT device 10 .

[0014] The service operation cloud server 30 is, for example, a server computer that authenticates the terminal 40 and accepts access from the authenticated terminal 40. Note that, although the information processing system 1 will be described as including the device connection cloud server 20 and the service operation cloud server 30, the functions of the device connection cloud server 20 and the service operation cloud server 30 may be integrated into a single cloud server.

[0015] The terminal 40 is, for example, a smartphone, tablet, or the like operated by the user, and displays a consent screen (described later) and transmits the consent details according to the user's operation to the device connection cloud server 20 via the service operation cloud server 30.

[0016] The configurations of the IoT device 10 and the device connection cloud server 20, which are the most distinctive features of the information processing system 1, will be described in more detail below.

[0017] 2 is a schematic diagram showing an example of the configuration of an IoT device 10. The IoT device 10 includes a sensor camera 11, a privacy data storage unit 12, a software service 13, a network service 14, a device authentication unit 15, and a network I / F (interface) 16.

[0018] The sensor camera 11 is a temperature sensor, a humidity sensor, a thermal imaging camera, or the like, and acquires privacy data related to the privacy of a user who uses the IoT device 10. Note that the sensor camera 11 is not limited to being located inside the IoT device 10, but may be located outside the IoT device 10. In this case, the sensor camera 11 is connected to the IoT device 10 via a wired or wireless connection. For example, the sensor camera 11 may be a wearable sensor worn by the user. In this case, the sensor camera 11 acquires privacy data such as the user's heart rate and body temperature.

[0019] The privacy data storage unit 12 accumulates and stores the privacy data acquired by the sensor camera 11. As will be described later, the accumulation of privacy data in the privacy data storage unit 12 starts after a request for setting a security level is made by the device connection cloud server 20 in response to an operation on a consent screen on the terminal 40. Alternatively, the IoT device 10 may be configured to collect and store privacy data by itself, without going through an operation on the consent screen.

[0020] The software service 13 provides local functions that are standard functions of the IoT device 10. For example, the software service 13 causes the IoT device 10 to perform standard air conditioning control that does not require communication with the device connection cloud server 20.

[0021] The network service 14 provides a network function that is an additional function of the IoT device 10. For example, the network service 14 causes the IoT device 10 to perform air conditioning control in accordance with a command from the device connection cloud server 20.

[0022] The device authentication unit 15 performs device authentication when providing the network service 14 or when displaying a consent screen (described later). For example, the device authentication unit 15 stores account information such as a user name and a password, and performs device authentication together with the user who uses the terminal 40 via the service operation cloud server 30.

[0023] The network I / F 16 is a communication unit for communicating with the device connection cloud server 20 via the Internet N, for example.

[0024] The IoT device 10 configured as described above is connected to the Internet N, and therefore may be subject to cyber attacks such as leakage of communication data, unauthorized operation, etc. For this reason, the IoT device 10 is provided with security functions such as encryption of communication data, encryption of storage, and automatic updating of F / W (firmware).

[0025] These security features are set to best practices by default. However, because encryption slows communication speeds and automatic firmware updates cause waiting times, these security features are designed to be manually switched on and off by the user. In other words, the user can turn off a security feature if they accept the risk or if they want to provide an alternative security feature. Examples of alternative security features include when the IoT device 10 is used only within a local network or when a separate router with access control functionality is provided.

[0026] The user may configure the security functions by operating a switch installed on the IoT device 10 or by operating an operation screen on the terminal 40.

[0027] Next, the configuration of the device connection cloud server 20 will be described with reference to Fig. 3. Fig. 3 is a schematic diagram showing an example of the configuration of the device connection cloud server 20. The device connection cloud server 20 includes a storage unit 21, a network I / F 22, and a control unit 23.

[0028] The storage unit 21 is, for example, a solid state drive (SSD), a hard disk, etc., and stores various information. For example, the storage unit 21 stores a service management table 211 and a level management table 212.

[0029] 4, the service management table 211 stores items 211a requiring user consent and required security levels 211b in association with each other. Note that the larger the value of the security level 211b, the higher the security level.

[0030] On the other hand, the level management table 212 stores, for example, a security level 212a and a required setting 212b in association with each other, as shown in FIG.

[0031] In addition, the storage unit 21 is capable of storing privacy data collected from the IoT device 10.

[0032] 3 , the network I / F 22 is, for example, a communication unit for communicating with the IoT device 10 via the Internet N. Note that the network I / F 22 also communicates with the service operation cloud server 30 via the Internet N.

[0033] The control unit 23 is an arithmetic unit including, for example, a CPU (Central Processing Unit), RAM (Random Access Memory), ROM (Read Only Memory), etc., and controls the entire device connection cloud server 20. For example, the CPU uses the RAM as a work memory and appropriately executes a control program stored in the ROM, thereby realizing consent content acquisition means 231, setting means 232, confirmation means 233, service processing means 234, revocation instruction acquisition means 235, and deletion means 236.

[0034] The consent content acquisition means 231 acquires the consent content sent from the terminal 40 via the service operation cloud server 30. For example, a consent screen CG1 for privacy data as shown in FIG. 6 is displayed on the terminal 40, allowing the user to arbitrarily enter a check mark for each item that requires consent. When the consent button BT1 is pressed on the consent screen CG1, the consent content is sent to the device connection cloud server 20 via the service operation cloud server 30. Therefore, the consent content acquisition means 231 acquires this consent content. When the consent withdrawal button BT2 on the consent screen CG1 is pressed, a withdrawal instruction is sent to the device connection cloud server 20 via the service operation cloud server 30, as described below.

[0035] Returning to Fig. 3 , the setting unit 232 sets a security level in the IoT device 10 according to the consent details acquired by the consent details acquisition unit 231. Specifically, the setting unit 232 refers to the service management table 211 shown in Fig. 4 described above and identifies the security levels required for each consent item included in the consent details. Then, the setting unit 232 sets the highest security level of the identified security levels in the IoT device 10. More specifically, the setting unit 232 sets a security option corresponding to the security level in the IoT device 10.

[0036] The confirmation means 233 confirms the security level set in the IoT device 10. More specifically, the confirmation means 233 reads out the security options set in the IoT device 10. Then, the confirmation means 233 compares the security level required for the consent content with the security level set in the IoT device 10.

[0037] The service processing means 234 provides a service according to the security level using the IoT device 10 whose security level has been set by the setting means 232. For example, the service processing means 234 provides an automatic control service using privacy data using the IoT device 10 whose security level has been set to "3." Specifically, the service processing means 234 collects privacy data such as heart rate, body temperature, and temperature from the IoT device 10, and performs air conditioning control appropriate for the user.

[0038] The withdrawal instruction acquisition means 235 acquires the withdrawal instruction sent from the terminal 40 via the service operation cloud server 30. For example, when the consent withdrawal button BT2 is pressed on the consent screen CG1 as shown in Fig. 6 described above, a withdrawal instruction is sent to the device connection cloud server 20 via the service operation cloud server 30. Therefore, the withdrawal instruction acquisition means 235 acquires this withdrawal instruction.

[0039] When the cancellation instruction acquisition means 235 acquires the cancellation instruction, the deletion means 236 instructs the IoT device 10 to delete the accumulated privacy data. In addition, when the privacy data is stored in the storage unit 21, the deletion means 236 also deletes the privacy data from the storage unit 21.

[0040] The operation of the information processing system 1 having such a configuration will be described in detail below with reference to the drawings.

[0041] First, the process of setting a security level will be described with reference to Fig. 7. Fig. 7 is a sequence diagram illustrating the flow of the process of setting a security level. Note that although Fig. 7 omits communications related to user authentication, device authentication, etc., in reality, the process of setting a security level is executed after user authentication, device authentication, etc. are performed, as will be described below.

[0042] First, the terminal 40 transmits the consent details to the service operation cloud server 30 (SQ1). For example, when the user arbitrarily checks each item requiring consent on the consent screen CG1 as shown in FIG. 6 and then presses the consent button BT1, the terminal 40 transmits the consent details, including whether each item is checked or not, to the service operation cloud server 30.

[0043] The service operation cloud server 30 transmits the consent sent from the terminal 40 to the device connection cloud server 20 (SQ2). That is, upon receiving the consent, the service operation cloud server 30 transfers the consent to the device connection cloud server 20.

[0044] The device connection cloud server 20 determines a security level according to the consent content (SQ3). That is, when the consent content acquisition means 231 acquires the consent content sent from the terminal 40, the setting means 232 determines a security level according to the consent content. Note that SQ3 is an example of an consent content acquisition step.

[0045] The device connection cloud server 20 transmits a security level setting request to the IoT device 10 (SQ4). That is, the setting unit 232 sets the security level specified in SQ3 above in the IoT device 10. More specifically, the setting unit 232 sets a security option corresponding to the security level in the IoT device 10. Note that SQ4 is an example of a setting step.

[0046] In response to the setting request, the IoT device 10 sets the security level (SQ5). More specifically, the IoT device 10 sets the security option corresponding to the security level.

[0047] The IoT device 10 returns the setting result to the device connection cloud server 20 (SQ6). That is, when the IoT device 10 successfully completes the security level setting, it returns a reply to the device connection cloud server 20 indicating that the setting result is "OK."

[0048] The device connection cloud server 20 starts providing the service (SQ7). That is, the service processing means 234 uses the IoT device 10 for which the security level has been set to provide a service according to the security level. For example, the service processing means 234 uses the IoT device 10 for which the security level has been set to "3" to provide an automatic control service using privacy data. Specifically, the service processing means 234 collects privacy data such as heart rate, body temperature, and temperature from the IoT device 10 and performs air conditioning control appropriate for the user.

[0049] 7, a service using private data is provided after ensuring the security of the IoT device 10. As a result, the private data stored in the IoT device 10 can be appropriately protected.

[0050] If the user does not consent on the consent screen CG1 described above, the IoT device 10 will not be set to a security level, and services using privacy data will not be provided. However, there are the following advantages.

[0051] The unsecured storage area can also be used, allowing for efficient resource utilization. When access rights control is not required, sensor information including privacy data can be viewed locally.

[0052] Next, the process of checking the security level will be described with reference to Fig. 8. Fig. 8 is a sequence diagram illustrating the flow of the process of checking the security level. Note that, even in Fig. 8, communications regarding user authentication, device authentication, etc. are omitted, but in reality, the process of checking the security level is executed after user authentication, device authentication, etc. are performed, as described below. Furthermore, the same process content as that already explained will be explained in a simplified manner.

[0053] First, the terminal 40 transmits the consent details to the service operation cloud server 30 (SQ11). The service operation cloud server 30 then transmits the consent details sent from the terminal 40 to the device connection cloud server 20 (SQ12).

[0054] The device connection cloud server 20 requests the security level from the IoT device 10 (SQ13). That is, the confirmation means 233 confirms the security level set in the IoT device 10. More specifically, the confirmation means 233 reads out the security options set in the IoT device 10.

[0055] In response to the request, the IoT device 10 returns the set security level (SQ14). More specifically, the IoT device 10 returns the security option corresponding to the security level to the device connection cloud server 20.

[0056] The device connection cloud server 20 checks the security level required for the agreed-upon content (SQ15). That is, the checking means 233 checks whether the security level set in the IoT device 10 meets the security level required for the agreed-upon content. More specifically, the checking means 233 compares the security option corresponding to the security level required for the agreed-upon content with the security option set in the IoT device 10.

[0057] If the security level set in the IoT device 10 does not meet the security level required for the agreement, i.e., does not satisfy the required standard, the device connection cloud server 20 notifies the service operation cloud server 30 of the insufficient security level (SQ16). Note that if the security level set in the IoT device 10 meets the security level required for the agreement, the device connection cloud server 20 starts providing the service, similar to SQ7 in FIG. 7 described above.

[0058] The service providing cloud server 30 issues a warning to the user (SQ17). For example, the service providing cloud server 30 displays a warning message on the terminal 40 indicating that the security level is insufficient.

[0059] By performing the process shown in FIG. 8, it is possible to prevent services using private data from being provided without ensuring security.

[0060] In SQ11 and SQ12 of Fig. 8, the consent details may be sent each time a check mark is entered in one of the items requiring consent on the consent screen CG1 as shown in Fig. 6. In this case, items with insufficient security levels may be sent in SQ16 and SQ17, and the items with insufficient security levels may be highlighted in red, for example, on the consent screen CG1.

[0061] Next, the process of displaying configurable items on the consent screen will be described with reference to Fig. 9. Fig. 9 is a sequence diagram illustrating the process flow of displaying configurable items on the consent screen. Note that, even in Fig. 9, communication regarding user authentication, device authentication, etc. is omitted, but in reality, it is assumed that user authentication, device authentication, etc. are performed, and then the process of displaying configurable items on the consent screen is executed as described below. Furthermore, the same process content as that already described will be explained in a simplified manner.

[0062] First, the terminal 40 transmits to the service operation cloud server 30 a message indicating that the consent screen has been selected (SQ21). That is, the terminal 40 transmits to the service operation cloud server 30 a message indicating that an instruction to display the consent screen has been issued.

[0063] The service operation cloud server 30 requests the device connection cloud server 20 for selectable items (SQ22).

[0064] The device connection cloud server 20 requests the security level from the IoT device 10 (SQ23). In response to the request, the IoT device 10 returns the set security level (SQ24).

[0065] The device connection cloud server 20 identifies configurable items from the set security level (SQ25). That is, the confirmation means 233 identifies configurable items by referring to the service management table 211 of FIG. 4 described above based on the security level set in the IoT device 10. For example, if the security level set in the IoT device 10 is "2," the device connection cloud server 20 identifies "upload private data" and "remote viewing of private data" as configurable items.

[0066] The device connection cloud server 20 transmits the identified configurable items to the service operation cloud server 30 (SQ26).

[0067] The service operation cloud server 30 displays a consent screen corresponding to the configurable items on the terminal 40 (SQ27). For example, if the configurable items are "upload of private data" and "remote viewing of private data," the terminal 40 displays "collection of data" and "remote viewing of data" as selectable items, and grays out "automatic control" so that it cannot be selected, as shown in the consent screen CG2 in FIG. 10.

[0068] By performing the process shown in FIG. 9 , it is possible to appropriately display configurable items on the consent screen according to the security level set in the IoT device 10 .

[0069] In the above-described first embodiment, the case where the security level is managed by a numerical value has been described. However, the security level may be managed by the F / W (firmware) version of the IoT device 10.

[0070] In this case, the device connection cloud server 20 stores a management table as shown in Fig. 11 in the storage unit 21 instead of the service management table 211 of Fig. 4. In the management table shown in Fig. 11, items requiring user consent are associated with firmware versions.

[0071] Then, in the process shown in FIG. 7 described above, the device connection cloud server 20 determines a firmware version according to the consent content instead of determining a security level in SQ3. Then, when making a setting request in SQ4, the device connection cloud server 20 requests the IoT device 10 to set the determined firmware version. In response to this request, the IoT device 10 updates the firmware version as appropriate instead of setting a security level in SQ5. In other words, if the firmware version requested to be set is newer than the current firmware version, the IoT device 10 updates to the requested firmware version. Note that if the firmware version requested to be set is older than the current firmware version, the IoT device 10 does nothing in particular.

[0072] 8 and 9, the device connection cloud server 20 requests the firmware version instead of requesting the security level from the IoT device 10 in SQ13 and SQ23. In response to this request, the IoT device 10 replies with the current firmware version instead of returning the set security level in SQ14 and SQ24. Then, the device connection cloud server 20 checks the firmware version required for consent instead of checking the security level in SQ15. Furthermore, the device connection cloud server 20 identifies the configurable items from the current firmware version instead of identifying the configurable items from the security level in SQ25.

[0073] In this way, even when using a new firmware version of the IoT device 10, it is possible to provide services that utilize privacy data after ensuring security. Furthermore, an older version of the firmware of the IoT device 10 can be used as needed. For example, this can accommodate users who are reluctant to update the firmware due to limitations in the specifications of the IoT device 10 or because the user is accustomed to an older version of the UI (user interface).

[0074] Next, the process of deleting privacy data will be described with reference to Fig. 12. Fig. 12 is a sequence diagram illustrating the flow of the process of deleting privacy data. Note that, although communication regarding user authentication, device authentication, etc. is omitted in Fig. 12, in reality, it is assumed that user authentication, device authentication, etc. are performed, and then a process of confirming the security level is executed as described below. It is also assumed that a service using the privacy data has already been provided, and that the device connection cloud server 20 and the IoT device 10 have stored the privacy data shown in Fig. 13.

[0075] First, the terminal 40 transmits a consent withdrawal request to the service operation cloud server 30 (SQ31). For example, when the consent withdrawal button BT2 is pressed on the consent screen CG1 as shown in FIG. 6, the terminal 40 transmits a consent withdrawal request to the service operation cloud server 30.

[0076] The service operation cloud server 30 transmits the consent revocation sent from the terminal 40 to the device connection cloud server 20 (SQ32).

[0077] The device connection cloud server 20 identifies the privacy data according to the content of the revoked consent (SQ33). For example, the deletion unit 236 identifies the privacy data stored in the device connection cloud server 20 and the IoT device 10 according to the content of the revoked consent, with reference to FIG. 13 .

[0078] The device connection cloud server 20 transmits a request to delete the identified privacy data to the IoT device 10 (SQ34). For example, the deletion unit 236 instructs the IoT device 10 to delete the privacy data stored in the IoT device 10 identified in SQ33.

[0079] In response to the deletion request, the IoT device 10 deletes the privacy data (SQ35). More specifically, the IoT device 10 deletes the privacy data from the privacy data storage unit 12.

[0080] The IoT device 10 returns the deletion result to the device connection cloud server 20 (SQ36). That is, when the IoT device 10 successfully completes the deletion of the private data, it returns a reply to the device connection cloud server 20 indicating that the deletion result is "OK."

[0081] The device connection cloud server 20 deletes the private data in the storage unit 21 (SQ37). For example, the deletion means 236 deletes the private data stored in the device connection cloud server 20 identified in SQ33 described above.

[0082] The device connection cloud server 20 sends a deletion notification to the service operation cloud server 30 (SQ38), and the service operation cloud server 30 sends a deletion notification to the terminal 40 (SQ39).

[0083] 12 , it is possible to properly delete not only the private data stored in the device connection cloud server 20 but also the private data stored in the IoT device 10. Since a deletion notification is sent to the terminal 40, the user can confirm that the stored private data has been deleted from both the device connection cloud server 20 and the IoT device 10 upon the withdrawal of consent. In particular, when the IoT device 10 is sold, or when the IoT device 10 is temporarily used in a hotel, rental facility, or the like, it becomes possible to delete the private data in the IoT device 10 from the terminal 40 even if the user is not the owner of the IoT device 10.

[0084] (Other Embodiments) In the above-described first embodiment, the case where the IoT device 10 is an air conditioning device has been described, but the present disclosure can also be applied to other devices as the IoT device 10. For example, the present disclosure can also be appropriately applied to a case where the IoT device 10 is a lighting device.

[0085] In the above-described first embodiment, the CPU of the device connection cloud server 20 uses RAM as a work memory and appropriately executes control programs stored in ROM to realize the consent content acquisition means 231, setting means 232, confirmation means 233, service processing means 234, revocation instruction acquisition means 235, and deletion means 236. However, all or part of the control unit 23 may be realized by dedicated hardware. Examples of dedicated hardware include a single circuit, a composite circuit, a programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a combination thereof.

[0086] In addition, the above control program can also be stored and distributed on a computer-readable recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD (Digital Versatile Disc), a Magneto-Optical Disc, a USB (Universal Serial Bus) memory, a memory card, or an HDD (Hard Disk Drive).

[0087] In a configuration in which such a control program is executed by a device separate from the device connection cloud server 20, the program distributed as described above can be installed on a specific or general-purpose computer, causing the computer to function as the device connection cloud server 20. Alternatively, the control program may be stored in a disk device owned by another server on the Internet, and the control program may be downloaded from the server to the control device.

[0088] The present disclosure allows various embodiments and modifications without departing from the broad spirit and scope. Furthermore, the above-described embodiments are intended to explain the present disclosure and do not limit the scope of the disclosure. That is, the scope of the present disclosure is defined by the claims, not the embodiments. Various modifications made within the scope of the claims and the scope equivalent thereto are considered to be within the scope of the present disclosure.

[0089] The present disclosure can be suitably adopted in a cloud server, an information processing system, a management method, and a program that can appropriately protect privacy data stored in IoT devices.

[0090] 1 Information processing system, 10 IoT device, 11 Sensor / camera, 12 Privacy data storage unit, 13 Software service, 14 Network service, 15 Device authentication unit, 16 Network I / F, 20 Device connection cloud server, 21 Storage unit, 211 Service management table, 212 Level management table, 22 Network I / F, 23 Control unit, 231 Agreement content acquisition means, 232 Setting means, 233 Confirmation means, 234 Service processing means, 235 Cancellation instruction acquisition means, 236 Deletion means, 30 Service operation cloud server, 40 Terminal

Claims

1. A cloud server that manages an Internet of Things (IoT) device that collects and stores privacy data related to a user's privacy, consent details acquisition means for acquiring consent details regarding the use of the privacy data from a terminal operated by a user; A setting means for setting a security level corresponding to the consent content acquired by the consent content acquisition means in the IoT device; A service processing means for processing a service using the privacy data; A confirmation means for confirming a security level set in the IoT device when the service processing means starts the service, The IoT device has a security level defined according to the firmware version installed therein, The confirmation means confirms the firmware version installed in the IoT device when the service processing means starts the service, The service processing means does not collect the privacy data from the IoT device when the firmware version confirmed by the confirmation means is lower than a required standard. Cloud server.

2. a revocation instruction acquisition means for acquiring a revocation instruction for revoking the consent acquired by the consent acquisition means; and a deletion means for instructing the IoT device to delete the stored privacy data when the cancellation instruction acquisition means acquires the cancellation instruction. The cloud server of claim 1 .

3. A cloud server that manages IoT devices that collect and store privacy data related to a user's privacy, consent details acquisition means for acquiring consent details regarding the use of the privacy data from a terminal operated by a user; A setting means for setting a security level corresponding to the consent content acquired by the consent content acquisition means in the IoT device; a revocation instruction acquisition means for acquiring a revocation instruction for revoking the consent acquired by the consent acquisition means; a deletion means for instructing the IoT device to delete the stored privacy data when the cancellation instruction acquisition means acquires the cancellation instruction; A cloud server comprising:

4. An information processing system in which an IoT device that collects and accumulates privacy data related to a user's privacy, a terminal operated by the user, and a cloud server are communicatively connected, The cloud server includes: consent details acquisition means for acquiring consent details regarding the use of the privacy data from the terminal; A setting means for setting a security level corresponding to the consent content acquired by the consent content acquisition means in the IoT device; a revocation instruction acquisition means for acquiring a revocation instruction for revoking the consent acquired by the consent acquisition means; and a deletion means for instructing the IoT device to delete the stored privacy data when the cancellation instruction acquisition means acquires the cancellation instruction. Information processing system.

5. A management method executed by a cloud server that manages an IoT device that collects and stores privacy data related to a user's privacy, comprising: a consent content acquisition step of acquiring consent content regarding the use of the privacy data from a terminal operated by a user; a setting step of setting a security level corresponding to the consent content acquired in the consent content acquisition step in the IoT device; a revocation instruction acquisition step of acquiring a revocation instruction for revoking the consent acquired in the consent acquisition step; a deletion step of instructing the IoT device to delete the stored privacy data when the cancellation instruction is acquired in the cancellation instruction acquisition step; A management method comprising:

6. A computer that manages an IoT device that collects and stores privacy data related to a user's privacy, a consent content acquisition step of acquiring consent content regarding the use of the privacy data from a terminal operated by the user; A setting step of setting a security level corresponding to the consent content acquired in the consent content acquisition step in the IoT device; a revocation instruction acquisition step of acquiring a revocation instruction for revoking the consent acquired in the consent acquisition step; a deletion step of instructing the IoT device to delete the stored privacy data when the cancellation instruction is acquired in the cancellation instruction acquisition step; A program for executing the above.