Data management device, monitoring support device, management support device, data management method, monitoring support method, management support method, and recording medium

Abstract

This data management device comprises a derived key output unit, a query log acquisition unit, a search request acquisition unit, a search unit, and a search result output unit. The derived key output unit outputs a first derived key, generated from a master key, to an information processing device used by a monitoring entity that monitors an access status. The query log acquisition unit acquires a query log in an encrypted state based on a second derived key generated from the master key and the first derived key, the query log recording queries related to access to data managed by a rights entity which is an entity different from the monitoring entity and has rights to the data. The search request acquisition unit acquires a search request for searching the query log, in a state in which the search request is encrypted on the basis of the first derived key. The search unit searches the query log in the encrypted state, on the basis of the search request. The search result output unit outputs a query log search result.

Description

Data management device, monitoring support device, management support device, data management method, monitoring support method, management support method, and recording medium

[0001] The present disclosure relates to a data management device and the like.

[0002] With the advancement of medical care, there are an increasing number of cases where people receive treatment across borders, such as in medical tourism. Furthermore, when receiving treatment across borders, medical data related to the treatment may also be transferred across borders, for example, when a doctor in the patient's home country reviews the data. Furthermore, because medical data is, for example, a patient's personal information, it is protected by the laws and regulations of each country in which it is transferred. Therefore, medical data must be transferred in a manner that eliminates the risk of it being leaked to unauthorized parties.

[0003] The medical data search system of Patent Document 1 stores medical data in an encrypted state and performs a confidential search of the medical data based on the scope of disclosure.

[0004] Japanese Patent Application Laid-Open No. 2019-57822

[0005] The technique described in Patent Document 1 may not be able to safely check the status of access to data.

[0006] In order to solve the above-mentioned problems, the present disclosure aims to provide data management that can improve the security of checking the status of access to data.

[0007] In order to solve the above problems, a data management device according to one embodiment of the present disclosure includes a derived key output means for outputting a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status; a query log acquisition means for acquiring a query log that records queries regarding access to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in an encrypted state based on a second derived key and the first derived key generated from the master key; a search request acquisition means for acquiring a search request to search the query log, in an encrypted state based on the first derived key; a search means for searching the query log in an encrypted state based on the search request; and a search result output means for outputting search results of the query log.

[0008] A monitoring support device according to one aspect of the present disclosure includes a derived key acquisition means for acquiring a first derived key from a data management device that stores a query log, which records queries related to access to data, in an encrypted state based on a first derived key and a second derived key generated from a master key; a search request output means for outputting a search request for searching the query log to the data management device in an encrypted state based on the first derived key; a search result acquisition means for acquiring search results of the query log from the data management device; and an output means for outputting the acquired search results.

[0009] In one aspect of the present disclosure, the management support device includes a request acquisition means for acquiring a disclosure request for a session log associated with a query log based on search results of a query log that records queries regarding access to data; an acquisition means for acquiring a session log specified by the disclosure request; a confirmation log output means for outputting the acquired session log as information for confirming whether the session log can be disclosed to the information processing device that sent the disclosure request; a determination result acquisition means for acquiring a determination result as to whether the session log can be disclosed; and an output means for outputting a session log that can be disclosed as a result of the determination to the information processing device that sent the disclosure request.

[0010] A data management method in one aspect of the present disclosure includes a search request acquisition means that outputs a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status, acquires a query log that records queries regarding access to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in an encrypted state based on a second derived key and the first derived key generated from the master key, and acquires a search request for searching the query log, in an encrypted state based on the first derived key, and searches the query log in an encrypted state based on the search request, and outputs search results of the query log.

[0011] A monitoring support method in one aspect of the present disclosure includes obtaining a first derived key from a data management device that stores a query log that records queries regarding access to data in an encrypted state based on a first derived key and a second derived key generated from a master key, outputting a search request to search the query log to the data management device in an encrypted state based on the first derived key, obtaining search results for the query log from the data management device, and outputting the obtained search results.

[0012] A management support method in one aspect of the present disclosure obtains a disclosure request for a session log associated with a query log based on search results of a query log that records queries regarding access to data, obtains the session log specified by the disclosure request, outputs the obtained session log as information to confirm whether the session log can be disclosed to the information processing device that sent the disclosure request, obtains a determination result as to whether the session log can be disclosed, and outputs the session log that can be disclosed as a result of the determination to the information processing device that sent the disclosure request.

[0013] A recording medium according to one aspect of the present disclosure non-temporarily records a data management program that causes a computer to execute the following processes: outputting a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status; acquiring a query log that records queries regarding access to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in an encrypted state based on a second derived key and the first derived key generated from the master key; acquiring a search request to search the query log, in an encrypted state based on the first derived key; searching the query log in an encrypted state based on the search request; and outputting search results of the query log. A recording medium according to one aspect of the present disclosure non-temporarily records a monitoring support program that causes a computer to execute the following steps: obtain a first derived key from a data management device that stores a query log, which records queries related to access to data, in an encrypted state based on a first derived key and a second derived key generated from a master key; output a search request to the data management device to search the query log in an encrypted state based on the first derived key; obtain search results from the data management device using a search result obtaining means; and output the obtained search results.

[0014] A recording medium according to one aspect of the present disclosure non-temporarily records a management support program that causes a computer to execute the following processes: obtaining a request to disclose a session log associated with a query log based on search results of a query log that records a query related to access to data; obtaining the session log specified by the disclosure request; outputting the obtained session log as information for confirming whether the session log can be disclosed to the information processing device that sent the disclosure request; obtaining a determination result as to whether the session log can be disclosed; and outputting the session log that can be disclosed as a result of the determination to the information processing device that sent the disclosure request.

[0015] According to the present disclosure, it is possible to improve the security of checking the status of access to data.

[0016] FIG. 1 is a diagram illustrating an example of a configuration of a medical data system in the present disclosure. FIG. 2 is a diagram illustrating an example of a configuration of a data management device in the present disclosure. FIG. 3 is a diagram illustrating an example of a data flow in the present disclosure. FIG. 4 is a diagram illustrating an example of a query log in the present disclosure. FIG. 5 is a diagram illustrating an example of an encrypted query log in the present disclosure. FIG. 6 is a diagram illustrating an example of a session log in the present disclosure. FIG. 7 is a diagram illustrating an example of a configuration of a monitoring assistance device in the present disclosure. FIG. 8 is a diagram illustrating an example of a configuration of a management assistance device in the present disclosure. FIG. 9 is a diagram illustrating an example of an operation flow of a data management device in the present disclosure. FIG. 10 is a diagram illustrating an example of an operation flow of a monitoring assistance device in the present disclosure. FIG. 11 is a diagram illustrating an example of an operation flow of a monitoring assistance device in the present disclosure. FIG. 12 is a diagram illustrating an example of an operation flow of a management assistance device in the present disclosure. FIG. 13 is a diagram illustrating an example of a data flow in the present disclosure. FIG. 14 is a diagram illustrating an example of a hardware configuration in the present disclosure.

[0017] An embodiment of the present disclosure will be described in detail with reference to the drawings. FIG. 1 is a diagram illustrating an example of the configuration of a medical data system. The medical data system includes, for example, a data management device 10, a monitoring support device 20, a management support device 30, a data storage device 40, a supervisor terminal device 50, and an administrator terminal device 60. The data management device 10 is connected to the monitoring support device 20, for example, via a network. The data management device 10 is also connected to the management support device 30, for example, via a network. The data management device 10 is also connected to the data storage device 40, for example, via a network. The monitoring support device 20 is also connected to the management support device 30, for example, via a network. The monitoring support device 20 is also connected to the supervisor terminal device 50, for example, via a network. The management support device 30 is also connected to the administrator terminal device 60, for example, via a network. There may be multiple monitoring support devices 20, management support devices 30, data storage devices 40, supervisor terminal devices 50, and administrator terminal devices 60. The number of monitoring support devices 20, management support devices 30, data storage devices 40, supervisor terminal devices 50, and manager terminal devices 60 can be set as appropriate.

[0018] The medical data system, for example, searches for access status to data. The data is, for example, medical data. For example, the medical data is patient medical information. The access status is, for example, saved as an access log, which is a record of access to data. The access log includes, for example, a query log and an access log. The query log is a log of executed queries. The query log includes, for example, the date and time of execution and the content of the query. The information included in the query log is not limited to the above. Furthermore, the session log is, for example, a log of processing executed based on a query. The session log includes, for example, the date and time of execution of a session and the content of the session.

[0019] For example, suppose a doctor of country B has obtained permission to access some of the medical data managed by the government of country A. In this case, for example, a monitor in country B who monitors access situations in country B searches the access logs and obtains the access logs related to the doctor's accesses. The monitor in country B then monitors the doctor's access to the medical data managed by the government of country A, for example, by analyzing the obtained access logs.

[0020] The patient's medical information is, for example, the details of the medical treatment performed on the patient. The details of the medical treatment are, for example, information indicating the name of the patient's illness or injury, examination, surgery, examination, injection, medication, treatment for treatment, rehabilitation, counseling, and details of the meal provided to the patient. The details of the medical treatment may include information indicating the body part to be treated. Treatment for treatment is, for example, irradiation with radiation, shock waves, or ultraviolet rays, suction, removal, excision, or suturing. Treatment for treatment is not limited to the above. Furthermore, the medical treatment is not limited to the above.

[0021] The medical data may include one or more of the following data: clinical trial data, safety information, medical papers, reports, minutes, proceedings, hospital management records, physician performance data, medical accounting data, medical receipts, and prescriptions. The medical data may also be personal patient data. The patient's personal data is, for example, a combination of one or more items of the patient's name, address, health insurance card number, personal identification number, and attributes. The patient's attributes are, for example, information on one or more items of the patient's nationality, place of residence, race, age, sex, family composition, work history, medical history, and medical history of family members. The patient's attributes are not limited to the above. The patient's personal data is also not limited to the above. The medical data is also not limited to the above.

[0022] The medical data is entered, for example, by a doctor of country A who has treated a patient of country B. The medical data entered by the doctor of country A is stored, for example, in the data storage device 40. For example, when the doctor of country B treats a patient who received treatment in country A, the doctor accesses the data storage device 40 to obtain medical data related to the treatment that the patient received in country A. When the doctor of country B obtains the data related to the treatment, the data storage device 40 generates an access log that records access to the medical data. The generated access log is stored in an encrypted state in the data management device 10.

[0023] The monitor in country B searches the query logs among the access logs and identifies query logs that require further investigation. Query logs that require further investigation are, for example, accesses made by doctors in country B or accesses to the medical data of patients in country B that are suspected of being fraudulent. Suspected fraudulent access is, for example, access made when the doctor who made the access does not have the right to view the medical data that was accessed.

[0024] The monitor in country B, for example, requests the administrator in country A to disclose the session log corresponding to the query log that requires detailed confirmation. If the administrator in country A approves the disclosure of the session log, the monitor in country B can, for example, obtain the session log that has been requested for disclosure. The monitor in country B can then monitor access to medical data by, for example, analyzing the obtained session log.

[0025] Furthermore, although the above explanation has been given of an example of data exchange between country A and country B, data exchange in the medical data system may also be carried out between company groups, between hospital groups, or between a hospital and a company. The entities that exchange data in the medical data system are not limited to those mentioned above.

[0026] The person who inputs and accesses medical data is not limited to a doctor. The person who inputs and accesses medical data may be, for example, a nurse, a pharmacist, a physical therapist, a counselor, or an administrative official. The person who accesses medical data may also be an employee of the company that acquires the medical data. The person who inputs and accesses medical data is not limited to the above.

[0027] Here, an example of the configuration of the data management device 10 will be described. Fig. 2 is a diagram showing an example of the configuration of the data management device 10. The data management device 10 basically includes a derived key output unit 102, a query log acquisition unit 103, a search request acquisition unit 104, a search unit 105, and a search result output unit 106. The data management device 10 may further include, for example, a derived key generation unit 101, a session log acquisition unit 107, a log search request acquisition unit 108, a session log output unit 109, and a storage unit 110.

[0028] The following description will also be made with reference to the diagram of Figure 3 showing an example of data flow in a medical data system. In the example of Figure 3, the monitoring support device 20 is, for example, a device under the control of the government of country B. In the example of Figure 3, the data management device 10, management support device 30, and data storage device 40 are, for example, devices under the control of the government of country A. The data management device 10 and data storage device 40 are also referred to as, for example, data spaces. In the example of Figure 3, the data storage device 40 stores a query log as a query DB (Qa). In the example of Figure 3, the data storage device 40 stores a session log as a session DB (La), for example.

[0029] The derived key generation unit 101 generates, for example, multiple derived keys from a master key. The derived keys are generated, for example, so that data encrypted using any of the derived keys cannot be decrypted using other derived keys. The derived key generation unit 101 generates, for example, a first derived key Kb, a second derived key Ka, and a third derived key Kz from the master key K. In this case, for example, data encrypted using the first derived key Kb cannot be decrypted using the second derived key Ka and the third derived key Kz. On the other hand, the derived keys are generated so that, for example, data encrypted using the first derived key Kb and the second derived key Ka can be secretly searched using a search query encrypted using the first derived key Kb. The secret search is performed, for example, using a well-known secret search technique.

[0030] The derived key output unit 102 outputs a first derived key Kb generated from the master key K to an information processing device used by a monitoring entity that is an entity that monitors the access status. The information processing device used by the monitoring entity that is an entity that monitors the access status is, for example, the monitoring support device 20. For example, the derived key output unit 102 outputs the first derived key Kb of the first derived key Kb, second derived key Ka, and third derived key Kz generated from the master key K to the monitoring support device 20. The monitoring entity that is an entity that monitors the access status is, for example, a monitor who is a person that monitors the access status.

[0031] Furthermore, the derived key output unit 102 outputs a first derived key Kb and a second derived key Kb generated from the master key K to, for example, a data storage device 40, which is a device that stores a query log and a session log. The first derived key Kb and the second derived key Ka are used, for example, to encrypt data in the data storage device 40. The first derived key Kb and the second derived key Ka are used, for example, to encrypt a query log, which is one of the data stored in the data storage device 40.

[0032] Furthermore, the derived key output unit 102 outputs the third derived key Kz to, for example, the management support device 30, which is an information processing device used by a rights entity that has rights to the data. Having rights to the data means, for example, being able to allow others to access the data. Having rights to the data may also mean, for example, possessing the data. The third derived key Kz is used, for example, together with the second derived key Ka, to encrypt the session log in the data encryption process performed by the data storage device 40.

[0033] The query log acquisition unit 103 acquires the query log in a state in which it has been encrypted based on a second derivative key Ka and a first derivative key Kb generated from the master key K. In the example of FIG. 3 , the query log encrypted based on the second derivative key Ka and the first derivative key Kb is "Enc Ka,Kb(Qa)". The query log is an entity different from the monitoring entity, and records queries regarding access to data managed by a rights entity that has rights to the data. In the example of FIG. 3 , the monitoring entity is, for example, a monitor in country B. In the example of FIG. 3 , the rights entity that has rights to the data is, for example, the government of country A. Furthermore, the entity that manages data in country A is, for example, an administrator in country A. Furthermore, the data is, for example, medical data.

[0034] The query log acquired by the query log acquisition unit 103 is encrypted based on the second derivative key Ka and the first derivative key Kb. Therefore, for example, a monitoring entity that has only the first derivative key Kb cannot decrypt the query log acquired by the query log acquisition unit 103.

[0035] The search request acquisition unit 104 acquires a search request for searching a query log in a state encrypted based on a first derivative key Kb. The search request acquisition unit 104 acquires, for example, a search request for searching a query log in a state encrypted using a derivative key Kb' obtained by converting the first derivative key Kb. In the example of FIG. 3 , the search request encrypted using the derivative key Kb' obtained by converting the first derivative key Kb is "Enc Kb'(qb)." The search request acquisition unit 104, encrypted using the derivative key Kb' obtained by converting the first derivative key Kb, acquires, for example, from the search request output unit 203 of the monitoring support device 20, a search request encrypted using the derivative key Kb' obtained by converting the first derivative key Kb.

[0036] FIG. 4 shows an example of a query log. In the example of FIG. 4, the query log includes, for example, the date and time when the query was executed, a session number, and the content of the query. In the example of FIG. 4, for example, "Select x from DB" and "Select x from DBX" indicate the content of the query. For example, if the search condition indicated by the search request is to extract the query "Select x from DBX," the search unit 105 extracts, for example, "Session 123" as the query corresponding to the search request.

[0037] Fig. 5 shows an example of an encrypted query log. The example of the encrypted query log in Fig. 5 is a query log obtained by encrypting the query log shown in Fig. 4. In the example of the query log in Fig. 5, the content portion of the query log is encrypted.

[0038] The search unit 105 searches the encrypted query log based on the search request. For example, the search unit 105 performs a secure search of the query log based on the search request. The secure search can be performed using, for example, a well-known secure search technique. For example, the search unit 105 performs a search between a search request encrypted using a key Kb' converted from a first derivative key and a query log encrypted using a first encryption key Kb and a second encryption key Ka. In the example of FIG. 3 , for example, the search unit 105 performs a secure search between a search request encrypted using a derivative key Kb' converted from the first derivative key Kb, "Enc Kb'(qb)×Ka" generated from the second derivative key Ka, and a query log "Enc Ka,Kb(Qa)" encrypted based on the second derivative key Ka and the first derivative key Kb. In the search process, the search unit 105 extracts, for example, query logs that match the search request. 3, the search result of the query log by the search unit 105 is, for example, "Result(Qa, qb)." In the example of FIG. 5, the search unit 105 extracts, for example, "Session123" as a query that satisfies the search condition "Select x from DBX." The search unit 105 outputs, for example, the query log result in plain text. The search unit 105 may output the query log search result in a state in which it is encrypted using a derived key Kb' obtained by converting the first derived key Kb.

[0039] Furthermore, the search unit 105 searches for a session log based on a session log search request from among the session logs acquired by the session log acquisition unit 107, for example. The session log search request is acquired, for example, by the log search request acquisition unit 108 from the management support device 30. The search unit 105 performs a secure search between the session log search request encrypted using a key Kb' converted from the first derivative key Kb and the session log encrypted using the second encryption key Ka and the third encryption key Kz. In the example of FIG. 3, the session log search request encrypted using the key Kb' converted from the first derivative key Kb is, for example, "Enc Kb'(R)." In the example of FIG. 3, the session log data encrypted based on the second derivative key Ka and the first derivative key Kb is "Enc Kb,Kz'(La)." The search unit 105 performs a confidential search between, for example, a search request encrypted using a derived key Kb' obtained by converting the first derived key Kb, "Enc Kb'(R)×Kz" generated from the third derived key Kza, and a session log "Enc Kb, Kz'(La)" encrypted based on the key Kz' converted from the third derived key Kz and the first derived key Kb.

[0040] Fig. 6 shows an example of a session log. In the example of the session log in Fig. 6, the session number, the nationality of the person who performed the session, and information indicating the person who performed the session are associated with each other. In the example of the session log in Fig. 5, for example, "Country B" and "Db2" in "Session 123" indicate that the access was from "Db2" in "Country B."

[0041] The search result output unit 106 outputs the search results of the query log. The search results of the query log include, for example, information identifying the session log corresponding to the query log. The information identifying the session log is, for example, a session ID included in the query log. The search results are, for example, information indicated using a session ID or a line number in the log. The session ID is, for example, a session number. The information included in the search results is not limited to the above. The search result output unit 106 outputs the search results of the query log in the form of plain text, for example. The search result output unit 106 may output the search results of the query log in the form of encryption using the first derived key Kb. The search result output unit 106 outputs the search results of the query log to, for example, the monitoring support device 20. In the example of FIG. 3, the search result is, for example, "Result(Qa, qb)."

[0042] The session log acquisition unit 107 acquires, for example, a session log. The session log is, for example, a log that records the content of access to data managed by a rights entity. The session log is, for example, a log associated with a query log. The session log acquisition unit 107 acquires, for example, a session log encrypted based on a third derivative key Kz and a first derivative key Kb generated from a master key K, from the data storage device 40. The session log is encrypted using, for example, a key Kz' converted from the third derivative key Kz and the first derivative key Kb. In the example of FIG. 3, the encrypted session log is, for example, "Enc Kb, Kz'(La)."

[0043] A session log is, for example, a log of a session in which access to medical data to which the right entity has rights is made by someone other than the right entity. The right entity is, for example, an entity that can grant access rights to medical data to others. A person other than the right entity is, for example, an entity that accesses data after receiving access rights from the right entity. For example, a session log is a log of a session in which access is made by a monitoring entity. Furthermore, the session log includes, for example, the nationality of the person who accessed the data and information that identifies the person who made the access. The nationality may be information indicating the country in which an organization to which the person who accessed the data belongs is located. Furthermore, the nationality may be information indicating the country in which the organization to which the person who accessed the data belongs is located. Furthermore, the nationality may include information indicating a region.

[0044] The log search request acquisition unit 108 acquires, for example, a session log search request for searching a session log, encrypted based on the first derived key Kb. For example, the log search request acquisition unit 108 acquires the session log search request encrypted using a key Kb' obtained by converting the first derived key Kb. The log search request acquisition unit 108 acquires the session log search request from, for example, the log search request output unit 302 of the management support device 30. The session log search request includes, for example, information identifying the session to be searched. The information identifying the session to be searched is, for example, a session number. In the example of FIG. 5, the session log search request is, for example, "Enc Kb'(R)".

[0045] The session log output unit 109 outputs, for example, the results of a search of the session log. For example, the session log output unit 109 outputs the results of a session log search performed by the search unit 105. The session log output unit 109 outputs the results of the search of the session log to, for example, the management support device 30. In the example of FIG. 5 , when "Session 123" is the search target, the search result of the session log is, for example, information including "Country B" and "Db2."

[0046] The storage unit 110 stores, for example, data related to searches of query logs and session logs. The storage unit 110 stores, for example, encrypted query logs. The storage unit 110 also stores, for example, encrypted session logs. The storage unit 110 may also store search requests acquired from the monitoring support device 20, and may also store search results for query logs. The storage unit 110 may also store session log search requests acquired from the management support device 30. The storage unit 110 may also store search results for session logs. The storage unit 110 stores, for example, a master key K and derived keys generated from the master key K. The storage unit 110 stores, for example, a first derived key Kb, a second derived key Ka, and a third derived key Kz as derived keys. The master key K and the derived keys generated from the master keys may be stored in a storage means other than the storage unit 110.

[0047] An example of the configuration of the monitoring assistance device 20 will be described. Fig. 7 is a diagram showing an example of the configuration of the monitoring assistance device 20. The monitoring assistance device 20 basically includes a derived key acquisition unit 201, a search request output unit 203, a search result acquisition unit 204, and a result output unit 205. The monitoring assistance device 20 may also include, for example, a search target acquisition unit 202, a confirmation target acquisition unit 206, a disclosure request unit 207, a log acquisition unit 208, a log output unit 209, and a monitoring data storage unit 210.

[0048] The derived key acquisition unit 201 acquires a first derived key Kb from the derived key output unit 102 of the data management device 10. The data management device 10 stores, for example, a query log recording queries related to access to data, encrypted based on the first derived key Kb and the second derived key Ka generated from the master key K. The data is, for example, a query log related to access to medical data. The query log is, for example, a log related to access to medical data from an entity that does not have rights related to the medical data. The entity that does not have rights related to the medical data is, for example, a monitoring entity.

[0049] The search target acquisition unit 202 acquires, for example, search conditions for the query log. The search target acquisition unit 202 acquires, for example, search conditions for the query log from the monitor terminal device 50. The search conditions for the query log are, for example, input to the monitor terminal device 50 by the monitor. In the example of FIG. 5 , the search conditions are set, for example, as conditions for searching for queries including "Select x from DBX". In the example of FIG. 5 , the search conditions may be set as conditions for searching for queries that match "Select x from DBX".

[0050] The search request output unit 203 outputs a search request for searching a query log to the search request acquisition unit 104 of the data management device 10, encrypted based on the first derived key Kb. The search request includes, for example, a search condition of the query. For example, the search request output unit 22 outputs a search request for searching a query log, encrypted using a key Kb' converted from the first derived key Kb. The key Kb' converted from the first derived key Kb is, for example, a key that is compatible with the first derived key Kb in a secure search. In other words, for example, the key Kb' converted from the first derived key Kb is converted so that, when a secure search is possible with a search request for a query log encrypted using the first derived key Kb, a secure search is also possible with a query log encrypted using the key Kb' converted from the first derived key Kb. In the example of FIG. 5 , the search request encrypted using the key Kb' converted from the first derived key Kb is "Enc Kb'(qb)."

[0051] The search result acquisition unit 204 acquires the search results of the query log from the search result output unit 106 of the data management device 10. The search result acquisition unit 204 acquires, for example, the search results of the query log in plain text. The plain text state is, for example, an unencrypted state. The search result acquisition unit 204 may acquire the search results of the query log in a state encrypted using the first derived key Kb'. When the search results of the query log are encrypted, the search result acquisition unit 204 decrypts them using, for example, the first derived key Kb'. In the example of FIG. 5 , the search result of the query log is "Result (Qa, qb)." Furthermore, in the example of FIG. 5 , the decrypted search result is "Dec Kb'(Result (Qa, qb))."

[0052] The result output unit 205 outputs the search results of the query logs acquired by the search result acquisition unit 204. The result output unit 205 outputs the search results of the query logs to, for example, the monitor terminal device 50, which is a terminal device used by the monitor.

[0053] The confirmation target acquisition unit 206 acquires, for example, information specifying a query log whose session log is to be checked from among the query logs included in the search results. The confirmation target acquisition unit 206 acquires, for example, information specifying a query log whose session log is to be checked from a monitor terminal device 50, which is a terminal device used by the monitor. The information specifying the query log whose session log is to be checked is specified, for example, by the monitor. The monitor, for example, refers to the query search results and identifies queries whose detailed access status needs to be checked. A query whose detailed access status needs to be checked is, for example, a query that may be causing unauthorized access. For example, if information written in the data "DBX" has been leaked to the outside, the monitor selects, as the confirmation target, a session log corresponding to a query related to access made to the data "DBX."

[0054] The disclosure request unit 207 outputs a session log disclosure request to an information processing device used by an entity that has rights to the data. A session log is, for example, a log that records the content of access to data and is associated with a query log. The session log disclosure request is, for example, information requesting disclosure of the content of the session log. For example, the session log disclosure request includes information specifying the query log that is the target of session log confirmation. The session log disclosure request is, for example, information requesting that an encrypted session log be provided in plain text or in a decryptable state. The information processing device used by the entity that has rights to the data is, for example, the management support device 30. The disclosure request unit 207 outputs the session log disclosure request in a state where it has been encrypted with the first derivative key Kb. In the example of FIG. 5, the session log disclosure request is, for example, "Enc Kb'(R)".

[0055] The log acquisition unit 208 acquires session logs, for example, from the management support device 30. For example, the log acquisition unit 208 acquires session logs that the administrator has determined to be disclosable from among the session logs specified in the session log disclosure request. For example, the session logs that the administrator has determined to be disclosable are, for example, session logs related to the entity to which the monitor belongs. For example, if the monitor belongs to the government of country B, the session logs that the administrator has determined to be disclosable are, from among the session logs specified in the disclosure request, session logs related to access made by country B or persons of country B nationality.

[0056] The monitoring data storage unit 210 stores, for example, data related to the process of acquiring a query log and a session log. The monitoring data storage unit 210 stores, for example, search results for a query log. The monitoring data storage unit 210 also stores, for example, a session log acquired from the management support device 30. The monitoring data storage unit 210 also stores, for example, a first storage key Kb and a key Kb' converted from the first storage key Kb.

[0057] An example of the configuration of the management support device 30 will be described. Fig. 8 is a diagram showing an example of the configuration of the management support device 30. The management support device 30 basically includes a request acquisition unit 301, an acquisition unit 303, a confirmation log output unit 304, a judgment result acquisition unit 305, and an output unit 306. The management support device 30 may further include, for example, a log search request output unit 302, a key acquisition unit 307, and a management data storage unit 309.

[0058] The request acquisition unit 301 acquires a request for disclosing a session log. The disclosure request is a request to disclose a session log associated with a query log based on the search results of the query log. A query log is a log that records queries related to access to data. For example, the request for disclosing a session log includes information that identifies the session for which disclosure is requested. For example, the information that identifies the session for which disclosure is requested is the session number of the session for which disclosure is requested. Furthermore, the request acquisition unit 301 acquires the request for disclosing a session log in a state that is encrypted based on a derived key. Furthermore, the data is, for example, medical data. In the example of FIG. 5, the disclosure request is, for example, "Enk Kb'(R)".

[0059] The log search request output unit 302 outputs, for example, a search request to search for a session log indicated by the disclosure request. The session log is encrypted, for example, based on a first derived key and a third derived key generated from a master key. The search request includes, for example, the contents of the disclosure request encrypted using a key Kb' converted from the first derived key Kb. For example, the log search request output unit 302 outputs a query for searching a session log corresponding to the disclosure request as a session log search request together with the disclosure request. The log search request output unit 302 outputs the session log search request to, for example, the log search request acquisition unit 108 of the data management device 10. In the example of FIG. 5, the session log search request is, for example, "Enk Kb'(R)."

[0060] The acquisition unit 303 acquires a session log corresponding to the session log for which disclosure has been requested. Furthermore, the acquisition unit 303 acquires, for example, the session log corresponding to the requested session log as a result of a secure search. For example, the session log includes the nationality of the person who accessed the data. Furthermore, the session log may include information identifying the person who accessed the data. The acquisition unit 303 acquires, for example, the session log corresponding to the session log for which disclosure has been requested from the session log output unit 109 of the data management device 10.

[0061] The confirmation log output unit 304 outputs the session log acquired by the acquisition unit 303 as information for confirming whether or not the session log can be disclosed to the information processing device that sent the disclosure request. The confirmation log output unit 304 outputs the session log acquired by the acquisition unit 303 to, for example, the administrator terminal device 60, which is a terminal device used by the administrator.

[0062] The determination result acquisition unit 305 acquires a determination result on whether or not to disclose the session log. The determination of whether or not to disclose the session log is made by, for example, a data administrator. For example, if the data management device 10, the management assistance device 30, and the data storage device 40 are under the control of the government of country A, the data administrator is the data administrator in country A. For example, if a request for session log disclosure is made to a legitimate target, the data administrator determines that the session log is discloseable. A legitimate target is, for example, a session log for which log verification is legitimate. For example, if the requester of the session log is a monitor in country B, a legitimate target is a session log of data access made by a person with country B nationality. That is, for example, if a monitor in country B requests a session log of data access made by a person with country B nationality, the data administrator determines that the requested session log is sendable. For example, if a monitor in country B requests a session log of data access made by a person with country C nationality, the data administrator determines that the requested session log is not sendable. The determination result acquisition unit 305 acquires the determination result as to whether or not the session log is to be disclosed from, for example, the administrator terminal device 60, which is a terminal device used by the administrator.

[0063] The output unit 306 outputs the session log indicating that disclosure is permitted as a result of the determination to the information processing device that sent the disclosure request. The information processing device that sent the disclosure request is, for example, the monitoring support device 20. The output unit 306 also outputs, for example, the nationality of the person who accessed the data and information identifying that person as session log data. The output unit 306 outputs the session log indicating that disclosure is permitted as a result of the determination to the log acquisition unit 208 of the monitoring support device 20, for example.

[0064] The key acquisition unit 307 acquires, for example, a third derived key Kz generated from the master key. The key acquisition unit 307 acquires, for example, the third derived key Kz from the derived key output unit 102 of the data management device 10. The third derived key Kz is used, for example, together with the second derived key Ka to encrypt a session log in the data encryption process performed by the data storage device 40.

[0065] The encryption unit 308 performs, for example, processing related to encryption of the session log. As the encryption processing, the encryption unit 308 requests the data storage device 40 to encrypt the session log. For example, the encryption unit 308 outputs, to the data storage device 40, a request to encrypt the session log together with the key Kz' obtained by converting the third derived key Kz.

[0066] The management data storage unit 309 stores, for example, data related to a process for managing the disclosure of a session log. The management data storage unit 309 stores, for example, a third derived key Kz used to encrypt the session log. The management data storage unit 309 may also store a key Kz' converted from the third derived key Kz. The management data storage unit 309 stores, for example, a disclosure request. The management data storage unit 309 also stores, for example, a session log corresponding to the disclosure request.

[0067] The data storage device 40 stores records related to access to data, for example, in an access data storage unit (not shown). For example, the data storage device 40 stores query logs and session logs as records related to access. Furthermore, the data storage device 40 stores the query logs and session logs as encrypted data, for example.

[0068] The data storage device 40, for example, encrypts records related to access. As part of the data encryption process, the data storage device 40, for example, encrypts a query log. For example, the data storage device 40 encrypts the query log using a first derivative key Kb and a second derivative key Ka. For example, the data storage device 40 acquires the first derivative key Kb and the second derivative key Ka from the data management device 10. Then, the data storage device 40 encrypts the query log using the first derivative key Kb and the second derivative key Ka. Furthermore, the data storage device 40 outputs the encrypted query log to the query log acquisition unit 103 of the data management device 10, for example.

[0069] As a data encryption process, the data storage device 40 encrypts, for example, a session log. For example, the data storage device 40 encrypts the session log using a key Kz' converted from the first derivative key Kb and the third derivative key Kz. The data storage device 40 acquires, for example, the first derivative key Kb from the data management device 10. The data storage device 40 also acquires, for example, from the management support device 30, a key Kz' converted from the third derivative key Kz and a request to encrypt the session log. The data storage device 40 then encrypts the session log using, for example, the key Kz converted from the first derivative key Kb and the third derivative key Kz. The data storage device 40 also outputs the encrypted session log to, for example, the session log acquisition unit 107 of the data management device 10. The data storage device 40 may also be an integrated device with the data management device 10.

[0070] The monitor terminal device 50 is, for example, a terminal device used by the monitor to check the query log and the session log. The monitor terminal device 50 acquires, for example, search conditions for the query log input by the monitor's operation. Then, the monitor terminal device 50 outputs the search conditions for the query log to, for example, the search target acquisition unit 202 of the monitoring support device 20. The monitor terminal device 50 also acquires, for example, the search results for the query log from the result output unit 205 of the monitoring support device 20. Then, the monitor terminal device 50 outputs the search results for the query log to, for example, a display device (not shown).

[0071] The monitor terminal device 50 also acquires, for example, a query that is to be checked for a session log from among the query logs input by the monitor's operation. Then, the monitor terminal device 50 outputs, for example, the query that is to be checked for a session log to the confirmation target acquisition unit 206 of the monitoring support device 20. The monitor terminal device 50 also acquires, for example, a session log that has been determined to be disclosable from the log output unit 209 of the monitoring support device 20. Then, the monitor terminal device 50 outputs the acquired session log to, for example, a display device (not shown). The monitor terminal device 50 may also be an integrated device with the monitoring support device 20.

[0072] The administrator terminal device 60 is, for example, a terminal device used by an administrator to determine whether or not to disclose a session log. The administrator terminal device 60, for example, acquires a session log corresponding to a query specified in a disclosure request from the confirmation log output unit 304 of the management support device 30. Then, the administrator terminal device 60 outputs the session log corresponding to the query specified in the disclosure request to, for example, a display device (not shown). The administrator terminal device 60 also acquires a determination result on whether or not to disclose the session log, which is input by operation of the administrator, for example. Then, the administrator terminal device 60 outputs the determination result on whether or not to disclose the session log to the determination result acquisition unit 305 of the management support device 30. The administrator terminal device 60 may be a device integrated with the management support device 30.

[0073] A description will be given of an example of the operation of searching a query log in the data management device 10. Fig. 9 is a diagram showing an example of the flow of processing for searching a query log in the data management device 10.

[0074] The derived key output unit 102 outputs the first derived key Kb generated from the master key K to the derived key acquisition unit 201 of the monitoring support device 20 (step S101). The monitoring support device 20 is an information processing device used by a monitoring entity that monitors access status to data.

[0075] The query log acquisition unit 103 also acquires the query log in a state encrypted based on the second derived key Ka and the first derived key Kb generated from the master key K (step S102). The query log is a log that records queries related to access to data managed by a rights entity that is different from the monitoring entity and has rights to the data. For example, the query log acquisition unit 103 acquires the query log from the data storage device 40 in a state encrypted based on the second derived key Ka and the first derived key Kb.

[0076] When the query log is acquired, the search request acquisition unit 104 acquires a search request for searching the query log in a state encrypted based on the first derivative key Kb (step S103). For example, the search request acquisition unit 104 acquires, from the search request output unit 203 of the monitoring support device 20, a search request encrypted using a key Kb' converted from the first derivative key Kb.

[0077] When the search request is received, the search unit 105 searches the query log in an encrypted state based on the search request (step S104).

[0078] If the query log indicated in the search request exists (Yes in step S105), the search result output unit 106 outputs the query log indicated in the search request as a query log search result (step S106). For example, the search result output unit 106 outputs the query log searched from the encrypted query logs as the search result to the search result acquisition unit 204 of the monitoring support device 20.

[0079] In step S105, if the query log indicated in the search request does not exist among the encrypted query logs (No in step S105), the search result output unit 106 outputs information indicating that a query log corresponding to the search request does not exist as a query log search result (step S107). For example, the search result output unit 106 outputs information indicating that a query log corresponding to the search request does not exist as a query log search result to the search result acquisition unit 204 of the monitoring support device 20.

[0080] An example of the operation of searching a session log in the data management device 10 will be described below. Fig. 10 is a diagram showing an example of the flow of processing for searching a session log in the data management device 10.

[0081] The session log acquisition unit 107 acquires an encrypted session log, for example, from the data storage device 40 (step S111). The session log is encrypted, for example, using a key Kz′ converted from a third derived key Kz generated from a master key K and the first derived key Kb.

[0082] The log search request acquisition unit 108 acquires, for example, a session log search request for requesting a search of a session log, encrypted based on the first derived key Kb (step S112). For example, the log search request acquisition unit 108 acquires, from the log search request output unit 302 of the management support device 30, a session log search request encrypted using the key Kb' converted from the first derived key Kb.

[0083] When the session log search request is received, the search unit 105 searches for a session log based on the session log search request (step S113). For example, the search unit 105 searches for a session log by a confidential search.

[0084] When the session log is searched, the session log output unit 109 outputs the search result of the session log to, for example, the acquisition unit 303 of the management support device 30 (step S114).

[0085] A description will be given of an example of an operation for acquiring a query log in the monitoring support device 20. Fig. 11 is a diagram showing an example of a processing flow for acquiring a query log in the monitoring support device 20.

[0086] The derived key acquisition unit 201 of the monitoring support device 20 acquires the first derived key Kb from the data management device 10 (step S201). The query log is stored in the data management device 10 in an encrypted state based on the first derived key Kb and the second derived key Ka generated from the master key K. The query log is a log that records queries related to access to data.

[0087] When a search request is acquired (Yes in step S202), the search request output unit 203 outputs a search request for searching a query log to the search result acquisition unit 204 of the data management device 10, encrypted based on the first derived key Kb (step S203). For example, the search request output unit 203 outputs a search request encrypted using a key Kb' converted from the first derived key Kb to the search result acquisition unit 204 of the data management device 10. The search request acquisition unit 104 of the data management device 10 acquires the encrypted search request from the search request output unit 203 of the monitoring support device 20, for example. Upon acquiring the search request, the search unit 105 of the data management device 10 searches the query log, for example, by a confidential search based on the search request. Then, the search result output unit 106 of the data management device 10 outputs the search results of the query log to the search result acquisition unit 204 of the monitoring support device 20, for example.

[0088] The search result acquisition unit 204 of the monitoring support device 20 acquires the search results of the query log from the search result acquisition unit 204 of the monitoring support device 20 (step S204).

[0089] When the query log search result is acquired, the result output unit 205 outputs the query log search result (step S205). For example, the result output unit 205 outputs the query log search result to the monitor terminal device 50 used by the monitor.

[0090] The monitor terminal device 50 acquires the query log search results from, for example, the result output unit 205 of the monitoring support device 20. Then, the monitor terminal device 50 outputs the query log search results to, for example, a display device (not shown). The monitor, for example, refers to the query log search results and determines whether there are any query logs whose session logs need to be checked. When it is determined that there are any query logs whose session logs need to be checked, the monitor inputs, for example, information specifying the query logs whose session logs are to be checked into the monitor terminal device 50. When the information specifying the query logs whose session logs are to be checked is input, the monitor terminal device 50 outputs, for example, information specifying the query logs whose session logs are to be checked to the check target acquisition unit 206 of the monitoring support device 20.

[0091] Furthermore, if a search request is not acquired in step S202 (No in step S202), the monitoring support device 20 waits, for example, until a search request is input. When the monitoring support device 20 is waiting for a search request to be input and acquires information indicating that the query log search is to be terminated, the monitoring support device 20 terminates, for example, the processing related to the query log search.

[0092] An example of the operation of acquiring a session log in the monitoring support device 20 will be described below. Fig. 12 is a diagram showing an example of the flow of processing for acquiring a session log in the monitoring support device 20.

[0093] The confirmation target acquisition unit 206 of the monitoring assistance device 20 acquires, for example, information specifying a query log for which session logs are to be confirmed from among the query logs included in the search results (step S211).

[0094] When information specifying the query log to be checked for the session log is acquired, the disclosure request unit 207 outputs a request to disclose the session log to, for example, the request acquisition unit 301 of the management support device 30 (step S212).

[0095] When the request acquisition unit 301 of the management support device 30 acquires a request to disclose a session log, the management support device 30 performs, for example, a process to determine whether or not to disclose the session log indicated in the disclosure request. Then, the output unit 306 of the management support device 30 outputs information about the determination result of whether or not to disclose the session log to, for example, the log acquisition unit 208 of the monitoring support device 20.

[0096] The log acquisition unit 208 of the monitoring support device 20 acquires information about the determination result of whether or not the session log can be disclosed from, for example, the output unit 306 of the management support device 30 (step S213).

[0097] When the information on the determination result of whether or not the session log can be disclosed is acquired, the log output unit 209 outputs the information on the determination result of whether or not the session log can be disclosed to, for example, the monitor terminal device 50 (step S214).

[0098] The monitor terminal device 50 acquires information about the determination result of whether or not to disclose the session log from, for example, the log output unit 209 of the monitoring support device 20. Then, the monitor terminal device 50 outputs the information about the determination result of whether or not to disclose the session log to, for example, a display device (not shown).

[0099] An example of an operation for checking whether or not a session log can be disclosed in the management support device 30 will be described below. Fig. 13 is a diagram showing an example of a processing flow for checking whether or not a session log can be disclosed in the management support device 30.

[0100] The request acquisition unit 301 acquires a disclosure request for requesting disclosure of a session log (step S301). The disclosure request is a request based on the search results of a query log that records queries related to access to data.

[0101] When the disclosure request is acquired, the log search request output unit 302 outputs, for example, a search request to search for the session log indicated by the disclosure request to the log search request acquisition unit 108 of the data management device 10 (step S302). The log search request output unit 302 outputs, for example, the search request including the disclosure request encrypted using the key Kb' converted from the first derivative key Kb.

[0102] The log search request acquisition unit 108 of the data management device 10 acquires a search request from the log search request output unit 302 of the management support device 30. Upon acquiring the search request, the search unit 105 of the data management device 10 searches for a session log corresponding to the disclosure request, for example, based on the search request. Then, the session log output unit 109 of the data management device 10 outputs the session log corresponding to the disclosure request to the acquisition unit 303 of the management support device 30, for example.

[0103] The acquisition unit 303 of the management assistance device 30 acquires a session log corresponding to the disclosure request (step S303). For example, the acquisition unit 303 acquires a session log corresponding to the disclosure request from the session log output unit 109 of the data management device 10.

[0104] When the session log is acquired, the confirmation log output unit 304 outputs the acquired session log as information for confirming whether or not the acquired session log can be disclosed to the monitoring support device 20, which is the information processing device that sent the disclosure request (step S304). For example, the confirmation log output unit 304 outputs the acquired session log to the administrator terminal device 60, which is a terminal device used by the administrator.

[0105] The administrator terminal device 60 outputs the session logs to, for example, a display device. Then, the administrator terminal device 60 acquires, for example, the determination result of whether or not each session log input by an administrator's operation can be disclosed. Then, the administrator terminal device 60 outputs, for example, the determination result of whether or not each session log can be disclosed to the determination result acquisition unit 305 of the management support device 30.

[0106] The determination result acquisition unit 305 acquires the determination result of whether or not the session log is to be disclosed (step S305). For example, the determination result acquisition unit 305 acquires the determination result of whether or not the session log is to be disclosed from the administrator terminal device 60. If the determination result includes a session log whose disclosure is permitted (Yes in step S306), the output unit 306 outputs the session log whose disclosure is permitted in the determination result to the log acquisition unit 208 of the monitoring support device 20 (step S307).

[0107] In step S306, if the judgment result does not include a session log that can be disclosed (No in step S306), the output unit 306 outputs information indicating that the session log cannot be disclosed, for example, to the log acquisition unit 208 of the monitoring support device 20 (step S308).

[0108] In the above description, the encrypted session log is stored in the data management device 10. However, the encrypted session log may also be stored in the management support device 30. FIG. 14 shows an example of a data flow when the encrypted session log is stored in the management support device 30. When the encrypted session log is stored in the management support device 30, the encryption unit 308 of the management support device 30 outputs a request to encrypt the session log to the data storage device 40, along with a key Kz' obtained by converting the third derivative key Kz. The encryption unit 308 then acquires, from the data storage device 40, a session log encrypted using the key Kz obtained by converting the first derivative key Kb and the third derivative key Kz. The management data storage unit 309 stores, for example, the encrypted session log acquired by the encryption unit 308.

[0109] Furthermore, when an encrypted session log is stored in the management support device 30, upon receiving a disclosure request from the disclosure request unit 207 of the monitoring support device 20, the management support device 30 searches for the session log specified in the disclosure request using a search unit (not shown). The management support device 30 searches for the session log specified in the disclosure request, for example, by a confidential search. The confirmation log output unit 304 of the management support device 30 then outputs the acquired session log searched for based on the disclosure request to, for example, the administrator terminal device 60. In this way, even when the session log is stored in the management support device 30 as shown in the example of FIG. 14 , the management support device 30 can perform, for example, processing related to determining whether or not to disclose the session log, similar to the case where the session log is stored in the data storage device 40 as shown in the example of FIG. 5 .

[0110] The data management device 10 acquires the query log in a state in which the query log is encrypted based on a first derived key Kb and a second derived key Ka generated from a master key K. The data management device 10 also acquires a search request for searching the query log in a state in which the query log is encrypted based on the first derived key. The data management device 10 then searches the query log in an encrypted state based on the search request. By searching the query log in this encrypted state, the data management device 10 can prevent the contents of the query log from being leaked when a search is performed. As a result, the data management device 10 can improve the security of searches of access status.

[0111] Furthermore, by encrypting the query log using the key Kb' converted from the first derived key Kb, the query log cannot be viewed directly on the data management device 10, thereby further improving security. Furthermore, the data management device 10 outputs, for example, information regarding the session log corresponding to the query log to the management support device 30. Therefore, disclosure of the session log can be determined by the administrator who has the rights to the data, and the data management device 10 can further improve security in data searches. Furthermore, by obtaining the session log, the person in charge of monitoring the access status can make appropriate decisions regarding the access status.

[0112] The monitoring support device 20 also acquires a first derived key Kb from the data management device 10. The monitoring support device 20 also outputs a search request for searching a query log to the data management device 10, encrypted based on the first derived key. The monitoring support device 20 then acquires search results for the query log from the data management device 10. By outputting an encrypted search request in this manner, the monitoring support device 20 can acquire search results while preventing the content of the search from being leaked. The monitoring support device 20 also encrypts the query log using a key Kb' converted from the first derived key Kb, thereby preventing the query log from being directly viewed on the data management device 10, thereby further improving security.

[0113] The management support device 30 also acquires a request for disclosure of a session log associated with the query log based on the search results of the query log. The management support device 30 then outputs the acquired session log as information confirming whether the session log should be disclosed. The management support device 30 then outputs the session log for which disclosure is permitted based on the determination result of whether the session log should be disclosed. By outputting the session log based on the determination result of whether the session log should be disclosed, the management support device 30 can output only session logs for which disclosure is permitted. Therefore, use of the management support device 30 can prevent unnecessary information leakage, thereby improving security in data searches. Furthermore, by outputting information confirming whether the session log should be disclosed along with the nationality of the person who accessed it, the administrator can, for example, more appropriately make decisions on whether to permit disclosure.

[0114] Each process in the data management device 10 may be distributed and executed among multiple information processing devices connected via a network. Also, each process in the monitoring support device 20 may be distributed and executed among multiple information processing devices connected via a network. Also, each process in the management support device 30 may be distributed and executed among multiple information processing devices connected via a network. It can be set as appropriate which information processing device performs each process in each of the data management device 10, the monitoring support device 20, and the management support device 30.

[0115] Each process in the data management device 10 can be realized by executing a computer program on a computer. Fig. 15 shows an example of the configuration of a computer 70 that executes a computer program that performs each process in the data management device 10. The computer 70 includes a CPU (Central Processing Unit) 701, a memory 702, a storage device 703, an input / output I / F (Interface) 704, and a communication I / F 705.

[0116] The CPU 701 reads and executes computer programs for performing each process from the storage device 703. The CPU 701 may be configured as a combination of multiple CPUs. The CPU 701 may also be configured as a combination of a CPU and another type of processor. For example, the CPU 701 may be configured as a combination of a CPU and a graphics processing unit (GPU). The memory 702 is configured with a dynamic random access memory (DRAM) or the like, and temporarily stores computer programs executed by the CPU 701 and data being processed. The storage device 703 stores computer programs executed by the CPU 701. The storage device 703 is configured with, for example, a non-volatile semiconductor storage device. Other storage devices such as a hard disk drive may also be used for the storage device 703. The input / output I / F 704 is an interface that receives input from an operator and outputs display data, etc. The communication I / F 705 is an interface that transmits and receives data to and from other information processing devices. Furthermore, the monitoring support device 20, the management support device 30, the data storage device 40, the supervisor terminal device 50 and the manager terminal device 60 may also have the same configuration as the computer 70.

[0117] The computer program used to execute each process can also be stored and distributed on a computer-readable recording medium that non-temporarily stores data. Examples of recording media that can be used include magnetic tapes for recording data and magnetic disks such as hard disks. Optical disks such as CD-ROMs (Compact Disc Read Only Memory) can also be used as recording media. Non-volatile semiconductor storage devices can also be used as recording media.

[0118] Some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0119] [Supplementary Note 1] A data management device comprising: a derived key output means for outputting a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status; a query log acquisition means for acquiring a query log, which records queries regarding access to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in an encrypted state based on a second derived key generated from the master key and the first derived key; a search request acquisition means for acquiring a search request for searching the query log in an encrypted state based on the first derived key; a search means for searching the query log based on the search request; and a search result output means for outputting search results of the query log.

[0120] [Supplementary Note 2] The data management device according to Supplementary Note 1, further comprising: a session log acquisition means for acquiring a session log, which is a log that records the content of access to data managed by the rights entity and is associated with the query log, in a state where the session log is encrypted based on a third derived key generated from the master key and the first derived key; a search request acquisition means for acquiring a session log search request for searching the session log in a state where the session log search request is encrypted based on the first derived key; and a session log output means for outputting the results of the search of the session log.

[0121] [Supplementary Note 3] The data management device according to Supplementary Note 1 or 2, wherein the search results of the query log include information for identifying a session corresponding to the query log.

[0122] [Supplementary Note 4] The data management device according to any one of Supplementary Notes 1 to 3, wherein the search request acquisition means acquires the search request for searching the query log in a state encrypted using a key converted from the first derived key.

[0123] [Supplementary Note 5] The data management device according to any one of Supplementary Notes 1 to 4, wherein the query log is a log related to accesses made to medical data to which the rights entity holds rights.

[0124] [Supplementary Note 6] The data management device according to Supplementary Note 2, wherein the session log is a log of a session in which access is made to medical data to which the rights entity has rights.

[0125] [Supplementary Note 7] The data management device according to Supplementary Note 6, wherein the session log includes information on the nationality of a person who has accessed the medical data.

[0126] [Supplementary Note 8] The data management device according to Supplementary Note 3, wherein the information for identifying the session is an identifier of the session included in the query log.

[0127] [Supplementary Note 9] A monitoring support device comprising: a derived key acquisition means for acquiring a first derived key from a data management device that stores a query log, which records queries related to access to data, in a state encrypted based on a first derived key and a second derived key generated from a master key; a search request output means for outputting a search request for searching the query log to the data management device in a state encrypted based on the first derived key; a search result acquisition means for acquiring a search result of the query log from the data management device; and an output means for outputting the acquired search results.

[0128] [Supplementary Note 10] The monitoring support device described in Supplementary Note 9 further comprises: a disclosure request means for outputting a request for disclosure of a session log, which is a log that records the content of access to the data and is associated with the query log, to an information processing device used by a rights entity that has rights related to the data; and a log acquisition means for acquiring information regarding the determination result of whether the session log can be disclosed from the information processing device used by the rights entity.

[0129] [Supplementary Note 11] The monitoring assistance device according to Supplementary Note 10, wherein the disclosure request means outputs the disclosure request for the session log in a state in which the disclosure request is encrypted with the first derivative key.

[0130] [Supplementary Note 12] The monitoring assistance device according to any one of Supplementary Notes 9 to 11, wherein the data is medical data, and the query log is a log related to accesses made to medical data to which the rights entity holds rights.

[0131] [Supplementary Note 13] A management support device comprising: a disclosure request acquisition means for acquiring a request to disclose a session log associated with a query log based on a search result of the query log that records a query regarding access to data; an acquisition means for acquiring a session log specified by the disclosure request; a confirmation log output means for outputting the acquired session log as information for confirming whether the session log can be disclosed to an information processing device that is the sender of the disclosure request; a determination result acquisition means for acquiring a determination result as to whether the session log can be disclosed; and an output means for outputting a session log that is determined to be discloseable to the information processing device that is the sender of the disclosure request.

[0132] [Supplementary Note 14] The management support device according to Supplementary Note 13, further comprising a log search request output means for searching for the session log indicated by the disclosure request from session logs encrypted based on a first derivative key and a third derivative key generated from a master key.

[0133] [Supplementary Note 15] The management support device according to Supplementary Note 13 or 14, wherein the session log includes the nationality of the person who accessed the data, and the output means outputs a session log including the nationality of the person who accessed the data as a session log to be output for confirming whether disclosure is permitted.

[0134] [Supplementary Note 16] The management support device according to any one of Supplementary Notes 13 to 15, wherein the data is medical data, and the query log is a log regarding access made to the medical data by an entity that does not have rights related to the medical data.

[0135] [Supplementary Note 17] The management support device according to any one of Supplementary Notes 13 to 16, wherein the data is medical data, and the session log is a log of a session in which an entity that does not have rights to the medical data accesses the medical data.

[0136] [Supplementary Note 18] A data management method comprising: outputting a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status; acquiring a query log that records queries regarding accesses to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in a state encrypted based on a second derived key generated from the master key and the first derived key; acquiring a search request for searching the query log, in a state encrypted based on the first derived key; searching the query log in an encrypted state based on the search request; and outputting search results of the query log.

[0137] [Supplementary Note 19] A monitoring support method comprising: obtaining a first derived key from a data management device that stores a query log, which records queries related to access to data, in a state encrypted based on a first derived key and a second derived key generated from a master key; outputting a search request to search the query log in a state encrypted based on the first derived key to the data management device; obtaining search results of the query log from the data management device; and outputting the obtained search results.

[0138] [Supplementary Note 20] A management support method comprising: acquiring a request to disclose a session log associated with a query log based on a search result of the query log that records a query related to access to data; acquiring the session log specified by the disclosure request; outputting the acquired session log as information for confirming whether the session log can be disclosed to an information processing device that has sent the disclosure request; acquiring a determination result as to whether the session log can be disclosed; and outputting the session log that can be disclosed according to the determination result to the information processing device that has sent the disclosure request.

[0139] [Supplementary Note 21] A recording medium that non-temporarily records a data management program that causes a computer to execute the following processes: outputting a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status; acquiring a query log, which records queries regarding accesses to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in a state encrypted based on a second derived key generated from the master key and the first derived key; acquiring a search request for searching the query log in a state encrypted based on the first derived key; searching the query log in an encrypted state based on the search request; and outputting search results of the query log.

[0140] [Supplementary Note 22] A recording medium that non-temporarily records a monitoring support program that causes a computer to execute the following processes: a process of acquiring a first derived key from a data management device that stores a query log, in which queries related to access to data are recorded, in a state encrypted based on a first derived key and a second derived key generated from a master key; a process of outputting a search request for searching the query log to the data management device in a state encrypted based on the first derived key; a process of acquiring search results of the query log from the data management device; and a process of outputting the acquired search results.

[0141] [Supplementary Note 23] A recording medium that non-temporarily records a management support program that causes a computer to execute the following processes: a process of acquiring a request to disclose a session log associated with a query log that records a query related to access to data, based on a search result of the query log; a process of acquiring a session log specified by the disclosure request; a process of outputting the acquired session log as information for confirming whether the session log can be disclosed to an information processing device that has sent the disclosure request; a process of acquiring a determination result as to whether the session log can be disclosed; and a process of outputting a session log that can be disclosed according to the determination result to the information processing device that has sent the disclosure request.

[0142] Furthermore, some or all of the configurations described in Supplements 2 to 8 that are dependent on Supplement 1 above may also be dependent on Supplements 18 and 21 in the same dependent relationship as Supplements 2 to 8. Furthermore, not limited to Supplement 1, Supplement 18, and Supplement 21, some or all of the configurations described as Supplements may be made dependent on various hardware, software, various recording means for recording software, or systems, within the scope of each of the above-mentioned embodiments.

[0143] Furthermore, some or all of the configurations described in Supplements 10 to 12, which are dependent on Supplementary Note 9, may also be dependent on Supplementary Note 19 and Supplementary Note 22 in the same dependent relationship as Supplements 2 to 8. Furthermore, not limited to Supplementary Note 9, Supplementary Note 19, and Supplementary Note 22, some or all of the configurations described as Supplements may be similarly made dependent on various hardware, software, various recording means for recording software, or systems, within the scope of each of the above-mentioned embodiments.

[0144] Furthermore, some or all of the configurations described in Supplements 14 to 17, which are dependent on Supplement 13, may also be dependent on Supplement 20 and Supplement 23 in the same dependent relationship as Supplements 2 to 8. Furthermore, not limited to Supplement 13, Supplement 20, and Supplement 23, some or all of the configurations described as Supplements may be made dependent on various hardware, software, various recording means for recording software, or systems, within the scope of each of the above-mentioned embodiments.

[0145] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0146] 10 Data management device 101 Derived key generation unit 102 Derived key output unit 103 Query log acquisition unit 104 Search request acquisition unit 105 Search unit 106 Search result output unit 107 Session log acquisition unit 108 Log search request acquisition unit 109 Session log output unit 110 Storage unit 20 Monitoring support device 201 Derived key acquisition unit 202 Search target acquisition unit 203 Search request output unit 204 Search result acquisition unit 205 Result output unit 206 Confirmation target acquisition unit 207 Disclosure request unit 208 Log acquisition unit 209 Log output unit 210 Monitoring data storage unit 30 Management support device 301 Request acquisition unit 302 Log search request output unit 303 Acquisition unit 304 Confirmation log output unit 305 Determination result acquisition unit 306 Output unit 307 Key acquisition unit 308 Encryption unit 309 Management data storage unit 40 Data storage device 50 Supervisor terminal device 60 Manager terminal device 70 Computer 701 CPU 702 Memory 703 Storage device 704 Input / output I / F 705 Communication I / F

Claims

1. A data management device comprising: a derived key output means for outputting a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status; a query log acquisition means for acquiring a query log that records queries regarding access to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in an encrypted state based on a second derived key generated from the master key and the first derived key; a search request acquisition means for acquiring a search request for searching the query log, in an encrypted state based on the first derived key; a search means for searching the query log based on the search request; and a search result output means for outputting search results of the query log.

2. The data management device of claim 1 further comprising: a session log acquisition means for acquiring a session log, which is a log that records the content of access to data managed by the rights entity and is associated with the query log, in a state encrypted based on a third derived key generated from the master key and the first derived key; a search request acquisition means for acquiring a session log search request for searching the session log in a state encrypted based on the first derived key; and a session log output means for outputting the results of the search of the session log.

3. The data management device according to claim 1 or 2, wherein the search results for the query log include information for identifying a session corresponding to the query log.

4. The data management device according to claim 1, wherein the search request acquisition means acquires a search request for searching the query log in a state encrypted using a key converted from the first derived key.

5. The data management device according to any one of claims 1 to 4, wherein the query log is a log relating to accesses made to medical data to which the rights entity holds rights.

6. The data management device according to claim 2, wherein the session log is a log of a session in which the rights subject has accessed medical data to which the rights subject has rights.

7. The data management device according to claim 6, wherein the session log includes information about the nationality of a person who accessed the medical data.

8. The data management device according to claim 3, wherein the information for identifying the session is an identifier of the session included in the query log.

9. A monitoring support device comprising: a derived key acquisition means for acquiring a first derived key from a data management device that stores a query log, which records queries regarding access to data, in an encrypted state based on a first derived key and a second derived key generated from a master key; a search request output means for outputting a search request for searching the query log to the data management device in an encrypted state based on the first derived key; a search result acquisition means for acquiring search results of the query log from the data management device; and an output means for outputting the acquired search results.

10. The monitoring support device described in claim 9, further comprising: a disclosure request means for outputting a request for disclosure of a session log, which is a log that records the content of access to the data and is associated with the query log, to an information processing device used by a rights entity that has rights to the data; and a log acquisition means for acquiring information regarding the determination result of whether or not the session log can be disclosed from the information processing device used by the rights entity.

11. The monitoring assistance device according to claim 10, wherein the disclosure request means outputs the session log disclosure request in a state where the request is encrypted with the first derived key.

12. A management support device comprising: a disclosure request acquisition means for acquiring a request to disclose a session log associated with a query log based on search results of the query log that records queries regarding access to data; an acquisition means for acquiring a session log specified by the disclosure request; a confirmation log output means for outputting the acquired session log as information for confirming whether the session log can be disclosed to the information processing device that sent the disclosure request; a determination result acquisition means for acquiring a determination result as to whether the session log can be disclosed; and an output means for outputting a session log that can be disclosed based on the determination result to the information processing device that sent the disclosure request.

13. The management support device according to claim 12, further comprising a log search request output means for searching for the session log indicated by the disclosure request from session logs encrypted based on a first derivative key and a third derivative key generated from a master key.

14. The management support device described in claim 12 or 13, wherein the session log includes the nationality of the person who accessed the data, and the output means outputs a session log including the nationality of the person who accessed the data as a session log to be output for confirmation of whether disclosure is permitted.

15. A data management method comprising: outputting a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status; acquiring a query log that records queries regarding access to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in an encrypted state based on a second derived key generated from the master key and the first derived key; acquiring a search request to search the query log, in an encrypted state based on the first derived key; searching the query log based on the search request; and outputting search results of the query log.

16. A monitoring support method comprising: obtaining a first derived key from a data management device that stores a query log, which records queries related to access to data, in a state encrypted based on a first derived key and a second derived key generated from a master key; outputting a search request to search the query log in a state encrypted based on the first derived key to the data management device; obtaining search results for the query log from the data management device; and outputting the obtained search results.

17. A management support method comprising: acquiring a request to disclose a session log associated with a query log based on search results for the query log that records queries regarding access to data; acquiring the session log specified in the disclosure request; outputting the acquired session log as information for confirming whether the session log can be disclosed to the information processing device that sent the disclosure request; acquiring a determination result as to whether the session log can be disclosed; and outputting the session log that can be disclosed based on the determination result to the information processing device that sent the disclosure request.

18. A recording medium that non-temporarily records a data management program that causes a computer to execute the following processes: outputting a first derived key generated from a master key to an information processing device used by a monitoring entity that monitors access status; acquiring a query log that records queries regarding access to data managed by a rights entity that is different from the monitoring entity and has rights to the data, in a state encrypted based on a second derived key generated from the master key and the first derived key; acquiring a search request for searching the query log, in a state encrypted based on the first derived key; searching the query log in an encrypted state based on the search request; and outputting search results of the query log.

19. A recording medium that non-temporarily records a monitoring support program that causes a computer to execute the following processes: a process of acquiring a first derived key from a data management device that stores a query log, which records queries related to access to data, in a state encrypted based on a first derived key and a second derived key generated from a master key; a process of outputting a search request for searching the query log to the data management device in a state encrypted based on the first derived key; a process of acquiring search results of the query log from the data management device; and a process of outputting the acquired search results.

20. A recording medium that non-temporarily records a management support program that causes a computer to execute the following processes: acquiring a request to disclose a session log associated with a query log that records queries regarding access to data, based on the search results of the query log; acquiring the session log specified in the disclosure request; outputting the acquired session log as information for confirming whether the session log can be disclosed to the information processing device that sent the disclosure request; acquiring a determination result as to whether the session log can be disclosed; and outputting the session log that can be disclosed based on the determination result to the information processing device that sent the disclosure request.

Images