Information management device

Abstract

[Problem] To appropriately consolidate access to management information by automatically determining access authority for each user. [Solution] The present invention comprises: a storage means for storing user identification information and attribute information in association with each other; a storage means for storing attribute information, accessible information, and a provision form of information in association with each other; a means for receiving one item of user identification information and a provision request for one item of management information from one user terminal operated by one user; a means for extracting one item of attribute information pertaining to the one user on the basis of the one item of user identification information; a means for specifying one item of accessible information and a provision form of the one item of accessible information on the basis of the one item of attribute information; a means for converting and processing the one item of management information on the basis of the provision form of the one item of accessible information when the one item of management information is included in the one item of accessible information; and a means for providing the one item of management information after the conversion and processing to the one user terminal.

Description

Information management apparatus

[0001] The present invention relates to information security technology.

[0002] Business operators hold various types of important information, such as purchasing data, customer data, employee data and financial data. On the other hand, business operators have connections with a large number of unspecified people, including employees, business partners and outsourced service providers, and in some cases, it may become necessary to allow such a large number of unspecified people to access the information held by the business operator.

[0003] Against this background and in an era where the importance of information security is ever-increasing, a large number of technical proposals related to information security have been made. For example, Patent Document 1 proposes a personal information leakage monitoring system that detects the fact that personal information has been leaked from a monitored database and the date and time when the leakage occurred.

[0004] Japanese Patent No. 5674991

[0005] However, as described above, it is necessary to permit access to management information for a large number of unspecified stakeholders, and it is necessary to restrict the information that each stakeholder can access in accordance with their respective qualifications. The prior art has a problem in that it cannot address such needs.

[0006] Therefore, in view of the above problems, an object of the present invention is to provide an information management apparatus that automatically determines access authority for each user and appropriately manages access to management information.

[0007] One form of the disclosed information management device is characterized by comprising: user attribute storage means for storing user identification information and attribute information of a user identified by the user identification information in association; access management information storage means for storing the attribute information, accessible information from management information, and the form of provision of the accessible information in association; provision request receiving means for receiving a request for provision of one of the management information and one of the user identification information relating to the one of the user from a user terminal operated by one of the user identification information; attribute information extraction means for extracting one of the attribute information relating to one of the user from the user attribute storage means based on the one of the user identification information; provision condition identification means for identifying one of the accessible information and one of the form of provision of the accessible information based on the one of the attribute information and the access management information storage means; information conversion and processing means for converting and processing one of the management information based on the form of provision of the one of the accessible information if the one of the management information is included in the one of the accessible information; and information providing means for providing the one of the converted and processed management information to the one of the user terminals.

[0008] The information management system to be disclosed automatically determines access rights for each user and appropriately manages access to the management information.

[0009] This figure shows an overview of the information management device according to this embodiment. This is a functional block diagram of the information management device according to this embodiment. This figure shows an example of the hardware configuration of the information management device according to this embodiment. This is a flowchart showing an example of processing performed by the information management device according to this embodiment.

[0010] The embodiments for carrying out the present invention will be described with reference to the drawings. (Operating principle of the information management device according to this embodiment)

[0011] The operating principle of the information management device (hereinafter simply referred to as "this device") 100 according to this embodiment will be explained using Figures 1 and 2. Figure 1 is a diagram showing the connection relationship between this device 100 and other devices, and Figure 2 is a functional block diagram of this device 100.

[0012] As shown in Figure 1, the device 100 is connected via a communication network 330 to a user terminal 230 operated by a user 210 and a management information storage device 340 that stores management information 250 managed by the device 100. The communication network 330 may be wired or wireless. The user terminal 230 may be a mobile information terminal such as a smartphone or a personal computer.

[0013] As shown in Figure 2, the device 100 includes a user attribute storage means 110, an access management information storage means 120, a provision request receiving means 130, an attribute information extraction means 140, a provision condition identification means 150, an information conversion / processing means 160, and an information provision means 170.

[0014] The user attribute storage means 110 stores user identification information 220 and attribute information 240 of the user 210 identified by the user identification information 220 in association with each other. The attribute information 240 includes, for example, information such as name, gender, age, affiliation, and position within the affiliation.

[0015] The access management information storage means 120 stores, in association with, the access source information 290 of the user terminal 230, attribute information 240, accessible information (or information defining accessible information) 270 from the management information 250, and the provision form (or information defining the provision form) 280 for each accessible information 270. The access source information 290 is, for example, user terminal identification information 310 and access path 320 such as an IP (Internet Protocol) address. The management information 250 is information that this device 100 manages, and is stored, for example, in the management information storage device 340. Accessible information 270 is information for identifying and defining accessible information. The information provision form 280 is information that defines the provision form of the management information 250 when providing the management information 250, and is, for example, information masking, encryption, hashing, etc., and masking, encryption, and hashing may be all or a specific part of the target information.

[0016] The information provision request receiving means 130 receives a request 260 for the provision of management information 250 directly or indirectly from the user terminal 230 operated by the user 210. In addition, the information provision request receiving means 130 receives user identification information 220 related to the user 210 and access source information 290 related to the user terminal 230 directly or indirectly from the user terminal 230.

[0017] The attribute information extraction means 140 extracts attribute information 240 relating to the user 210 from the user attribute storage means 110 based on the user identification information 220 received by the provision request receiving means 130.

[0018] The provision condition identification means 150 identifies the accessible information (or information defining it) 270 and the provision form (or information defining it) 280 of the information 270, based on the attribute information 240 extracted by the attribute information extraction means 140, the access source information 290 received by the provision request receiving means 130, and the access management information storage means 120.

[0019] The information conversion / processing means 160 performs the following processing when the management information 250 targeted by the provision request 260 received by the provision request receiving means 130 is included in the accessible information 270 identified by the provision condition identification means 150. The information conversion / processing means 160 converts and processes the management information 250 targeted by the provision request 260 based on the information provision form 280 identified by the provision condition identification means 150. The information conversion / processing means 160 performs, for example, masking, encryption, hashing, etc., on all or a specific part of the management information 250. The information provision means 170 provides the management information 250 converted and processed by the information conversion / processing means 160 to the user terminal 230 that sent the provision request 260.

[0020] Based on the above operating principle, the device 100 can automatically determine access rights for each user 210 and appropriately manage (consolidate) access to the management information 250. (Hardware configuration of the information management device according to this embodiment)

[0021] An example of the hardware configuration of the device 100 will be explained using Figure 3. Figure 3 is a diagram showing an example of the hardware configuration of the device 100. As shown in Figure 3, the device 100 has a CPU (Central Processing Unit) 510, ROM (Read-Only Memory) 520, RAM (Random Access Memory) 530, auxiliary storage device 540, communication I / F 550, input device 560, display device 570, and storage medium I / F 580.

[0022] The CPU 510 is a device that executes programs stored in the ROM 520. It processes data loaded into the RAM 530 according to program instructions and controls the entire device 100. The ROM 520 stores programs and data that the CPU 510 will execute. When the CPU 510 executes a program stored in the ROM 520, the RAM 530 loads the program and data to be executed and temporarily holds the calculation data during the calculation.

[0023] The auxiliary storage device 540 is a device that stores the operating system (OS), which is the basic software, and application programs related to this embodiment, along with related data. The auxiliary storage device 540 is, for example, an HDD (Hard Disk Drive) or flash memory, and includes user attribute storage means 110 and access management information storage means 120.

[0024] The communication interface 550 is an interface for exchanging data with other devices 230 that provide communication functions, by connecting to a communication network 310 such as a wired or wireless LAN (Local Area Network) or the Internet.

[0025] The input device 560 is a device for inputting data into the main device 100, such as a keyboard. The display device (output device) 570 is a device consisting of an LCD (Liquid Crystal Display) or the like, and functions as a user interface when the user uses the functions of the main device 100 or makes various settings. The storage medium I / F 580 is an interface for sending and receiving data with storage media 590 such as CD-ROMs, DVD-ROMs, and USB memory.

[0026] Each of the means of this device 100 may be realized by the CPU 510 executing a program corresponding to each means stored in the ROM 520 or auxiliary storage device 540. Alternatively, each of the means of this device 100 may be realized by the processing related to each means being implemented as hardware. Furthermore, the program according to the present invention may be read from an external server device via a communication I / F 550, or read from a storage medium 590 via a storage medium I / F 580, and the device 100 may execute the program. (Example of processing by the information management device according to this embodiment) An example of processing by this device 100 will be described using Figure 4. Figure 4 is a flowchart showing the flow of the processing example by this device 100.

[0027] In S10, the request receiving means 130 receives a request 260 for the provision of management information 250, either directly or indirectly, from the user terminal 230 operated by the user 210. In addition, in S10, the request receiving means 130 receives user identification information 220 related to the user 210 and access source information 290 related to the user terminal 230, either directly or indirectly, from the user terminal 230.

[0028] In S20, the attribute information extraction means 140 extracts attribute information 240 relating to the user 210 from the user attribute storage means 110 based on the user identification information 220 received in S10.

[0029] In S30, the provision condition identification means 150 identifies the accessible information 270 and the form of provision 280 of the information 270 based on the attribute information 240 extracted in S20, the access source information 290 received in S10, and the access management information storage means 120.

[0030] In S40, the information conversion / processing means 160 performs the following processing if the management information 250 targeted by the provision request 260 received in S10 is included in the accessible information 270 identified in S30. In S40, the information conversion / processing means 160 converts and processes the management information 250 targeted by the provision request 260 based on the information provision form 280 identified in S30. For example, the information conversion / processing means 160 performs masking, encryption, hashing, etc., on all or a specific part of the management information 250 according to the information provision form 280 identified in S30. In S50, the information provision means 170 provides the management information 250 converted and processed in S40 to the user terminal 230 that sent the provision request 260.

[0031] By performing the above-described process, the device 100 can automatically determine access rights for each user 210 and appropriately manage (consolidate) access to the management information 250.

[0032] Although embodiments of the present invention have been described in detail above, the present invention is not limited to these specific embodiments, and various modifications and changes are possible within the scope of the gist of the present invention as described in the claims.

[0033] 100 Information management device 110 User attribute storage means 120 Access management information storage means 130 Provision request receiving means 140 Attribute information extraction means 150 Provision condition identification means 160 Information conversion / processing means 170 Information provision means 210 User 220 User identification information 230 User terminal 240 Attribute information 250 Management information 260 Request for provision of management information 270 Accessible information 280 Information provision form 290 Access source information 310 User terminal identification information 320 Access route 330 Communication network 340 Management information storage device 510 CPU 520 ROM 530 RAM 540 Auxiliary storage device 550 Communication interface 560 Input device 570 Output device 580 Storage medium interface 590 Storage medium

Claims

1. An information management device comprising: a user attribute storage means for storing user identification information and attribute information of a user identified by the user identification information in association; an access management information storage means for storing the attribute information, accessible information from management information, and the form of provision of the accessible information in association; a provision request receiving means for receiving a request for provision of one of the management information and one of the user identification information relating to the one of the user from a user terminal operated by one of the user identification information; an attribute information extraction means for extracting one of the attribute information relating to one of the user from the user attribute storage means based on the one of the user identification information; a provision condition identification means for identifying one of the accessible information and one of the form of provision of the accessible information based on the one of the attribute information and the access management information storage means; an information conversion and processing means for converting and processing one of the management information based on the form of provision of the one of the accessible information if the one of the management information is included in the one of the accessible information; and an information provision means for providing the converted and processed one of the management information to the one of the user terminal.

2. The information management device according to claim 1, characterized in that the access management information storage means stores in association the access source information of the user terminal, the attribute information, the accessible information, and the form of provision of the accessible information, the provision request receiving means receives one of the access source information relating to the user terminal, and the provision condition identification means identifies one of the accessible information and the form of provision of the accessible information based on the one of the attribute information and the one of the access source information.

3. The information management device according to claim 2, characterized in that the access source information includes user terminal identification information relating to the user terminal or the access route to the information management device.

4. A computer comprising: a user attribute storage means for storing user identification information and attribute information of a user identified by the user identification information in association; an access management information storage means for storing the attribute information, accessible information from management information, and the form of provision of the accessible information in association; wherein the provision request receiving means receives a request for provision of one of the management information and one of the user identification information relating to the one user from a user terminal operated by one of the users; an attribute information extraction means extracts one of the attribute information relating to the one user from the user attribute storage means based on the one user identification information; a provision condition identification means identifies one of the accessible information and one form of provision of the accessible information based on the one attribute information and the access management information storage means; and an information conversion / processing means converts / processes the one management information based on the form of provision of the one accessible information if the one management information is included in the one accessible information. An information management method characterized in that the information provision means includes the step of providing the converted and processed management information to the user terminal.

5. The information management method according to claim 4, characterized in that the access management information storage means stores in association the access source information of the user terminal, the attribute information, the accessible information, and the form of provision of the accessible information, the provision request receiving means receives one of the access source information relating to the user terminal, and the provision condition identification means identifies one of the accessible information and the form of provision of the accessible information based on the one of the attribute information and the one of the access source information.

6. The information management method according to claim 5, characterized in that the access source information includes user terminal identification information relating to the user terminal or the access route to the information management device.

7. An information management program for causing a computer to perform the method according to any one of claims 4 to 6.

Images