Distributed mesh data server and program

Abstract

[Problem] To enable control of user authentication access to mesh data that exists in a dispersed manner on different servers, and to enable recording and updating (metering) of user access frequency information in accordance with the use of mesh data by a user. [Solution] A distributed mesh data server 1 according to the present invention comprises: a mesh data provision unit 118 that provides mesh data corresponding to a mesh code; a user information update unit 119 that updates user information pertaining to a user when the mesh data provision unit 118 has provided mesh data to the user; a shared secret key acquisition unit 114 that acquires a shared secret key used by a plurality of servers; an encryption unit 120 that uses the shared secret key to encrypt the user information; an encrypted information provision unit 121 that provides the encrypted user information to another server; an encrypted information acquisition unit 115 that acquires encrypted user information from another server; and a decryption unit 116 that decrypts the encrypted user information.

Description

Distributed mesh data server and program

[0001] The present invention relates to a distributed mesh data server and a program.

[0002] Mesh data, which is defined as a grid of longitude and latitude on a map, is used to digitize information on a map or to obtain various statistical information about a region. Examples of mesh data that are used include primary mesh divisions with sides of approximately 80 km, which are areas based on 100 degrees east longitude and 0 degrees north latitude and are divided lengthwise and widthwise by meridians at each degree, even-numbered latitudes, and latitudes that divide the intervals between them into thirds; secondary mesh divisions with sides of approximately 10 km, which are areas obtained by dividing the primary mesh division into eight equal parts in the latitude and meridian directions; and tertiary mesh divisions (standard regional meshes) with sides of approximately 1 km, which are areas obtained by dividing the secondary mesh division into ten equal parts in the latitude and meridian directions.

[0003] If the mesh data is further divided into standard area meshes, such as 1 / 10 fine mesh sections with sides of approximately 100 meters, which are areas obtained by dividing a third-order mesh section into ten equal parts in the latitude and longitude directions, the spatial resolution of the mesh data can be further improved. However, the smaller the area into which the mesh data is divided, the greater the number and volume of data in the mesh data. For example, Patent Document 1 discloses a system that calculates mesh statistics from satellite data at different spatial resolutions while integrating mesh data divided into smaller sections. In systems that handle mesh data divided into smaller sections, such as those exemplified in Patent Document 1, the data capacity and processing power required of the mesh data server on which the mesh data is stored becomes even greater. Therefore, there is a need to improve the processing power of the mesh data server.

[0004] With regard to improving the processing capacity of a server storing map-related data, Patent Document 2 discloses a database search program that causes a computer to execute steps such as: in a map database or the like relating to an area on a map divided into meshes of a plurality of unit sizes, the data relating to the map database is stored in a plurality of database server devices; a search request relating to the data is divided into a plurality of split search requests; the generated split search requests are registered in a common queue provided in common to the plurality of database server devices, together with the reception time of the original search requests; determining one or more database server devices to which the split search requests can be added and which satisfy predetermined processability conditions and specific parallel processability conditions; additionally submitting the selected split search request to one of the one or more database server devices determined as being able to be added; and, in synchronization with the completion of processing of any split search request by any database server device, selecting from the common queue the oldest split search request that satisfies the processability conditions and parallel processability conditions and submitting it to that database server device.

[0005] Patent Document 2 enables the construction of a large-scale information database system by using a distributed configuration in which multiple database server devices are used, without being limited in performance by the storage capacity per computer, the limits of CPU performance, or the platform such as the OS, while preventing an increase in the processing time of split search requests and shortening the processing time of search requests.

[0006] Japanese Patent No. 7328650 Japanese Patent Application Laid-Open No. 2004-102631

[0007] When mesh data stored in a mesh data server is provided for a fee, there is a need to identify which user a search request belongs to in order to appropriately calculate the fee for each user. There is also a need to keep the search request itself secret from other users. Due to various needs exemplified by these needs, there is a need to appropriately manage user information related to search requests on multiple mesh data servers. Hereinafter, each mesh data server that performs parallel processing will also be referred to as a distributed mesh data server. Furthermore, multiple distributed mesh data servers that perform parallel processing will also be referred to as a distributed mesh data server group.

[0008] Regarding proper management of user information, when user information is handled in a group of distributed mesh data servers, there is a concern that the user information may be updated asynchronously across multiple distributed mesh data servers, resulting in a loss of consistency of the user information.

[0009] Furthermore, with regard to the appropriate management of user information, encryption of user information is considered as a means for protecting the confidentiality of user information. However, when encryption is used to protect the confidentiality of user information in a distributed mesh data server group, there is a concern that the processing load and processing time will increase due to repeated encryption and decryption processes on each of the multiple distributed mesh data servers.

[0010] Therefore, the techniques of Patent Documents 1 and 2 have room for further improvement in terms of appropriately managing user information on a distributed mesh data server group.

[0011] The present invention has been made in consideration of the above circumstances, and an object of the present invention is to appropriately manage user information on a distributed mesh data server group.

[0012] As a result of intensive research into solving the above-mentioned problems, the inventors have discovered that the above-mentioned object can be achieved by obtaining a common secret key used by multiple servers and exchanging user information encrypted using the common secret key between distributed mesh data servers. As a result, the inventors have completed the present invention. Specifically, the present invention provides the following.

[0013] The present invention provides a distributed mesh data server comprising a mesh data providing unit that provides mesh data corresponding to a mesh code, a user information updating unit that updates user information related to the user when the mesh data providing unit provides mesh data to the user, a common private key obtaining unit that obtains a common private key used by multiple servers, an encryption unit that encrypts the user information using the common private key, an encrypted information providing unit that provides the encrypted user information to other servers, an encrypted information obtaining unit that obtains the encrypted user information from the other servers, and a decryption unit that decrypts the encrypted user information.

[0014] The mesh data is defined as a longitude-latitude grid on a map and is stored in association with a mesh code that identifies the grid. In the present invention, a mesh data providing unit provides mesh data corresponding to the mesh code. In the present invention, a user information updating unit updates user information in response to the provision of the mesh data.

[0015] Then, the present invention provides the updated user information to other distributed mesh data servers by the encrypted information providing unit and the encrypted information acquiring unit, and can acquire the updated user information from other distributed mesh data servers. As a result, the present invention can maintain the consistency of user information even though the user information is updated on the distributed mesh data server group.

[0016] In mesh data, data corresponding to a wide geographical area such as a city, town, village, prefecture, country, or region is divided and stored as a large number of mesh data. Therefore, in a distributed mesh data server group, when a search request corresponding to a wide geographical area is made, the divided and / or replicated search request may be processed in parallel by a large number of servers. Therefore, in a distributed mesh data server group, synchronous parallel processing is required to exchange updated results of user information corresponding to a search request with other distributed mesh data servers.

[0017] On the other hand, data encryption is typically performed using a method that uses a server-specific private key. Therefore, when a search request covering a wide geographical area is made, each distributed mesh data server using this method performs encryption and / or decryption using multiple private keys corresponding to multiple other distributed mesh data servers. Therefore, in a distributed mesh data server group configured in this way, the processing load and processing time required for updating encrypted user information increases.

[0018] In the present invention, the encryption unit and decryption unit encrypt and decrypt user information using a common secret key used by multiple servers. This allows each distributed mesh data server to encrypt and decrypt user information using a single common secret key, without the need for processing that requires the use of multiple secret keys and requires a large processing load and time. Therefore, the present invention can protect the confidentiality of user information without unnecessarily increasing the processing load and processing time.

[0019] The present invention can appropriately manage user information on a group of distributed mesh data servers, thereby providing a system that enables user authentication and access control to mesh data distributed across different servers, as well as recording and updating (metering) information on the number of user accesses according to the user's use of the mesh data.

[0020] FIG. 1 is a diagram showing an overview of a system S according to this embodiment (first embodiment). FIG. 2 is a block diagram showing the hardware and software configurations of the system S according to this embodiment. FIG. 3 is an example of a map divided into grids. FIG. 4 is an example of a mesh data database 131. FIG. 5 is an example of a multimedia database 132. FIG. 6 is a block diagram showing the hardware and software configurations of a user information management server 2 according to this embodiment. FIG. 7 is an example of a server database 221. FIG. 8 is an example of a user information database 222. FIG. 9 is a block diagram showing the hardware and software configurations of a certificate authority server 3 according to this embodiment. FIG. 10 is a flowchart showing an example of a preferred flow of mesh data acquisition processing executed by a terminal T according to this embodiment. FIG. 11 is a diagram continuing from FIG. 10. FIG. 12 is a main flowchart showing an example of a preferred flow of mesh data provision processing executed by a distributed mesh data server 1 according to this embodiment. FIG. 13 is a diagram continuing from FIG. 12. FIG. 14 is a diagram continuing from FIG. 13. FIG. 15 is a diagram continuing from FIG. 14. FIG. 16 is a flowchart showing an example of a preferred flow of mesh code conversion processing. FIG. 17 is a flowchart showing an example of a preferred flow of user information management processing executed by the user information management server 2 of this embodiment. FIG. 18 is a flowchart showing an example of a preferred flow of server authentication processing executed by the certification authority server 3 of this embodiment. FIG. 19 is a block diagram showing the hardware configuration and software configuration of the system S of the second embodiment. FIG. 20 is a flowchart showing an example of a preferred flow of mesh data generation processing. FIG. 21 is a flowchart continuing from the previous figure. FIG. 22 is a flowchart continuing from the previous figure. FIG. 23 is a flowchart continuing from the previous figure. FIG. 24 is a flowchart continuing from the previous figure. FIG. 25 is a flowchart continuing from the previous figure. FIG. 26 is a flowchart continuing from the previous figure.

[0021] First, although the following disclosure, diagrams, and / or claims may be described as being presented alone or in combination with one or more other aspects, the subject matter of the immediate disclosure is not intended to be so limited. That is, the immediate disclosure, diagrams, and claims are intended to encompass the various aspects described herein, each alone or in one or more combinations with each other. For example, even if the immediate disclosure describes and illustrates a first embodiment, a second embodiment, and a third embodiment in such a way that the first embodiment is described and illustrated specifically in conjunction with the second embodiment, or the second embodiment is described and illustrated only in conjunction with the third embodiment, the immediate disclosure and illustrations are not so limited and may include only the first embodiment, only the second embodiment, only the third embodiment, or one or more combinations of the first, second, and / or third embodiments, such as the first and second embodiments, the first and third embodiments, the second and third embodiments, or the first, second, and third embodiments.

[0022] The use of the phrase "or" herein shall mean a "non-exclusive" arrangement unless expressly specified otherwise. For example, when we say "item x is A or B," we mean either: (1) item x is either A or B, but not both; or (2) item x is both A and B. In other words, the word "or" is not used to define an "exclusive" arrangement.

[0023] Additionally, as used herein, the phrases "comprise at least one of" and "comprise at least one of the following," when used in connection with a system or element, mean that the system or element includes one or more of the elements listed after the phrase. For example, if there are three types of elements, a first element, a second element, or a third element, the phrases "comprise at least one of" and "comprise at least one of the following" are to be interpreted as any of the following structural arrangements: a device including the first element, a device including the second element, a device including the third element, a device including the first and second elements, a device including the first and third elements, a device including the second and third elements, or a device including the first, second, and third elements.

[0024] A similar interpretation is intended when the phrase "used in at least one of the following" is used herein. Furthermore, as used herein, "and / or" is used as a verbal conjunction to indicate that one or more of the listed elements or conditions are included or occur. For example, a device including a first element, a second element, and / or a third element is to be interpreted as any of the following structural arrangements: a device including the first element, a device including the second element, a device including the third element, a device including the first element and the second element, a device including the first element and the third element, a device including the second element and the third element, or a device including the first element, the second element, and the third element.

[0025] In addition, the use of the phrase "and / or" in the text means a "non-exclusive" agreement, as stipulated in the Japanese Industrial Standards (JIS) "Format and preparation method of standard sheets JIS Z 8301."

[0026] <<First Embodiment>> Hereinafter, an example of a first embodiment of the present invention (hereinafter also simply referred to as "this embodiment") will be described in detail with reference to the drawings.

[0027] <System S> Fig. 1 is a diagram showing an outline of the system S according to this embodiment (first embodiment). Fig. 2 is a block diagram showing the hardware configuration and software configuration of the system S according to this embodiment. The following describes an example of a preferred configuration of the system S according to this embodiment using Figs. 1 and 2.

[0028] The system S of this embodiment is configured to include one or more terminals T, a plurality of distributed mesh data servers 1, a user information management server 2, and a certification authority server 3, all of which are configured to be able to communicate with each other via a network N.

[0029] An overview of the system S of this embodiment will be described below. In the system S of this embodiment, the distributed mesh data server 1 stores a common secret key, user information, and various mesh data. The distributed mesh data server 1 receives a user authentication request from the terminal T, performs user authentication related to the user authentication request using the user authentication API of the user information management server 2, and starts a session if the user authentication is successful. Using the one-time common secret key API of the certification authority server 3, the distributed mesh data server 1 obtains a common secret key used by multiple distributed mesh data servers 1 (distributed mesh data server group) from the certification authority server 3, and shares and updates user information encrypted using the common secret key. The system S may include one or more distributed mesh data server groups. A configuration in which the system S includes one distributed mesh data server group simplifies the overall configuration and contributes to improved security. A configuration in which the system S includes multiple distributed mesh data server groups allows multiple distributed mesh data server groups managed by different administrators to be integrated into a single system S. Furthermore, a configuration in which the system S includes multiple distributed mesh data server groups makes it possible to assign processes related to different users to different distributed mesh data server groups. This allows the system S of this embodiment to process processes for different users using different common secret keys. This prevents the processing contents from being leaked between different users. Therefore, a configuration in which the system S includes multiple distributed mesh data server groups improves security.

[0030] The distributed mesh data server 1 of this embodiment uses a common secret key instead of a secret key specific to each individual distributed mesh data server 1, so that even though user information is updated across a group of distributed mesh data servers, it is possible to maintain the consistency of user information and protect the confidentiality of user information without unnecessarily increasing processing load and processing time.

[0031] In addition, the distributed mesh data server 1 of this embodiment uses a common secret key configured as a one-time common secret key, thereby minimizing increases in processing load and processing time while further reducing the risk of interception of user information, etc.

[0032] In addition, the distributed mesh data server 1 of this embodiment updates the number of accesses to the distributed mesh data server 1, which is part of the user information, so that the fee for each user related to the provision of mesh data can be appropriately calculated.

[0033] In addition, the distributed mesh data server 1 of this embodiment can separate the processing for each user related to the provision of mesh data by session, thereby protecting the user's confidentiality, by performing a session start process based on user authentication and a process that commands the storage of user information at the end of the session.

[0034] Furthermore, the terminal T included in the system S of this embodiment converts location information into a mesh code and searches for and acquires mesh data based on the mesh code, thereby protecting the confidentiality of the user's detailed location information, which is part of the user information.

[0035] [Terminal T] The type of terminal T is not particularly limited. The terminal T may be, for example, a personal computer, a laptop computer, a smartphone, a tablet terminal, or the like. The terminal T includes a control unit, a memory unit, a communication unit, an input unit, and a display unit (not shown). The terminal T also includes a position measurement unit (not shown) that measures the current position of the terminal T, exemplified by a global positioning system receiver (GPS receiver), or the like. The terminal T stores a program that causes the terminal T to execute a mesh data acquisition process that acquires mesh data from the distributed mesh data server 1. The functions provided by each of the software components of the program (search request unit, position acquisition unit, mesh code generation unit, mesh data display unit, etc.) will be described later in the description of a preferred flow of the mesh data acquisition process.

[0036] [Distributed Mesh Data Server 1] The distributed mesh data server 1 includes a control unit (data server control unit 11), a memory unit (data server memory unit 13), and a communication unit (data server communication unit 14). The type of the distributed mesh data server 1 is not particularly limited. The type of the distributed mesh data server 1 may be, for example, a server or node that constitutes a distributed database.

[0037] [Data Server Control Unit 11] The data server control unit 11 includes a central processing unit (CPU), a random access memory (RAM), a read only memory (ROM), and the like.

[0038] The data server control unit 11 cooperates with the data server storage unit 13 and / or the data server communication unit 14 as necessary. The data server control unit 11 then realizes the following software components of the program of this embodiment executed by the distributed mesh data server 1: a user authentication request receiving unit 111, a user authentication unit 112, a session initiation unit 113, a common secret key acquisition unit 114, an encrypted information acquisition unit 115, a decryption unit 116, a mesh code receiving unit 117, a mesh data providing unit 118, a user information update unit 119, an encryption unit 120, an encrypted information providing unit 121, and a session termination unit 122. The functions provided by each of the software components of the program related to the distributed mesh data server 1 of this embodiment will be described later in the description of a preferred flow of the mesh data provision process.

[0039] The main processing performed by the distributed mesh data server 1 is data processing related to the search and acquisition of mesh data (described below). Such data processing is characterized by having few sequentially executed parts that cannot be parallelized. For this reason, it is preferable that the distributed mesh data server 1 be configured such that mesh data is stored in a parallel database and processed in parallel. However, even if mesh data is stored in a parallel database, a single-core CPU executes parallelizable processes sequentially, and the benefits of parallel processing cannot be realized.

[0040] For the above reasons, it is preferable that the data server control unit 11 is provided with a multi-core CPU. This allows the data server control unit 11 to perform parallelizable processing related to the parallel database in parallel using each core of the CPU, thereby increasing the processing capacity. For example, if the number of cores and the number of parallel databases of the ith distributed mesh data server 1 in a distributed mesh data server group consisting of n distributed mesh data servers 1 are m, ｉ If m is the distributed mesh data server group, １ From m ｎ A parallelism of M, which is the sum of all the above, can be realized.

[0041] [Data Server Storage Unit 13] The data server storage unit 13 is a device in which data and / or files are stored, and has a storage unit that stores data non-temporarily using a hard disk, semiconductor memory, recording medium, memory card, etc.

[0042] The data server storage unit 13 stores a program executed by the microcomputer, a mesh data database 131, a multimedia database 132, a common secret key, user information, a secret key unique to the distributed mesh data server 1, and the like.

[0043] (Mesh data database 131) Mesh data, which is data obtained by dividing a map into a grid, is stored in the mesh data database 131. If the data server control unit 11 has a multi-core CPU, it is preferable that the mesh data database 131 be a parallel database in order to increase processing capacity through parallel processing.

[0044] From the viewpoint of maintaining compatibility of mesh data, it is preferable that the division method for dividing a map into a grid conforms to JIS X0410, which is related to regional mesh codes. From the viewpoint of centrally handling mesh data from all over the world, it is even more preferable that the division method conforms to the World Mesh, which is an extension of JIS X0410. The type of mesh data is not particularly limited as long as it is data that can be associated with sections on a map. The mesh data may be various types of data, such as population, land use classification, vegetation, topography, and elevation. These mesh data are stored, for example, in multiple data tables according to their types.

[0045] Figure 3 is an example of a map divided into grids. The example shown in Figure 3 shows a map including a first district A1, a second district A2, and a third district A3 indicated by dotted lines. The map is divided into tertiary mesh divisions indicated by solid lines and expanded 100m meshes indicated by dashed lines. This makes it possible to calculate data corresponding to areas on the map, such as districts, as the integrated value of mesh data associated with divisions that intersect with the area.

[0046] In the example map shown in Figure 3, 10m meshes are indicated by dashed lines. This allows the distributed mesh data server 1 to treat, for example, the first district A1 as an area made up of multiple expanded 100m meshes and many expanded 10m meshes. The distributed mesh data server 1 can then add up the mesh data for these meshes and provide it as data corresponding to the first district A1.

[0047] 4 is an example of the mesh data database 131. The mesh data database 131 stores various types of mesh data in association with mesh codes. In this example, mesh code "5439-21-68" is associated with mesh data such as a population of "8,000 people" and an administrative division of "△△ town" in the third-order mesh section identified by the reference area mesh code. Also, in this example, mesh code "5439-21-78" is associated with mesh data such as a population of "7,000 people" and an administrative division of "△△ town" in the third-order mesh section identified by the mesh code. This allows the distributed mesh data server 1 to provide mesh data such as population for the third-order mesh section identified by the mesh code.

[0048] (Multimedia database 132) Multimedia data such as images, videos, and audio are stored in the multimedia database 132 in association with mesh codes. This allows the distributed mesh data server 1 to provide various types of multimedia data corresponding to mesh codes. In order to treat multimedia data in the same way as mesh data, it is preferable that the mesh codes in the multimedia database 132 are the same as those in the mesh data database 131. If the data server control unit 11 has a multi-core CPU, it is preferable that the multimedia database 132 be a parallel database in order to increase processing power through parallel processing.

[0049] FIG. 5 is an example of the multimedia database 132. The multimedia database 132 shown in FIG. 5 stores various types of multimedia data in association with mesh codes. In this example, mesh code "5439-21-68" is associated with an image of the scenery in the third-order mesh section identified by the reference area mesh code, and audio recorded in the third-order mesh section. Also, in this example, mesh code "5439-21-78" is associated with an image of the scenery in the third-order mesh section identified by the mesh code, audio recorded in the third-order mesh section, and video captured in the third-order mesh section. This allows the distributed mesh data server 1 to provide various types of multimedia data for the third-order mesh section identified by the mesh code.

[0050] (Common Private Key) The common private key is an encryption key used by multiple distributed mesh data servers 1 (distributed mesh data server group). The common private key is obtained from the certification authority server 3. The common private key is kept secret from outside the system S. The common private key encrypts user information, etc. This makes it virtually impossible for an interceptor who does not possess the common private key to decrypt the encrypted information within a practically meaningful time period. In other words, the common private key makes it difficult for an interceptor who does not possess the common private key to use the encrypted information.

[0051] The common private key method is not particularly limited as long as information encrypted with the common private key can be decrypted by the distributed mesh data server 1. The common private key can be, for example, a random character string distributed in advance in writing by the certification organization managing the certification authority server 3 (one-time common private key server) or an authentication method using arbitrary encryption with an RSA public key / private key pair. To ensure the security of the authentication path, communication between the distributed mesh data server 1 and the certification authority server 3 in this embodiment preferably uses, for example, an encrypted communication method via SSL, or an authentication method using arbitrary encryption with an RSA public key / private key pair. The certification authority server 3 (one-time common private key server) creates and stores a random character string specific to the session using generation logic at the start of a session (synchronization time interval), and distributes a different one-time common private key for each group of distributed mesh data servers 1 in response to a request from the distributed mesh data server 1. This allows the operating organization of the certification authority server 3 to control the possibility of communication between the distributed mesh data servers 1 during a session. The random string generation logic can use a method of generating a string of alphanumeric characters registered in advance using uniform random numbers, or, for example, a random code generation method using irreversible hashing with a representative time and a secret phrase. This allows the certificate authority server 3 to mechanically generate unique and controllable random strings at synchronized time intervals. Because the mechanical generation method uses an irreversible hashing process, the representative time and secret phrase used originally cannot be decrypted. Therefore, this method is superior to reversible AES encryption, etc.

[0052] The common secret key is preferably a one-time common secret key with a set expiration date that is updated within a certain period of time. This prevents information intercepted after the expiration date from being decrypted even if the one-time common secret key becomes non-secret. This allows the distributed mesh data server 1 of this embodiment to further reduce the risk of interception of user information while minimizing increases in processing load and processing time.

[0053] It is preferable that the one-time common secret key is stored in association with its expiration date. This prevents the distributed mesh data server 1 from continuing to use an expired one-time secret key. This also allows the distributed mesh data server 1 to properly update an expired one-time common secret key.

[0054] (User Information) User information is not particularly limited as long as it is information related to a user who uses the distributed mesh data server 1. User information includes information that can be updated in response to the user's use of the distributed mesh data server 1. An example of information that can be updated in response to use is the access count (user access count information), which is the number of times a user has accessed the distributed mesh data server 1. By including the access count in this information, the distributed mesh data server 1 can record and update (meter) the user access count information in response to the user's use of mesh data. This allows the distributed mesh data server 1 to charge the user a usage fee in accordance with the number of accesses. Furthermore, to enable advance payment of the usage fee, the user information preferably includes a charge that increases in response to payment from the user and decreases in response to the user's use of the distributed mesh data server 1.

[0055] [Data Server Communication Unit 14] The data server communication unit 14 is not particularly limited as long as it connects the distributed mesh data server 1 to the network N and enables communication with the user information management server 2, the certification authority server 3, and the terminal T. An example of the data server communication unit 14 is a network card compatible with the Ethernet standard.

[0056] 6 is a block diagram showing the hardware and software configurations of the user information management server 2 of this embodiment. The user information management server 2 includes a control unit (management server control unit 21), a storage unit (management server storage unit 22), and a communication unit (management server communication unit 23). The type of the user information management server 2 is not particularly limited.

[0057] [Management Server Control Unit 21] The hardware configuration of the management server control unit 21 may be the same as that of the data server control unit 11. The management server control unit 21 cooperates with the management server storage unit 22 and / or the management server communication unit 23 as necessary. The management server control unit 21 then realizes the software components of the program of this embodiment executed on the user information management server 2, such as a user authentication request receiving unit 211, a user authentication executing unit 212, a user information providing unit 213, a user information receiving unit 214, and a user information storage executing unit 215. The functions provided by each of the software components of the program related to the user information management server 2 of this embodiment will be described later in the description of a preferred flow of user information management processing.

[0058] [Management Server Storage Unit 22] The hardware configuration of the management server storage unit 22 may be the same as that of the data server storage unit 13. The management server storage unit 22 stores programs executed by the microcomputer, a server database 221, a user information database 222, and the like.

[0059] (Server database 221) The server database 221 stores information (server information) related to the distributed mesh data server 1. The server information includes information that identifies the distributed mesh data server 1 related to the server information from multiple distributed mesh data servers 1. By including information that identifies the distributed mesh data server 1 in the server information, the user information management server 2 performs an identification process related to the server that requests the provision of a common secret key, and can provide the user information only if the server is identified as an appropriate distributed mesh data server 1 to which the user information is to be provided. This protects the confidentiality of the user information.

[0060] Information that identifies the distributed mesh data server 1 includes the name of the distributed mesh data server 1 (server ID), a public key corresponding to a private key unique to the distributed mesh data server 1, information relating to the location of the distributed mesh data server 1 on the network N, exemplified by an IP address, and information unique to the distributed mesh data server 1, exemplified by a MAC address.

[0061] 7 is an example of the server database 221. In the server database 221 of the example shown in FIG. 7, server information such as a public key corresponding to a private key unique to the distributed mesh data server 1 is stored in association with a server ID. In this example, the server ID "N0001" is associated with server information such as a public key corresponding to the private key unique to the distributed mesh data server 1 identified by the server ID, an IP address, a MAC address, etc. Also, in this example, the server ID "N0002" is associated with server information such as a public key corresponding to the private key unique to the distributed mesh data server 1 identified by the server ID, an IP address, a MAC address, etc. This allows the user information management server 2 to perform authentication related to the distributed mesh data server 1 identified by the server ID "N0001", "N0002", etc. using the public key.

[0062] (User information database 222) The user information database 222 stores user information of users who use the distributed mesh data server 1. The user information preferably includes the number of times the distributed mesh data server 1 has been accessed. This allows the system S to update the number of times the distributed mesh data server 1 has been accessed, which is part of the user information, and appropriately calculate the compensation for each user related to the provision of mesh data. The user information also preferably includes the remaining balance of the charge used to pay the compensation for the provision of mesh data. This allows the system S to provide mesh data by deducting the compensation from the charge previously acquired by the user, without requiring the user to pay the compensation each time.

[0063] Furthermore, the user information preferably includes information related to the authentication of the corresponding user (user authentication information). This allows the user information management server 2 to perform user authentication processing and start a session related to use of the distributed mesh data server 1 only when the user is identified as a user of the distributed mesh data server 1. This prevents unauthorized users from using the distributed mesh data server 1.

[0064] FIG. 8 is an example of the user information database 222. In the example shown in FIG. 8, user information such as user authentication information, number of accesses, and charge balance is stored in association with a user ID. In this example, user ID "U0001" is stored in association with user information such as the user's user authentication information, number of accesses "3," and charge balance "2,000." Also, in this example, user ID "U0002" is stored in association with user information such as the user's user authentication information, number of accesses "1," and charge balance "500." This allows the user information management server 2 to perform processes related to authentication of users identified by user IDs "U0001," "U0002," etc., updating the number of accesses, and consumption of charge associated with usage.

[0065] [Management Server Communication Unit 23] The management server communication unit 23 is not particularly limited as long as it connects the user information management server 2 to the network N and enables communication with the distributed mesh data server 1, etc. The hardware configuration of the management server communication unit 23 may be the same as that of the data server communication unit 14.

[0066] 9 is a block diagram showing the hardware and software configurations of the certification authority server 3 of this embodiment. The certification authority server 3 includes a control unit (certification authority server control unit 31), a storage unit (certification authority server storage unit 32), and a communication unit (certification authority server communication unit 33). The type of certification authority server 3 is not particularly limited.

[0067] From the viewpoint of centralizing authentication related to the common private key, it is preferable that the number of certification authority servers 3 is one. If the system S is used frequently or if high availability is required for the system S, it is preferable that the number of certification authority servers 3 is multiple. This distributes the load of authentication related to the common private key. Furthermore, even if one of the certification authority servers 3 becomes unable to perform authentication, the other certification authority servers 3 can perform authentication related to the common private key. This prevents the distributed mesh data server 1 from being unable to share user information using the common private key due to one of the certification authority servers 3 being unable to perform authentication.

[0068] [Certification authority server control unit 31] The hardware configuration of the certification authority server control unit 31 may be the same as that of the data server control unit 11. The certification authority server control unit 31 cooperates with the certification authority server storage unit 32 and / or the certification authority server communication unit 33 as necessary. The certification authority server control unit 31 then realizes the software components of the program of this embodiment executed by the certification authority server 3, such as a server authentication request receiving unit 311, a server determination unit 312, and a common secret key providing unit 313. The functions provided by each of the software components of the program related to the certification authority server 3 of this embodiment will be described later in the description of a preferred flow of server authentication processing.

[0069] [Certification Authority Server Storage Unit 32] The hardware configuration of the certification authority server storage unit 32 may be the same as that of the data server storage unit 13. The certification authority server storage unit 32 stores a program executed by a microcomputer, a server database 321, a common secret key, etc.

[0070] (Server Database 321) The server database 321 stored in the certificate authority server storage unit 32 may be the same as the server database 221.

[0071] (Common Secret Key) The common secret key stored in the certificate authority server storage unit 32 may be the same as the common secret key related to the distributed mesh data server 1 .

[0072] [Certification authority server communication unit 33] The certification authority server communication unit 33 is not particularly limited as long as it connects the certification authority server 3 to the network N and enables communication with the distributed mesh data server 1, etc. The hardware configuration of the certification authority server communication unit 33 may be the same as that of the data server communication unit 14.

[0073] [Network N] The type of network N is not particularly limited as long as it enables communication between the distributed mesh data server 1, the user information management server 2, the certification authority server 3, and one or more terminals T. The type of network N may be, for example, the Internet, a mobile phone network, a wireless LAN, or the like.

[0074] The network N may include a first network that enables multiple distributed mesh data servers 1 to communicate with each other, separate from a second network used for other communications, in order to increase the communication speed between the distributed mesh data servers 1. The network N may also include a third network that enables the distributed mesh data server 1, the user information management server 2, and the certification authority server 3 to communicate with each other, separate from a fourth network used for other communications, in order to keep communications between the distributed mesh data server 1, the user information management server 2, and the certification authority server 3 secret from external devices, terminals, etc., such as the terminal T.

[0075] The following is an example of a preferred flow of processing executed by each computer (terminal T, distributed mesh data server 1, user information management server 2, and certification authority server 3) included in the system S of this embodiment.

[0076] [Flowchart of Mesh Data Acquisition Processing Executed by Terminal T] Fig. 10 is a flowchart showing an example of a preferable flow of the mesh data acquisition processing executed by terminal T of this embodiment. Fig. 11 is a diagram continuing from Fig. 10. Below, an example of a preferable flow of the mesh data acquisition processing executed by terminal T of this embodiment will be described using Figs. 10 and 11.

[0077] In order to further protect the confidentiality of user information in the distributed mesh data server 1, the mesh data acquisition process preferably includes a series of processes (steps S1 to S3) related to the start of a user session.

[0078] [Step S1: Determining Whether to Start a User Session] The control unit of terminal T executes a user authentication request unit (not shown) in cooperation with a storage unit, a communication unit, an input unit, a display unit, etc. Then, the control unit executes a process of determining whether to start a user session by the user authentication request unit (step S1, user session start determination step). If it is determined that a user session should be started, the control unit moves the process to step S2. If it is not determined that a user session should be started, the control unit returns the process to step S1.

[0079] The user session start determination step includes a procedure for determining that a user session should be started when, for example, a user using terminal T issues an instruction via an input unit to start searching for mesh data.

[0080] [Step S2: Sending an authentication request] The control unit of the terminal T executes a process of sending an authentication request to any of the distributed mesh data servers 1 by the user authentication request unit (step S2, user authentication request execution step). The control unit then proceeds to step S3.

[0081] The user authentication request execution step includes, for example, a procedure of transmitting an authentication request including a user ID and a password. From the viewpoint of protecting the confidentiality of user information, it is preferable that the user ID and password included in the authentication request are encrypted.

[0082] [Step S3: Determining whether an authentication success notification has been received] The control unit of the terminal T executes a process of determining whether an authentication success notification has been received from the distributed mesh data server 1 in step S2 by the user authentication request unit (step S3, authentication success notification reception determination step). If it is determined that the notification has been received, the control unit proceeds to step S4. If it is not determined that the notification has been received, the control unit returns the process to step S3.

[0083] The mesh data acquisition process preferably involves a series of steps for searching for mesh data based on information indicating a geographical area, such as a place name, a building name, or a geometric figure enclosing an area. Steps S4 to S5 shown below are an example of this process. The example shown below illustrates a procedure for "searching based on a place name," but the process can be configured in a similar manner when searching for mesh data based on information other than a place name that indicates a geographical area, such as a building name or a geometric figure enclosing an area.

[0084] [Step S4: Determining whether to perform a search based on a place name] The control unit of terminal T executes a search request unit (not shown) in cooperation with the storage unit, communication unit, input unit, display unit, etc. Then, the control unit of terminal T executes a process of determining whether to perform a search based on a place name using the search request unit (step S4, place name search request determination step). If it is determined that a search should be performed, the control unit proceeds to step S5. If it is not determined that a search should be performed, the control unit proceeds to step S6.

[0085] The user session start determination step includes a procedure for determining whether to start a search based on a place name when, for example, a user of terminal T issues an instruction via an input unit to start a search for mesh data based on a place name or a current location. The input via the input unit may be, for example, input via a character input means such as a keyboard or a software keyboard on a touch panel, input via voice recognition, or input via a graphical user interface (GUI). In particular, a configuration for searching mesh data via voice recognition input facilitates searching for mesh data from terminal T configured as a mobile terminal such as a smartphone. Since detailed location information of a mobile terminal is updated as the terminal moves, there is a greater need to keep location information confidential than for a fixed terminal. Therefore, a synergistic effect is achieved between the program of this embodiment, which conceals detailed location information through a mesh data acquisition process, and the configuration for searching mesh data via voice recognition input.

[0086] [Step S5: Transmitting a search request based on a place name] The control unit of the terminal T executes a process of transmitting a search request based on the place name in step S4 to any of the distributed mesh data servers 1 by the search request unit (step S5, place name search request transmitting step). The control unit then proceeds to step S10.

[0087] The mesh data acquisition process involves a series of processes for searching based on mesh codes. Regarding mesh data searches, there is a demand for searching mesh data related to various areas that include the current location of terminal T. However, when searching for such mesh data, if location information indicating the current location of terminal T is transmitted to a server, there is a concern that the confidentiality of terminal T's current location may be leaked.

[0088] The mesh data acquisition process performs a series of processes for searching based on mesh codes, allowing the terminal T to perform a search based on location information while protecting the confidentiality of the current location of the terminal T, i.e., the current location of the user using the terminal T. This series of processes can be implemented not only for searches related to the current location of the terminal T, but also for searches of mesh data based on information indicating a geographical area, such as place names, building names, etc.

[0089] Steps S6 to S9 shown below are an example of a preferred process flow for performing a search based on a mesh code. The example shown below shows a case where a search is performed based on a mesh code related to the location information of terminal T. By providing terminal T with a mesh code search engine that searches for mesh codes corresponding to information other than place names that indicate geographical areas, a similar configuration can be used to search for mesh data based on information other than place names that indicate geographical areas.

[0090] [Step S6: Determining whether to perform a search based on mesh code] The control unit of terminal T, in cooperation with the storage unit, communication unit, input unit, display unit, etc., executes a process of determining whether to perform a search based on location information (step S6, mesh code search request determination step). If it is determined that a search should be performed, the control unit proceeds to step S7. If it is not determined that a search should be performed, the control unit proceeds to step S10.

[0091] [Step S7: Obtaining Location Information] The control unit of terminal T executes a location information acquisition unit (not shown) in cooperation with the storage unit, location measurement unit, etc. The control unit of terminal T executes a process of acquiring location information relating to the current location of terminal T from the location measurement unit using the location information acquisition unit (step S7, location information acquisition step). The control unit proceeds to step S8.

[0092] [Step S8: Generate Mesh Code] The control unit of the terminal T executes a mesh code generation unit (not shown) in cooperation with a storage unit, etc. The control unit of the terminal T executes a process of generating a mesh code by the mesh code generation unit based on the location information acquired in the location information acquisition step (step S8, mesh code generation step). The control unit proceeds to step S9.

[0093] When searching based on a mesh code related to the location information of terminal T, a mesh code is generated in the mesh code generation step from the latitude and longitude of the current location included in the location information. At this time, if the search target is a "circular area centered on the current location" or a "rectangular area centered on the current location," a mesh code related to that area is generated based on the latitude and longitude of the current location and parameters (radius, scale, length, width, etc.) that identify such an area.

[0094] Furthermore, if the search targets are "administrative districts that include the current location," "street that includes the current location," "buildings that include the current location," etc., a mesh code is generated from the search results using the mesh code search engine. The same applies when the reference and search target are locations different from the current location. The mesh code search engine performs processing similar to the mesh code conversion processing described later using FIG. 16, for example.

[0095] [Step S9: Transmitting a search request based on the mesh code] The control unit of terminal T executes a mesh data request unit (not shown) in cooperation with the memory unit, communication unit, input unit, display unit, etc. Then, the control unit of terminal T executes a process in which the mesh data request unit transmits a search request based on the mesh code generated in the mesh code generation step to any of the distributed mesh data servers 1 (step S9, mesh data request step). The control unit then proceeds to step S10.

[0096] The search request based on the mesh code may include the mesh code and an instruction to search for the administrative district corresponding to the mesh code. This allows the terminal T to send a search request to the distributed mesh data server 1 to search for mesh data for the administrative district corresponding to its current location without transmitting detailed location information of the terminal T.

[0097] [Step S10: Determining Whether Mesh Data Has Been Received] The control unit of the terminal T, in cooperation with the storage unit, communication unit, etc., executes a process of determining whether mesh data has been received from any of the distributed mesh data servers 1 (step S10, mesh data reception determination step). If it is determined that mesh data has been received, the control unit proceeds to step S11. If it is not determined that mesh data has been received, the control unit returns the process to step S10.

[0098] [Step S11: Display Mesh Data] The control unit of terminal T executes a mesh data display unit (not shown) in cooperation with a storage unit, etc. The control unit of terminal T executes a process of displaying the mesh data determined to have been received in the mesh data reception determination step by the mesh data display unit (step S11, mesh data display step). The control unit returns the process to step S1 and repeats the processes from step S1 to step S11. The process of displaying the mesh data includes, for example, a procedure of displaying the mesh data on a browser.

[0099] [Effect of the Program for Executing Mesh Data Acquisition Processing] Improvements in global positioning system receivers (GPS receivers) have made it possible to measure the current location of terminal T with high accuracy. This allows the detailed current location measured with high accuracy, i.e., the detailed location information of terminal T, to be transmitted to a server, where the detailed location information can be stored. However, when the detailed location information is stored on a server, users may have privacy concerns. Furthermore, if the detailed location information of terminal T is transmitted to an external device, there is a concern that the location information may be intercepted and the detailed current location of the user using terminal T may be leaked. Leaking the detailed current location may not only lead to a violation of the user's privacy, but also raise concerns that the leaked detailed current location may be used for crimes such as stalking, blackmail, and kidnapping.

[0100] The program stored in terminal T of this embodiment causes terminal T to execute a mesh data acquisition process, thereby preventing detailed location information of terminal T, among other user information, from being sent as is to the distributed mesh data server 1 and preventing such location information from being stored in the distributed mesh data server 1, user information management server 2, etc. Terminal T can then send only the mesh code, which is the minimum amount of data required to search for mesh data, to the distributed mesh data server 1. This prevents the detailed current location of the user using terminal T from being leaked. Therefore, the program can protect the confidentiality of user information in the distributed mesh data server 1.

[0101] [Main Flowchart of Mesh Data Providing Process Executed by Distributed Mesh Data Server 1] Figure 12 is a main flowchart showing an example of a preferred flow of the mesh data providing process executed by the distributed mesh data server 1 of this embodiment. Figure 13 is a diagram continuing from Figure 12. Figure 14 is a diagram continuing from Figure 13. Figure 15 is a diagram continuing from Figure 14. Below, an example of a preferred flow of the mesh data providing process executed by the distributed mesh data server 1 of this embodiment will be described using Figures 12 to 15.

[0102] As described above, the group of distributed mesh data servers that make up the system S includes a plurality of distributed mesh data servers 1. Hereinafter, of these plurality of distributed mesh data servers 1, the distributed mesh data server 1 that is being closely watched in the processing flow will be referred to as "this distributed mesh data server 1" and distinguished from it. In addition, distributed mesh data servers 1 that are different from this distributed mesh data server 1 will be referred to as "other distributed mesh data servers 1."

[0103] In order to further protect the confidentiality of user information in the distributed mesh data server 1, the mesh data providing process preferably includes a series of processes (steps S21 to S24) related to the start of a user session.

[0104] [Step S21: Determine whether an authentication request has been received] The data server control unit 11 executes the user authentication request receiving unit 111 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether an authentication request has been received from the terminal T by the user authentication request receiving unit 111 (step S21, user authentication request receiving step). If it is determined that the request has been received, the data server control unit 11 proceeds to step S22. If it is not determined that the request has been received, the data server control unit 11 returns the process to step S21.

[0105] [Step S22: Request user authentication] The data server control unit 11 cooperates with the data server storage unit 13, the data server communication unit 14, etc. to execute the user authentication unit 112. Then, the data server control unit 11 executes processing to request user authentication from the user information management server 2 by the user authentication unit 112 (step S22, user authentication request step). The data server control unit 11 proceeds to step S23.

[0106] In the user authentication request step, for example, a user authentication request including information related to the authentication request received in the user authentication request receiving step is provided to the user authentication API of the user information management server 2. The user authentication request includes information related to user authentication, such as a user ID and password. To further improve security, the user authentication request step preferably includes authentication using a one-time password. In this authentication, the distributed mesh data server 1 performs authentication using a one-time password generated by the authentication authority server 3 at the start of a server session. This prevents an attacker from gaining unauthorized access unless they can break the one-time password during the short time that authentication using the one-time password is performed. Therefore, this user authentication request step significantly narrows the attacker's opportunities for attack. As a result, this user authentication request step improves security.

[0107] [Step S23: Determine whether a user authentication success notification has been received] The data server control unit 11 executes a process of determining whether a user authentication success notification has been received from the user information management server 2 by the user authentication unit 112 (step S23, user authentication success confirmation step). If it is determined that the notification has been received, the data server control unit 11 proceeds to step S24. If it is not determined that the notification has been received, the data server control unit 11 returns the process to step S23.

[0108] The user authentication success notification includes, for example, a user-specific API key obtained from the user authentication API. The user is identified by the user-specific API key. This makes it possible to manage access rights to various data processed by the distributed mesh data server 1 on a per-user basis.

[0109] [Step S24: Start Session] The data server control unit 11 executes the session initiation unit 113 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes processing to start a user session corresponding to the user related to the user authentication success notification received in the user authentication success confirmation step, using the session initiation unit 113 (step S24, session initiation step). The data server control unit 11 proceeds to step S25.

[0110] The user session includes management of access to data using a user-specific API key, thereby ensuring that communications between the terminal T used by the user and the distributed mesh data server 1 are kept secret from anyone other than the user. It is also preferable that the user session includes management of access to communications using a user-specific API key, thereby ensuring that communications between the terminal T used by the user and the distributed mesh data server 1 are kept secret from anyone other than the user.

[0111] In order to further protect the confidentiality of user information in the distributed mesh data server 1, the mesh data providing process preferably includes a series of processes relating to server authentication (steps S25 to S26).

[0112] [Step S25: Request Server Authentication] The data server control unit 11 cooperates with the data server storage unit 13, the data server communication unit 14, etc. to execute the common private key acquisition unit 114. Then, the data server control unit 11 executes processing to request server authentication from the certificate authority server 3 using the common private key acquisition unit 114 (step S25, server authentication request step). The data server control unit 11 proceeds to step S26.

[0113] In order to prevent the common private key from being obtained by a server without proper authorization, the server authentication request step preferably includes a procedure for obtaining the common private key using a server-specific private key associated with the distributed mesh data server 1. In this case, the server authentication request step provides authentication information related to the server-specific private key associated with the distributed mesh data server 1 to the common private key API of the certification authority server 3. The "authentication information related to the server-specific private key" includes, for example, information signed with the server-specific private key, the server-specific private key itself, etc.

[0114] If the certification authority server 3 has a one-time common private key API, the server authentication request step preferably provides the server-specific private key associated with the distributed mesh data server 1 to the one-time common private key API of the certification authority server 3. This allows the distributed mesh data server 1 to use a common private key configured as a one-time common private key that has an expiration date and is updated at regular intervals.

[0115] [Step S26: Determine whether a server authentication success notification has been received] The data server control unit 11 executes a process of determining whether a server authentication success notification has been received from the certificate authority server 3 by the common private key acquisition unit 114 (step S26, server authentication success confirmation step). If it is determined that the notification has been received, the data server control unit 11 proceeds to step S27. If it is not determined that the notification has been received, the data server control unit 11 returns the process to step S26. The server authentication success notification includes at least the common private key acquired from the common private key API.

[0116] The mesh data providing process includes a process of acquiring a common secret key from the certificate authority server 3, etc. Step S27 is an example of this process.

[0117] [Step S27: Obtaining a common secret key] The data server control unit 11 cooperates with the data server storage unit 13, the data server communication unit 14, etc. to execute the common secret key acquisition unit 114. Then, the data server control unit 11 executes processing to acquire a common secret key by the common secret key acquisition unit 114 (step S27, common secret key acquisition step). The data server control unit 11 proceeds to step S28.

[0118] From the viewpoint of carrying out the process integrally with the authentication procedure, it is preferable that the common secret key acquisition step includes a step of acquiring the common secret key from the server authentication success notification determined to have been received in the server authentication success confirmation step.

[0119] If the certificate authority server 3 has a one-time common private key API, the common private key acquisition step preferably includes a procedure for acquiring, from the one-time common private key API, a one-time common private key having a set expiration date and updated at regular intervals. This allows the distributed mesh data server 1 to use a common private key configured as a one-time common private key. Because the one-time common private key has a set expiration date and is updated at regular intervals, it is possible to minimize increases in processing load and processing time while further reducing the risk of interception of user information, etc.

[0120] [Step S28: Determine whether a search request has been received] The data server control unit 11 executes the mesh code receiving unit 117 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether a search request has been received from another device (terminal T or another distributed mesh data server 1) by the mesh code receiving unit 117 (step S28, search request receiving step). If it is determined that a search request has been received, the data server control unit 11 proceeds to step S29. If it is not determined that a search request has been received, the data server control unit 11 proceeds to step S40.

[0121] The mesh data providing process includes a series of processes in which the search request received in the search request receiving step is distributed to a plurality of distributed mesh data servers 1 belonging to a distributed mesh data server group for processing. The series of processes for distributed processing is not particularly limited, and may be similar to that of a conventional distributed server in which mesh data is stored in a distributed manner on a plurality of servers and the mesh data is processed in a distributed manner using these servers. Steps S29 to S31 are an example of a series of processes for distributed processing.

[0122] [Step S29: Determine whether further parallelization is required] The data server control unit 11, in cooperation with the data server storage unit 13 and the data server communication unit 14, etc., executes a process of determining whether further parallelization is required for the processing related to the search request received in the search request receiving step (step S29, parallelization determination step). If it is determined that further parallelization is required, the data server control unit 11 proceeds to step S30. If it is not determined that further parallelization is required, the data server control unit 11 proceeds to step S32.

[0123] The parallelization determination step includes, for example, a procedure for determining that further parallelization is required if the search request is sent from terminal T and is not a search request that has been duplicated or otherwise processed in another distributed mesh data server 1.

[0124] The parallelization determination step also includes, for example, a procedure for determining whether or not mesh data corresponding to the mesh code related to the search request is stored in other distributed mesh data servers 1, and determining that further parallelization is required if it is determined that the mesh data is stored in one or more other distributed mesh data servers 1. This determination procedure may be a procedure corresponding to various methods (range partitioning, hash partitioning, etc.) for distributing mesh data to multiple distributed mesh data servers 1.

[0125] [Step S30: Encrypting the Search Request] The data server control unit 11, in cooperation with the data server storage unit 13 and the like, executes a process of encrypting the search request using a common secret key (step S30, search request encryption step). The data server control unit 11 moves the process to step S31. Because encryption is performed using a common secret key, each distributed mesh data server 1 belonging to the same distributed mesh data server group can confirm that they mutually possess the same common secret key with a relatively small computational cost. Furthermore, because encryption is performed using a common secret key, the distributed mesh data server 1 can decrypt the request with a relatively small computational cost. These advantages contribute to a significant reduction in computational costs, particularly when the common secret key is a one-time common secret key that is periodically changed.

[0126] [Step S31: Transmitting a Search Request] The data server control unit 11, in cooperation with the data server storage unit 13 and the data server communication unit 14, executes a process of transmitting a search request (query) that has been copied to other distributed mesh data servers 1 (step S30, search request transmission step). The data server control unit 11 moves the process to step S32. The transmission of the search request and the acquisition of the results in the search request transmission step are performed via an API that uses the query and an encrypted user private key as authentication options. For example, communication between distributed mesh data servers 1 for each user during a session is performed using a one-time common private key encrypted via an SSL route to encrypt the user's unique private key. Note that, to prevent interception on the communication route, it is preferable that the distributed mesh data server 1 transmits the search request via an encrypted route via SSL.

[0127] The "duplicated search request" in the search request transmission step is, for example, a duplicate of a search request received from a terminal T, etc. Furthermore, if it is possible to identify the distributed mesh data server 1 in which mesh data corresponding to the mesh code is stored, the "duplicated search request" may be a search request that requests only a portion of the search request that corresponds to the mesh data stored in the distributed mesh data server 1 to which it is sent.

[0128] The other distributed mesh data servers 1 to which the search request is sent in the search request sending step are, for example, "one or more other distributed mesh data servers 1" that are determined in the parallelization determination step to have mesh data corresponding to the mesh code stored therein. If the other distributed mesh data servers 1 that store mesh data are not determined to prevent search omissions, it is preferable that the other distributed mesh data servers 1 to which the search request is sent in the search request sending step are all distributed mesh data servers 1 that belong to the distributed mesh data server group.

[0129] [Step S32: Mesh code conversion process] If the search request received in the search request receiving step is not a search request related to a mesh code, the data server control unit 11 executes mesh code conversion process (step S32, mesh code conversion step) in cooperation with the data server storage unit 13, etc. The data server control unit 11 proceeds to step S33. Details of the mesh code conversion process will be described later using FIG. 16.

[0130] [Step S33: Acquire Mesh Data] The data server control unit 11, in cooperation with the data server storage unit 13 and the data server communication unit 14, executes a process of acquiring mesh data corresponding to the mesh code related to the search request received in the search request receiving step (step S33, mesh data acquisition step). The data server control unit 11 then proceeds to step S34.

[0131] [Step S34: Providing Mesh Data] The data server control unit 11 cooperates with the data server storage unit 13, the data server communication unit 14, etc. to execute the mesh data providing unit 118. Then, the data server control unit 11 executes a process of providing the mesh data acquired in the mesh data acquisition step to the device related to the search request received in the search request reception step by the mesh data providing unit 118 (step S34, mesh data providing step). The data server control unit 11 proceeds to step S35.

[0132] In the mesh data providing step, the "device related to the search request received in the search request receiving step" is the terminal T or another distributed mesh data server 1. This "other distributed mesh data server 1" refers to another distributed mesh data server 1 that has copied the search request or otherwise transmitted it to this distributed mesh data server 1.

[0133] If the search request is copied or otherwise transmitted to other distributed mesh data servers 1 in the search request transmission step, it is preferable that the mesh data provision step includes a procedure of receiving mesh data as the search result from the distributed mesh data server 1 to which the search request was copied or otherwise transmitted, and combining it with the mesh data acquired in the mesh data acquisition step, in order to centralize the distributed mesh data servers 1 with which clients such as terminal T communicate.

[0134] [Step S35: Determine whether encrypted user information has been received] The data server control unit 11 executes the encrypted information acquisition unit 115 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether encrypted user information has been received from another distributed mesh data server 1 by the encrypted information acquisition unit 115 (step S35, encrypted information acquisition step). If it is determined that the encrypted user information has been received, the data server control unit 11 proceeds to step S36. If it is not determined that the encrypted user information has been received, the data server control unit 11 returns the process to step S37.

[0135] The encrypted user information preferably includes a user API key for identifying the user and an access count, which is the number of times the user has accessed the distributed mesh data server 1. The "number of times the user has accessed the distributed mesh data server 1" is the sum of the number of times the user has accessed any of the multiple distributed mesh data servers 1 belonging to the distributed mesh data server group. The access count is associated with the user API key.

[0136] By including the user API key in the encrypted user information, the distributed mesh data server 1 can identify the user. This allows the distributed mesh data server 1 to process the session related to that user so that only data related to that user can be accessed. Therefore, the confidentiality of the user information is maintained.

[0137] Since mesh data may have commercial value, there is a demand for payment according to the number of times the mesh data is accessed. By including the number of accesses in the encrypted user information, the distributed mesh data server 1 can appropriately calculate the compensation for each user for the provision of mesh data.

[0138] [Step S36: Decrypting Encrypted User Information] The data server control unit 11 executes the decryption unit 116 in cooperation with the data server storage unit 13, etc. Then, the data server control unit 11 executes a process of decrypting the encrypted user information acquired in the encrypted information acquisition step by the decryption unit 116 (step S36, decryption step). The data server control unit 11 proceeds to step S37.

[0139] The encrypted user information is user information encrypted using a common secret key in an encryption step (described later) executed by another distributed mesh data server 1. This common secret key is a common secret key used by multiple servers, i.e., multiple distributed mesh data servers 1 belonging to a distributed mesh data server group. Therefore, this distributed mesh data server 1 can decrypt the encrypted user information using the common secret key without managing encryption keys unique to the other distributed mesh data servers 1. This reduces the processing load associated with the decryption and prevents an increase in the processing load caused by managing encryption keys unique to each of the multiple distributed mesh data servers 1 belonging to the distributed mesh data server group.

[0140] [Step S37: Updating User Information] The data server control unit 11, in cooperation with the data server storage unit 13 and the like, executes a process of updating the user information stored in the data server storage unit 13 (step S37, user information update step). The data server control unit 11 proceeds to step S38.

[0141] In order to reflect the acquisition of mesh data in the access count, the user information update step preferably includes a procedure for updating the access count in the user information in accordance with the mesh data acquired in the mesh data acquisition step. Also, in order to reflect the update of the access count in other distributed mesh data servers 1, the user information update step preferably includes a procedure for updating the access count using the encrypted user information decrypted in the decryption step.

[0142] [Step S38: Encrypt User Information] The data server control unit 11 cooperates with the data server storage unit 13 and the like to execute the encryption unit 120. Then, the data server control unit 11 executes a process of encrypting the user information updated in the user information update step using the encryption unit 120 (step S38, encryption step). The data server control unit 11 proceeds to step S39.

[0143] [Step S39: Providing User Information] The data server control unit 11 cooperates with the data server storage unit 13 and the like to execute the encrypted information providing unit 121. Then, the data server control unit 11 executes a process of providing the encrypted user information encrypted in the encryption step to other distributed mesh data servers 1 by the encrypted information providing unit 121 (step S39, encrypted information providing step). The data server control unit 11 proceeds to step S40.

[0144] Through the series of processes from step S35 to step S39, the user information updated in the user information update step of this distributed mesh data server 1 is shared with other distributed mesh data servers 1 in an encrypted state.

[0145] When a series of processes related to the start of a user session (steps S21 to S24) are executed, the mesh data providing process preferably includes a series of processes related to the end of the user session (steps S40 to S42). This ends the user session that has completed its role by completing the provision of mesh data, etc. This further protects the confidentiality of user information in the distributed mesh data server 1.

[0146] [Step S40: Determine whether to end the session] The data server control unit 11 executes the session ending unit 122 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes processing to determine whether to end the session using the session ending unit 122 (step S40, session end determination step). If it is determined that the session should be ended, the data server control unit 11 proceeds with the processing to step S41. If it is not determined that the session should be ended, the data server control unit 11 returns the processing to step S28.

[0147] The session termination determination step includes, for example, a procedure for determining that the session should be terminated when an instruction to terminate the mesh data search is received from the user of terminal T. The session termination determination step also includes, for example, a procedure for determining that the session should be terminated when all mesh data related to the search request has been provided to terminal T.

[0148] [Step S41: Command to store user information] The data server control unit 11 executes a process of commanding the user information management server 2 to store user information by the session termination unit 122 (step S41, user information storage command step). The data server control unit 11 moves the process to step S42. As a result, the user information shared among the multiple distributed mesh data servers 1 and including the number of accesses and the like updated in response to accesses to the mesh data is stored in the user information management server 2 and becomes centrally managed.

[0149] [Step S42: End Session] The data server control unit 11 executes processing to end the session started in the session start step by the session end unit 122 (step S42, session end execution step). The data server control unit 11 returns the processing to step S21 and repeats the processing from step S21 to step S42. If a one-time password (one-time common secret key) is used, the distributed mesh data server 1 discards the one-time password in the session end execution step. This allows the distributed mesh data server 1 to prevent unauthorized access after the session using the one-time password has ended.

[0150] [Searching for Mesh Data Using Text] In order to enable the provision of mesh data based on text, the mesh data provision process preferably includes a procedure for searching for mesh data based on a search request related to text provided from the terminal T. As a configuration for realizing such a procedure, for example, a proper noun mesh database (not shown) storing proper noun mesh data is stored in the data server storage unit 13. In this configuration, for example, a mesh code is searched for from the proper noun mesh database using the text provided from the terminal T as a search key.

[0151] [Providing Multimedia Data] The mesh data acquisition step acquires mesh data corresponding to the mesh code from the mesh data database 131. In order to provide multimedia data such as images, audio, and video related to the mesh code, the mesh data acquisition step preferably includes a procedure of acquiring mesh data corresponding to the mesh code from the multimedia database 132. This allows the distributed mesh data server 1 to provide various types of multimedia data corresponding to the mesh code.

[0152] [Calculation of administrative district from mesh code] The search request received in the search request receiving step may include a mesh code and an instruction to perform a search for the administrative district corresponding to the mesh code. In such a case, the distributed mesh data server 1 identifies the administrative district corresponding to the mesh code based on the mesh code. Then, the distributed mesh data server 1 calculates a mesh code covering the identified administrative district by a mesh code conversion process. This allows the distributed mesh data server 1 to perform a search for the administrative district corresponding to the current location of the terminal T without receiving detailed location information from the terminal T.

[0153] [Mesh Data Update] In order to enable updating of mesh data based on the mesh code, the mesh data provision process preferably includes a series of processes related to updating the mesh data. The mesh data update request includes a mesh code that identifies the mesh data to be updated and data related to the mesh data update. The data related to the mesh data update includes, for example, the updated mesh data, instructions for changing the currently stored mesh data, and a change procedure.

[0154] [Effects of Mesh Data Providing Process] In the mesh data providing process, a common secret key is used (steps S26 to S39) instead of using a secret key specific to each distributed mesh data server 1. This allows the mesh data providing process to update user information on the distributed mesh data server group (steps S35 to S39), while maintaining the consistency of the user information and protecting the confidentiality of the user information without unnecessarily increasing the processing load and processing time.

[0155] In addition, the mesh data providing process can use a common secret key configured as a one-time common secret key (step S27), which can further reduce the risk of interception of user information while minimizing increases in processing load and processing time.

[0156] Additionally, in the mesh data providing process, the number of accesses to the distributed mesh data server 1, which is part of the user information, can be updated (step S37). As a result, the mesh data providing process realizes a fee billing transaction that appropriately calculates the fee for each user related to the provision of mesh data.

[0157] Furthermore, in the mesh data providing process, the processes for providing mesh data for each user are separated by session, making it possible to protect the privacy of the users (steps S21 to S24, steps S40 to S42).

[0158] Therefore, by executing the mesh data provision process on the distributed mesh data server 1, the distributed mesh data server 1 can appropriately manage user information on the distributed mesh data server group. This provides a system S that enables user authentication access control to mesh data distributedly present on different distributed mesh data servers 1, and also enables recording and updating (metering) user access count information (access count) according to the user's use of mesh data.

[0159] [Flowchart of Mesh Code Conversion Processing] The process of converting a search request that is not related to a mesh code (for example, a search request related to various information such as information indicating a geographical area exemplified by a place name, a building name, a geometric figure surrounding an area, etc.) into a search request related to a mesh code is not particularly limited and may be similar to that of conventional technology. Figure 16 is a flowchart showing an example of a preferred flow of the mesh code conversion processing. Below, an example of a preferred flow of the mesh code conversion processing executed in step S32 of Figure 14 will be described using Figure 16.

[0160] In order to provide various programs with a means of accessing mesh data, it is preferable that the program that performs the mesh code conversion process be provided as part of a library that obtains mesh data corresponding to a world mesh code in response to a search request, i.e., a world mesh code library.

[0161] In the following description, the geographical area related to the search request is also referred to as the "target area." A detailed description of the specific means for determining the intersection between the target area and a mesh will be omitted. The intersection determination is performed starting from the coarsest mesh (e.g., the first mesh of the world mesh). The mesh that is the target of the intersection determination is also referred to as the "conversion target."

[0162] [Step S51: Determine whether there is a mesh that contains the entire target] The data server control unit 11, in cooperation with the data server storage unit 13, performs a process of determining whether there is an intersection between the target region and a mesh, and determines whether there is a mesh that contains the entire target region (step S51, fully covered mesh determination step). If it is determined that there is, the data server control unit 11 proceeds to step S52. If it is not determined that there is, the data server control unit 11 proceeds to step S53.

[0163] [Step S52: Adding Mesh Codes] The data server control unit 11, in cooperation with the data server storage unit 13, executes a process of adding the mesh codes of the meshes determined to include the entire area in the all-covered mesh determination step to the converted mesh code (step S52, all-covered mesh code addition step). The data server control unit 11 then proceeds to step S53.

[0164] [Step S53: Determine whether there is a mesh that contains part of the target] The data server control unit 11, in cooperation with the data server storage unit 13, performs an intersection determination between the target region and the mesh, and executes a process to determine whether there is a mesh that contains part of the target region (step S53, partially covering mesh determination step). If it is determined that there is, the data server control unit 11 proceeds to step S54. If it is not determined that there is, the data server control unit 11 ends the mesh code conversion process and returns the process to step S33.

[0165] [Step S54: Determine whether there are more detailed meshes] The data server control unit 11, in cooperation with the data server storage unit 13, executes a process of determining whether there are more detailed meshes than the meshes for which intersection determination was performed in the fully covered mesh determination step and the partially covered mesh determination step, as targets for further intersection determination (step S54, granularity change determination step). If it is determined that there are more detailed meshes, the data server control unit 11 proceeds to step S55. If it is not determined that there are more detailed meshes, the data server control unit 11 proceeds to step S56.

[0166] [Step S55: Change to Finer Mesh] The data server control unit 11, in cooperation with the data server storage unit 13, executes a process of changing the conversion target to a finer mesh (step S55, granularity change step). The data server control unit 11 returns the process to step S51.

[0167] From the viewpoint of load distribution, it is preferable that the granularity change step change the conversion object to a finer mesh, that is, change the conversion object to a finer mesh along a path that evens out the division load when dividing the conversion object for which intersection detection is performed. Such a path can be exemplified by a path that changes the conversion object to a finer mesh in the following order in the world mesh: first-order mesh, second-order mesh, third-order mesh, fourth-order mesh, fifth-order mesh, expanded 10m mesh, and expanded 1m mesh.

[0168] [Step S56: Adding Mesh Codes] The data server control unit 11, in cooperation with the data server storage unit 13, executes a process of adding the mesh codes of the meshes that were determined to be partially included in the partially covered mesh determination step to the converted mesh code (step S56, partially covered mesh code addition step). The data server control unit 11 ends the mesh code conversion process and returns the process to step S33.

[0169] [Effects of the Mesh Code Conversion Process] When an arbitrary region is given as the target region, it is easy to identify the primary mesh code that includes this region. After identifying the primary mesh code, the mesh code conversion process repeatedly checks whether the arbitrary region intersects with the divided meshes each time the target region is divided into finer meshes. This allows the mesh code conversion process to generate a mesh code that covers the arbitrary region (target region) up to a spatial resolution corresponding to a maximum expanded 1-meter mesh.

[0170] 17 is a flowchart showing an example of a preferred flow of the user information management process executed by the user information management server 2 of this embodiment. Hereinafter, an example of a preferred flow of the user information management process executed by the user information management server 2 of this embodiment will be described with reference to FIG.

[0171] [Step S61: Determine whether a user authentication request has been received] The management server control unit 21 executes the user authentication request receiving unit 211 in cooperation with the management server storage unit 22, management server communication unit 23, etc. Then, the management server control unit 21 executes a process of determining whether a user authentication request relating to a user who has requested authentication from the distributed mesh data server 1 from the terminal T has been received from the distributed mesh data server 1 using the user authentication API provided by the user authentication request receiving unit 211 (step S61, user authentication request receiving step). If it is determined that the request has been received, the management server control unit 21 proceeds to step S62. If it is not determined that the request has been received, the management server control unit 21 proceeds to step S65.

[0172] [Step S62: Execute User Authentication] The management server control unit 21 cooperates with the management server storage unit 22 and the like to execute the user authentication execution unit 212. The management server control unit 21 then executes a process in which the user authentication execution unit 212 references the user information database 222 and executes user authentication related to the user authentication request received in the user authentication request reception step (step S62, user authentication execution step). The management server control unit 21 then proceeds to step S63. To further improve security, the user authentication execution step preferably includes authentication using a one-time password. In this authentication, the user information management server 2 generates a one-time password at the start of a server session. The user information management server 2 then performs user authentication using the one-time password. The user information management server 2 then discards the one-time password at the end of the server session. This allows the user information management server 2 to prevent unauthorized access using the one-time password after the end of the server session.

[0173] In order to prevent user information from being sent to a server that is not included in the distributed mesh data server group, the user information management process preferably includes a procedure for determining whether the server that is the sender in the user authentication request receiving step is a distributed mesh data server 1 that is included in the distributed mesh data server group. Step S63 is an example of this procedure.

[0174] [Step S63: Determine whether server authentication was successful] The management server control unit 21, in cooperation with the management server storage unit 22 and the like, executes a process of determining whether server authentication of the distributed mesh data server 1 that is the sender in the user authentication request receiving step is successful by referring to the server database 221 and authentication information related to the server-specific private key associated with the distributed mesh data server 1 that is the sender, which is provided from the distributed mesh data server 1 in the user authentication request receiving step (step S63, server authentication step). If it is determined that the authentication is successful, the management server control unit 21 proceeds to step S64. If it is not determined that the authentication is successful, the management server control unit 21 proceeds to step S65.

[0175] [Step S64: Transmitting Authentication Result and User Information] The management server control unit 21 cooperates with the management server storage unit 22 and the like to execute the user information providing unit 213. Then, the management server control unit 21 executes a process in which the user information providing unit 213 transmits the authentication result related to the user authentication execution step and the like and the user information related to the user authenticated in the user authentication execution step to the sender of the user authentication request received in the user authentication request receiving step (step S64, user information providing step). The management server control unit 21 proceeds to step S65. The user information is acquired from the user information database 222 based on the authentication result in the user authentication execution step.

[0176] [Step S65: Determine whether user information has been received] The management server control unit 21 executes the user information receiving unit 214 in cooperation with the management server storage unit 22, the management server communication unit 23, etc. Then, the management server control unit 21 executes a process of determining whether user information has been received from the distributed mesh data server 1 by the user information receiving unit 214 (step S65, user information receiving step). If it is determined that the user information has been received, the management server control unit 21 proceeds to step S66. If it is not determined that the user information has been received, the management server control unit 21 returns the process to step S61 and repeats the processes from step S61 to step S66.

[0177] [Step S66: Storing User Information] The management server control unit 21 cooperates with the management server storage unit 22 and the like to execute the user information storage execution unit 215. Then, the management server control unit 21 executes processing to store the user information determined to have been received in the user information receiving step in the user information database 222 using the user information storage execution unit 215 (step S66, user information storage execution step). The management server control unit 21 returns the processing to step S61 and repeats the processing from step S61 to step S66.

[0178] [Effects of the User Information Management Process] In the user information management process, user authentication and, if necessary, server authentication are performed, and user information is sent only if authentication is successful (steps S61 to S64). Then, the user information updated by the distributed mesh data server 1, which is the recipient, is stored in the user information database 222 (steps S65 to S66). This protects the confidentiality of the user information, and the updated user information is managed centrally in the user information database 222. Therefore, the user information management server 2 contributes to the appropriate management of user information on the distributed mesh data server group.

[0179] [Flowchart of Server Authentication Processing Executed by Certification Authority Server 3] Fig. 18 is a flowchart showing an example of a preferred flow of server authentication processing executed by the certification authority server 3 of this embodiment. Hereinafter, an example of a preferred flow of server authentication processing executed by the certification authority server 3 of this embodiment will be described with reference to Fig. 18 .

[0180] [Step S71: Determine whether a server authentication request has been received] The certificate authority server control unit 31 executes the server authentication request receiving unit 311 in cooperation with the certificate authority server storage unit 32, the certificate authority server communication unit 33, etc. Then, the certificate authority server control unit 31 executes a process to determine whether a server authentication request related to the distributed mesh data server 1 has been received from any of the distributed mesh data servers 1 using the common secret key API provided by the server authentication request receiving unit 311 (step S71, server authentication request receiving step). If it is determined that a server authentication request has been received, the certificate authority server control unit 31 proceeds to step S72. If it is not determined that a server authentication request has been received, the certificate authority server control unit 31 returns the process to step S71.

[0181] The server authentication request determined to have been received in the server authentication request receiving step preferably includes authentication information related to a server-specific private key associated with the sender distributed mesh data server 1. This allows the certification authority server 3 to perform reliable server authentication using the server-specific private key. In addition, the server authentication request may include data that can be used to identify the sender distributed mesh data server 1, such as an IP address or MAC address, in order to be used for server authentication in the server authentication process.

[0182] The common secret key API provided by the server authentication request receiving unit 311 is preferably a one-time common secret key API that has an expiration date and is updated at regular intervals. This allows the certificate authority server 3 to prevent information intercepted after the expiration date from being decrypted, even if the one-time common secret key becomes non-secret.

[0183] [Step S72: Execute Server Authentication] The certificate authority server control unit 31 executes the server determination unit 312 in cooperation with the certificate authority server storage unit 32 and the certificate authority server communication unit 33. Then, the certificate authority server control unit 31 executes a process to execute server authentication for the distributed mesh data server 1 that is the sender of the server authentication request, based on the server authentication request received in the server authentication request reception step, using the server determination unit 312 (step S72, server authentication execution step). The certificate authority server control unit 31 proceeds to step S73.

[0184] The server authentication in the server authentication execution step is not particularly limited as long as it determines, based on the data included in the server authentication request, whether the sending server is one of the distributed mesh data servers 1 belonging to the distributed mesh data server group, i.e., one of the distributed mesh data servers 1 stored in the server database 321. If the server authentication request includes authentication information related to a server-specific private key, the server authentication includes a procedure for verifying the authentication information with a corresponding encryption key (for example, a public key corresponding to the server-specific private key stored in the server database 321).

[0185] [Step S73: Determine whether server authentication was successful] The certificate authority server control unit 31 executes the server determination unit 312 in cooperation with the certificate authority server storage unit 32, the certificate authority server communication unit 33, etc. Then, the certificate authority server control unit 31 executes processing to determine whether server authentication was successful in the server authentication execution step using the server determination unit 312 (step S73, server determination step). If it is determined that the server authentication was successful, the certificate authority server control unit 31 proceeds to step S74. If it is not determined that the server authentication was successful, the certificate authority server control unit 31 returns the processing to step S71.

[0186] When the common secret key API provided by the server authentication request receiving unit 311 is a one-time common secret key API, the server authentication process preferably includes a series of processes related to updating the one-time common secret key. Steps S74 to S75 are an example of such processes.

[0187] [Step S74: Determining Whether the One-Time Common Private Key Needs to be Updated] The certificate authority server control unit 31, in cooperation with the certificate authority server storage unit 32 and the like, executes a process of determining whether the one-time common private key needs to be updated (step S74, one-time common private key update determination step). If it is determined that the one-time common private key needs to be updated, the certificate authority server control unit 31 proceeds to step S75. If it is not determined that the one-time common private key needs to be updated, the certificate authority server control unit 31 proceeds to step S76.

[0188] The one-time common private key update determination step includes a procedure for determining that the one-time common private key needs to be updated when a server authentication request is sent from a source server belonging to a distributed mesh data server group that has not sent a server authentication request since the start of the server session. This allows the certification authority server 3 to provide a different one-time common private key for each distributed mesh data server group. This prevents, for example, distributed mesh data server groups managed by different administrators from leaking processing details of other distributed mesh data server groups. The determination in the one-time common private key update determination step includes a procedure for determining that the one-time common private key needs to be updated when the current time is after the expiration date of the one-time common private key. The expiration date of the one-time common private key may or may not match the update frequency of the one-time common private key. To achieve both reduced frequency of server authentication processing in the certification authority server 3 and security, the expiration date of the one-time common private key is preferably 60 minutes after the one-time common private key is acquired. In other words, the one-time common private key acquired from the certification authority server 3 is preferably cached in the distributed mesh data server 1 for 60 minutes.

[0189] With regard to the one-time shared private key update determination step, the higher the update frequency of the one-time shared private key, the higher the security guaranteed. However, the higher the update frequency of the one-time shared private key, the longer the update process of the one-time shared private key takes. In other words, there is a trade-off between security and calculation speed in the update frequency of the one-time shared private key. Meanwhile, it is considered that demand for map data is closely related to human activity, such as movement. Therefore, it is considered that the frequency of mesh data search requests has a daily periodicity. In order to update the one-time shared private key in accordance with this periodicity, it is preferable that the update frequency of the one-time shared private key in the certificate authority server 3 is once a day.

[0190] The update frequency of the one-time shared secret key may vary depending on the importance of the mesh data related to the search request. In this case, for example, for mesh data for which the economic loss due to leakage can be ignored to a certain extent, or for mesh data that is the subject of large-scale data processing, the update frequency of the one-time shared secret key may be set lower than once a day. For example, it may be "every week," which allows update processing to be performed on weekends. In addition, in this case, for critical mesh data for which leakage must be strictly prevented, the update frequency of the one-time shared secret key may be set higher than once a day. For example, it may be updated every hour, or it may be updated according to the amount of mesh data, such as "every time a predetermined number of critical mesh data are searched."

[0191] [Step S75: Updating the One-Time Common Secret Key] The certificate authority server control unit 31 executes a process of updating the one-time common secret key in cooperation with the certificate authority server storage unit 32 and the like (step S75, one-time common secret key update execution step). The certificate authority server control unit 31 then proceeds to step S76.

[0192] The one-time common private key update execution step is realized, for example, by a series of processes that acquire a one-time common private key list from a given one-time common private key list and delete the acquired one-time common private key from the list, and a process that generates a one-time common private key using a randomly generated seed value.

[0193] [Step S76: Providing Authentication Result and Common Private Key] The certificate authority server control unit 31 cooperates with the certificate authority server storage unit 32, the certificate authority server communication unit 33, etc. to execute the common private key providing unit 313. Then, the certificate authority server control unit 31 executes a process of providing the authentication result indicating successful server authentication and the common private key to the sender of the server authentication request received in the server authentication request receiving step, using the common private key providing unit 313 (step S76, common private key providing step). The certificate authority server control unit 31 returns the process to step S71 and repeats the processes from step S71 to step S76.

[0194] [Effects of Server Authentication Processing] In the server authentication processing, the server authentication request receiving unit 311 provides a common secret key API (step S71, etc.). The common secret key API performs server authentication using authentication information related to the server-specific secret key associated with the distributed mesh data server 1 requesting server authentication, and provides the distributed mesh data server 1 with a common secret key used among multiple servers (steps S71 to S76). This makes it possible to properly determine whether the server requesting server authentication is a distributed mesh data server 1 belonging to the distributed mesh data server group, and the common secret key is provided only to distributed mesh data servers 1 belonging to the distributed mesh data server group.

[0195] The above process makes it virtually impossible for a server other than the distributed mesh data server 1 to read the contents of user information transmitted using the common secret key, even if that server is able to intercept the information. Therefore, the confidentiality of the user information in the distributed mesh data server 1 is protected.

[0196] Furthermore, the server authentication request receiving unit 311 can provide a one-time common private key API as the common private key API. The one-time common private key API provides a one-time common private key with a set expiration date that is updated at regular intervals. This allows the distributed mesh data server 1 to use the one-time common private key. Therefore, the distributed mesh data server 1 can further reduce the risk of interception of user information while minimizing increases in processing load and processing time.

[0197] <Example of Use> The following is an example of use of the distributed mesh data server 1.

[0198] [Start of session] The user requests authentication from one of the distributed mesh data servers 1 via terminal T. The distributed mesh data server 1 that has received the authentication request makes an authentication request to the user information management server 2. The user information management server 2 performs authentication for the user and returns the authentication result. After successful authentication, the distributed mesh data server 1 starts a session for the user. User information such as the number of accesses and the user-specific API key provided by the user information management server 2 are read into the distributed mesh data server 1.

[0199] [Obtaining a common secret key] The distributed mesh data server 1 provides an authentication request for a server-specific private key, etc. to the one-time common private key API of the certification authority server 3. The certification authority server 3 performs authentication using the server-specific private key and provides the one-time common private key to the certification authority server 3. The distributed mesh data server 1 obtains the one-time common private key.

[0200] [Obtaining a mesh code from the current location] The user instructs terminal T to search for mesh data related to the current location. Terminal T obtains location information related to the current location via a GPS function or the like. Terminal T generates a mesh code from the location information related to the current location, etc.

[0201] [Searching for Mesh Data] The terminal T transmits a search request including the generated mesh code to the distributed mesh data server 1. The distributed mesh data server 1 that receives the search request may copy the search request as necessary, encrypt it with a one-time common secret key, and then provide it to other distributed mesh data servers 1. The distributed mesh data server 1 that receives the search request and the other distributed mesh data servers 1 acquire mesh data corresponding to the mesh code from the mesh data database 131 and the multimedia database 132.

[0202] At this time, each distributed mesh data server 1 updates the access count in response to the acquisition of mesh data. Then, each distributed mesh data server 1 encrypts the updated access count with a one-time common secret key and shares it. That is, the distributed mesh data server 1 updates the access count while performing server mutual authentication using the one-time common secret key. In addition, the other distributed mesh data servers 1 encrypt the acquired mesh data with a one-time common secret key and provide it to the distributed mesh data server 1 that received the search request.

[0203] Then, the distributed mesh data server 1 that receives the search request compiles the mesh data that has been encrypted with a one-time common secret key and provided to the distributed mesh data server 1 from other distributed mesh data servers 1, and transmits it to terminal T.

[0204] [Display of Mesh Data] Terminal T receives and displays the mesh data. As a result, terminal T generates a view of the administrative district corresponding to the current location of terminal T, for example, using multimedia data included in the mesh data. Terminal T can then play back a view of the administrative district, including images, audio, and video.

[0205] [Updating User Information] Furthermore, upon receiving the search request, the distributed mesh data server 1 instructs the user information management server 2 to store the encrypted, shared, and updated user information such as the number of accesses. The user information management server 2 stores the user information in the user information database 222. The user information management server 2 then performs billing processing, such as deducting the fee for providing mesh data from the points stored in the user information based on the number of accesses.

[0206] Second Embodiment The following describes a second embodiment of the present invention. In the second embodiment, individual data including personal and confidential information is statistically processed on a distributed mesh data server group similar to that of the first embodiment, and the statistical data is provided to an external party as mesh data, thereby realizing appropriate management of the information, including security and confidentiality.

[0207] <Background of the Second Embodiment> Mesh data is a statistical analysis of individual data, each of which is a mesh, as a unit of aggregation. Data linking on different distributed servers is possible using a mesh code as a common key. Furthermore, the individual data contains personal or confidential information. However, when operators of a distributed mesh data server group obtain data related to such individual data from individuals, there is a problem of psychological resistance on the part of individuals. Regarding psychological resistance, data disclosure is irreversible, meaning that once disclosed, data cannot be restored to a confidential state. In addition, in a distributed mesh data server group used by many users, individuals who provide individual data find it difficult to build a relationship of trust with the recipient because they are unaware of the recipients to whom the data will be disclosed and the limitations on the scope of use of the disclosed data.

[0208] Furthermore, when acquiring individual data from distributed mesh data servers, there is also the issue of incentive matching for providing individual data. Conventional technologies that provide mesh data generated from individual data do not allow for gradual data disclosure, resulting in a binary decision: whether to disclose or not. Furthermore, in such cases, it is impossible to determine the affinity between multiple data sets and the synergistic effects of combining them before disclosing them. Furthermore, because there is no precedent for such a case, it is impossible to build mutual understanding and trust based on precedent, nor to advance mutual understanding regarding the exchange of large amounts of data.

[0209] <Problems of the Second Embodiment> In light of the above background, when handling information such as user information on a distributed mesh data server group, there is a demand for security and confidentiality of the individual data provided for mesh data generation. "Security" here refers to making it difficult to reproduce the original data from the provided mesh data. "Confidentiality" refers to controlling personal information to protect the freedom and dignity of individuals.

[0210] As described above, the first embodiment of the present invention can protect the confidentiality of user information relating to users who use a distributed mesh data server group without unnecessarily increasing the processing load and processing time. On the other hand, the second embodiment has an objective of ensuring the security and confidentiality of the mesh data itself that is provided in addition to the above.

[0211] <Means for solving the problems in the second embodiment> As a result of extensive research into solving the above problems, the inventors have found that the above object can be achieved by acquiring a desired level of safety and a designation of a process to be executed to ensure the safety when generating mesh data, and then executing one of two types of processes related to ensuring the safety based on the acquired desired level of safety and the designation of the process. The inventors have then completed the present invention. Specifically, the present invention provides the following:

[0212] A first invention according to a second embodiment of the present invention (hereinafter also simply referred to as the "first invention") provides a distributed mesh data server further comprising: a safety designation acquisition unit that acquires a designation of desired safety and a process to be executed to ensure safety when generating mesh data; a mesh data generation unit that generates hierarchical mesh data; a mesh data integration unit that, when the designation includes a k-anonymity threshold n, integrates mesh data of an order k=n or less related to k-anonymity with neighboring mesh data; a noise addition unit that, when the designation includes a differential privacy criterion, adds noise to individual data of mesh data that does not satisfy the criterion; and a mesh data provision control unit that, when the designation includes an l-diversity threshold m, controls a hierarchical level of mesh data of an order l=m or less related to l-diversity so that the hierarchical level is not provided, wherein the safety designation acquisition unit acquires the designation including at least one of the k-anonymity threshold n, the differential privacy criterion, and the l-diversity threshold m.

[0213] Technologies for protecting the anonymity of data include (1) a technology for evaluating the anonymity of data using k-anonymity, (2) a technology for ensuring differential privacy by adding noise, and (3) a technology for evaluating the anonymity of data using l-diversity.

[0214] Regarding (1), if a data group consisting of multiple individual records, each of which has multiple attributes, has a minimum number of individual records with the same combination of attributes, the data group is evaluated as satisfying k-anonymity. In other words, since the data group has at least k individual records with the same combination of attributes, the data group has anonymity in that narrowing down the number of relevant individual records using the combination can be limited to k.

[0215] In the first invention, a mesh data integration unit integrates mesh data with low anonymity below a threshold n of k-anonymity with neighboring mesh data, preventing such mesh data with low anonymity from being provided. This allows the first invention to provide only mesh data that satisfies the k-anonymity specifications, thereby ensuring the safety and confidentiality of the mesh data itself.

[0216] Regarding (2), there is a method for estimating the value of an element related to a non-intersecting part of a data set by taking the difference between the statistical values ​​related to two data sets that have a common part. For example, for an element x, by taking the difference c = a - b between the sum a of the set A≡x+U and the sum b of the set B≡U, the value of x can be estimated from c. Similar estimations can also be realized for other statistical values, such as the average value.

[0217] The first invention adds noise to individual records (such as location information) of mesh data that does not satisfy the criteria for differential privacy and aggregates them, making it difficult to infer the individual records from differences in mesh data. This makes it possible to ensure the security and confidentiality of the mesh data itself.

[0218] Regarding (3), mesh data that satisfies k-anonymity is vulnerable to homogeneity attacks and background knowledge attacks. A homogeneity attack is an attack that attempts to guess the value of a sensitive attribute (e.g., skill, industry, occupation, age group, etc.) whose value you want to keep secret when it is the same for all k individual records. A background knowledge attack is an attack that exploits the association between one or more quasi-identifier attributes and a sensitive attribute to reduce the set of values ​​that can be used for the sensitive attribute.

[0219] In the first invention, the mesh data provision control unit provides only hierarchies of mesh data with l-diversity, where the sensitive attribute has at least l well-expressed values. Therefore, the first invention makes it difficult to narrow down the candidates for the sensitive attribute value itself to a number less than l. This ensures the security and confidentiality of the mesh data itself.

[0220] In the first invention, the safety specification acquisition unit acquires a specification that includes at least one of the k-anonymity threshold n, the differential privacy criterion, and the l-diversity threshold m, and therefore, processing related to the safety of at least one of (1) and (2) above is performed, and the output of the output mesh data item is suppressed by the evaluation of (3), thereby ensuring the safety and confidentiality of the mesh data itself.

[0221] As described above, the first invention not only protects the confidentiality of user information relating to users who use a distributed mesh data server group, but also ensures security and confidentiality for the mesh data itself that is provided, without unnecessarily increasing the processing load and processing time.

[0222] A second invention relating to the second embodiment of the present invention (hereinafter also simply referred to as the "second invention") provides a distributed mesh data server further comprising a first API unit that provides a mesh data generation program that generates mesh data from individual records.

[0223] When mesh data is generated from individual records in a distributed mesh data server group, the provider of the individual record has difficulty verifying the security and confidentiality of the mesh data before providing it. In the second invention, by providing a mesh data generation program using a first API unit, the provider of the individual record can generate mesh data on a secret computer or the like different from the distributed mesh data server group and verify the security and confidentiality of the mesh data.

[0224] As described above, the second invention not only protects the confidentiality of user information relating to users who use a distributed mesh data server group, but also ensures the safety and confidentiality of the mesh data itself that is provided, without unnecessarily increasing the processing load and processing time.

[0225] The third invention relating to the second embodiment of the present invention (hereinafter also referred to simply as the "third invention") provides a distributed mesh data server that further includes a second API unit that acquires information related to the generation of mesh data as confidential information and provides an indicator related to the relationship with the mesh data under its management.

[0226] There is a demand for determining the benefits of using a distributed mesh data server group, which is a meshstats infrastructure, for analytical purposes before releasing the data. The third invention obtains information related to the generation of mesh data, such as target variables and provided data, as private information, and provides indicators related to relationships such as correlation coefficients with other mesh data and spatiotemporal distances between sparse data, thereby providing information for determining the above-mentioned benefits before releasing the data. This allows users to understand relationships such as correlation coefficients with other mesh data that are linked and useful on the infrastructure, and spatiotemporal distances between sparse data, and confirm the above-mentioned benefits before deciding whether to upload the data to a production environment and perform analysis work.

[0227] As described above, the third invention not only protects the confidentiality of user information relating to users who use a distributed mesh data server group, but also ensures the safety and confidentiality of the mesh data itself that is provided, without unnecessarily increasing the processing load and processing time.

[0228] The fourth invention relating to the second embodiment of the present invention (hereinafter also referred to simply as the "fourth invention") provides a distributed mesh data server which further includes a mutual use condition setting unit which acquires conditions relating to targets for mutual data use and exchange, and sets other users who satisfy the conditions as targets for mutual data use and exchange.

[0229] When using a distributed mesh data server as a mesh data infrastructure, there is a demand for mutual data use and exchange on the infrastructure based on desired conditions among parties that meet the desired requirements. The fourth invention enables mutual data use and exchange among multiple users who meet similar conditions by obtaining conditions related to the objects of mutual data use and exchange (e.g., trust negotiation and incentive matching conditions exemplified by data disclosure conditions, counter-partner conditions, conditions related to the purpose of use, conditions related to the disclosure level, conditions related to costs, conditions related to the possibility of mutual information provision, conditions related to the data owner, and transfer conditions).

[0230] As described above, the fourth invention not only protects the confidentiality of user information relating to users who use a distributed mesh data server group, but also ensures the safety and confidentiality of the mesh data itself that is provided, without unnecessarily increasing the processing load and processing time.

[0231] <System S of Second Embodiment> FIG. 19 is a block diagram showing the hardware configuration and software configuration of the system S of the second embodiment. Below, the system S according to the second embodiment (hereinafter also simply referred to as "system S") will be described using FIG. 19 . In the following description, when referring to hardware components, software components, process names, etc. according to the second embodiment, phrases such as "according to the second embodiment" may be omitted. On the other hand, when referring to hardware components, software components, process names, etc. according to the first embodiment, phrases such as "according to the first embodiment" are not omitted. Furthermore, in the following description, as a general rule, descriptions of hardware components, software components, process names, etc. that are the same as those in the first embodiment will be omitted.

[0232] The system S according to the second embodiment generates mesh data with guaranteed security and confidentiality. The hardware configuration of the system S may be the same as that of the system S according to the first embodiment. The device for generating mesh data in the second embodiment is not limited to the distributed mesh data server 1 according to the second embodiment, but may be a separately configured computer. The following is a description of the system S for generating mesh data in the distributed mesh data server 1 according to the second embodiment, but a person skilled in the art will be able to easily conceive of a configuration for generating mesh data using a separately configured computer from this description.

[0233] [Distributed Mesh Data Server 1] The hardware configuration of the distributed mesh data server 1 of the second embodiment may be the same as that of the distributed mesh data server 1 of the first embodiment. The distributed mesh data server 1 of the second embodiment differs from the distributed mesh data server 1 of the first embodiment in that the data server control unit 11 and the like perform further processing to ensure safety and confidentiality in the software components involved in generating mesh data.

[0234] [Data Server Control Unit 11] The data server control unit 11 cooperates with the data server storage unit 13 and / or the data server communication unit 14 as necessary. The data server control unit 11 further realizes the following software components in addition to the software components of the program of this embodiment executed by the distributed mesh data server 1 of the first embodiment. Software components further realized in the second embodiment include a mesh data generation unit 123, a safety specification acquisition unit 124, a mesh data integration unit 125, a noise addition unit 126, a mesh data provision control unit 127, an API unit 128, and a mutual use condition setting unit 129. The functions provided by each of these software components will be described later in the description of a preferred flow of the mesh data generation process.

[0235] [Data Server Storage Unit 13] The hardware configuration of the data server storage unit 13 may be the same as that of the data server storage unit 13 of the first embodiment. The data server storage unit 13 can store the program of the second embodiment executed by the microcomputer, various data similar to the various data stored in the data server storage unit 13 of the first embodiment, and a mesh data conversion program provided to an external device by an API unit 128 (described later).

[0236] [Terminal T] In addition to the various data stored in the terminal T of the first embodiment, the terminal T of the second embodiment stores a mesh data conversion program provided by an API unit 128 (described later), individual data that are statistically processed as mesh data, mesh data generated from the individual data by the mesh data conversion program, etc. The software components and processing flow of the mesh data conversion program are the same as those related to the mesh data generation processing.

[0237] [Flowchart of Mesh Data Generation Processing] Fig. 20 is a flowchart showing an example of a preferred flow of mesh data generation processing. Fig. 21 is a flowchart continuing from the previous figure. Fig. 22 is a flowchart continuing from the previous figure. Fig. 23 is a flowchart continuing from the previous figure. Fig. 24 is a flowchart continuing from the previous figure. Fig. 25 is a flowchart continuing from the previous figure. Fig. 26 is a flowchart continuing from the previous figure. The following describes an example of a preferred flow of mesh data generation processing executed by the distributed mesh data server 1 etc. in the second embodiment, using Figs. 20 to 26.

[0238] The mesh data generation process executes a series of steps related to the generation of mesh data, steps S101 to S103 being an example of this process.

[0239] [Step S101: Determine whether to generate mesh data] The data server control unit 11 executes the mesh data generation unit 123 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether to generate mesh data by the mesh data generation unit 123 (mesh data generation determination step). If it is determined that mesh data should be generated, the data server control unit 11 proceeds to step S102. If it is not determined that mesh data should be generated, the data server control unit 11 proceeds to step S118.

[0240] The mesh data generation determination step includes a procedure for determining that mesh data should be generated when, for example, a user of terminal T issues an instruction via an input unit to start generating mesh data.

[0241] [Step S102: Acquire Individual Records] The data server control unit 11 executes a process to acquire individual records related to the generation of mesh data by the mesh data generation unit 123 (individual record acquisition step). The data server control unit 11 moves the process to step S103. The "individual record" here refers to individual data used to generate mesh data.

[0242] The individual record acquisition step acquires individual records, for example, by a procedure for acquiring individual records transmitted by terminal T, or by a procedure for acquiring individual records from a source identified by information transmitted by terminal T (for example, a database server connected to network N).

[0243] [Step S103: Generate Mesh Data] The data server control unit 11 executes a process of generating mesh data based on the individual records acquired in the individual record acquisition step (mesh data generation step) using the mesh data generation unit 123. The data server control unit 11 then proceeds to step S104.

[0244] The mesh data generation process preferably includes a series of steps to ensure the security of the mesh data based on specifications regarding the security of the mesh data to be generated. "Security" here refers to a low risk of leakage of personal information, confidential information, etc., contained in the individual records used to generate the mesh data. Steps S104 to S116 are an example of such a process.

[0245] [Step S104: Determine whether to acquire safety-related designation] The data server control unit 11 executes the safety designation acquisition unit 124 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process to determine whether to acquire a designation related to the safety of the mesh data using the safety designation acquisition unit 124 (safety designation acquisition determination step). If it is determined that the designation should be acquired, the data server control unit 11 proceeds to step S105. If it is not determined that the designation should be acquired, the data server control unit 11 proceeds to step S117.

[0246] The safety designation acquisition determination step includes a procedure for determining that a safety designation should be acquired when, for example, a user of terminal T instructs the user to make a safety designation by input via an input unit.

[0247] [Step S105: Obtaining Safety-Related Designation] The data server control unit 11 executes processing to obtain safety-related designation by the safety designation acquisition unit 124 (safety designation acquisition step). The data server control unit 11 moves the processing to step S106. The "safety-related designation" here includes at least one of the k-anonymity threshold n, the differential privacy criterion, or the l-diversity threshold m. The safety designation acquisition step obtains safety-related designation by, for example, a procedure for obtaining safety-related designation transmitted by terminal T.

[0248] Since l-diversity is an extension of k-anonymity, it is preferable that the threshold m for l-diversity is specified together with the threshold n for k-anonymity in specifying security.

[0249] The generation process preferably includes a series of processes that ensure that the mesh data satisfies the k-anonymity threshold n. This ensures that anyone attempting to learn about the privacy of individuals in the individual records from the mesh data can narrow down the individuals to a group of n people only. This protects the privacy of the individual records. Steps S106 to S109 are an example of this process.

[0250] [Step S106: Determine whether k-anonymity threshold n is included] The data server control unit 11 executes the mesh data integration unit 125 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process in which the mesh data integration unit 125 determines whether the safety designation acquired in the safety designation acquisition step includes the k-anonymity threshold n (k-anonymity determination step). If it is determined that the safety designation includes the k-anonymity threshold n, the data server control unit 11 proceeds to step S107. If it is not determined that the safety designation includes the k-anonymity threshold n, the data server control unit 11 proceeds to step S110.

[0251] [Step S107: Calculating k related to k-anonymity] The data server control unit 11 executes a process of calculating k related to k-anonymity for the mesh data generated in the mesh data generation step using the mesh data integration unit 125 (k-anonymity calculation step). The data server control unit 11 then proceeds to step S108.

[0252] "k-anonymity" as used herein refers to a state in which an individual in a dataset cannot be distinguished from at least (k-1) other individuals. Calculation of k for k-anonymity can be performed using a conventionally known method. "k-anonymity" will be explained below using an example.

[0253] For example, suppose there is the following data set relating to four individuals A to D: A (23 years old, female, secret 1), B (25 years old, female, secret 2), C (31 years old, male, secret 3), and D (33 years old, male, secret 4). Here, age and gender, which are information that can identify an individual when combined, are called "quasi-identifiers." Furthermore, secrets 1 to 4, which are information that should not be known to others, are called "sensitive attributes." In this case, if a person who wants to know the secret knows the target's age and gender, it can be determined from this data set that the target's secret is one of secrets 1 to 4.

[0254] Now, let's assume that the "age" of this dataset is aggregated as follows: A (20s, female, secret 1), B (20s, female, secret 2), C (30s, male, secret 3), and D (30s, male, secret 4). In this case, even if a person who wants to know the secret knows that the target's age is "23" and gender is "female," because there are two people who fit the "20s, female" category, the person who wants to know the secret cannot distinguish between the target individual and another individual from the dataset. As a result, even by looking at this dataset, the person who wants to know the secret cannot determine whether the target's secret is secret 1 or secret 2. The same is true for "30s, male." Therefore, such a dataset is said to have "2-anonymity." This protects the privacy of each individual whose individual records were used to generate the mesh data.

[0255] [Step S108: Determine whether data equal to or less than k=n is included] The data server control unit 11 executes a process in which the mesh data integration unit 125 determines whether data equal to or less than k=n is included for the k calculated in the k-anonymity calculation step, related to the mesh data generated in the mesh data generation step (k-anonymity designation determination step). If it is determined that data is included, the data server control unit 11 proceeds to step S109. If it is not determined that data is included, the data server control unit 11 proceeds to step S110.

[0256] [Step S109: Integration with nearby mesh data] The data server control unit 11 executes a process in which the mesh data integration unit 125 integrates the data determined to be "included" in the k-anonymity designation determination step with nearby mesh data (mesh data integration step). The data server control unit 11 proceeds to step S107.

[0257] The series of processes for ensuring that mesh data meets the requirements for k-anonymity preferably includes a procedure for ensuring that the data does not contain unstructured zeros. This procedure is realized, for example, by a series of procedures for detecting unstructured zeros and integrating data in which unstructured zeros are detected with neighboring mesh data. Note that "unstructured zeros" here refer to combinations that could be included in a dataset but are not included in the dataset. A privacy attack using "unstructured zeros" will be explained below using an example.

[0258] For example, suppose there is a dataset containing four individuals, A to D, as follows: A (20s, female, passed), B (20s, female, failed), C (20s, male, failed), and D (20s, male, failed). This dataset satisfies 2-anonymity because it contains at least two individuals in both the "20s, female" and "20s, male" categories.

[0259] However, if someone who wants to know the secret of whether the subject passed or failed knows that the subject is a man in his 20s, they can find out that the subject failed from the number of successful applicants by age and gender generated from this dataset. This is because the number of successful applicants includes a non-structural zero, where the number of successful applicants for "men in their 20s" is "0".

[0260] Here, if "female" and "male" are combined, the following dataset is obtained: A (20s, passed), B (20s, failed), C (20s, failed), D (20s, failed). This dataset does not contain unstructured zeros. Because the number of successful applicants in their 20s generated from this dataset is "1," it is not possible to determine whether any of individuals A-D passed or failed. Therefore, even if someone tries to learn the secret, they cannot determine whether the subject passed or failed from this dataset, even if they know the age and gender. Therefore, the privacy of each individual whose individual records were used to generate the mesh data is protected.

[0261] The generation process preferably includes a series of processes that ensure that the mesh data meets the criteria for differential privacy. This prevents anyone attempting to learn the privacy of an individual related to an individual record from identifying the individual's information based on the differences between multiple mesh data sets. This protects the privacy of the individual record. Steps S110 to S112 are an example of this process.

[0262] [Step S110: Determining Whether Differential Privacy Criteria Are Included] The data server control unit 11 executes the noise adding unit 126 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process in which the noise adding unit 126 determines whether the safety-related designation acquired in the safety designation acquisition step includes the differential privacy criteria (differential privacy determination step). If it is determined that the designation includes the differential privacy criteria, the data server control unit 11 proceeds to step S111. If it is not determined that the designation includes the differential privacy criteria, the data server control unit 11 proceeds to step S113.

[0263] The criterion for differential privacy is given by, for example, ε and δ of (ε, δ)-differential privacy. (ε, δ)-differential privacy is defined as follows: ｜Ｘ｜ When a dataset S according to satisfies (ε, δ)-differential privacy, ||x−y|| １ All x, y∈N satisfying ≦1 ｜Ｘ｜satisfies the formula "Pr[M(x)εS]≦exp(ε)Pr[M(y)εS]+δ".

[0264] [Step S111: Adding Noise] The data server control unit 11 executes a process of adding noise to the individual data using the noise adding unit 126 so that the individual data satisfies the indicators determined to be included in the differential privacy determination step (noise adding step). Next, the mesh data generation unit 123 executes a process of generating mesh statistics (mesh statistics generation step). The data server control unit 11 moves the process to step S112. The noise adding procedure in the noise adding step may be, for example, a procedure using a conventionally known noise adding algorithm related to (ε, δ)-differential privacy.

[0265] [Step S112: Determine whether there is mesh data that does not satisfy the criteria] The data server control unit 11 executes a process of determining whether there is mesh data that does not satisfy the above-mentioned criteria among the mesh data to which noise has been added in the noise adding step by the noise adding unit 126 (differential privacy criteria determination step). If it is determined that there is mesh data that does not satisfy the above-mentioned criteria, the data server control unit 11 proceeds to step S111. If it is not determined that there is mesh data, the data server control unit 11 proceeds to step S113.

[0266] When the process includes a series of processes for ensuring that the mesh data meets the k-anonymity threshold n, the generation process preferably also includes a series of processes for ensuring that the mesh data meets the l-diversity threshold m. This makes it difficult for someone attempting to learn the privacy of an individual associated with an individual record to use sensitive attributes to identify the individual from within a group of individuals whose attributes other than the sensitive attributes are homogeneous. This protects the privacy of the individual record. Steps S113 to S116 are an example of this process.

[0267] [Step S113: Determining Whether the l-diversity Threshold m is Included] The data server control unit 11 executes the mesh data provision control unit 127 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether the safety-related designation acquired in the safety designation acquisition step includes the l-diversity threshold m by the mesh data provision control unit 127 (l-diversity determination step). If it is determined that the safety-related designation includes the l-diversity threshold m, the data server control unit 11 proceeds to step S114. If it is not determined that the safety-related designation includes the l-diversity threshold m, the data server control unit 11 proceeds to step S117.

[0268] [Step S114: Calculating l related to l-diversity] The data server control unit 11 executes a process of calculating l related to l-diversity for the mesh data generated in the mesh data generation step using the mesh data provision control unit 127 (l-diversity calculation step). The data server control unit 11 then proceeds to step S115.

[0269] "l-diversity" here refers to a state in which there are at least l other types of sensitive attributes corresponding to homogeneous groups in a dataset. Calculation of l relating to l-diversity may be performed using a conventionally known method. "l-diversity" will be explained below using an example.

[0270] For example, suppose there is the following data set for six individuals A to F: A (20s, female, stomach ulcer), B (20s, female, heart disease), C (30s, male, malignant neoplasm), D (30s, male, malignant neoplasm), E (20s, male, heart disease), and F (20s, male, heart disease). Here, the sensitive attribute is the name of the disease. This data set is divided into groups of two individuals (20s, female), two individuals (30s, male), and two individuals (20s, male), so it has 2-anonymity. However, the sensitive attribute for the two individuals (30s, male) is only one type, "malignant neoplasm." Therefore, someone who wants to know the secret can narrow down the subjects with "malignant neoplasm" to either of the two individuals (30s, male). The same applies to the individuals (20s, male).

[0271] Let's assume that the "age" of this dataset is integrated into the following hierarchy: A (20s-30s, female, stomach ulcer), B (20s-30s, female, heart disease), C (20s-30s, male, malignant neoplasm), D (20s-30s, male, malignant neoplasm), E (20s-30s, male, heart disease), F (20s-30s, male, heart disease). In this case, even if someone who wants to know the secret knows that the subject has a "malignant neoplasm," they can only narrow down the subject to four people (20s-30s, male). Therefore, such a dataset is said to have "2-diversity." This protects the privacy of each individual whose individual records were used to generate the mesh data.

[0272] [Step S115: Determining Whether Hierarchies Below l=m Are Included] The data server control unit 11 executes a process in which the mesh data provision control unit 127 determines whether hierarchies below l=m are included for l calculated in the l-diversity calculation step, related to the mesh data generated in the mesh data generation step (l-diversity designation determination step). If it is determined that they are included, the data server control unit 11 proceeds to step S116. If it is not determined that they are included, the data server control unit 11 proceeds to step S117.

[0273] [Step S116: Control so that the relevant layer is not provided] The data server control unit 11 executes a process in which the mesh data provision control unit 127 controls the provision of a layer determined to be included in the l-diversity designation determination step, among the layers related to the mesh data generated in the mesh data generation step, so that the layer is not provided (mesh data provision control step). The data server control unit 11 proceeds to step S114.

[0274] An example of control in the mesh data provision control step will be described using the above example. In the above example, the 20's and 30's hierarchies do not satisfy the l-diversity threshold of "2". Therefore, the mesh data provision control unit 127 controls so that the 20's and 30's hierarchies are not provided, and only a higher integrated hierarchical level, for example, a hierarchical level combining the 20's and 30's, is provided. In this way, the mesh data provision control step protects the privacy of each individual associated with the individual records used to generate the mesh data.

[0275] [Step S117: Providing Mesh Data] The data server control unit 11 executes a process of providing the mesh data generated in the mesh data generation step (mesh data provision step) using the mesh data provision control unit 127. The data server control unit 11 then proceeds to step S118.

[0276] When each of the above-mentioned privacy protection processes is performed, the mesh data providing step performs privacy protection according to each process, thereby protecting the privacy of each individual whose individual record is used to generate the mesh data.

[0277] The mesh data generation process preferably includes a series of processes for providing a mesh data generation program via an API. This allows users to generate mesh data in their own environment and verify its security without uploading individual data to an external mesh data server group. Steps S118 to S119 are an example of this process.

[0278] [Step S118: Determine whether to provide a program] The data server control unit 11 executes the API unit 128 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process of determining whether to provide a mesh data generation program that generates mesh data from an individual form using the API unit 128 (program provision determination step). If it is determined that the program should be provided, the data server control unit 11 proceeds to step S119. If it is not determined that the program should be provided, the data server control unit 11 proceeds to step S120.

[0279] The program provision determination step includes a procedure of determining that the program should be provided when a user of the terminal T issues an instruction to provide the program via an input unit, for example.

[0280] [Step S119: Providing Mesh Data Generation Program] The data server control unit 11 executes a process of providing a mesh data generation program that generates mesh data from the individual records via the API unit 128 (program providing step). The data server control unit 11 proceeds to step S120.

[0281] The mesh data generation program is a program that causes a computer to execute at least a portion of the mesh data generation process described above. This portion includes at least an individual data acquisition step and a mesh data generation step. Preferably, this portion also includes a series of processes that ensure the security of the mesh data based on specifications related to the security of the mesh data to be generated. This series of processes preferably includes, for example, at least one of a series of processes that ensures that the mesh data satisfies a threshold n for k-anonymity, a series of processes that ensures that the mesh data satisfies standards for differential privacy, or a series of processes that ensures that the mesh data satisfies a threshold m for l-diversity.

[0282] The mesh data generation process preferably includes a series of steps that acquires private information related to the generation of mesh data and provides indicators of relationships with managed mesh data. The indicators include correlation coefficients with other mesh data with linkage utility on the platform, spatiotemporal distances between sparse data, and other examples of relationships. This allows users to confirm the benefits of using the MeshStats platform for analytical purposes based on the indicators before providing mesh data. Based on this confirmation, users can then decide whether to upload the data to a production environment where the mesh data will be made public and proceed with the analysis. Steps S120 to S123 are an example of this process.

[0283] [Step S120: Determine whether to provide an index] The data server control unit 11 executes the API unit 128 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process using the API unit 128 to determine whether to provide an index relating to the relationship between information related to the generation of mesh data and the mesh data under its management (index provision determination step). If it is determined that an index should be provided, the data server control unit 11 proceeds to step S121. If it is not determined that an index should be provided, the data server control unit 11 proceeds to step S124.

[0284] The index provision determination step includes a procedure for determining whether to provide the index when a user of terminal T instructs the user to provide the index by input via an input unit, for example.

[0285] [Step S121: Obtaining Information Related to Mesh Data Generation] The data server control unit 11 executes a process of obtaining information related to mesh data generation using the API unit 128 (generation information obtaining step). The data server control unit 11 proceeds to step S122.

[0286] [Step S122: Control to Keep Private] The data server control unit 11 executes a process of controlling the information acquired in the generation information acquisition step to be kept private by the API unit 128 (privacy control step). The data server control unit 11 moves the process to step S123. This control is realized, for example, by a procedure of storing the information in a private area of ​​the data server storage unit 13, a procedure of assigning an attribute indicating that the information is private information, or the like.

[0287] [Step S123: Providing an index] The data server control unit 11 executes a process of providing an index relating to the relationship between the information acquired in the generation information acquisition step and the mesh data under the management of the distributed mesh data server 1, using the API unit 128 (index providing step). The data server control unit 11 proceeds to step S124.

[0288] The indices include indices relating to relationships exemplified by, for example, a correlation coefficient with other mesh data that are linked and useful on the platform, a spatiotemporal distance between sparse data, etc. The index providing step calculates at least one of these indices relating to relationships and provides it to the user.

[0289] It is preferable that the mesh data generation process includes a series of processes for obtaining conditions related to the targets for mutual data use and exchange, and setting other users who meet the conditions as targets for mutual data use and exchange.

[0290] If there are no restrictions on the parties with whom data can be used or exchanged, there is a concern that data use and exchange may become unfair. For example, data from a user who charges low fees for the use of their own data may be used by a party who charges high fees for the use of their data.

[0291] This series of processes allows users to pre-set trust negotiation or incentive matching conditions, such as the conditions under which they will disclose their data, the conditions for available counterparties, the conditions for the purpose of use, the conditions for the disclosure level, the presence or absence of costs and pricing conditions, the conditions for the possibility of mutual information provision (exchange), the data owner, and transfer conditions. Based on these conditions, users can mutually use and exchange data on the platform with parties that meet their desires, under the desired conditions, without having to use and exchange data with all parties. Steps S124 to S127 are an example of this process.

[0292] [Step S124: Determine whether to register conditions] The data server control unit 11 executes the mutual use condition setting unit 129 in cooperation with the data server storage unit 13, the data server communication unit 14, etc. Then, the data server control unit 11 executes a process to determine whether to register conditions related to targets for mutual data use and exchange using the mutual use condition setting unit 129 (condition registration determination step). If it is determined that registration should be performed, the data server control unit 11 proceeds to step S125. If it is determined that registration should not be performed, the data server control unit 11 returns the process to step S101 and repeats the processes from step S101 to step S127.

[0293] The condition registration determination step includes a procedure for determining that the condition should be registered when, for example, a user of terminal T gives an instruction to register the condition by input via an input unit.

[0294] [Step S125: Obtaining conditions related to targets for mutual data use and exchange] The data server control unit 11 executes a process of obtaining conditions related to targets for mutual data use and exchange using the mutual use condition setting unit 129 (condition obtaining step). The data server control unit 11 proceeds to step S126. The condition obtaining step includes a procedure of storing the obtained conditions in the data server storage unit 13.

[0295] (Regarding conditions) The conditions related to the condition acquisition step are not particularly limited as long as they are conditions for trust negotiation or incentive matching related to mutual use of mesh data. Such conditions include, for example, the conditions under which one's own data will be made public, conditions for available counterparts, conditions related to the purpose of use, conditions for the disclosure level, whether or not costs will be incurred and price conditions, conditions for the possibility of mutual information provision (exchange), data holders, transfer conditions, etc.

[0296] [Step S126: Identifying Other Users Who Satisfy the Conditions] The data server control unit 11 executes a process to identify other users who satisfy the conditions acquired in the condition acquisition step (user identification step) using the mutual use condition setting unit 129. The data server control unit 11 proceeds to step S127.

[0297] The user identification step includes, for example, a procedure for identifying other users who share common ground with one or more conditions related to the trust negotiation or incentive matching described above. For example, for a user who has registered a mutual information provision (exchange) possibility condition of "mutually usable," a use purpose of "academic use," and a cost condition to be paid to the other party of "less than △△△△ yen per data file," this procedure identifies another user who has registered a mutual information provision (exchange) possibility condition of "mutually usable," a use condition of "academic use only," and a cost condition for provision of "△△△△ yen per data file" as the other user with common ground.

[0298] [Step S127: Setting as a target for mutual data use and exchange] The data server control unit 11 executes a process of setting the other user identified in the user identification step as a target for mutual data use and exchange by the mutual use condition setting unit 129. The data server control unit 11 returns the process to step S101 and repeats the processes from step S101 to step S127.

[0299] [Effects of Mesh Data Generation Processing] In the mesh data generation processing, the mesh data generation unit 123 acquires an individual form and generates mesh data (steps S101 to S103). This allows the user to use the mesh data generated from the individual form.

[0300] In the mesh data generation process, the safety specification acquisition unit 124 acquires the desired safety when generating mesh data and the specification of the process to be executed to ensure the safety (steps S104 to S105). This allows the distributed mesh data server 1 to perform the process based on the specification and provide only mesh data that meets the specified safety.

[0301] In the mesh data generation process, the mesh data integration unit 125 integrates mesh data with low anonymity that is below the k-anonymity threshold n with neighboring mesh data, preventing such mesh data with low anonymity from being provided (steps S106 to S109). This allows the distributed mesh data server 1 to provide only mesh data that satisfies the k-anonymity specifications, ensuring the safety and confidentiality of the mesh data itself.

[0302] In the mesh data generation process, the noise adding unit 126 adds noise to the mesh data so that the mesh data satisfies the standard of differential privacy (steps S110 to S112). As a result, the distributed mesh data server 1 provides only mesh data to which noise has been added so that personal information cannot be identified from the differences between multiple mesh data, thereby ensuring the safety and confidentiality of the mesh data itself.

[0303] In the mesh data generation process, the mesh data provision control unit 127 integrates mesh data with low anonymity below the k-anonymity threshold n with neighboring mesh data, and in addition to processing to prevent such mesh data with low anonymity from being provided, controls to provide only hierarchies that satisfy the l-diversity threshold m (steps S113 to S116). In this way, the distributed mesh data server 1 makes it difficult for someone attempting to learn the privacy of an individual related to an individual record to use sensitive attributes to identify an individual from within a group of individuals with the same attributes other than the sensitive attributes, thereby ensuring the safety and confidentiality of the mesh data itself.

[0304] Therefore, the mesh data generation process not only protects the confidentiality of user information related to users who use the distributed mesh data server group, but also increases the anonymity of individual records in the provided mesh data itself, ensuring safety and confidentiality, without unnecessarily increasing the processing load and processing time.

[0305] In the mesh data generation process, the API unit 128 provides the mesh data generation program via the API (steps S118 to S119). This allows the distributed mesh data server 1 to generate mesh data in a local environment without uploading the individual data to an external mesh data server group, thereby supporting the user in verifying the security of the generated mesh data.

[0306] In the mesh data generation process, the API unit 128 acquires information related to the generation of mesh data as private information and provides an index related to the relationship with the mesh data under its management (steps S120 to S123). This allows the distributed mesh data server 1 to confirm the benefits of using the MeshStats platform for analytical purposes based on the index before the user provides mesh data. Based on this confirmation, the distributed mesh data server 1 can help the user decide whether to upload the data to a production environment where the mesh data will be made public and proceed with the analysis work.

[0307] In the mesh data generation process, the mutual use condition setting unit 129 acquires conditions relating to targets for mutual data use and exchange, and sets other users who satisfy the conditions as targets for mutual data use and exchange (steps S124 to S127). In this way, the distributed mesh data server 1 can support mutual data use and exchange on the platform between parties that match the user's desires, based on the conditions set by the user himself, without the user having to use and exchange data with all parties.

[0308] Therefore, the mesh data generation process not only protects the confidentiality of user information related to users who use the distributed mesh data server group, but also ensures safety and confidentiality in the mesh data provision process, without unnecessarily increasing the processing load and processing time.

[0309] <Example of Use of Distributed Mesh Data Server 1 of Second Embodiment> The following is an example of use of the distributed mesh data server 1 of the second embodiment.

[0310] [Designation for Ensuring Safety] A user who generates and provides mesh data designates the safety of the mesh data generation and the processing to be executed to ensure the safety via the terminal T. The distributed mesh data server 1 receives information related to the designation from the terminal T.

[0311] [Processing related to k-anonymity] If the above specification includes a k-anonymity threshold n, the distributed mesh data server 1 generates mesh data to satisfy the threshold n by, for example, integrating mesh data with low anonymity that falls below the k-anonymity threshold n with nearby mesh data and preventing such mesh data with low anonymity from being provided.

[0312] [Processing Related to Differential Privacy] If the above-mentioned specification includes a criterion for differential privacy, the distributed mesh data server 1 generates mesh data so as to satisfy the criterion by adding noise, etc. Note that this processing may be performed on mesh data that has been processed for k-anonymity, or on mesh data that has not been processed for k-anonymity.

[0313] [Processing Related to l-Diversity] If the above specification includes an l-diversity threshold m, the distributed mesh data server 1 controls the provision of mesh data so that only hierarchies that satisfy the l-diversity threshold m are provided. Note that this processing may be performed on mesh data that has undergone one or more of the above-mentioned various processes, or on mesh data that has not undergone any of the above-mentioned various processes.

[0314] [Provision of Generated Mesh Data] The user issues a command to start providing the generated mesh data via the terminal T. The distributed mesh data server 1 starts providing the generated mesh data based on the command.

[0315] [Searching and Displaying Mesh Data] The user searches for and displays mesh data using the same procedure as in the example of use of the first embodiment.

[0316] [Session Start] The user starts a session by performing authentication using the same procedure as in the usage example of the first embodiment. The distributed mesh data server 1 obtains a common secret key from the certificate authority server 3 and executes processing while protecting the user's privacy. Specifically, the distributed mesh data server 1 encrypts user information to prevent personal information such as mesh data usage from leaking to the outside. The distributed mesh data server 1 also achieves further privacy protection by using a one-time common secret key that is updated within a certain period of time as needed. The user searches for mesh data while their privacy is protected, and the search results are displayed on the terminal T or the like.

[0317] [End of session] The distributed mesh data server 1 commands the storage of user information at the end of a session. This user information includes data related to usage, such as the number of times the mesh data has been accessed. The system S bills the user for system usage fees, etc., based on the stored user information.

[0318] [Variations in mesh data generation and provision] Users can use a variety of variations in the generation and provision of mesh data based on individual records and personal data while ensuring the security of these data.

[0319] [Variation 1: Local mesh data generation using a conversion API] The user issues a command via the terminal T to provide a mesh data generation program via an API (conversion API). The distributed mesh data server 1 provides the mesh data generation program via the API. The user runs the program in their local environment to generate mesh data from the individual records.

[0320] [Variation 2: Obtaining indicators related to relationships with other mesh data] The user provides information related to the generation of mesh data as private information via terminal T and issues a command to provide relationships between the information and indicators related to the relationships between the information and other mesh data. The distributed mesh data server 1 obtains information related to the generation of mesh data as private information and provides relationships between the information and indicators related to the relationships between the information and other mesh data. The user references the relationships and confirms the benefits of providing the mesh data. The user then issues a command to start providing mesh data that the user determines will be beneficial.

[0321] [Variation 3: Setting conditions for mutual data use and exchange] The user sets conditions for mutual data use and exchange via terminal T and issues a command to start providing the generated mesh data. Based on the command, the distributed mesh data server 1 starts providing the mesh data so that data can be mutually used and exchanged with parties that meet the above conditions.

[0322] It should be noted that within the scope of the concept of the present invention, those skilled in the art may conceive of various modifications and alterations. Therefore, it is understood that such modifications and alterations fall within the scope of the present invention. For example, even if a person skilled in the art appropriately adds, deletes, or modifies components of the above-described embodiment, or adds, omits, or modifies the conditions of a process, such modifications are also included within the scope of the present invention as long as they maintain the gist of the present invention.

[0323] S System 1 Distributed mesh data server 11 Data server control unit 111 User authentication request receiving unit 112 User authentication unit 113 Session initiation unit 114 Common secret key acquisition unit 115 Encryption information acquisition unit 116 Decryption unit 117 Mesh code receiving unit 118 Mesh data providing unit 119 User information update unit 120 Encryption unit 121 Encryption information providing unit 122 Session termination unit 123 Mesh data generation unit 124 Safety designation acquisition unit 125 Mesh data integration unit 126 Noise addition unit 127 Mesh data provision control unit 128 API unit 129 Mutual use condition setting unit 13 Data server storage unit 131 Mesh data database 132 Multimedia database 14 Data server communication unit 2 User information management server 21 Management server control unit 211 User authentication request receiving unit 212 User authentication execution unit 213 User information providing unit 214 User information receiving unit 215 User information storage execution unit 22 Management server storage unit 221 Server database 222 User information database 23 Management server communication unit 3 Certification authority server 31 Certification authority server control unit 311 Server authentication request receiving unit 312 Server determination unit 313 Common secret key providing unit 32 Certification authority server storage unit 321 Server database N Network T Terminal

Claims

1. A distributed mesh data server comprising: a mesh data providing unit that provides mesh data corresponding to a mesh code; a user information updating unit that updates user information relating to the user when the mesh data providing unit provides mesh data to the user; a common private key acquisition unit that acquires a common private key used by a plurality of servers; an encryption unit that encrypts the user information using the common private key; an encrypted information providing unit that provides the encrypted user information to other servers; an encrypted information acquisition unit that acquires the encrypted user information from the other servers; and a decryption unit that decrypts the encrypted user information.

2. The distributed mesh data server according to claim 1, wherein the common secret key acquisition unit acquires a one-time common secret key that is updated within a certain period of time using a server-specific private key associated with the distributed mesh data server.

3. The distributed mesh data server of claim 1, wherein the user information includes a user API key that identifies the user and an access count that is the number of times the user has accessed the distributed mesh data server, and the user information update unit updates the access count when the mesh data providing unit provides mesh data to the user.

4. The distributed mesh data server of claim 1, further comprising: a user authentication request receiving unit that receives an authentication request from the user; a user authentication unit that authenticates the user when the user authentication request receiving unit receives the authentication request; and a session initiation unit that initiates a user session for the user when the user authentication unit successfully authenticates the user.

5. The distributed mesh data server according to claim 4, further comprising a session termination unit which terminates a user session relating to said user when a request to terminate said user session is received, said session termination unit instructing storage of said user information.

6. A program that causes a terminal to execute a location information acquisition step of acquiring location information indicating the current location of the terminal, a mesh code generation step of generating a mesh code corresponding to the current location based on the location information, and a mesh data request step of requesting an external device to provide mesh data corresponding to the mesh code.

7. The distributed mesh data server of claim 1, further comprising: a safety designation acquisition unit that acquires a designation of desired safety and a process to be executed to ensure safety when generating mesh data; a mesh data generation unit that generates hierarchical mesh data; a mesh data integration unit that, when the designation includes a k-anonymity threshold n, integrates mesh data having an order of k=n or less related to k-anonymity with neighboring mesh data; a noise addition unit that, when the designation includes a differential privacy criterion, adds noise to individual data of mesh data that does not satisfy the criterion; and a mesh data provision control unit that, when the designation includes an l-diversity threshold m, controls a hierarchical level of mesh data having an order of l=m or less related to l-diversity so that the hierarchical level is not provided, wherein the safety designation acquisition unit acquires the designation including at least one of the k-anonymity threshold n, the differential privacy criterion, and the l-diversity threshold m.

8. The distributed mesh data server according to claim 1, further comprising an API unit that provides a mesh data generation program for generating mesh data from individual records.

9. The distributed mesh data server according to claim 1, further comprising an API unit that acquires information relating to the generation of mesh data as private information and provides an index relating to the relationship between said information and the mesh data under its management.

10. The distributed mesh data server of claim 1, further comprising a mutual use condition setting unit which acquires conditions relating to targets for mutual data use and exchange, and sets other users who satisfy the conditions as targets for mutual data use and exchange.

Images