JP4381925B2 - Access control system, access control method, and access control program - Google Patents

Description

  The present invention relates to an access control system, an access control method, and an access control program for controlling access by an accessor to a service related to an accessed person.

  2. Description of the Related Art Conventionally, there is a system for controlling access by an accessor to a service related to an accessed person. For example, personal information related to a certain user A (for example, the referred person information represented by the name, address, date of birth, credit number, etc. of the user A who is a referenced person) is disclosed to the other user B who is a referring person. This corresponds to the system related to the information disclosure service. By the way, when implementing such an information disclosure service, if the information about the user A is disclosed without limitation, the user A who is a reference person may suffer a disadvantage. For this reason, in order to realize a practical information disclosure service, it is necessary to disclose personal information to the user B in a form that the user A is convinced. However, such an access control function is realized. Conventional techniques as described below are known as conventional techniques.

  For example, Patent Document 1 (Japanese Patent Laid-Open No. 2002-229953) discloses a system for disclosing personal information of a user based on an access code in a personal information disclosure server. More specifically, in this system, when the referred person sends an access code issue request specifying an attribute to be disclosed (information indicating which attribute is to be disclosed) to the server, the server The access code is generated in response to this, the access code and the attribute to be disclosed are associated with each other and stored in the database, and the access code is returned to the referenced person. Then, when the referred person notifies the access code to the referrer who permits the disclosure, and the referrer sends a disclosure request including the access code to the server, the server associates the access code with the access code. Notify the referrer of the attributes to be disclosed stored in the database.

JP 2002-229953 A

  By the way, as described below, the above-described conventional technique has a problem that it lacks convenience in bringing users together by third party mediation.

  More specifically, for example, an access code (hereinafter referred to as “access code AB”) for the user B to refer to the personal information of the user A, and a user C refers to the personal information of the user B, for example. It is assumed that an access code (hereinafter referred to as “access code BC”) has been issued. In such a situation, in order for the user B to become an intermediary, to bring the user A and the user C together, and to allow the user C to refer to the personal information of the user A, as with the access code AB and the access code BC, User C needs to issue an access code (hereinafter referred to as “access code AC”) for referring to the personal information of user A. For this reason, even if the user C becomes acquainted with the user A through the mediation of the user B, there is a problem that the personal information of the user A cannot be referred to unless the access code AC is issued.

  Such a problem is not limited to the case where access control is performed by the information disclosure service described above, but can be caused similarly when the access of an accessor to a service related to a certain accessee is controlled. Even if there was a third-party mediation, the accessor himself / herself could not access the service related to the accessed person without the access code for accessing the accessed person.

  Therefore, the present invention has been made to solve the above-described problems of the prior art and relates to the accessed person even if the accessing person himself does not have an access code for accessing the accessed person. It is an object to provide an access control system, an access control method, and an access control program capable of accessing a service.

In order to solve the above-described problems and achieve the object, the present invention is an access control system for controlling access by an accessor to a service related to the accessed person, and specifies the accessed person that uniquely identifies the accessed person. An access code generating means for generating an access code including at least information and accessor restriction information for restricting the accessor, and access from at least the accessor Y as a plurality of access codes from a predetermined accessor Y Access code reception means for receiving an access code TS including the person-limited information and an access code TE including the access target specifying information of the predetermined access target person X as an access target, and a plurality of the access codes received by the access code reception means Access included in each access code Based on the specific information and the accessor limited information, a determination unit for determining whether to reach from the access code TS to the access code TE, and a determination to reach the access code TE by the arrival determination unit If it is, access control means for controlling the access of the accessor Y for the service related to the accessee X is provided.

Further, the present invention is the above invention, wherein the access code generation means includes relation information indicating a relationship between the accessed person and the accessing person, and an effective condition required for permitting access from the accessing person. Alternatively, an access code further including a combination of these is generated, and when the access control means determines that the access code TE is reached by the arrival determination means, the access code is received by the access code reception means. Access judging means for judging whether or not to permit access by the accessor Y based on relation information, valid conditions or a combination thereof included in each access code, and according to a judgment result by the access judging means The access by the accessor Y is permitted.

Further, the present invention is the above invention, wherein the access determination means is configured to determine whether the predetermined access target X and the predetermined access are based on relation information included in each access code from the access code TS to the access code TE. A link value indicating a degree of connection with the access person Y is calculated, and it is determined whether or not the access of the access person Y is permitted according to the link value.

Further, in the present invention according to the above invention, the access code generating means generates an access code further including an extended effective condition required for permitting access from the predetermined accessor Y, and When it is determined by the arrival determination means that the access code TE is reached, the control means determines the access person Y based on the extended effective condition included in the access code TE received by the access code reception means. Access judging means for judging whether or not to permit access is provided, and access of the accessor Y is permitted according to a judgment result by the access judging means.

Further, the present invention provides the access code according to the above invention, wherein the access control means passes the access code TE when it reaches the access code TE when the arrival determination means determines that the access code TE is reached. Access judging means for judging whether or not the number of access points exceeds a predetermined number, and the access by the accessor Y is permitted according to the judgment result by the access judging means.

Also, in the present invention according to the above-mentioned invention, the access code generation means includes relationship information indicating a relationship between the accessed person and the accessing person, or access control content for controlling access from the accessing person. The access control means controls the access of the predetermined accessor Y based on the relationship information or the access control content included in the access code.

Further, the present invention is the above-described invention, wherein the access control means is configured to calculate the predetermined accessee X calculated based on relation information included in each access code from the access code TS to the access code TE. The access of the predetermined access person Y is controlled in accordance with a link value indicating the degree of connection between the predetermined access person Y and the predetermined access person Y.

Further, in the present invention according to the above-mentioned invention, the access code generation means performs extended relationship information indicating a relationship between the predetermined accessee X and the accessor Y, or access from the predetermined accessor Y. An access code further including an extended access control content for control is generated, and the access control means accesses the predetermined accessor Y based on the extended relation information or the extended access control content included in the access code. It is characterized by controlling.

Further, the present invention is the above-mentioned invention, wherein the access control means controls the access by the accessor Y according to the number of access codes passed from the access code TS to the access code TE. It is characterized by determining.

Further, according to the present invention, in the above invention, the arrival determination unit is configured on the condition that the accessee specifying information included in a certain access code corresponds to the accessor limited information included in another access code. When the access code TS and the access code TE can be connected via another access code, it is determined that the access code TS is reached from the access code TE. Features.

The present invention also provides an access control method for controlling access by an accessor to a service related to an accessed person, the accessee specifying information for uniquely specifying the accessed person and an access for limiting the accessee An access code generating step for generating an access code including at least accessor-limited information, and an access code TS and access including at least accessor-limited information of the accessor Y as a plurality of access codes from a predetermined accessor Y An access code receiving step for receiving an access code TE including access target specifying information of a predetermined target accessee X as a target, and an access target specifying information included in each of the plurality of access codes received by the access code receiving step And based on access-only information And determining whether to reach from the access code TS to the access code TE, and when it is determined by the arrival determination step that the access code TE is reached, the accessee The service related to X includes an access control step for controlling access of the accessor Y.

Further, in the present invention according to the above-mentioned invention, the access code generation step includes relationship information indicating a relationship between the accessed person and the accessing person, and effective conditions required for permitting access from the accessing person. Alternatively, an access code further including a combination of these is generated, and when the access control step determines that the access code TE is reached by the arrival determination step, the access code is received by the access code reception step. Including an access determination step for determining whether to permit access by the accessor Y based on relational information, valid conditions, or a combination thereof included in each access code, and depending on the determination result of the access determination step The access by the accessor Y is permitted.

Further, in the present invention according to the above-mentioned invention, the access determination step is based on the relationship information included in each access code from the access code TS to the access code TE, and the predetermined accessee X and the predetermined access A link value indicating a degree of connection with the access person Y is calculated, and it is determined whether or not the access of the access person Y is permitted according to the link value.

Also, in the present invention according to the above-mentioned invention, the access code generation step includes relationship information indicating a relationship between the accessed person and the accessing person, or access control content for controlling access from the accessing person. Is generated, and the access control step controls access of the predetermined accessor Y based on relation information or access control content included in the access code.

Further, the present invention is the above-mentioned invention, wherein the access control step is the predetermined accessee X calculated based on relation information included in each access code from the access code TS to the access code TE. The access of the predetermined access person Y is controlled in accordance with a link value indicating the degree of connection between the predetermined access person Y and the predetermined access person Y.

The present invention also provides an access control program for causing a computer to execute an access control method for controlling access by an accessor to a service related to an accessed person, the accessee specifying information for uniquely specifying the accessed person, An access code generation procedure for generating an access code including at least accessor limitation information for limiting an accessor, and a plurality of access codes from a predetermined accessor Y as at least accessor limitation information of the accessor Y And an access code reception procedure for receiving an access code TE including accessee identification information of a predetermined accessee X that is an access target, and a plurality of access codes received by the access code reception procedure. Each included Based on the accessor identification information and the accessor-limited information, the arrival determination procedure for determining whether or not the access code TS is reached from the access code TS, and the access code TE is reached by the arrival determination procedure. If it is determined that the access control procedure is to be executed, the access control procedure for controlling the access of the accessor Y for the service related to the accessee X is executed by a computer.

Further, the present invention is the above invention, wherein the access code generation procedure includes relationship information indicating a relationship between the accessed person and the accessing person, and valid conditions required for permitting access from the accessing person. Alternatively, an access code further including a combination thereof is generated, and when the access control procedure determines that the access code TE is reached by the arrival determination procedure, the access code is received by the access code reception procedure. Based on relation information, valid conditions included in each access code, or a combination thereof, the computer executes an access determination procedure for determining whether to permit access by the accessor Y, and a determination result based on the access determination procedure The access by the accessor Y is permitted according to To.

Further, the present invention is the above invention, wherein the access determination procedure is performed based on the predetermined access target X and the predetermined access based on relation information included in each access code from the access code TS to the access code TE. A link value indicating a degree of connection with the access person Y is calculated, and it is determined whether or not the access of the access person Y is permitted according to the link value.

Also, in the present invention according to the above-mentioned invention, the access code generation procedure includes relation information indicating a relation between the accessed person and the accessing person, or access control content for controlling access from the accessing person. Is generated, and the access control procedure controls the access of the predetermined accessor Y based on the relationship information or the access control content included in the access code.

Further, the present invention is the above-described invention, wherein the access control procedure is the predetermined accessee X calculated based on relation information included in each access code from the access code TS to the access code TE. The access of the predetermined access person Y is controlled in accordance with a link value indicating the degree of connection between the predetermined access person Y and the predetermined access person Y.

According to the present invention, since access from the accessor Y to the accessee X is controlled by using a plurality of access codes for reaching the accessee X from the accessor Y, the accessor Y is the accessee. Even without having an access code itself for accessing X, it is possible to access a service related to the accessed person X. In other words, if the accessor Y obtains an access code that reaches the accessee X through third-party mediation, the accessee Y does not wait for the access code to be accessed to the accessee X and can access the accessee X The accessor Y can access the service related to the accessed person X through third-party mediation without directly knowing the accessed person X. Furthermore, the accessor Y can secure his / her legitimacy and reliability with respect to the person to be accessed X through third party mediation. For a third party who is an intermediary, it is possible to bring together strangers via an access code and mediate the establishment of a new trust relationship. In addition, since it is not necessary to issue an access code for accessing the accessed person X from the accessing person Y, it is possible to reduce the burden associated with issuing the access code of the address issuing server, the accessed person X, and the accessing person Y. become.

Further, according to the present invention, since the relation information, valid condition, and extended condition included in the access code are used for access determination, it is possible to avoid a situation in which access to the accessor X is permitted without restriction by mediation, Practical control can be realized in which access through mediation is permitted only within a range that satisfies the above. In addition, since the conditions used for such access determination are included in the access code, it is not necessary to manage such conditions in the database, and database resources can be reduced. Furthermore, by using the relational information and valid conditions used for normal access determination also for access determination at the time of mediation, the access code that was not originally intended for mediation remains unchanged without altering the access code generation method. It becomes possible to perform access determination at the time of mediation with assistance.

Further, according to the present invention, the link value indicating the degree of connection between the accessed person X and the accessed person Y is calculated, and this link value is used for access determination. Therefore, the relationship between the accessed person X and the accessed person Y It is possible to practically determine whether or not to allow access by intermediary while estimating.

Further, according to the present invention, by performing access determination at the time of mediation using an extended effective condition that is not normally included in the access code, a practical access determination specialized at the time of mediation can be performed separately from the normal access determination. It becomes possible to do.

Further, according to the present invention, the number of access codes (hops) passed from the access code TS to the access code TE is used for access determination, so the proximity of the accessed person X and the accessed person Y In consideration of the above, it is possible to practically determine whether or not to allow access by mediation.

Further, according to the present invention, by using the relation information and access control contents used for normal access control for access control at the time of mediation, the mediation is originally intended without altering the access code generation method. Access control at the time of mediation can be performed by directly using the access code that has not been performed.

According to the present invention, since the link value indicating the degree of connection between the accessed person X and the accessed person Y is used for access control, the relationship between the accessed person X and the accessed person Y can be estimated while mediating. Can be practically controlled.

In addition, according to the present invention, by performing access control at the time of mediation using extended relation information or extended access control contents that are not normally included in the access code, practical use specialized at the time of mediation is performed separately from normal access control. Access control can be performed.

In addition, according to the present invention, the number of access codes (hops) passed from the access code TS to the access code TE is used for access control. Therefore, it is possible to practically control access at the time of mediation.

Further, according to the present invention, by linking a plurality of access codes depending on whether or not the access target specific information included in a certain access code corresponds to the access-only information included in another access code, It is possible to determine whether the access code TS reaches the access code TE.

  Exemplary embodiments of an access control system, an access control method, and an access control program according to the present invention will be explained below in detail with reference to the accompanying drawings. In the following description, the case where the present invention is applied to an information disclosure service will be described as Embodiments 1 and 2, and the case where the present invention is applied to a service other than the information disclosure service will be described as Embodiment 3.

  In the first embodiment, a case where the present invention is applied to an information disclosure system that controls disclosure of personal information of a referred person who is an accessed person will be described. In the following, after describing the terms used in the first embodiment, the outline and features of the information disclosure system according to the first embodiment, the configuration of the information disclosure system, the details of each device in the system, the generation of the disclosure address, and the normal information A processing procedure leading to disclosure, a processing procedure leading to extended information disclosure, and the like will be described, and finally the effects of the first embodiment will be described.

[Explanation of Terms (Example 1)]
First, main terms used in Example 1 will be described. The “information disclosure service (corresponding to“ service ”described in claims)” used in the first embodiment is a service that discloses information about a user who is a referenced person to a user who is a referring person. Yes, for example, as shown in FIG. 4 and FIG. 5, personal information such as the telephone number (phone), mail address (e-mail), address (address), schedule (schedule) of the referred person is given to the reference person. Disclose.

  The “reference person (corresponding to“ access person ”described in the claims”) used in the first embodiment is a user who refers to personal information, while “referenced person”. The term “corresponds to“ accessed person ”described in the claims” refers to a user who discloses personal information.

  The “identification information (ID)” used in the first embodiment is information for uniquely identifying (specifying or limiting) a referred person or a reference person as a user. For example, a user name or a user number In addition to such user IDs, user addresses and accounts (such as email addresses and telephone numbers) associated therewith, and further, user identifiers generated using these user IDs and user addresses (user IDs and user addresses) This corresponds to the hash value generated from the data or the encrypted data obtained by encrypting these. The “referenced person ID” used below is identification information for uniquely identifying the referenced person, while the “referenced person ID” is for uniquely identifying the referenced person. It is identification information.

  The “disclosure address T (corresponding to the“ access code ”recited in the claims)” used in the first embodiment is a user who is a referrer in the above information disclosure service. This is an access code to be presented when requesting reference to information. Specifically, the above-mentioned “referenced person ID” and “referenced person ID”, “disclosure control content S” or “relationship level R” described later. ”,“ Valid condition C ”and the like. Here, “disclosure control content S”, “relationship level R”, and “valid condition C” are control information for controlling the access of the referrer to the information disclosure service regarding the referee.

  Among these, “disclosure control content S (corresponding to“ access control content ”described in claims) and also expressed as“ disclosure policy ”as appropriate)” means information disclosure of the information disclosure service described above. For example, as illustrated in FIG. 6, “all telephone numbers, e-mail addresses, addresses, and schedules are disclosed”, “phone numbers, e-mail addresses, addresses, and public information. The contents of the control such as “Disclose the schedule (public-schedule)” and “Disclose only the email address and address” correspond to this. In the following first embodiment, the disclosure control content S in the form of listing information items (disclosure information items) that are permitted to be disclosed will be described as an example. It is described as “information item”.

  The “relationship level R (corresponding to“ relationship information ”described in the claims”) is uniquely associated with the disclosure control content S described above, and the above-mentioned referenced person and reference person. For example, the information indicating the relationship of the accessor as viewed from the person to be accessed, such as a friend, a colleague, and a boss, corresponds to this. In addition, the “relationship” mentioned here is not limited to the relationship of the referrer as seen from the referee, but from all viewpoints such as the relationship of the referee as viewed from the referrer and the relationship between the both viewed from the third party. The relationship between the two is understood. In the following first embodiment, as illustrated in FIG. 6, the relationship information such as “friend, colleague, boss” is replaced with a code value (relation level value) “0, 1, 2”. I am trying to process it.

  The “effective condition C (corresponding to the“ effective condition ”described in the claims)” is a condition required for executing the above-described disclosure control content S. For example, disclosure control This is a condition that specifies the period during which the content S is allowed to be executed (for example, only on weekends), the deadline (for example, what year, what month and day), the time (for example, only daytime), or a combination thereof. . In the first embodiment, in addition to the control information such as “relationship level R”, “disclosure control content S”, and “valid condition C” as described above, the referred person ID and the referrer ID are included by a key. A disclosure address T is generated. In other words, as illustrated in S1405 of FIG. 14, a disclosure address T formed of a complex character string is generated.

[Outline and Features of System (Example 1)]
Next, the outline and characteristics of the information disclosure system according to the first embodiment will be described with reference to FIG. FIG. 1 is a diagram for explaining the outline of the information disclosure system according to the first embodiment. However, here, for convenience of explanation, there are three users (user U1, user U2, user U3), and the disclosure address T (U1_U2) for the user U2 to refer to the personal information of the user U1. ) And a case where a disclosure address T (U2_U3) for the user U3 to refer to the personal information of the user U2 is issued will be described as an example. Of the symbols in parentheses of the disclosure address T, the former indicates a user as a referenced person, and the latter indicates a user as a referring person.

(1) Overview of System The overview of the information disclosure system according to the first embodiment is to transmit the personal information of the user who is the referenced person to the user terminal of the user who is the referring person and disclose the information. Briefly explaining this, in the information disclosure system according to the first embodiment, a third party other than the user (for example, a service center that handles the disclosure address T) receives personal information from the user U1 or the user U2 who are the referees. Is received and stored in the personal information storage unit, and the disclosure policy, that is, the relationship level R and the disclosure control content S are received from the user U1 and the user U2 and stored in the disclosure policy storage unit (FIG. 1 (1-1) and (2-1)).

  On the other hand, the service center issues, as a request for issuing the disclosure address T (U1_U2), from the user U1 who is the referenced person, the referred person ID_U1 (identification information of the user U1 who is the referenced person), and the reference person ID_U2 (the reference person). The identification information of a certain user U2), the relationship level R, and the valid condition C are received (see (1-2) in FIG. 1). Then, the service center generates a disclosure address T (U1_U2) including “referenced person ID_U1, reference person ID_U2, relationship level R, and valid condition C” using a predetermined key (FIG. 1). (See 1-3)). Further, the service center transfers the generated disclosure address T (U1_U2) to the user U2 who is a referrer (see (1-4) in FIG. 1). Note that “P” shown in the figure means that a disclosure address T is generated using a key.

  Then, the service center receives an e-mail with the disclosure address T (U1_U2) as the destination address from the user U2 who is the reference as a reference request for the personal information of the user U1 who is the reference (refer to (1- of FIG. 1). See 5)). Thereafter, the service center verifies the validity of the disclosure address T (U1_U2) using a predetermined key, and also refers to the referenced person ID_U1, the reference person ID_U2, the relationship level R, and the validity from the disclosure address T (U1_U2). The condition C is extracted, and further, the validity condition C is used to determine whether or not the disclosure control content can be executed (see (1-6) in FIG. 1). Note that “Q” shown in the figure means that extraction is performed using a key.

  In addition, when the validity of the disclosure address T (U1_U2) is recognized and the execution of the disclosure control content is permitted, the service center discloses the personal information stored in the personal information storage unit. The personal information corresponding to the referred person ID_U1 included in the address T (U1_U2) for the correspondence corresponds to the relationship level R included in the disclosure address T (U1_U2) among the disclosure control contents S stored in the disclosure policy storage unit. In accordance with the disclosure control content S, it is disclosed by mail transmission to the user U2 who is a referrer (see (1-7) in FIG. 1). That is, if the disclosure control content S corresponding to the relationship level R included in the disclosure address T (U1_U2) received from the user U2 is “disclose only the email address and address”, the email address of the user U1. And only the address is disclosed to the user U2.

  Similarly to the above, when the service center receives the referred person ID_U2, the reference person ID_U3, the relationship level R, and the validity condition C from the user U2 who is a reference person as an issuance request for the disclosure address T (U2_U3). Generates a disclosure address T (U2_U3) including these with a predetermined key, and transfers the generated disclosure address T (U2_U3) to the user U3 who is a reference ((2-2) to FIG. 1). (See (2-4)).

  When the service center receives a mail requesting the disclosure address T (U2_U3) as the destination address from the user U3 as a reference as a reference request for the personal information of the user U2 as a reference person, The validity of the disclosure address T (U2_U3) is verified using the key, and the referenced person ID_U2, the reference person ID_U3, the relationship level R, and the validity condition C are extracted from the disclosure address T (U2_U3). Whether or not the disclosure control content can be executed is determined using the effective condition C (see (2-5) and (2-6) in FIG. 1).

  In addition, when the validity of the disclosure address T (U2_U3) is recognized and the execution of the disclosure control content is permitted, the service center discloses the personal information stored in the personal information storage unit. The personal information corresponding to the referenced person ID_U2 included in the address T (U2_U3) for use corresponds to the relationship level R included in the disclosure address T (U2_U3) among the disclosure control contents S stored in the disclosure policy storage unit. In accordance with the disclosure control content S, it is disclosed by mail transmission to the user U3 who is a referrer (see (2-7) in FIG. 1).

(2) System Features As described above, in the information disclosure system according to the first embodiment, the personal information of the user U1 is disclosed to the user U2 through the disclosure address T (U1_U2), and also through the disclosure address T (U2_U3). The personal information of the user U2 is disclosed to the user U3, which is normal information disclosure according to the first embodiment. That is, this information disclosure system has a main feature in that extended information disclosure is performed in addition to normal information disclosure. In the above example, the user U3 refers to the personal information of the user U1. Even without having the disclosure address T (U1_U3) itself, the personal information of the user U1 can be referred to.

  This main feature (extended information disclosure) will be specifically described. In the information disclosure system illustrated in FIG. 1, the user U2 himself or herself as a reference user U1 in order to bring the user U1 and the user U3 together. The disclosure address T (U1_U2) for referring to the personal information is notified to the user U3 (see (3-1) in FIG. 1).

  On the other hand, the service center receives an email including the disclosure address T (U1_U2) and the disclosure address T (U2_U3) from the user U3 who is a reference as an extended reference request for the personal information of the user U1 (FIG. 1). (See (3-2)). Then, the service center verifies the validity of both disclosure addresses T using a predetermined key, and obtains the referred person ID, the reference person ID, the relationship level R, and the validity condition C from each disclosure address T. It is extracted, and it is determined whether or not the disclosure address T (U2_U3) reaches the disclosure address T (U1_U2) (see (3-3) in FIG. 1).

  Here, “to arrive” means that the referenced person ID included in the disclosure address T (U2_U3) corresponds to the reference person ID included in the disclosure address T (U1_U2). In other words, if both the referred person ID and the referred person ID are the user ID_U2, it is determined that “they will arrive”. That is, if the user U1 permits the reference of the user U2 through the disclosure address T (U1-U2) and the user U2 permits the reference of the user U3 through the disclosure address T (U2-U3), the user This means that the user U3 reaches the user U1 with U2 as an intermediary. Note that, from the user U3, a disclosure address T (U1-U4) for which the user U1 has permitted the reference of the user U4 and a disclosure address T (U2-U3) for which the user U2 has permitted the reference of the user U3 are provided. If it has been accepted, it is determined from the user U3 that the user U1 cannot reach the user U1.

  Furthermore, in addition to such arrival determination, the service center determines whether the validity condition C included in each disclosure address T is satisfied, and whether the relationship level R included in the disclosure address T matches. From this viewpoint, it is determined whether or not the disclosure control content can be executed (see (3-3) in FIG. 1). On that basis, the service center determines that the validity of each disclosure address T is recognized, it is determined that the user U3 reaches the user U1, and the execution of the disclosure control content is permitted. Is the relationship level R included in the disclosure address T (U1_U2) of the disclosure control content S stored in the disclosure policy storage unit, the personal information corresponding to the user ID_U1 in the personal information stored in the personal information storage unit. In accordance with the disclosure control content S corresponding to, the user U3 who is the referrer is sent by email and disclosed (see (3-4) in FIG. 1).

  Thus, in the information disclosure system according to the first embodiment, from the user U1 to the user U3 using the plurality of disclosure addresses T (U1_U2) and the disclosure addresses T (U2_U3) for reaching the user U1 from the user U3. Therefore, even if the user U3 does not have the disclosure address T (U1_U3) itself for referring to the personal information of the user U1 as in the main feature described above, the user U1 It becomes possible to refer to personal information. Note that “user U3” here corresponds to “accessee Y” in the claims, “user U1” also corresponds to “accessed person X”, and “disclosure address T (U1_U2)” "Similarly corresponds to" access code TE ", and" disclosure address T (U2_U3) "also corresponds to" access code TS ".

  By the way, in the information disclosure system according to the first embodiment, the generated disclosure address T is not managed in the database, so that the control information (relationship level R and valid condition C) is obtained every time the disclosure address T is generated. It also becomes possible to control disclosure without using such a database, eliminating the need for new accumulation in the database. That is, the relationship level R and the effective condition C are not managed in the database for each generated disclosure address T, but the relationship level R and the effective condition C are included in the disclosure address T. Accordingly, the database resources are not increased in proportion to the database size, and the database itself can be made unnecessary.

[System Configuration (Example 1)]
Next, the configuration of the information disclosure system according to the first embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating the configuration of the information disclosure system according to the first embodiment. In the following, the information disclosure shown in (5) to (7) of FIG. 1 is expressed as “normal information disclosure” or “normal disclosure”, and the information shown in (8) to (11) of FIG. Disclosure is expressed as “extended information disclosure” or “extended disclosure”.

  As shown in FIG. 2, the information disclosure system includes a plurality of user terminals 1, a user information server 10, an address issuing server 20, and an information disclosure server 30 connected to a network (Internet 3, LAN 4, router, etc.). The communication network is configured to be communicable with each other via a communication network formed. Below, after describing the outline | summary of each apparatus, the detail of each apparatus is demonstrated.

  The user terminal 1 is a known personal computer, workstation, home game machine, Internet TV, PDA, or mobile communication device such as a mobile phone or PHS in which communication software such as e-mail software and browser software is installed. Terminal. Specifically, the user terminal 1 is a terminal that a user uses as a referenced person, a referrer, or an intermediary, and has the following roles according to each use. That is, when used by a user as a referenced person, the user terminal 1 mainly has a role of transmitting personal information and a disclosure policy to the information disclosure server 30.

  Further, when used by a user as a reference in normal disclosure, the user terminal 1 is mainly accompanied by a role of receiving and registering a disclosure address T from the address issuing server 20 and a disclosure address T. It has a role of transmitting a reference request mail for normal disclosure to the information disclosure server 30, a role of receiving a disclosure mail including personal information related to normal disclosure from the information disclosure server 30, and the like. On the other hand, when used by a user as a reference in the extended disclosure, the user terminal 1 mainly receives and registers the disclosure address T from the user terminal 1 of the user who is an intermediary, It has a role of transmitting an extended disclosure reference request mail with a plurality of disclosure addresses T to the information disclosure server 30, a role of receiving a disclosure mail including personal information related to the extended disclosure from the information disclosure server 30, and the like. Further, when used by a user as an intermediary in the extended disclosure, the user terminal 1 mainly has a role of transmitting the disclosure address T to the user terminal 10 of the reference in the extended disclosure.

  The user information server 10 is a database device that stores data and programs necessary for various processes performed by the information disclosure system according to the first embodiment, and mainly has a role of managing information on users who use the information disclosure service.

  The address issuing server 20 is a server device that issues a disclosure address T, and mainly plays a role of receiving an address issue request message from a user terminal 1 of a user as an issuer, a role of generating a disclosure address T, and generation It has a role of transmitting the disclosed address T to the user terminal 1 of the user who is a referer or a referee.

  The information disclosure server 30 is a server device that provides an information disclosure service. The information disclosure server 30 mainly receives and registers personal information and a disclosure policy from the user terminal 1 of the user who is a referred person, and the user who is the reference person. The role of receiving a reference request mail for normal disclosure with a disclosure address T from the user terminal 1, the role of determining whether disclosure is possible based on the disclosure address T included in the reference request mail, and the personal information of the referenced person The role of transmitting to the user terminal 1 of the referrer based on the disclosure address T and disclosing it, and the extended disclosure reference request mail with a plurality of disclosure addresses T from the user terminal 1 of the user who is the referrer , A role of determining whether disclosure is possible (whether it arrives, etc.) based on a plurality of disclosure addresses T included in the reference request email, and the personal information of the referred person is disclosed. Having like functions to disclose and transmitted to the user terminal 1 of the reference person based on less T.

[User terminal (Example 1)]
As described above, the user terminal 1 has various roles according to the use by the user as a referenced person, a reference person, or an intermediary, as closely related to the present invention. Below, the role of the above-mentioned user terminal 1 is demonstrated easily.

  Transmission of personal information (that is, referred person information such as a telephone number, an e-mail address, an address, a schedule, etc.) by the user terminal 1 is performed in accordance with a user instruction as a referred person or periodically every predetermined time Alternatively, when the personal information is changed, an update request message including a user ID, a password for user authentication and personal information is transmitted to the information disclosure server 30. Similarly, transmission of a disclosure policy (that is, information including the relationship level R and the disclosure control content S) is also performed in accordance with a user instruction as a referred person, periodically at predetermined time intervals, or in accordance with a disclosure policy. When a change occurs, it is performed by transmitting an update request message including a user ID, a password for user authentication, and a disclosure policy.

  Also, the issue request message for the disclosure address T as a referred person is transmitted through a “disclosure address issue page” as illustrated in FIG. That is, after accessing the address issuing server 20, if the user authentication is successful through the user authentication page illustrated in FIG. 8, the “disclosure address issuing page” illustrated in FIG. However, when a referrer ID, a relationship level R, a valid condition C (expiration date designation), and a notification destination of a disclosure address T are input from a referenced person via a keyboard or a mouse to such a page. Then, an address issue request message composed of the input information is transmitted to the address issue server 20. The address generation notification as a referred person is received by receiving an “address issue response page” as illustrated in FIG. 10 from the address issue server 20 and outputting the page to the monitor of the user terminal 1 or the like. Done in

  Also, the disclosure address T as a reference is received and registered through an “address generation notification mail” as illustrated in FIG. That is, when an “address generation notification mail” as illustrated in FIG. 11 is received from the address issuing server 20, the content including the disclosure address T is output to the monitor of the user terminal 1 of the referrer. When the disclosure address T is designated by the user via the keyboard or mouse on the mail, the designated disclosure address T is registered in the address storage unit 1a (so-called mail software address book). Note that the process of receiving and registering the disclosure address T from the user terminal 1 of the user who is an intermediary in the extended disclosure is performed in the same manner as described above.

  In addition, the reference request mail in the normal disclosure is disclosed in accordance with the instruction of the user who is the referrer or periodically at every predetermined time as shown in FIG. This is done by transmitting to the server 30. That is, as illustrated in FIG. 12, when the reference request mail addressed to the disclosure address T is created by the user via the keyboard or mouse of the user terminal 1, the user terminal 1 is created. A reference request mail for normal disclosure is transmitted to the information disclosure server 30. When transmitting the reference request mail, a user who is a reference can make a limited disclosure request via the mail subject (SUBJECT) as illustrated in FIG. In other words, for example, when a reference is requested only for the schedule of April 1, 2004, a limited disclosure request command such as “sched 040401” is input to the subject.

  In addition, the reference request mail in the extended disclosure is disclosed in accordance with the instruction of the user who is the referrer or periodically at every predetermined time as shown in FIG. This is done by transmitting to the server 30. That is, as illustrated in FIG. 18, the disclosure address T (U2_U3) corresponding to the access code TS is the destination, and the disclosure address T (U1_U2) corresponding to the access code TE is continued from the characters [syoukai]. In addition, a reference request mail in which a limited disclosure request similar to the above-described normal disclosure reference request mail is described in the subject (SUBJECT) is sent to the user via the keyboard or mouse of the user terminal 1 The user terminal 1 transmits the created extended disclosure reference request mail to the information disclosure server 30.

  In addition, reception of personal information in normal disclosure and extended disclosure is performed by receiving a “disclosure mail” as exemplified in FIGS. 13 and 19 from the information disclosure server 30. That is, as illustrated in FIG. 13 and FIG. 19, an e-mail in which the disclosure subject (referee) user name and the command of the limited disclosure request are included and the personal information of the referee to be disclosed is received. To do.

[User Information Server (Example 1)]
As described above, the user information server 10 has a role of managing information of users (referencers and referenced persons) who receive an information disclosure service, as described above, which is closely related to the present invention. Specifically, the user information server 10 includes a user information table 11 as shown in FIG. 2, and the user information table 11 includes a user ID (referenced person) of each user as illustrated in FIG. 3. IDs and IDs used as referrer IDs) are stored in association with passwords for user authentication, e-mail addresses, and the like.

[Address issuing server (Example 1)]
As illustrated in FIG. 2, the address issuing server 20 includes a communication unit 21, a user authentication unit 22, an issue key storage unit 23, and an address generation unit 24 as closely related to the present invention. The address generation unit 24 corresponds to “access code generation means” recited in the claims.

  Among these, the communication unit 21 is a processing unit that controls communication with the user terminal 1 or the like according to a so-called SMTP or HTTP communication protocol. Specifically, processing for receiving an access request from the user terminal 1 of the user who is a referenced person and returning a user authentication page (see FIG. 8) to the user terminal 1, from information input on the user authentication page A process of receiving a user authentication request message from the user terminal 1, a process of receiving an address issue request message consisting of information input on the disclosure address issue page (see FIG. 9), and the like are executed.

  Further, when the disclosure address T is generated by the address generation unit 24 described later, the communication unit 21 transmits an address issue response page (see FIG. 10) to the user terminal 1 of the user who is the referred person. In addition to the processing, a generation notification mail including the generated disclosure address T (see FIG. 11) is created, and the generation notification mail is transmitted to the user terminal 1 of the user who is the referrer. To do.

  The user authentication unit 22 is a processing unit that authenticates whether or not the referred person is a valid user who can request the issuance of the disclosure address T. Specifically, when a user authentication request message including information input on the user authentication page (see FIG. 8) is received from the referenced person terminal 1, the identification information and password included in the request message are stored in the user information table. 11 is authenticated whether or not it is stored in association with 11. As a result, if the user authentication is successful, information to that effect is passed to the address generation unit 24 described later, and if the user authentication fails, a response to that effect is sent to the referenced user terminal 1.

  The issuance key storage unit 23 is a means for storing an issuance key (master key) used for generating the disclosure address T. This issuance key is a verification key stored in a verification key storage unit 36 of the information disclosure server 30 described later. It is the same key as the key.

  The address generation unit 24 is a processing unit that receives information used for generating the disclosure address T from the user terminal 1 of the referenced person and generates the disclosure address T. Specifically, through the “disclosure address issuance page” illustrated in FIG. 9, the referrer ID, the relationship level R, the valid condition C (expiration date designation), the notification destination of the disclosure address T (the user of the referrer) Name). The referred person ID is accepted without waiting for input with the user name written in the above-described user authentication page.

  Then, the address generation unit 24 uses the issuance key stored in the issuance key storage unit 23, the referenced person ID received from the referenced person, the referrer ID, the relationship level R, and the validity condition C (expiration date designation). The disclosure address T is generated. The process for generating the disclosure address T will be described in detail later with reference to FIG.

[Information Disclosure Server (Example 1)]
As shown in FIG. 2, the information disclosure server 30 is closely related to the present invention, and as illustrated in FIG. 2, the communication unit 31, the user authentication unit 32, the personal information storage unit 33, the disclosure policy storage unit 34, An update unit 35, a verification key storage unit 36, a disclosure determination unit 37 (normal disclosure determination unit 37a, extended disclosure determination unit 37b), and a disclosure control unit 38 (normal disclosure control unit 38a, extended disclosure control unit 38b). Prepare. The communication unit 31 corresponds to the “access code receiving unit” recited in the claims, and the extended disclosure determination unit 37b corresponds to the “arrival determination unit” and the “access determination unit”, and the disclosure control unit 38b. Corresponds to “access control means”.

  Among these, the communication unit 31 is a processing unit that controls communication with a user terminal 1 of a user as a referred person or a reference person in accordance with a so-called SMTP or HTTP communication protocol. Specifically, a process of receiving an update request message related to personal information or a disclosure policy from the user terminal 1 of the user who is a referenced person, and a reference to normal disclosure or extended disclosure from the user terminal 1 of the user who is the reference person Processing for receiving a request mail (see FIG. 12 and FIG. 18), a disclosure mail (see FIG. 13 and FIG. 19) containing personal information related to normal disclosure and extended disclosure is transmitted to the user terminal 1 of the user who is the referrer Execute the process to perform.

  Here, when receiving a reference request mail for normal disclosure or extended disclosure, the communication unit 31 receives a limited disclosure request from a reference person via the mail subject (SUBJECT) as described above. That is, as illustrated in FIG. 12 and FIG. 18, for example, a user who requests a reference only for the schedule of April 1, 2004 inputs a limited disclosure request command such as “sched 040401” in the subject line. The received reference request mail is accepted.

  The user authentication unit 32 is a processing unit that authenticates whether or not the user who is a referred person is a valid user who can receive the information disclosure service. Specifically, when a personal information or disclosure policy update request message is received from the user terminal 1 of the user as a referenced person, the user ID and password included in the message are stored in association with the user information table 11. Authenticate whether or not As a result, if the user authentication is successful, information to that effect is passed to the information updating unit 35 described later, and if the user authentication fails, a response to that effect is sent to the user terminal 1 of the referenced person.

  The personal information storage unit 33 is means for storing the personal information of each user received from the user terminal 1 of the user who is a referenced person. Specifically, as illustrated in FIGS. 4 and 5, the basic information table shows the user's telephone number (phone), mail address (e-mail), and address (address) in association with the user ID of each user. And the start date / time and end date / time and contents of the schedule are stored in the schedule table. In the schedule table, for each schedule, whether it is a public schedule or a private schedule may be stored.

  The disclosure policy storage unit 34 is a means for storing the disclosure policy of each user received from the user terminal 1 of the user who is a referenced person. Specifically, as illustrated in FIG. 6, the disclosure control content S is stored for each relationship level R in association with the user ID of each user. Here, in the first embodiment, the disclosure control content S that uses different disclosure information items for each relationship level R is adopted. Therefore, as illustrated in the figure, the disclosure control content S includes “phone, e-mail, address, Information items permitted to be disclosed such as “schedule” are listed and defined. Note that “schedule” means that all schedules are disclosed regardless of whether they are public schedules or private schedules, and “public-schedule” means that only public schedules are disclosed. It is.

  The information update unit 35 is a processing unit that registers personal information and a disclosure policy in the personal information storage unit 33 and the disclosure policy storage unit 34, respectively. Specifically, after receiving the update request message for the personal information and the disclosure policy from the user terminal 1 of the user who is the referenced person, when the user authentication of the referenced person is successful, the information updating unit 35 displays the request message. The updated personal information and disclosure policy included are registered in the personal information storage unit 33 and the disclosure policy storage unit 34. Such update processing is executed every time personal information or a disclosure policy is received from the user terminal 1, and can be executed at any time independently of address generation processing, disclosure determination processing, and disclosure control processing described later.

  The verification key storage unit 36 is a means for storing a verification key (master key) used for verification of the disclosure address T included in the reference request mail for normal disclosure or extended disclosure, and this verification key is stored in the address issuing server 20. This is the same key as the issue key stored in the issue key storage unit 23.

  The normal disclosure determination unit 37a of the disclosure determination unit 37 determines whether to disclose personal information based on the disclosure address T included in the normal disclosure reference request mail received from the user terminal 1 of the user who is the reference. Part. Specifically, when the reference request mail of normal disclosure is received from the user terminal 1, the validity of the disclosure address T included in the reference request mail is verified, and when the validity is recognized, the disclosure address is confirmed. Whether or not the disclosure control content S can be executed is determined using the effective condition C included in T. The normal disclosure determination process will be described in detail later with reference to FIG.

  On the other hand, the extended disclosure determination unit 37b of the disclosure determination unit 37 determines whether or not to disclose personal information based on a plurality of disclosure addresses T included in the extended disclosure reference request mail received from the user terminal 1 of the user who is the reference. It is a processing part which determines. Specifically, when a reference request mail for extended disclosure is received from the user terminal 1, the validity of each disclosure address T included in the reference request mail is verified, and a disclosure address TS (for example, a disclosure address T (U2_U3), corresponding to the “access code TS” recited in the claims) to the disclosure address TE (for example, disclosure address T (U1_U2)), The relationship level R included in each disclosure address T matches whether or not the effective condition C included in each disclosure address T is satisfied. Whether or not the disclosure control content S can be executed is determined from the viewpoint of whether or not the disclosure control content S is executed. The extended disclosure determination process will be described in detail later with reference to FIG.

  By the way, the above-described disclosure determination unit 37 determines whether or not there is a character [syoukai] at the beginning of the body of the reference request mail received from the user terminal 1. If it is a reference request mail for disclosure, it is passed to the normal disclosure determination section 37a. On the contrary, if there is a character [syoukai], it is determined that it is a reference request mail for extended disclosure, and the extended disclosure determination section Pass to 37b.

  The normal disclosure control unit 38a of the disclosure control unit 38 is a processing unit that executes the disclosure control content S specified from the disclosure address T when the disclosure is permitted by the normal disclosure determination unit 37a. Specifically, among the personal information stored in the personal information storage unit 33, the personal information corresponding to the referred person ID included in the disclosure address T is stored in the disclosure control content S stored in the disclosure policy storage unit 34. Of these, disclosure is performed according to the disclosure control content S corresponding to the relationship level R included in the disclosure address T (more specifically, according to the limited disclosure request input in the subject of the reference request mail). The normal disclosure control process will be described later in detail with reference to FIG.

  On the other hand, the extended disclosure control unit 38b of the disclosure control unit 38 is a processing unit that executes the disclosure control content S specified from the disclosure address TE when the disclosure is permitted by the extended disclosure determination unit 37. Specifically, the personal information corresponding to the referred person ID included in the disclosure address TE among the personal information stored in the personal information storage unit 33 is stored in the disclosure control content S stored in the disclosure policy storage unit 34. Among them, disclosure is performed according to the disclosure control content S corresponding to the relationship level R included in the disclosure address TE (more specifically, according to the limited disclosure request input in the subject of the reference request mail). The extended disclosure control process will be described in detail later with reference to FIG.

[Processing Procedure from Generation of Disclosure Address to Normal Information Disclosure (Example 1)]
Next, a processing procedure from the disclosure address T generation to the normal information disclosure will be described with reference to FIG. FIG. 7 is a sequence diagram showing a processing procedure from the disclosure address generation to the normal information disclosure.

  As shown in FIG. 8, when the user terminal 1 of the user who is a referenced person transmits an access request message to the address issuing server 20 (step S701), the address issuing server 20 displays “user” as illustrated in FIG. An access response message consisting of “authentication page” is transmitted to the user terminal 1 (step S702).

  Subsequently, the user name (referenced user ID) and password are input to the “user authentication page” in the user terminal 1 of the referenced user, and a user authentication request message including these input information is sent to the address issuing server. 20 (Step S703), the address issuing server 20 authenticates whether or not the user ID and password included in the request message are stored in association with the user information table 11 (Step S704). The user authentication is not limited to the password authentication as described above, and any other authentication method such as a digital certificate may be adopted.

  As a result, if the user authentication is successful, the address issuing server 20 transmits a response message including a “disclosure address issuing page” as illustrated in FIG. 9 to the user terminal 1 of the referred person (step S705). . If user authentication fails, a response to that effect is sent to the user terminal 1.

  Then, for the “disclosed address issuance page” at the user terminal 1 of the referenced person, the reference person ID, the relationship level R, the validity condition C (expiration date designation), and the notification destination of the disclosure address T are input. When an address issuance request message including these pieces of input information is transmitted to the address issuance server 20 (step S706), the address issuance server 20 generates a disclosure address T (step S707). The process for generating the disclosure address T will be described in detail later with reference to FIG.

  Subsequently, the address issuing server 20 transmits the address issue response page (see FIG. 10) including the generated disclosure address T to the user terminal 1 of the referred person (for example, the user U1) and the generated address issuance response page. A generation notification mail including the disclosure address T (see FIG. 11) is created, and the generation notification mail is transmitted to the user terminal 2 of the referring person (for example, the user U2) (steps S708 and S709).

  In the user terminal 1 of the referrer, the content of the generation notification mail as illustrated in FIG. 11 is output to a monitor or the like, and the disclosure address T is designated by the user via the keyboard or mouse on this mail. Then, as the address storage process, the designated disclosure address T is registered in the address storage unit 1a (so-called mail software address book) (step S710).

  Thereafter, the user terminal 1 of the referrer makes the disclosure address T as the destination and restrictive disclosure as illustrated in FIG. 12 in accordance with the instruction of the referrer or periodically at predetermined time intervals. The reference request mail for normal disclosure in which the request command is input in the subject is transmitted to the information disclosure server 30 (step S711). In addition, based on the sender address of this reference request mail, the user information table 11 illustrated in FIG. 3 is referred to, thereby obtaining the user ID (referencer ID) of the user who is the referrer.

  In the information disclosure server 30 that has received the normal disclosure reference request mail, the normal disclosure determination process verifies the validity of the disclosure address T included in the reference request mail, and the validity condition C included in the disclosure address T. Is used to determine whether the disclosure control content S can be executed (step S712). The normal disclosure determination process will be described in detail later with reference to FIG.

  Then, as the normal disclosure control process, the information disclosure server 30 converts the personal information corresponding to the referenced person ID included in the disclosure address T according to the disclosure control content S corresponding to the relationship level R included in the disclosure address T. A disclosure email to be disclosed (see FIG. 13) is created, and the disclosure email is transmitted to the user terminal 1 of the referrer (step S713). The normal disclosure control process will be described later in detail with reference to FIG.

[Address Generation Processing (Example 1)]
Next, a process for generating the disclosure address T by the address issuing server 20 will be described with reference to FIG. FIG. 14 is a flowchart showing details of such address generation processing.

  In the address issuing server 20, when the referred person ID, the referrer ID, the relationship level R, and the validity condition C (expiration date designation) are input through the “disclosure address issuance page” illustrated in FIG. The address generator 24 generates the following 4-bit control code B0 from the relationship level R and the valid condition C, and sets this data B0 as the initial value of the data string B (step S1401).

Control code B0: [b3 b2 b1 b0]
b3: 1 if expiration date is specified, 0 if not specified b2 to b0: Value obtained by integer encoding the value of relationship level R with 3 bits In other words, for example, both expiration date specification and referenceer specification If “1” is designated as the relationship level R, the control code B0 “0001” is generated.

  Then, when the expiration date is designated in the validity condition C, the address generation unit 24 encodes the number of days from January 1, 2000 to the designated expiration date as an integer value of 15 bits to obtain data B1. And this data B1 is added to the end of the data string B (step S1402). Further, the address generation unit 24 obtains a hash value of the referrer ID, and adds data B2 consisting of the last 15 bits of the hash value to the end of the data string B (step S1403).

  Thereafter, the address generation unit 24 generates a character string Y in which the data string B is added after the referenced person ID, and the value of the keyed hash function of the character string Y using the issue key K of the issue key storage unit 23 And data B3 consisting of the last 25 bits of the hash value is added to the end of the data string B (step S1404).

  Then, the address generation unit 24 BASE32 encodes the data string B to generate a 12-character string X (tampering prevention code), and then adds a dot character “.” After the referenced person ID. Further, a character string X is added to the back, and “@ 121.anywhere.ne.jp” is added after the character string X, thereby generating and outputting a disclosure address T (step S1405).

  The domain name (for example, “@ 121.anywhere.ne.jp”) included in the disclosure address T is an address of a device that processes the disclosure address T. In the first embodiment, the domain name of the information disclosure server 30 This is the address. For this reason, the mail addressed to the disclosure address T is delivered to the information disclosure server 30.

[Normal Disclosure Determination Processing (Example 1)]
Next, normal disclosure determination processing by the information disclosure server 30 will be described with reference to FIG. FIG. 15 is a flowchart illustrating details of the normal disclosure determination process. In the following description, the reference ID (reference ID acquired by referring to the user information table 11 illustrated in FIG. 3 based on the sender address of the reference request mail) and the disclosure address T are already information. It is assumed that it has been input to the disclosure server 30.

  The normal disclosure determination unit 37a of the information disclosure server 30 obtains “character string X, verification data V, data string B, control code B0, referred person ID” from the disclosure address T included in the reference request mail of normal disclosure. Restoration is performed (step S1501). That is, as shown in the figure, in the disclosure address T, the character string from the first dot character “.” To the end counted from the end of the user name portion is “character string X”, and the character string X is The last 25 bits of the data string obtained by BASE32 decoding is “verification data V”, and the part other than the last 25 bits of the data string obtained by BASE32 decoding of the character string X is “data string B”. The first 4 bits of “1” are restored as “control code B0” and the character string up to immediately before the dot character “.” In the user name portion is taken as “referenced person ID”.

  Then, the normal disclosure determination unit 37a generates the character string Y by adding the data string B after the referred person ID, and uses the verification key K stored in the verification key storage unit 36 to generate the key of the character string Y. After obtaining the value of the attached hash function and generating the character string Vt consisting of the last 25 bits of this hash value, it is determined whether the character string Vt matches the verification data V (tampering prevention code). The disclosure address T is regarded as an illegal address, and it is determined that disclosure is not possible (NG) (step S1502).

Further, the normal disclosure determination unit 37a restores the relation level R and the valid condition C from the control code B0 as described below (step S1503).
In control code B0: [b3 b2 b1 b0]
If b3: 1, the expiration date is specified, and if 0, it is not specified. b2: Decodes b0: 3 bits into an integer value to restore the relation level R.

  Thereafter, when the expiration date is designated, the normal disclosure determination unit 37a determines whether or not the validity condition is satisfied (step S1504). That is, 15 bits from the 5th bit onward of the data string B are read, and a number (number of days) obtained by regarding the 15 bits as an integer value is added to January 1, 2000 to restore the expiration date. Then, it is determined whether the current date has passed the restored expiration date. If the expiration date has passed, it is determined that the validity condition is not satisfied and it is determined that disclosure is not possible (NG).

  Further, the normal disclosure determination unit 37a determines the legitimacy of the referrer ID acquired based on the sender address of the reference request mail (step S1505). That is, 15 bits after the 20th bit from the beginning of the data string B are read as the character string B2, and a hash value of the referrer ID is obtained, and data B2t consisting of the last 15 bits of the hash value is obtained. Then, it is determined whether the character string B2 and the data B2t match. If they do not match, it is determined that the referrer ID is not valid and the disclosure is not possible (NG).

  As a result, when all of the above determinations (steps S1502, S1504, and S1505) are satisfied, the normal disclosure determination unit 37a sends the referenced person ID and the relationship level R to the normal disclosure control unit 38a together with the disclosure determination result. Output.

[Normal Disclosure Control Processing (Example 1)]
Next, normal disclosure control processing by the information disclosure server 30 will be described with reference to FIG. FIG. 16 is a flowchart illustrating details of the normal disclosure control process. In the following description, for the disclosure address T permitted to be disclosed in the normal disclosure determination process, the referred person ID, the relationship level R, and the limited disclosure request have already been input to the information disclosure server 30. Shall.

  As shown in the figure, the normal disclosure control unit 38a of the information disclosure server 30 refers to the disclosure policy storage unit 34 and sets the disclosure control content (disclosure information item) S corresponding to the relationship level R of the referred person ID. Extract (step S1601).

  Furthermore, when the limited disclosure request is included in the subject of the reference request mail, the normal disclosure control unit 38a extracts the overlapping range between the disclosure control content S extracted above and the limited request included in the mail ( Step S1602). That is, out of the items included in the disclosure information item, the items included in the limitation request are extracted. For example, the disclosure control content S that “telephone number, e-mail address, address, and schedule are all disclosed”. On the other hand, when there is a limited disclosure request such as “sched 040401”, “all schedules of April 1, 2004” are extracted as disclosure information items in the overlapping range as a result.

  Thereafter, the normal disclosure control unit 38a refers to the personal information storage unit 33, and acquires the personal information corresponding to the disclosure information item in the overlapping range from the personal information of the referred person ID (step S1603). That is, in the above example, “all schedules for April 1, 2004” is acquired from the personal information of the referred person ID.

  Then, the normal disclosure control unit 38a creates a disclosure mail (see FIG. 13) including the personal information acquired above as the disclosure information, and transmits the disclosure mail to the user terminal 1 of the referrer (step S1604). . That is, in the above example, a disclosure mail disclosing the “all schedules for April 1, 2004” of the referred person is created and transmitted to the reference person.

[Processing procedure leading to extended information disclosure (Example 1)]
Next, a processing procedure leading to extended information disclosure will be described with reference to FIG. FIG. 17 is a sequence diagram showing a processing procedure leading to such extended information disclosure.

  As shown in the figure, here, the disclosure address T (U1_U2) for disclosing the personal information of the user U1 to the user U2 is provided to the user terminal 1 of the user U2 through the above-described disclosure address generation process. Assume that a disclosure address T (U2_U3) for disclosing personal information of the user U2 to the user U3 is stored in the user terminal 1 of the user U3 (step S1702).

  In such a situation, the user U2 notifies the user U3 of the disclosure address T (U1_U2) for referring to the personal information of the user U1 as a referrer in order to bring the user U1 and the user U3 together. (Step S1703). That is, the disclosure address T (U1_U2) is included in an electronic mail message such as Internet mail or mobile mail, or a SIP message, and transmitted to the user terminal 1 of the user U3. Note that the disclosure address T (U1_U2) may be notified offline.

  In the user terminal 1 of the user U3, the content of the message including the disclosure address T (U1_U2) is output to a monitor or the like, and the disclosure address T is designated on the message by the user U3 via a keyboard or a mouse. Then, as the address storage process, the designated disclosure address T is registered in the address storage unit 1a (so-called mail software address book) (step S1704).

  Thereafter, the user terminal 1 of the user U3 provides the disclosure address T (U2_U3) corresponding to the access code TS as illustrated in FIG. 18 in accordance with the instruction of the user U3 or periodically at predetermined time intervals. The address of disclosure T (U1_U2) corresponding to the access code TE is described in the text following the characters [syoukai], and a command for a limited disclosure request is entered in the subject. The reference request mail is transmitted to the information disclosure server 30 (step S1705). Note that the information disclosure server 30 acquires the user ID (referrer ID) of the user who is the referrer by referring to the user information table 11 illustrated in FIG. 3 based on the sender address of the reference request mail. To do.

  The information disclosure server 30 that has received the reference request mail for the extended disclosure verifies the validity of each disclosure address T included in the reference request mail and discloses from the disclosure address T (U2_U3) as the extended disclosure determination process. From the viewpoint of whether or not the destination address T (U1_U2) is reached, whether or not the validity condition C included in each disclosure address T is satisfied, and whether or not the relationship level R included in each disclosure address T matches. It is determined whether or not the disclosure control content S can be executed (step S1706). The extended disclosure determination process will be described in detail later with reference to FIG.

  Then, as the extended disclosure control process, the information disclosure server 30 converts the personal information corresponding to the referred person ID included in the disclosure address T (T1_U2) (that is, the personal information of the user U1) into the disclosure address T (T1_U2). The disclosure mail (see FIG. 19) to be disclosed is created according to the disclosure control content S corresponding to the relationship level R included in), and the disclosure mail is transmitted to the user terminal 1 of the user U3 who is the referrer (step S1707). . The extended disclosure control process will be described in detail later with reference to FIG.

  By the way, as described above, the update processing of the personal information and the disclosure policy in the information disclosure server 30 includes the processing procedure from the disclosure address generation to the normal information disclosure, and the processing to the extended information disclosure. Independently of the procedure, it is executed each time the updated personal information or disclosure policy is received from the user terminal 1 of the referenced person. Therefore, the updated personal information registered in the information disclosure server 30 at the time when the reference request mail for normal disclosure or extended disclosure is received from the user terminal 1 of the referrer is also registered in the information disclosure server 30 at the same time. It will be disclosed to the referrer according to the updated disclosure policy.

[Extended Discrimination Determination Processing (Example 1)]
Next, the extended disclosure determination process by the information disclosure server 30 will be described with reference to FIG. FIG. 20 is a flowchart illustrating details of the extended disclosure determination process. In the following description, user ID_U3 as the referrer ID (the ID of the user U3 acquired by referring to the user information table 11 illustrated in FIG. 3 based on the sender address of the reference request mail), disclosure It is assumed that the use address T (U1_U2) and the disclosure address T (U2_U3) have already been input to the information disclosure server 30.

  As shown in FIG. 20, the extended disclosure determination unit 37b of the information disclosure server 30 described above using the disclosure address T (U2_U3) and the user ID_U3 (the user ID acquired based on the sender address of the reference request mail) as inputs. A normal disclosure determination process is performed to output a referenced person ID (user ID_U2), a disclosure determination result, and a relationship level R (step S2001). That is, the extended disclosure determination unit 37b determines the validity of the disclosure address T (U2_U3), the validity of the referrer ID, and the valid condition C, and the referenced person ID included in the disclosure address T (U2_U3) and Extract the relationship level R.

  Then, the extended disclosure determination unit 37b determines whether or not the disclosure determination result is “OK” (step S2002). If the disclosure determination result is “NG” (No in step S2002), the extended disclosure is determined. The determination result is set as “non-disclosure (NG)” (step S2007).

  On the other hand, when the disclosure determination result is “OK” (Yes in step S2002), the extended disclosure determination unit 37b acquires the disclosure address T (U1_U2) and the user ID_U2 (obtained in step S2001 above). The normal disclosure determination process described above is performed using the referred person ID) as an input, and the referred person ID (user ID_U1), the disclosure determination result, and the relationship level R are output (step S2001). That is, the extended disclosure determination unit 37b determines the validity of the disclosure address T (U1_U2), the validity of the referrer ID (user ID_U2), and the validity condition C, and includes the subject included in the disclosure address T (U1_U2). The referrer ID and the relationship level R are extracted.

  Here, the process of determining the legitimacy of the referrer ID (user ID_U2) corresponds to the referenced person ID included in the disclosure address T (U2_U3) and the referrer ID included in the disclosure address T (U1_U2). In other words, it is a determination as to whether or not the disclosure address T (U2_U3) reaches the disclosure address T (U1_U2), and is specifically performed as follows. That is, the 15 bits from the beginning of the data string B obtained by restoring the disclosure address T (U1_U2) are read as the character string B2, and the hash value of the referred person ID obtained in step S2001 above And data B2t consisting of the last 15 bits of the hash value is obtained. Then, it is determined whether the character string B2 and the data B2t match. If they do not match, it is determined that the disclosure address T (U2_U3) cannot reach the disclosure address T (U1_U2), and it is determined that disclosure is not possible (NG). To do.

  Then, the extended disclosure determination unit 37b determines whether or not the disclosure determination result output in step S2003 is “OK” (step S2004), and when the disclosure determination result is “NG”. (No in step S2004), the extended disclosure determination result is set as non-disclosure (NG) (step S2007).

  On the other hand, if the disclosure determination result is “OK” (Yes in step S2004), the extended disclosure determination unit 37b determines whether or not the relationship level R output in steps S2001 and S2003 is equal. (Step S2005). If the relationship level R is the same (Yes in step S2005), the extended disclosure determination unit 37b sets the extended disclosure determination result to be openable (OK) (step S2006), but if the relationship level R is not equal, (No in step S2005), the extended disclosure determination result is set to be non-disclosure (NG) (step S2007).

  As a result, when all of the above-described determinations (steps S2002, S2004, and S2005) are satisfied, the extended disclosure determination unit 37b determines the referred person ID and the relationship level R output in the above-described step S2003 as described above. The result is output to the extended disclosure control unit 38b together with the extended disclosure determination result.

[Extended disclosure control processing (first embodiment)]
Next, the extended disclosure control process by the information disclosure server 30 will be described with reference to FIG. FIG. 21 is a flowchart illustrating details of the extended disclosure control process. In the following description, for the disclosure address TE that is permitted to be expanded in the extended disclosure determination process (that is, the disclosure address T (U1_U2)), the referenced person ID, the relationship level R, and the limited disclosure request Is already input to the information disclosure server 30.

  As shown in the figure, the extended disclosure control unit 38b of the information disclosure server 30 refers to the disclosure policy storage unit 34, and refers to the referred person ID included in the disclosure address T (U1_U2), that is, the user ID of the user U1. The disclosure control content (disclosure information item) S corresponding to the relationship level R is extracted (step S2101).

  Further, when the limited disclosure request is included in the subject of the extended disclosure reference request mail, the extended disclosure control unit 38b sets the overlapping range of the disclosure control content S extracted above and the limited request included in the mail. Extract (step S2102). That is, as in the normal disclosure control process shown in FIG. 16, the items included in the limitation request are extracted from the items included in the disclosure information item.

  Thereafter, the extended disclosure control unit 38b refers to the personal information storage unit 33, and acquires personal information corresponding to the disclosure information item in the overlapping range from the personal information of the user ID_U1 (step S2103). Then, the extended disclosure control unit 38b creates a disclosure mail (see FIG. 19) including the personal information acquired above as the disclosure information, and uses the disclosure mail of the user U3 who is the source of the extended disclosure reference request mail. It transmits to the user terminal 1 (step S2104).

[Effects of Example 1]
Thus, according to the first embodiment, information disclosure from the user U1 to the user U3 using the plurality of disclosure addresses T (U1_U2) and the disclosure addresses T (U2_U3) for reaching the user U1 from the user U3. Therefore, the user U3 can refer to the personal information of the user U1 even if the user U3 does not have the disclosure address T (U1_U3) itself for referring to the personal information of the user U1. .

  In other words, according to the first embodiment, the user U3 obtains the disclosure address T (U1_U2) and the disclosure address T (U2_U3) that reach the user U1 who is a referee through the mediation of the user U2 who is a third party. Once obtained, it becomes possible to quickly access information disclosure by the user U1 without waiting for the issuance of the disclosure address T (U1_U3), and the user U3 does not know the user U1 directly. It becomes possible to access information disclosure by the user U1 through the mediation of U2, and the user U3 can secure his / her legitimacy and reliability with respect to the user U1 through the mediation of the user U2. For the user U2 who is an intermediary, persons who do not know can be brought together via the disclosure address T, and the construction of a new trust relationship can be mediated.

  Further, according to the first embodiment, since it is not necessary to issue the disclosure address T (U1_U3) for accessing the user U1 from the user U3, the disclosure address of the address issuing server 20, the user U1, and the user U3 can be issued. It is possible to reduce the burden involved.

  In addition, according to the first embodiment, since the relationship level R and the valid condition C included in the disclosure address T are used for disclosure determination, it is possible to avoid a situation in which access to the user U1 is allowed without restriction by mediation, Practical control can be realized in which access through mediation is permitted only within a range that satisfies the conditions. Here, the case where the specific effective condition C itself is included in the disclosure address T has been described, but the present invention is not limited to this, and the specific effective condition C and the effective condition C are unique. The valid condition identifier for specifying the valid condition identifier is stored in the database in association with the valid condition identifier, and the valid condition identifier may be included in the disclosure address T instead of the valid condition C. In this case, the valid condition C in the disclosure determination process is determined by extracting the valid condition identifier from the disclosure address T, and reading the valid condition C corresponding to the extracted valid condition identifier from the database. .

  Further, according to the first embodiment, the conditions used for the disclosure determination are included in the disclosure address T, so that it is not necessary to manage the conditions in the database, and the database resources can be reduced. Furthermore, the method of generating the disclosure address T is modified by using the relationship level R and the effective condition C used for normal disclosure determination (normal information disclosure) for disclosure determination at the time of mediation (extended information disclosure). Accordingly, the disclosure address T that is not originally intended for mediation can be used as it is, and the disclosure determination at the time of mediation can be performed.

  Further, according to the first embodiment, the relationship level R and the disclosure control content S used for normal disclosure control (normal information disclosure) are also used for disclosure control (extended information disclosure) at the time of mediation. It becomes possible to perform disclosure control at the time of mediation by using the disclosure address T that is not originally intended for mediation as it is, without modifying the generation method of the business address T.

  Although the information disclosure system according to the first embodiment has been described so far, the present invention may be implemented in various different forms other than the above-described embodiments. Therefore, in the following, as the information disclosure system according to the second embodiment, various different embodiments will be described by dividing them into (1) to (14).

(1) A plurality of mediators In the first embodiment, the case where the user U3 accesses the information disclosure of the user U1 via one mediator (user U2) has been described, but the present invention is limited to this. However, the present invention can be similarly applied when accessing information disclosure of the user U1 via a plurality of intermediaries.

  That is, as illustrated in FIG. 22, there are n users (user U1, user U2,... User Un-1, user Un), and a disclosure address T (U1_U2) is given from user U1 to user U2. In the case where the disclosure address T (U2_U3) is given from the user U2 to the user U3, and the disclosure address T (Un-1_Un) is given from the user Un-1 to the user Un. The user Un as the referrer can access the information disclosure of the user U1 as the referee via a plurality of intermediaries (user U2 to user Un-1).

  In the following, as shown in FIG. 22, the disclosure address T (Un-1_Un) is expressed as a disclosure address TS, and the disclosure address T (U2_U3) is disclosed from the disclosure address T (Un-2_Un-1). The details of the extended disclosure reference request mail and the extended disclosure determination process in the case of passing through a plurality of intermediaries will be described by expressing the address TM and the disclosure address T (U1_U2) as the disclosure address TE.

  FIG. 23 is a diagram illustrating a configuration example of an extended disclosure reference request mail transmitted by a referer (user Un) through a plurality of mediators. As shown in the figure, the user Un who has obtained the disclosure address T (Un-1_Un) from the disclosure address T (U1_U2) has the disclosure address T (Un−) corresponding to the disclosure address TS at the mail destination. 1_Un) and a plurality of disclosure addresses T (Un-2_Un-1) corresponding to the disclosure address TM following the characters [syoukai] in the text of the email to disclosure addresses T (U2_U3), Furthermore, the user terminal 1 creates a reference request mail in which the disclosure address T (U1_U2) corresponding to the access code TE is continuously written with “/” in between, and this extended disclosure reference request mail is sent to the information disclosure server 30. Send.

  FIG. 24 is a flowchart illustrating details of the extended disclosure determination process executed when a plurality of mediators are interposed. In the following description, user ID_Un as a referrer ID (user Un ID acquired by referring to the user information table 11 illustrated in FIG. 3 based on the sender address of the reference request mail), disclosure A disclosure address T (Un-1_Un) corresponding to the disclosure address TS, a plurality of disclosure codes T (Un-2_Un-1) corresponding to the disclosure address TM to a disclosure address T (U2_U3), and an access code TE It is assumed that the disclosure address T (U1_U2) to be entered has already been input to the information disclosure server 30.

  As illustrated in FIG. 24, the extended disclosure determination unit 37b of the information disclosure server 30 extracts one disclosure address T in order from the disclosure addresses TS, TM, and TE (step S2401). Specifically, the disclosure address T (Un-1_Un) is first extracted, and the disclosure T (U1_U2) is extracted while repeating the processing of steps S2401 to S2404 described later (Yes in step S2404 described later). The disclosure address T (Un-2_Un-1),... The disclosure address T (U2_U3) and the disclosure address T (U1_U2) are taken out one by one in order.

  Then, the extended disclosure determination unit 37b receives the disclosure address T extracted in step S2401 and the user ID_Un of the referrer (or the user ID of the referenced person output in the previous normal disclosure determination process) as inputs. The disclosure determination process is performed, and the referred person ID, the disclosure determination result, and the relationship level R are output (step S2402). That is, the extended disclosure determination unit 37b determines the validity of the extracted disclosure address T, the validity of the referrer ID, and the valid condition C, and determines the referenced person ID and the relationship level R included in the disclosure address T. Extract.

  Here, the process for determining the legitimacy of the referrer ID will be described with a specific example. When the disclosure address T (Un-1_Un) is extracted, it is based on the sender address of the reference request mail. It is determined whether or not the referrer ID (user ID_Un of user Un) corresponds to the referrer ID included in the disclosure address T (Un-1_Un). When the disclosure address T (Un-2_Un-1) is extracted, the referred person ID (that is, the user ID_Un-1 of the user Un-1) output in the previous normal disclosure determination process is disclosed. It is determined whether or not it corresponds to the referrer ID included in the service address T (Un-2_Un-1). If these IDs do not correspond, it is determined that disclosure is not possible (NG) because the disclosure address TS cannot reach the disclosure address TE.

  Then, the extended disclosure determination unit 37b determines whether or not the disclosure determination result output in step S2402 is “OK” (step S2403), and if the disclosure determination result is “NG”. (No in step S2403), the extended disclosure determination result is set as non-disclosure (NG) (step S2407). On the other hand, when the disclosure determination result is “OK” (Yes at Step S2403), the extended disclosure determination unit 37b determines whether or not the extracted disclosure address T is the disclosure address TE (Step S2404). ).

  In this determination, if the extracted disclosure address T is not the disclosure address TE (No at step S2404), the extended disclosure determination unit 37b returns to the above-described step S2401, extracts the next disclosure address T, and creates a new one. In the same manner as described above, the processes of steps S2402 to S2404 are executed for the disclosure address T extracted in step S2.

  On the other hand, if the extracted disclosure address T is the disclosure address TE (Yes in step S2404), the extended disclosure determination unit 37b has reached the disclosure address TE from the disclosure address TS. As described above, it is determined whether or not the relationship level R of each disclosure address T output in step S2402 is equal (step S2405). If the relationship level R is the same (Yes at step S2405), the extended disclosure determination unit 37b sets the extended disclosure determination result to be openable (OK) (step S2406). If the relationship level R is not equal, (No in step S2405), the extended disclosure determination result is set as non-disclosure (NG) (step S2407).

  As a result, if both of the above determinations (steps S2403 and S2405) are satisfied, the extended disclosure determination unit 37b refers to the referred person ID (that is, the disclosure address TE last output in the above step S2402). The user ID_U1) and the relationship level R are output to the extended disclosure control unit 38b together with the above extended disclosure determination result. Note that the extended disclosure control process performed by the extended disclosure control unit 38b subsequent to this is as described above with reference to FIG.

  As described above, even in a case where a plurality of mediators are used, if the user can reach from the disclosure address TS to the disclosure address TE, the user Un can access the information disclosure of the user U1. That is, in the process of step S2402, the disclosure address T of both is provided on the condition that the referred person ID included in the previous disclosure address T corresponds to the reference person ID included in the next disclosure address T. Are sequentially executed, and as a result, when the disclosure address TS and the disclosure address TE can be linked via the disclosure address TM, the disclosure address TS is reached to the disclosure address TE. It is determined that the user Un can access the information disclosure of the user U1.

(2) Policy for Generating Disclosure Address T In the first embodiment, the disclosure address T generated including the referenced person ID, the referrer ID, the relationship level R, and the valid condition C is disclosed (normal disclosure and However, the present invention is not limited to this, and a disclosure address T as described below may be used for information disclosure.

  Specifically, as illustrated in (1-1) of FIG. 25, only the referred person specifying information A for specifying the referred person and the reference person limiting information B for limiting the reference person are included. The disclosure address T generated by including may be used for information disclosure. Here, the “referenced person specifying information A” is limited to information that can specify a user, such as a user address and an account associated with the user ID, such as a user name and a user number. The “person limited information B” is not limited to information that can identify a user, but can be a user identifier such as a user identifier generated using these user IDs or user addresses, or information for identifying an organization to which the user belongs. It may be.

  When this disclosure address T is used for information disclosure, normal information disclosure is performed according to a control algorithm prepared on the information disclosure server 30 side (that is, an algorithm corresponding to the effective condition C and the disclosure control content S). Is called. That is, disclosure control that distinguishes between the referenced person and the referee, disclosure control that does not distinguish these, and the like are performed. Note that the extended information disclosure performed when the disclosure address T is used will be described later.

  In addition, as other disclosure addresses T, as illustrated in (1-2) of FIG. 25, referee identification information A, referrer-limited information B, and normal information disclosure without an intermediary. The disclosure address T generated including the control information F for control may be used for information disclosure. Here, the “control information F” included in the disclosure address T is the effective condition C, the disclosure control content S or the relationship level R, as exemplified in (2-1) to (2-5) in FIG. Or a combination of these.

  When this disclosure address T is used for information disclosure, normal information disclosure is performed using the control information F included in the disclosure address T. Note that the extended information disclosure performed when the disclosure address T is used will be described later.

As other disclosure addresses T, as illustrated in (1-3) of FIG. 25, the addressed person identification information A, the reference person limited information B, the control information F, and the mediator are extended. The disclosure address T generated including the control information F ⁺ for controlling the information disclosure may be used for information disclosure. When this disclosure address T is used for information disclosure, normal information disclosure is performed using the control information F included in the disclosure address T. Note that the extended information disclosure performed when the disclosure address T is used will be described later.

Here, the “control information F ⁺ ” included in the disclosure address T is the valid condition C ⁺ , the disclosure control content S ^+, or the disclosure control content S ⁺ or the like as illustrated in (3-1) to (3-5) in FIG. Relationship level R ⁺ , or a combination thereof. More specifically, “disclosure control content S ⁺ (corresponding to“ extended access control content ”described in claims)” refers to control content related to expanded information disclosure, for example, Similar to the disclosure control content S illustrated in FIG. 6, the control content such as “disclosure all phone numbers, mail addresses, addresses, and schedules” corresponds to this.

“Relationship level R ⁺ (corresponding to“ extended relationship information ”described in claims)” is information uniquely associated with the above disclosure control content S ⁺ . Similarly to the relationship level R illustrated in (1), the relationship between the referee and the referrer via an intermediary is shown, for example, a close introducer, a distant introducer, and the like.

Furthermore, “effective condition C ⁺ (corresponding to“ expanded effective condition ”described in claims)” is a condition required for execution of extended information disclosure. Is allowed (for example, weekends only), deadline (for example, how many months, what days), time (for example, daytime only), hop count (number of intermediaries), link value (linkage with referrer) This is a condition that specifies a condition) or a combination thereof. The control information F ⁺ is designated through the “disclosure address issue page” as illustrated in FIG.

Further, as another disclosure address T, as illustrated in (1-4) of FIG. 25, the disclosure address generated including the referred person specifying information A, the reference person limited information B, and the control information F ⁺ is generated. The address T may be used for information disclosure. When this disclosure address T is used for information disclosure, normal information disclosure is performed according to a control algorithm prepared on the information disclosure server 30 side (that is, an algorithm corresponding to the effective condition C and the disclosure control content S). Is called. Note that the extended information disclosure performed when the disclosure address T is used will be described later.

As described above, in the present invention, the disclosure address T described above is not limited to the disclosure address T generated including the referenced person ID, the reference person ID, the relationship level R, and the validity condition C (FIG. 25). Can be used for information disclosure. Further, the disclosure address T including the referenceee identifying information A, the referrer limited information B, the control information F, the control information F ^+, or a combination thereof is not limited to the address including these with a key. May be an address T for disclosure that does not depend on the key.

(3) Extended Information Disclosure Control Policy Next, the extended information disclosure control policy will be described based on the above-described policy for generating the disclosure address T. In the first embodiment, in addition to whether or not the disclosure address TS reaches the disclosure address TE, whether or not the effective condition C included in each disclosure address T is satisfied, An extended disclosure determination process is performed by determining whether or not the relationship level R included matches, and the personal information of the referenced person is disclosed according to the relationship level R included in the disclosure address TE. Although the case where the disclosure control process is performed has been described, the present invention is not limited to this, and an extended disclosure determination process and an extended disclosure control process as described below may be performed.

  First, as shown in FIG. 26, as the extended disclosure determination process, it may be determined only whether or not the disclosure address TS reaches the disclosure address TE. It may also be determined whether or not to permit the disclosure. Here, as to whether or not to arrive, as shown in (4-1) of the figure, the referred person specifying information A and the referrer of each disclosure address T included in the reference request mail of the extended disclosure. The limited information B is used as a determination factor.

In addition, as to whether or not to permit extended disclosure, control information F included in the disclosure address T is used as a determination factor as shown in (5-1) to (5-4) in FIG. , Using control information F ⁺ included in disclosure address T as a determination element, using control information F and control information F ⁺ included in disclosure address T as a determination element, and further including in disclosure address T Can be determined by other algorithms that are not.

  Specifically, when the control information F included in the disclosure address T is used as a determination element (see (5-1) in FIG. 26), as in the first embodiment described above, The disclosure is not limited to determining the valid condition C and whether or not the relationship level R of each disclosure address T matches. For example, each disclosure address T is determined only for the validity condition C of each disclosure address T. Disclosure address TE for determining only the validity condition C of the disclosure address TS, for determining only the validity condition C for the disclosure address TS, for determining only whether the relationship level R of the address T matches The control information F included in the disclosure address T is used as a determination element, such as determining only the valid condition C of the disclosure address or determining whether or not half or more of the valid conditions C of each disclosure address T is satisfied If so, it is possible to adopt any technique.

Further, when the control information F ⁺ included in the disclosure address T is used as a determination element (see (5-2) in FIG. 26), for example, the effective condition C ⁺ of each disclosure address T is determined, It is determined whether or not the relationship level R ⁺ of each disclosure address T matches. Only the validity condition C ^{+ of} each disclosure address T is determined. Only whether the relationship level R ⁺ of each disclosure address T matches. determining, validity condition C ⁺ only determining disclosures address TS and disclosure address TE, the validity condition C ⁺ only determining disclosures address TS, the validity condition C ⁺ only determining disclosures address TE Any method can be used if the control information F ⁺ included in the disclosure address T is used as a determination element, such as determining whether or not half or more of the valid conditions C ⁺ of each disclosure address T is satisfied. Do Door can be. Note that the determination using the effective condition C ⁺ as a determination factor includes determination based on the number of hops and a link value, which will be described later with reference to FIGS.

Further, when the control information F and the control information F ⁺ included in the disclosure address T are used as determination elements (see (5-3) in FIG. 26), for example, the validity condition C and the validity of each disclosure address T Valid condition C and valid condition for each disclosure address T for judging condition C ⁺ and judging whether or not the relation level R of each disclosure address T matches, and further whether or not the relation level R ⁺ matches. determines C ^+, relationship level or R matches the disclosures address T, further determines whether relation level R ⁺ match, validity condition C and the effective conditions of the disclosed address TS and disclosure address TE C ⁺ alone determines the effective condition C and validity conditions C ⁺ only determining disclosures address TS, validity condition C and validity conditions C ⁺ only determining disclosures address TE, a for each disclosed If the control information F and the control information F ⁺ included in the disclosure address T are used as determination elements, such as determining whether or not half or more of the valid conditions C and valid conditions C ⁺ of the dress T are satisfied, Any technique can be employed.

Further, when the determination is made by another algorithm not included in the disclosure address T (see (5-4) in FIG. 26), for example, the control algorithm prepared on the information disclosure server 30 side (that is, the valid condition C Or the effective condition C ⁺ ), and a control algorithm that is distinguished by the referred person or the reference person, or a control algorithm that does not distinguish these can be employed. In addition, as determination based on such a control algorithm, there exists determination based on the hop number and link value which are mentioned later using FIG. 28 and FIG.

Subsequently, regarding the determination of which disclosure control content is to be executed in the extended disclosure control processing, as shown in (6-1) to (6-3) of FIG. 26, the control information included in the disclosure address T It can be executed based on F, executed based on the control information F ⁺ included in the disclosure address T, or can be executed based on another algorithm not included in the disclosure address T.

  Specifically, in the case where the extended disclosure control process is executed based on the control information F included in the disclosure address T (see (6-1) in FIG. 26), as in the first embodiment described above, The disclosure control content S corresponding to the same relationship level R included in the disclosure address T is not limited to being executed. For example, the disclosure control content S corresponding to the relationship level R included in the disclosure address TS is executed. The disclosure control content S corresponding to the relationship level R included in the disclosure address TE is executed. The disclosure control content S included in the disclosure address TS is executed. The disclosure control content S included in the disclosure address TE is executed. Any method can be employed as long as the disclosure control content is executed based on the control information F included in the disclosure address T.

Further, when the extended disclosure control process is executed based on the control information F ⁺ included in the disclosure address T (see (6-2) in FIG. 26), for example, the same information included in each disclosure address T executing the disclosure control content S ⁺ corresponding to relation level R ^+, corresponding to the relation level R ⁺ to performing the disclosed control content S ⁺ contained in the disclosed address TS, the relationship level included in the disclosure address TE R ⁺ The disclosure control content S ⁺ corresponding to the disclosure address T is executed, the disclosure control content S ⁺ included in the disclosure address TS is executed, the disclosure control content S ⁺ included in the disclosure address TE is executed, etc. Any method can be adopted as long as the disclosure control content is executed based on the included control information F ⁺ .

Further, when the extended disclosure control process is executed based on another algorithm not included in the disclosure address T (see (6-3) in FIG. 26), for example, the control prepared on the information disclosure server 30 side is used. Algorithms (that is, disclosure control content S and disclosure control content S ⁺ ), which are control algorithms that are distinguished by the referred person or the referee, or control algorithms that do not distinguish between these can be adopted.

As described above, according to the present invention, access determination at the time of mediation is performed by using the effective condition C ⁺ that is not normally included in the disclosure address T ((5-2) and (5-3) in FIG. ), It is possible to make a practical disclosure determination specialized at the time of mediation, apart from the normal disclosure determination. Further, by performing disclosure control at the time of mediation using the relationship level R ⁺ or disclosure control content ⁺ that is not normally included in the disclosure address T (in the case of (6-2) in FIG. 26), normal disclosure control and Apart from that, it becomes possible to carry out practical disclosure control specialized in mediation.

(4) Other Extended Disclosure Judgment Processing Next, the case where the extended disclosure judgment processing is performed for the disclosure address T including the hop count (number of intermediaries) as the valid condition C ⁺ will be described using FIG. As shown in FIG. 22, as in the case shown in FIG. 22, the number of hops (the number of hops designated by the referee) is included in each disclosure address T as an effective condition C ⁺ when a plurality of intermediaries are used. Suppose that

  In such a case, the extended disclosure determination unit 37b of the information disclosure server 30 extracts one disclosure address T in order from the disclosure addresses TS, TM, and TE, and traces from the disclosure address TS to the disclosure address TE. When determining whether or not to arrive, as shown in FIG. 27, the number of hops is added each time one disclosure address T is taken out, and the number of disclosure addresses passed through until reaching the disclosure address TE. (That is, how many intermediaries are passed through). Then, it is determined whether or not the calculated number of hops exceeds the number of hops included in the disclosure address TE. If this number is exceeded, the extended disclosure determination result is set as non-disclosure (NG). Is disclosed (OK).

  As described above, the number of disclosure addresses T (hops) passed from the disclosure address TS to the disclosure address TE is used for the extended disclosure determination, and therefore, the closeness between the user U1 and the user Un is considered. Thus, it is possible to practically determine whether or not to permit access through mediation. 27, the case where the number of hops (the number of intermediaries) is included in the disclosure address T for each user has been described. However, the present invention is not limited to this, and for example, as illustrated in FIG. In addition, a fixed hop number (threshold value) may be defined in the system without including the hop number in the disclosure address T.

Further, using FIG. 29, a case will be described in which the extended disclosure determination process is performed for the disclosure address T including the link value (a value indicating the degree of connection between the user Un and the user U1) as the valid condition C ⁺ . As shown in the figure, as in the case shown in FIG. 22 and FIG. 27, in the case of passing through a plurality of intermediaries, each disclosure address T has a link value (link value specified by the referenced person) as a valid condition C ^+. ).

  In such a case, the extended disclosure determination unit 37b of the information disclosure server 30 extracts one disclosure address T in order from the disclosure addresses TS, TM, and TE, and traces from the disclosure address TS to the disclosure address TE. When determining whether or not to arrive, as shown in FIG. 29, a link value indicating the degree of connection between the user Un and the user U1 is calculated. Any calculation formula may be adopted for the calculation of the link value. For example, as shown in the figure, the average value of the relationship level R included in each disclosure address T or the user U1 who is a reference person The weighted average value considering the distance (number of hops) from is calculated. Then, the extended disclosure determination unit 37b determines whether or not the calculated link value exceeds the link value included in the disclosure address TE. If the link value exceeds the link value, the extended disclosure determination result is set as disclosure possible (OK). If it does not exceed, the extended disclosure determination result is set as non-disclosure (NG).

  As described above, the link value indicating the degree of connection between the user U1 who is the referred person and the user Un who is the reference person is calculated, and this link value is used for the extended disclosure determination. Therefore, the relationship between the user U1 and the user Un It is possible to practically determine whether or not to allow access by intermediary while estimating. In FIG. 29, the case where the link value is included in the disclosure address T for each user has been described. However, the present invention is not limited to this, and for example, as shown in FIG. A fixed link value (threshold value) may be defined in the system without being included in the service address T.

(5) Other Extended Disclosure Control Processing In the first embodiment, the case where the disclosure control content corresponding to the relationship level R included in the disclosure address TE is executed as the extended disclosure control processing has been described. For example, as shown in FIG. 31, disclosure control content for introduction (for information disclosure via an intermediary) is stored in advance in the disclosure policy storage unit 34 and extended disclosure control is performed. If the extended disclosure determination result is “OK”, the unit 38b may execute the disclosure control content for introduction. As another example, the disclosure control content corresponding to the relationship level R that is several ranks lower than the relationship level R included in the disclosure address TE may be executed.

As another example, as illustrated in FIG. 32, disclosure control content S ⁺ is stored in advance in the disclosure policy storage unit 34 in association with a plurality of relationship levels R ⁺ (extended relationship information), and extended disclosure is performed. If the extended disclosure determination result is “OK”, the control unit 38b reads the disclosure control content S ⁺ corresponding to the relationship level R ⁺ included in the disclosure address TE from the disclosure policy storage unit 34 and executes it. Also good.

As another example, as illustrated in FIG. 33, disclosure control content S ⁺ is stored in advance in the disclosure policy storage unit 34 in association with a plurality of hop counts H, and the extended disclosure control unit 38 b If the disclosure determination result is “OK”, the disclosure control content S ⁺ corresponding to the calculated number of hops is read from the disclosure policy storage unit 34 and executed using the hop count described in FIG. 27 and FIG. You may make it do. In this way, since the number of disclosure addresses T (the number of hops) passed from the disclosure address TS to the disclosure address TE is used for extended disclosure control, the closeness between the user U1 and the user Un is considered. Thus, it becomes possible to practically control access during mediation.

As another example, as illustrated in FIG. 34, the disclosure control content S ⁺ is stored in advance in the disclosure policy storage unit 34 for each range of the link value L, and the extended disclosure control unit 38b If the result is “OK”, the disclosure control content S ⁺ corresponding to the calculated link value is read from the disclosure policy storage unit 34 and executed using the link value described in FIG. 29 and FIG. It may be. In this way, the link value indicating the degree of connection between the user U1 who is the referenced person and the user Un who is the reference person is calculated, and this link value is used for the extended disclosure control. Therefore, the relationship between the user U1 and the user Un It is possible to practically control access at the time of mediation while estimating.

In the above embodiment, the case where the disclosure policy is stored for each user has been described (see FIG. 6 and FIG. 31). However, the present invention is not limited to this, and as illustrated in FIG. You may make it memorize | store a common disclosure policy in a system, without distinguishing a user. Similarly, in the case shown in FIG. 32 to FIG. 34 as well, the system discloses a common disclosure policy (disclosure control content corresponding to a common relationship level R ⁺ , hop count H or link value L). Also good.

(6) Timing of Disclosure In the above embodiment, the case where information disclosure is performed at the timing when a reference request mail for normal disclosure or extended disclosure is received from a user has been described. However, the present invention is not limited to this. Information disclosure may be performed at the timing when the personal information is updated.

  That is, in this case, when a reference request mail for normal disclosure or extended disclosure is received from a user as a referrer, normal disclosure determination or extended disclosure determination is performed, and the disclosure address T permitted to be disclosed by this disclosure determination is determined. A reference ID, a reference person ID, and disclosure information items derived from disclosure control contents and limited disclosure requests are stored in the database in association with each other. Then, when the personal information stored in the personal information storage unit 33 is updated, the information disclosure server 30 searches the database for a reference ID in which the personal information related to the update is entered as a disclosure information item. Then, a disclosure mail containing the personal information related to the update is transmitted to this referrer ID.

(7) Disclosure Control Content In the above embodiment, the case where the type of information to be disclosed is defined as the disclosure control content has been described. However, the present invention is not limited to this, and as illustrated in FIG. Other control contents such as the disclosed timing, the disclosed terminal (medium), and the processing for the disclosure may be defined as the disclosed control contents.

  That is, as the disclosure timing, for example, disclosure at “request time (when sending a reference request mail)”, disclosure at “update time (when updating personal information)”, or the like may be specified. Further, as the disclosure terminal (medium), for example, if the reference request mail is “PC mail (Internet mail)” based on the source address of the reference request mail (this is the destination address of the disclosure mail). Disclosure may be prescribed if it is “mobile mail”.

  Further, as disclosure processing, for example, when disclosing a schedule, it may be specified that the name of the other party of the meeting is hidden and disclosed, or only the “scheduled” is disclosed by hiding the schedule content itself. When an address is disclosed, it may be specified to hide and disclose the street name. Even when other control contents as described above are defined in the disclosure control contents, a user as a reference can make a disclosure request limitedly. In other words, for example, when two disclosure timings “at request” and “at update” are defined, it is possible to request disclosure only at “request”.

(8) Other Disclosure Information In the above embodiment, the case where personal information such as the telephone number, e-mail address, address, schedule, etc. of the user who is a referenced person is disclosed has been described, but the present invention is limited to this. For example, information on the user's marital status (with or without spouse), family structure, etc., as well as information indicating the logged-on status, logon location, and telephone usage status of the referee for the network. Presence information indicating the dynamic attribute may be disclosed.

  Furthermore, the present invention is not limited to such information relating to an individual, and the present invention can be similarly applied even when disclosing information related to a user who is an organization or a group. That is, the present invention discloses a case where any information stored or managed in association with a user ID that uniquely identifies a user as a referenced subject is disclosed regardless of whether it is an individual or an organization. Can be applied.

  In the above embodiment, the case where the user who is a reference person updates the personal information (information stored in the basic information table and the schedule table) has been described. However, the present invention is not limited to this. Instead, for example, a user who is a reference adds a new schedule to the schedule of the referenced person, and the reference may also update the information of the referenced person, such as changing the already added schedule. You may be able to do it.

  Further, when such an update by a referrer is permitted, the referred person may be allowed to set whether to permit an update for each referer or for what information item. That is, in the same manner as the disclosure information item S stored in the disclosure policy storage unit 34 (see FIG. 6), the control content defining the information item permitted to be updated by the referrer is stored in association with the relationship level R. May be. As a result, update control based on the access code can be realized as well as disclosure control based on the access code.

(9) Message Address In the above embodiment, the case where the disclosure address T is generated in the form of a mail address used for an electronic mail message such as Internet mail or mobile mail has been described, but the present invention is not limited to this. For example, the disclosure address T may be generated in the form of a message address used for a so-called instant message, presence exchange message, SIP message such as an IP telephone control message.

(10) URL Disclosure Address In addition, the disclosure address T is not limited to such a message address format, and the disclosure address T may be generated in a so-called URL (Uniform Resource Locator) format. That is, as illustrated in FIGS. 37 and 38, a URL (Uniform Resource Locator) address having a character string obtained by concatenating the referred person ID and the falsification preventing code of the above-described embodiment as a “path name portion” is formed. May be. Hereinafter, the disclosure address T in the URL format will be specifically described.

  FIG. 37 is a diagram illustrating a configuration example of a creation notification mail received by a referrer, and FIG. 38 is a diagram illustrating a configuration example of a screen related to information disclosure. Here, as illustrated in FIG. 37, the disclosure address T in the URL format is, for example, a reference person after “//www.anywhere.ne.jp” indicating the server name (address) of the information disclosure server. It is formed by concatenating the identification information “/ suzuki” and the falsification prevention code “/ bgexrasdqwiu”.

  When the user terminal 1 of the referrer receives an “address generation notification mail” as illustrated in FIG. 37 from the address issuing server, the content including the generated URL address is displayed on the monitor of the user terminal 1 or the like. When a URL address is designated on the mail by the user via a keyboard or a mouse, the designated URL address is registered in the address storage unit 1 (so-called web browser software favorite).

  After that, when the user who is a reference uses the Web browser software of the user terminal 1 to transmit a reference request message with the URL address (disclosure address T) as the connection destination address to the information disclosure server, A disclosure determination process and a disclosure control process are performed based on the URL address (disclosure address T), and a disclosure screen as illustrated in FIG. In the case of the disclosure address T in the URL format, as illustrated in FIG. 38, a limited disclosure request command is input after the falsification prevention code.

  In the case of a reference request in extended disclosure, a plurality of URL addresses (that is, URL address T (Un-1_Un), URL address T (Un) are displayed in the URL input field on the Web screen displayed on the user terminal 1. -2_Un-1),..., URL address T (U2_U3), URL address T (U1_U2)) is transmitted to the information disclosure server in a series of reference request messages with the characters [syoukai] and “/” in between.

(11) Disclosure address T in other format
Further, the present invention is not limited to the disclosure address T in the message address format or URL format, and for example, a telephone number, a barcode (for example, a two-dimensional barcode), various card information (for example, magnetic information of the card). The present invention can be similarly applied to any information member that can express the disclosure address T, such as information stored in the IC card).

  More specifically, in the case of the disclosure address T expressed by a telephone number, the telephone of the user who is a referrer of a connection request (or a connection request made up of a plurality of telephone numbers) with the telephone number as a connection destination. Receiving from the terminal by the connection device of the telephone line network, performing normal disclosure determination processing and normal disclosure control processing (or extended disclosure determination processing and extended disclosure control processing), and returning the information of the referred person to the telephone terminal Become. Further, in the case of the disclosure address T expressed in a barcode, one (or a plurality) of barcode-attached media (for example, business cards and prepaid cards) are read by a barcode reader, and a normal disclosure determination process is performed. Or the normal disclosure control process (or the extended disclosure determination process or the extended disclosure control process) is performed, and the information of the referred person is output from the display device connected to the barcode reader. Further, in the case of the disclosure address T expressed by the card information, the disclosure is performed by the same method as the above barcode.

(12) Disclosure Address T Generating Body In the above embodiment, a case where a third party (service center) who is not a user generates the disclosure address T has been described. However, the present invention is not limited to this. Alternatively, the disclosure address T may be generated by the user terminal 1 of the user who is the referenced person. That is, in this case, the user terminal 1 generates the disclosure address T using the private key of the user who is the referenced person, and the information disclosure server 30 performs the disclosure determination using the public key of the user. Do.

(13) Generation of Disclosure Address T Using Key In the above embodiment, the case where the falsification preventing code is generated using the relationship level R has been described, but the present invention is not limited to this, The falsification preventing code may be generated using the disclosure control content S corresponding to the level R. In other words, the falsification prevention code is not limited to that described in the above embodiment, and the referenceee identifying information A, the referrer limited information B, the control information F, the control information F ⁺ or a combination thereof is appropriately used. Any tamper-proof code can be obtained.

In the above-described embodiment, the case where the disclosure address T including the so-called falsification prevention code is generated has been described. However, the present invention is not limited to this, and instead of the falsification prevention code, a reference is made. The disclosure address T including encrypted data obtained by encrypting the person specifying information A, the referrer limited information B, the control information F, the control information F ^+, or a combination thereof may be generated. . As a key, a common key or a public key can be used as appropriate.

(14) System configuration etc. In addition, among the processes described in the above embodiments, all or a part of the processes described as being automatically performed can be performed manually or manually. All or part of the processing described as being performed can be automatically performed by a known method. In addition, information including processing procedures, control procedures, specific names, various data and parameters (for example, information stored in a personal information storage unit, disclosure policy storage unit, etc.) shown in the above document or drawing Can be arbitrarily changed unless otherwise specified.

  In addition, each component of each device illustrated in the above embodiment (for example, the address issuing server and the information disclosure server illustrated in FIG. 2) is functionally conceptual and is not necessarily physically configured as illustrated. You don't need to be. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or a part of each device can be functionally or physically functioned in arbitrary units according to various loads or usage conditions. It can be configured to be distributed and integrated. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

  In the above-described embodiments, each device (for example, a user terminal, an address issuing server, an information disclosure server, etc.) that implements the present invention has been described in terms of functions. However, each function of each device is a personal computer or workstation. It can also be realized by causing a computer to execute the program. That is, the various processing procedures described in the first and second embodiments can be realized by executing a program prepared in advance on a computer. These programs can be distributed via a network such as the Internet. Further, these programs can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO, and a DVD, and can be executed by being read from the recording medium by the computer. In other words, for example, a CD-ROM (may be a separate CD-ROM for each apparatus) storing the address issuing server program as shown in the first embodiment and the information disclosure server program is distributed. Then, each computer may read and execute the program stored in the CD-ROM.

  The case where the access control according to the present invention has been applied to the information disclosure service has been described so far, but the present invention is not limited to this. For example, from a certain user (sender as an accessor) to another "Message delivery service" that delivers messages sent to other users (called recipients as accessed people) or from one user (sender as accessing person) to other users (called recipients as accessed person) The present invention can be similarly applied to any service accessed by other users with respect to a certain user, such as a “telephone connection service” for connecting an outgoing telephone connection request. Therefore, in the following, an embodiment when the access control according to the present invention is applied to the “message delivery service” and the “telephone connection service” will be described. However, here, for convenience of explanation, a case where three users (user U1, user U2, user U3) appear as in FIG. 1 will be described as an example.

(1) Message Delivery Service FIG. 39 is a diagram for explaining a message delivery system according to another embodiment. Here, a case where a delivery address T (U1_U2) for delivering a message to the user U1 by the user U2 and a delivery address T (U2_U3) for delivering a message to the user U2 by the user U2 are issued. An example will be described. “Messages” handled by the message delivery system include destination messages such as so-called instant messages, presence exchange messages, SIP messages such as IP phone control messages, in addition to electronic mail messages such as Internet mail and mobile mail. Various messages to be delivered.

  In this message delivery system, when a third party other than the user (for example, a service center handling the delivery address T) receives delivery destination information and a delivery policy from each user as a receiver, the delivery destination information storage unit And stored in the delivery policy storage unit (see (1-1) and (2-1) in FIG. 39). Here, the “delivery destination information” is information indicating a delivery destination of a message whose destination is a user as a recipient, for example, a user's mobile mail address or PC mail address. The “delivery control content S” is control content relating to delivery of the message delivery service. For example, as illustrated in FIG. 39, “deliver the message to the user's mobile phone and PC”. The control content such as “deliver the message only to the user's PC” corresponds to this.

  On the other hand, as a request for issuing the delivery address T (U1_U2), the service center receives the callee ID_U1 (identification information of the callee user U1) from the callee user U1 and the caller ID_U2 (caller ID user U2). Identification information), relation level R and valid condition C (see (1-2) in FIG. 39). After that, the service center generates a delivery address T (U1_U2) including “recipient ID_U1, caller ID_U2, relationship level R, and valid condition C” using a predetermined key ((FIG. 39 ( 1-3)). Further, the service center transfers the generated delivery address T (U1_U2) to the user U2 who is the caller (see (1-4) in FIG. 39).

  Then, the service center receives a message (email) having the delivery address T (U1_U2) as the destination address from the user U2 as the caller as a message delivery request to the user U1 as the callee ((1 in FIG. 39). Refer to -5)). After that, the service center verifies the validity of the delivery address T (U1_U2) using a predetermined key, and from the delivery address T (U1_U2), the recipient ID_U1, the caller ID_U2, the relationship level R, and the validity condition C is extracted, and further, the validity condition C is used to determine whether or not the delivery control content can be executed (see (1-6) in FIG. 39).

  In addition, if the validity of the delivery address T (U1_U2) is recognized and the execution of the delivery control content is permitted, the service center stores the delivery destination information stored in the delivery destination information storage unit. The relationship level included in the delivery address T (U1_U2) of the delivery control contents S stored in the delivery policy storage unit with reference to the delivery destination information corresponding to the callee ID_U1 included in the delivery address T (U1_U2). In accordance with the delivery control content S corresponding to R, the message is delivered to the user U1 who is the recipient (see (1-7) in FIG. 39).

  That is, as a specific example, the delivery control content S corresponding to the relationship level R included in the delivery address T (U1_U2) received from the user U2 who is the caller “delivers a message to the mobile phone and the PC”. If it is, the message from the caller B is delivered to the mobile phone and the PC terminal of the user U1 using the mobile mail address and the PC mail address of the user U1 who is the called party stored in the delivery destination information storage unit. To do.

  Similarly to the above, when the service center receives the callee ID_U2, the caller ID_U3, the relationship level R, and the valid condition C from the user U2 as the callee as a request for issuing the delivery address T (U2_U3), A delivery address T (U2_U3) including these is generated with a predetermined key, and the generated delivery address T (U2_U3) is transferred to the user U3 who is a caller ((2-2) to (2) in FIG. -4)).

  When the service center receives a message having a delivery address T (U2_U3) as the destination address from the caller user U3 as a message delivery request to the callee user U2, the service center uses a predetermined key. In addition to verifying the validity of the delivery address T (U2_U3), the receiver ID_U2, the caller ID_U3, the relationship level R, and the valid condition C are extracted from the delivery address T (U2_U3). Is used to determine whether or not the delivery control content can be executed (see (2-5) and (2-6) in FIG. 39).

  In addition, when the validity of the delivery address T (U2_U3) is recognized and the execution of the delivery control content is permitted, the service center stores the delivery destination information stored in the delivery destination information storage unit. The relationship level included in the delivery address T (U2_U3) of the delivery control contents S stored in the delivery policy storage unit with reference to the delivery destination information corresponding to the callee ID_U2 included in the delivery address T (U2_U3). In accordance with the delivery control content S corresponding to R, the message is delivered to the user U2 who is the recipient (see (2-7) in FIG. 39).

  As described above, in the message delivery system shown in FIG. 39, the message is delivered from the user U2 to the user U1 through the delivery address T (U1_U2), and the message is sent from the user U3 to the user U2 through the delivery address T (U2_U3). This is normal message delivery. That is, in this message delivery system, in addition to normal message delivery, as described below, extended message delivery is also performed.

  More specifically, in the message delivery system illustrated in FIG. 39, the user U2 sends a message to the user U1 as a caller for delivering a message T () in order to bring the user U1 and the user U3 together. U1_U2) is notified to the user U3 (see (3-1) in FIG. 39). On the other hand, the service center receives a message including the delivery address T (U1_U2) and the delivery address T (U2_U3) from the user U3 who is the caller as a delivery request for the extended message to the user U1 (FIG. 39). (Refer to (3-2)).

  The service center then verifies the validity of both delivery addresses T using a predetermined key, and extracts the callee ID, caller ID, relationship level R, and validity condition C from each delivery address T. Then, it is determined whether or not the delivery address T (U2_U3) reaches the delivery address T (U1_U2) (see (3-3) in FIG. 39). Here, “arrive” means that the callee ID included in the delivery address T (U2_U3) and the caller ID included in the delivery address T (U1_U2) correspond to each other in the above example. In other words, if both the callee ID and the caller ID are user ID_U2, it is determined that “arrive” is reached.

  Further, in addition to such arrival determination, the service center determines whether or not the valid condition C included in each delivery address T is satisfied, and whether or not the relationship level R included in the delivery address T matches. From this point of view, it is determined whether or not the delivery control content can be executed (see (3-3) in FIG. 39). Then, the service center determines that each delivery address T is legitimate, determines that the user U3 will reach the user U1, and further executes the delivery control contents. Refers to the delivery destination information corresponding to the callee ID_U1 included in the delivery address T (U1_U2) among the delivery destination information stored in the delivery destination information storage unit, and the delivery control content stored in the delivery policy storage unit In S, the message is delivered to the user U1 who is the callee in accordance with the delivery control content S corresponding to the relationship level R included in the delivery address T (U1_U2) (see (3-4) in FIG. 39).

  Thus, in the message delivery system described above, message delivery from user U3 to user U1 using a plurality of delivery addresses T (U1_U2) and delivery addresses T (U2_U3) to reach user U1 from user U3. Therefore, the user U3 can deliver the message to the user U1 even if the user U3 does not have the delivery address T (U1_U3) itself for delivering the message to the user U1.

  In this message delivery system, access control (delivery control) similar to the access control (disclosure control) described in the information disclosure system according to the first and second embodiments is realized. That is, in the description of the first and second embodiments, for example, “Disclosure address” is “delivery address”, “Disclosure policy” is “delivery policy”, and “Disclosure control content” is “delivery control content”. The same access control can be applied.

(2) Telephone connection service FIG. 40 is a diagram for explaining a telephone connection system according to another embodiment. Here, as an example, a connection address T (U1_U2) for the user U2 to make a telephone connection to the user U1 and a connection address T (U2_U3) for the user U3 to make a telephone connection to the user U2 are issued. I will give you a description.

  In this telephone connection system, when a third party other than the user (for example, a service center that handles the connection address T) receives connection destination information and a connection policy from each user as a callee, this is connected to the connection destination information storage unit. And stored in the connection policy storage unit (see (1-1) and (2-1) in FIG. 40). Here, the “connection destination information” is information indicating a connection destination of a telephone whose destination is a user as a callee, such as a user's mobile phone number, home phone number, company phone number, and the like. This is the case. The “connection control content S” is control content related to the connection of the telephone connection service. For example, as illustrated in FIG. 40, “connect to the user's mobile phone”, “user's home”. The control content such as “Connect to phone” corresponds to this.

  On the other hand, as a request for issuing the connection address T (U1_U2), the service center receives a caller ID_U1 (identification information of the user U1 who is the callee) and a caller ID_U2 (user U2 which is the caller) Identification level), relationship level R and valid condition C (see (1-2) in FIG. 40). Then, the service center generates a connection address T (U1_U2) including “recipient ID_U1, caller ID_U2, relationship level R, and valid condition C” using a predetermined key ((FIG. 40 ( 1-3)). Further, the service center delivers the generated connection address T (U1_U2) to the user U2 who is the caller (see (1-4) in FIG. 40).

  Then, the service center receives a telephone connection request with the connection address T (U1_U2) as the incoming call destination from the user U2 as the caller as a telephone connection request to the user U1 who is the callee ((1- See 5)). After that, the service center verifies the validity of the connection address T (U1_U2) using a predetermined key, and from the connection address T (U1_U2), the caller ID_U1, the caller ID_U2, the relationship level R, and the valid condition C is extracted, and further, the validity condition C is used to determine whether or not the connection control content can be executed (see (1-6) in FIG. 40).

  In addition, when the validity of the connection address T (U1_U2) is recognized and the execution of the connection control content is permitted, the service center stores the connection destination information stored in the connection destination information storage unit. The relation level included in the connection address T (U1_U2) of the connection control contents S stored in the connection policy storage unit with reference to the connection destination information corresponding to the callee ID_U1 included in the connection address T (U1_U2). In accordance with the connection control content S corresponding to R, the telephone is connected to the user U1 who is the called party (see (1-7) in FIG. 40).

  That is, as a specific example, the connection control content S corresponding to the relationship level R included in the connection address T (U1_U2) received from the user U2 who is the caller is “Connect to the user's mobile phone”. If it is, the telephone connection request from the user U2 who is the caller is transferred to the mobile phone of the user U1 who is the callee by using the mobile phone number of the user U1 stored in the connection destination information storage unit. .

  Similarly to the above, when the service center receives the callee ID_U2, the caller ID_U3, the relationship level R, and the valid condition C from the user U2 who is the callee as a request for issuing the connection address T (U2_U3), A connection address T (U2_U3) including these is generated with a predetermined key, and the generated connection address T (U2_U3) is transferred to the user U3 who is a caller ((2-2) to (2) in FIG. -4)).

  When the service center receives a telephone connection request with the connection address T (U2_U3) as the incoming call destination from the user U3 as the caller as a telephone connection request to the user U2 as the callee, Using the key, the validity of the connection address T (U2_U3) is verified, and the callee ID_U2, the caller ID_U3, the relationship level R, and the valid condition C are extracted from the connection address T (U2_U3) Whether or not to execute the connection control content is determined using the condition C (see (2-5) and (2-6) in FIG. 40).

  In addition, when the validity of the connection address T (U2_U3) is recognized and the execution of the connection control content is permitted, the service center stores the connection destination information stored in the connection destination information storage unit. The relation level included in the connection address T (U2_U3) in the connection control content S stored in the connection policy storage unit with reference to the connection destination information corresponding to the callee ID_U2 included in the connection address T (U2_U3). In accordance with the connection control content S corresponding to R, the telephone is connected to the user U2 who is the called party (see (2-7) in FIG. 40).

  As described above, in the telephone connection system shown in FIG. 40, a telephone connection is made from the user U2 to the user U1 through the connection address T (U1_U2), and a telephone connection is made from the user U3 to the user U2 through the connection address T (U2_U3). This is a normal telephone connection. That is, in this telephone connection system, an extended telephone connection is performed as described below in addition to a normal telephone connection.

  More specifically, in the telephone connection system illustrated in FIG. 40, the user U2 connects to the user U1 as a caller by using a connection address T (U1_U2) to attract the user U1 and the user U3. ) To the user U3 (see (3-1) in FIG. 40). On the other hand, the service center receives a telephone connection request including the connection address T (U1_U2) and the connection address T (U2_U3) from the user U3 as a caller as an extended telephone connection request to the user U1 (FIG. 40). (See (3-2)).

  Then, the service center verifies the validity of both connection addresses T using a predetermined key, and extracts the callee ID, caller ID, relationship level R, and validity condition C from each connection address T. Then, it is determined whether or not the connection address T (U2_U3) reaches the connection address T (U1_U2) (see (3-3) in FIG. 40). Here, “to arrive” means that the callee ID included in the connection address T (U2_U3) corresponds to the caller ID included in the connection address T (U1_U2). In other words, if both the callee ID and the caller ID are user ID_U2, it is determined that “arrive” is reached.

  Furthermore, in addition to such arrival determination, the service center determines whether the validity condition C included in each connection address T is satisfied, and whether the relationship level R included in the connection address T matches. From this point of view, it is determined whether or not the connection control content can be executed (see (3-3) in FIG. 40). Then, the service center determines that each connection address T is valid, determines that the user U3 has reached “user U1”, and is further permitted to execute the connection control contents. Refers to the connection destination information stored in the connection policy storage unit by referring to the connection destination information corresponding to the callee ID_U1 included in the connection address T (U1_U2) among the connection destination information stored in the connection destination information storage unit. The telephone is connected to the user U1 who is the callee according to the connection control content S corresponding to the relation level R included in the connection address T (U1_U2) among S (see (3-4) in FIG. 40).

  As described above, in the above-described telephone connection system, the telephone connection from the user U3 to the user U1 using the plurality of connection addresses T (U1_U2) and the connection addresses T (U2_U3) for reaching the user U1 from the user U3. Therefore, the user U3 can make a telephone connection to the user U1 even if the user U3 does not have the connection address T (U1_U3) itself for making a telephone connection to the user U1.

  In this telephone connection system, access control (connection control) similar to the access control (disclosure control) described in the information disclosure system according to the first and second embodiments is realized. That is, in the above description of the first and second embodiments, for example, “disclosure address” is “connection address”, “disclosure policy” is “connection policy”, and “disclosure control content” is “connection control content”. The same access control can be applied.

  As described above, the access control system, the access control method, and the access control program according to the present invention are useful when controlling access by an accessor to a service related to the accessed person. Even if the user does not have an access code for accessing the user X, it is suitable for accessing a service related to the person X to be accessed.

1 is a diagram for explaining an overview of an information disclosure system according to Embodiment 1. FIG. 1 is a diagram illustrating a configuration of an information disclosure system according to a first embodiment. It is a figure which shows the structural example of the information memorize | stored in a user information table. It is a figure which shows the structural example of the information memorize | stored in a personal information storage part (basic information table). It is a figure which shows the structural example of the information memorize | stored in a personal information storage part (schedule table). It is a figure which shows the structural example of the information memorize | stored in a disclosure policy memory | storage part. It is a sequence diagram which shows the processing procedure from address generation for disclosure to normal information disclosure. It is a figure which shows the structural example of the screen which concerns on a user authentication request | requirement. It is a figure which shows the structural example of the screen which concerns on the address issuing request for a disclosure. It is a figure which shows the structural example of the screen which concerns on an address issue response. It is a figure which shows the structural example of the mail for creation notifications which a referer receives. It is a figure which shows the structural example of the reference request | requirement mail of the normal disclosure which a referer transmits. It is a figure which shows the structural example of the disclosure mail of the normal disclosure which a referer receives. It is a flowchart which shows the detail of an address generation process. It is a flowchart which shows the detail of a normal disclosure determination process. It is a flowchart which shows the detail of a normal disclosure control process. It is a sequence diagram which shows the process sequence which leads to the extended information disclosure. It is a figure which shows the structural example of the reference request mail of the extended disclosure which a referer transmits. It is a figure which shows the structural example of the disclosure mail of the extended disclosure which a referer receives. It is a flowchart which shows the detail of an extended disclosure determination process. It is a flowchart which shows the detail of an extended disclosure control process. It is a figure for demonstrating the condition in the case of interposing a some intermediary. It is a figure which shows the structural example of the reference request | requirement mail of the extended disclosure which a referer transmits, when via a some intermediary. It is a flowchart which shows the detail of the extended disclosure determination process performed when passing through several mediators. It is a figure for demonstrating the concept which concerns on the production | generation of the address for a disclosure. It is a figure for demonstrating the concept which concerns on the extended information disclosure. It is a figure for demonstrating an example of an extended disclosure determination process. It is a figure for demonstrating an example of an extended disclosure determination process. It is a figure for demonstrating an example of an extended disclosure determination process. It is a figure for demonstrating an example of an extended disclosure determination process. It is a figure for demonstrating an example of an extended disclosure control process. It is a figure for demonstrating an example of an extended disclosure control process. It is a figure for demonstrating an example of an extended disclosure control process. It is a figure for demonstrating an example of an extended disclosure control process. It is a figure for demonstrating another disclosure policy. It is a figure for demonstrating another disclosure policy. It is a figure for demonstrating the address for a disclosure of another format. It is a figure for demonstrating the address for a disclosure of another format. It is a figure for demonstrating the message delivery system which concerns on another Example. It is a figure for demonstrating the telephone connection system which concerns on another Example.

Explanation of symbols

1 User terminal 1a Address storage unit 3 Internet 4 LAN (Local Area Network)
DESCRIPTION OF SYMBOLS 10 User information server 11 User information table 20 Address issue server 21 Communication part 22 User authentication part 23 Issue key memory | storage part 24 Address generation part 30 Information disclosure server 31 Communication part 32 User authentication part 33 Personal information storage part 34 Disclosure policy storage part 35 Information update unit 36 Verification key storage unit 37 Disclosure determination unit 37a Normal disclosure determination unit 37b Extended disclosure determination unit 38 Disclosure control unit 38a Normal disclosure control unit 38b Extended disclosure control unit

Claims (14)

An access control system for controlling access by an accessor to a service related to an accessee,
An access control information storage means for storing access control information for controlling the access in association with relationship information indicating a relationship between the accessed person and the accessed person;
Wherein the access user identification information for uniquely identifying the access person, access user-limiting information for limiting the access person, and including at least the access code of the relation information showing the relation between the objective-and the access user Access code generation means for generating
When one access code is received from a predetermined accessor, by executing access control information corresponding to relation information included in the access code among the access control information stored in the access control information storage unit, A first access control means for controlling access of the access for a service related to the accessed person specified by the accessed person specifying information included in the access code;
Access including a plurality of access codes from a predetermined access person Y including at least an access code TS including access-person limited information of the access person Y and access target identification information of a predetermined access target person X as an access target An access code receiving means for receiving the code TE;
Accessed person specifying information included in a certain access code and access included in another access code based on the accessed person specifying information and the accessor limited information respectively included in the plurality of access codes received by the access code receiving means The access code is obtained by linking both access codes on condition that the person-limited information corresponds, and determining whether the access code TS and the access code TE can be linked via another access code. Arrival determination means for determining whether to reach from the TS to the access code TE;
Access determining means for determining whether to permit access to the accessed person X by the accessor Y based on relation information included in each of the plurality of access codes received by the access code receiving means;
When it is determined that the arrival determination means arrives from the access code TS to the access code TE, and the access determination means determines that the accessee Y is allowed to access the accessed person X, By executing access control information corresponding to related information included in the access code TE among the access control information stored in the access control information storage means, the service related to the accessed person X can be A second access control means for controlling access;
An access control system comprising: The access determination means permits access to the accessee X by the accessor Y by determining whether or not the relationship information included in each access code from the access code TS to the access code TE is equal. The access control system according to claim 1, wherein it is determined whether or not to perform. The access determination means is a link indicating a degree of connection between the predetermined accessee X and the predetermined accessee Y based on relation information included in each access code from the access code TS to the access code TE. By calculating a value and determining whether or not the link value exceeds a predetermined link value, it is determined whether or not access to the accessed person X by the accessing person Y is permitted. The access control system according to claim 1 . The access code generating means generates an access code further including an extended valid condition required for executing the service when the access is extended by a plurality of access codes ;
Said access judging means, based on the extended valid condition included in the access code TE accepted by the access code receiving means further determining whether to permit access to the access person X by the accessor Y The access control system according to claim 1. Whether the number of other access codes exceeds a predetermined number or not when the arrival determination unit determines whether the access code TS and the access code TE can be linked via another access code The access control system according to claim 1, further comprising: determining that the access code TS is reached from the access code TS if the predetermined number is not exceeded . The access control information storage means further associates a plurality of link values indicating the degree of connection between the predetermined accessee X and the predetermined accessee Y when the access is extended by a plurality of access codes, Storing access control information for controlling the access extended by an access code;
When the link value is stored in the access control information storage unit, the second access control unit is based on relation information included in each access code from the access code TS to the access code TE. Corresponding to the link value of the access control information stored in the access control information storage means according to the calculated link value indicating the degree of connection between the predetermined accessee X and the predetermined accessee Y The access control system according to claim 1 , wherein access to the accessee Y is controlled for a service related to the accessee X by executing access control information to be accessed . The access control information storage means is further associated with expanded relationship information indicating a relationship between a predetermined accessed person X and a predetermined access person Y when the access is expanded by a plurality of access codes. Storing access control information for controlling the access extended by an access code;
The second access control means is included in the access code TE in the access control information stored in the access control information storage means when the extended relation information is stored in the access control information storage means. 2. The access control system according to claim 1 , wherein access of the accessee Y is controlled for a service related to the accessed person X by executing access control information corresponding to the extended relation information . The access control information storage means further includes a plurality of access codes associated with the number of other access codes linking a predetermined access code TS and a predetermined access code TE when the access is extended by a plurality of access codes. Storing access control information for controlling the access extended by an access code;
In the case where the number is stored in the access control information storage unit, the second access control unit sets the number of other access codes passed through from the access code TS to the access code TE. Accordingly, the access control information corresponding to the number of the access control information stored in the access control information storage means is executed to control the access of the accessor Y for the service related to the accessed person X. The access control system according to claim 1 . An access control method for controlling access by an accessor to a service related to an accessed person,
The access code issuing server
Wherein the access user identification information for uniquely identifying the access person, access user-limiting information for limiting the access person, and including at least the access code of the relation information showing the relation between the objective-and the access user An access code generation step for generating
The access control server
An access control information storage for storing access control information for controlling the access in association with relationship information indicating a relationship between the accessed person and the accessee when one access code is received from a predetermined accessor The access control information corresponding to the relation information included in the access code is executed from the means, so that the access for the service related to the accessed person specified by the accessed person specifying information included in the access code is performed. A first access control step to control;
Access including a plurality of access codes from a predetermined access person Y including at least an access code TS including access-person limited information of the access person Y and access target identification information of a predetermined access target person X as an access target An access code receiving process for receiving the code TE;
Based on the accessee identification information and the accessor limited information included in each of the plurality of access codes received in the access code reception step, accessee identification information included in a certain access code and access included in another access code The access code is obtained by linking both access codes on condition that the person-limited information corresponds, and determining whether the access code TS and the access code TE can be linked via another access code. An arrival determination step for determining whether to reach from TS to the access code TE;
An access determination step for determining whether or not to permit access to the accessed person X by the accessor Y based on relation information included in each of the plurality of access codes received by the access code receiving step;
When it is determined in the arrival determination step that the access code TS is reached from the access code TE and it is determined in the access determination step that access to the accessed person X by the accessor Y is permitted, Corresponding to the relationship information included in the access code TE from the access control information storage means for storing the access control information for controlling the access in association with the relationship information indicating the relationship between the accessed person and the accessee A second access control step for controlling access of the accessor Y for the service related to the accessed person X by executing access control information ;
An access control method comprising: The access determination step permits access to the accessed person X by the accessor Y by determining whether or not the relationship information included in each access code from the access code TS to the access code TE is equal. The access control method according to claim 9 , wherein it is determined whether or not to perform. In the access determination step, a link indicating a degree of connection between the predetermined accessee X and the predetermined accessee Y based on relation information included in each access code from the access code TS to the access code TE By calculating a value and determining whether or not the link value exceeds a predetermined link value, it is determined whether or not access to the accessed person X by the accessing person Y is permitted. The access control method according to claim 9 . An access control program for causing a computer to execute an access control method for controlling access by an accessor to a service related to an accessed person,
Wherein the access user identification information for uniquely identifying the access person, access user-limiting information for limiting the access person, and including at least the access code of the relation information showing the relation between the objective-and the access user Access code generation procedure to generate
An access control information storage for storing access control information for controlling the access in association with relationship information indicating a relationship between the accessed person and the accessee when one access code is received from a predetermined accessor The access control information corresponding to the relation information included in the access code is executed from the means, so that the access for the service related to the accessed person specified by the accessed person specifying information included in the access code is performed. A first access control procedure to control;
Access including a plurality of access codes from a predetermined access person Y including at least an access code TS including access-person limited information of the access person Y and access target identification information of a predetermined access target person X as an access target An access code reception procedure for receiving the code TE;
Based on the accessee specifying information and the accessor limited information included in each of the plurality of access codes received by the access code receiving procedure, the accessee specifying information included in a certain access code and the access included in another access code The access code is obtained by linking both access codes on condition that the person-limited information corresponds, and determining whether the access code TS and the access code TE can be linked via another access code. An arrival determination procedure for determining whether to reach from the TS to the access code TE;
An access determination procedure for determining whether or not to permit access to the accessed person X by the accessor Y based on relational information included in each of the plurality of access codes received by the access code reception procedure;
When it is determined by the arrival determination procedure that the access code TS reaches the access code TE, and when it is determined by the access determination procedure that access to the accessed person X by the accessee Y is permitted, Corresponding to the relationship information included in the access code TE from the access control information storage means for storing the access control information for controlling the access in association with the relationship information indicating the relationship between the accessed person and the accessee A second access control procedure for controlling access of the accessor Y for the service related to the accessed person X by executing access control information ;
An access control program comprising: The access determination procedure permits the accessee Y to access the accessed person X by determining whether or not the relationship information included in each access code from the access code TS to the access code TE is equal. 13. The access control program according to claim 12 , wherein it is determined whether or not to perform. The access determination procedure includes a link indicating a degree of connection between the predetermined accessee X and the predetermined accessee Y based on relation information included in each access code from the access code TS to the access code TE. By calculating a value and determining whether or not the link value exceeds a predetermined link value, it is determined whether or not access to the accessed person X by the accessing person Y is permitted. The access control program according to claim 12 .

Images