JP5561782B2 - Electronic data management system, server device, electronic data management method, and program - Google Patents

Description

  The present invention relates to an electronic data management system, a server device, an electronic data management method, and a program for managing electronic data registered in a database or the like.

  In recent years, the Internet has become widespread worldwide, and the speed of communication has been increasing at a considerable speed. Among them, the use form of information systems is based on the progress of distributed processing technology and virtualization technology, from the conventional method of using expensive high-performance machines alone to the required processing capacity by combining multiple popular machines. We are moving towards adopting methods that can change the amount of resources required for processing on an ad hoc basis, such as a method for obtaining multiple environments on a high-performance machine.

  Also, in recent years when investment in information systems has slowed due to the economic downturn, when replacing information systems that have been individually constructed and used by individual companies, instead of building individual systems that tend to be expensive, There is a need for an information system that can be constructed in a short period of time and at the same time has low costs for construction and operation.

  Against this background, cloud computing has emerged that enables companies to secure information system resources when they are needed, and at the same time minimize human resources for information system operations. Yes. Cloud computing is expected to spread and develop further in the future.

  However, cloud computing is still in a transitional state, and Non-Patent Document 1 points out various problems in cloud computing. For example, when a computer system operated by each company is migrated to cloud computing, each data managed by the company is deposited on a cloud service. For this reason, the system administrator of each company has confidentiality (data mixing with other users, leakage, theft, etc.) and integrity (data loss and loss, erasure of deleted data, etc.) I have concerns about such issues.

  In particular, in cloud computing, the scalability of processing capacity is flexibly controlled, and at the same time, each process is executed in a multi-tenant using a virtual environment, so the boundary with other users is on the user side. From the point of view, it looks vague. For this reason, there is a growing concern about information leakage due to data mixing, and the cloud computing system is in an environment where accidents such as information leakage are unlikely to occur at an early stage. It is necessary to clearly indicate that the situation is available.

  In order to cope with this situation, currently available methods for managing data include a method of encrypting the entire hard disk that stores the data, and an encryption key set on the database for each account used on the database. And a method of setting an encryption key management table or a role for each use account.

  Furthermore, in order to further secure the safety of data, for example, Patent Document 1, Patent Document 2, and Patent Document 3 divide stored data into personal identification parts and non-identification parts specialized for personal information. However, a technique for concealing information for uniquely combining the divided data with an encryption key or the like is disclosed.

JP 2007-34423 A JP 2005-182275 A JP 2007-317075 A

"Study Report on the Foundation of Cloud Computing Society" [online], March 24, 2010, Information-technology Promotion Agency, Internet <URL: http://www.ipa.go.jp /about/research/2009cloud/pdf/100324_cloud.pdf>

  By the way, with the technique disclosed in Patent Document 1, the data to be registered is only divided into a personal identification part and a non-identification part, and the loss of the uniqueness of the data to be registered is insufficient. . For this reason, the technique disclosed in Patent Document 1 has no problem as long as it is specialized in personal information, but it cannot be applied to highly confidential information held by companies, for example, accounting information and ordering information. There's a problem.

  In other words, the technique disclosed in Patent Document 1 cannot be applied as a company data management technique, and this technique provides the confidentiality required for cloud computing to promote the replacement of company information systems. It is difficult to meet.

  On the other hand, in the technique disclosed in Patent Document 2 or Patent Document 3, since the identifier indicating the relationship between the divided data is encrypted, it is divided more than in the case where the technique disclosed in Patent Document 1 is used. The loss of uniqueness of data is large, and it can be applied to other than personal information.

  However, in the technique disclosed in Patent Document 2 or Patent Document 3, each divided data is stored in a state where the uniqueness is lost. However, if the degree of division is rough, each data obtained by the division is stored. There is a problem that data is likely to be leaked when the data is stored together.

  An example of an object of the present invention is to provide an electronic data management system, a server device, an electronic data management method, and a program that can solve the above problems and can further improve the security of data registered in a database in a computer system. It is to provide.

To achieve the above object, an electronic data management system according to an aspect of the present invention is an electronic data management system for managing a data set including a plurality of item data,
A server device and a database device,
The database device stores a coefficient set that is set in advance for each type of data set and includes a coefficient corresponding to each item data,
The server device
When a data set is input, a database search unit that acquires the coefficient set corresponding to the input data set from the database device based on the type of the input data set;
Numbering a number unique to the input data set, and each item data of the input data set, the number corresponding to the coefficient corresponding to the item data in the acquired coefficient set, And a data registration unit for registering in a separate table in the database device together with the calculated value.

In order to achieve the above object, a server apparatus according to one aspect of the present invention is a server apparatus for managing a data set including a plurality of item data,
When a data set is input, it is set for each type of data set in advance, and the coefficient set including the coefficient corresponding to each item data is stored. A database search unit for obtaining the coefficient set corresponding to the input data set,
Numbering a number unique to the input data set, and each item data of the input data set, the number corresponding to the coefficient corresponding to the item data in the acquired coefficient set, A data registration unit, which is registered with a calculated value, and is registered in a separate table in the database device,
It is characterized by that.

In order to achieve the above object, an electronic data management method according to one aspect of the present invention is a method for managing a data set including a plurality of item data,
(A) When a data set is input, the data set is input from a database device that stores a coefficient set that is set in advance for each type of data set and includes coefficients corresponding to each item data. Obtaining the coefficient set corresponding to the input data set based on the type of:
(B) A number unique to the input data set is numbered, and each item data of the input data set is numbered with a coefficient corresponding to the item data in the acquired coefficient set Registered in a separate table in the database device together with the calculated value calculated from the number;
It is characterized by having.

Furthermore, in order to achieve the above object, a program according to one aspect of the present invention is a program for executing management of a data set including a plurality of item data by a computer,
In the computer,
(A) When a data set is input, the data set is input from a database device that stores a coefficient set that is set in advance for each type of data set and includes coefficients corresponding to each item data. Obtaining the coefficient set corresponding to the input data set based on the type of:
(B) A number unique to the input data set is numbered, and each item data of the input data set is numbered with a coefficient corresponding to the item data in the acquired coefficient set Registered in a separate table in the database device together with the calculated value calculated from the number;
Is executed.

  As described above, according to the electronic data management system, the server device, the electronic data management method, and the program of the present invention, it is possible to further improve the security of data registered in the database in the computer system.

FIG. 1 is a block diagram schematically showing an overall configuration of an electronic data management system according to an embodiment of the present invention. FIG. 2 is a block diagram showing the configuration of the server device and the database device in the embodiment of the present invention. FIG. 3 is a diagram illustrating an example of a management table registered in the database device. FIG. 4 is a diagram illustrating an example of an item table registered in the database device. FIG. 5 is a diagram showing an example of the combined information table registered in the database device. FIG. 6 is a diagram illustrating an example of an access level table registered in the database device. FIG. 7 is a diagram illustrating an example of an access authority table registered in the database device. FIG. 8 is a flowchart showing an operation at the time of data registration of the electronic data management system in the embodiment of the present invention. FIG. 9 is a flowchart showing an operation at the time of data search of the electronic data management system in the embodiment of the present invention. FIG. 10 is a block diagram illustrating an example of a computer that implements the Web server device according to the embodiment of the present invention. FIG. 11 is a diagram illustrating an example of personal information data used as registration data in the first embodiment. FIG. 12 is a diagram illustrating an example of an access level table registered in the database apparatus in the first embodiment. FIG. 13 is a diagram illustrating an example of an access authority table registered in the database apparatus in the first embodiment. FIG. 14 is a diagram illustrating an example of a management table registered in the database apparatus in the first embodiment. FIG. 15 is a diagram illustrating a format of an item table registered in the database device in the first embodiment. FIG. 16 is a diagram illustrating a correspondence list of item data and item tables registered in the database apparatus in the first embodiment. FIG. 17 is a diagram illustrating an example of an item table registered in the database apparatus in the first embodiment. FIG. 18 is a diagram illustrating an example of the combined information table registered in the database device in the first embodiment. FIG. 19 is a diagram illustrating an example of a registered data set to be searched in the second embodiment. FIG. 20 is a diagram illustrating an example of an access level table registered in the database apparatus in the second embodiment. FIG. 21 is a diagram illustrating an example of an access authority table registered in the database apparatus in the second embodiment. FIG. 22 is a diagram illustrating an example of a management table registered in the database apparatus in the second embodiment. FIG. 23 is a diagram illustrating a correspondence list between item data and item tables registered in the database apparatus in the second embodiment. FIG. 24 is a diagram illustrating an example of an item table registered in the database apparatus in the second embodiment. FIG. 25 is a diagram illustrating an example of the combined information table registered in the database apparatus in the second embodiment.

(Summary of Invention)
The present invention uses a technique for dividing electronic data stored in a database, which operates on a server via a network, in units of items, thereby losing uniqueness, thereby managing electronic data with high security. And enable operation. The present invention is particularly useful for cloud computing.

  In the present invention, an identifier for linking each item data is provided for each electronic data (hereinafter referred to as “item data”) divided in item units, and the identifiers are concealed and managed. Thereby, this invention can make it difficult to connect each item data easily. In the present invention, each item data is registered or updated in a separate table as a plain character string or encrypted data. Furthermore, in the present invention, the concealment of the identifier can be temporarily canceled and the item data can be combined to obtain the original data.

  The present invention relates to contents of operations that can be performed on electronic data before division and contents of operations that can be performed on item data in accordance with the access authority of a user who is authenticated through an application program that runs on a server device. Can be set.

  Further, the present invention can check whether the user has the right to access the electronic data when the user accesses the electronic data stored in the database based on the authority information.

  Specifically, the present invention checks whether the user has the right to search and display each item of electronic data. Further, according to the present invention, when the user has an access right to each item of the electronic data, the data is extracted from each item while performing sequential decryption, and the extracted data is converted into the unique information. Make it available as a lump.

(Embodiment)
Hereinafter, an electronic data management system, a server device, an electronic data management method, and a program according to an embodiment of the present invention will be described with reference to FIGS.

[System configuration]
Initially, the structure of the electronic data management system 10 in this Embodiment is demonstrated using FIG. FIG. 1 is a block diagram schematically showing an overall configuration of an electronic data management system according to an embodiment of the present invention.

  As shown in FIG. 1, the electronic data management system 10 in this Embodiment is used in order to manage the data set containing several item data. The electronic data management system 100 includes a server device 20 and a database device 30. In the present embodiment, the server device 20 is a Web server device that provides Web services to users. Hereinafter, it will be referred to as “Web server device 20”. The Web server device 20 is connected to the user's terminal 40 via a network, and accepts an operation performed by the user via the terminal 40.

  As shown in FIG. 1, the Web server device 20 executes one or more application programs (hereinafter referred to as “applications”) 21 on an OS (Operation System). The web server device 20 includes a data control unit 22. The data control unit 22 operates data stored in the database device 30 based on a request from the application 21.

  Next, the configuration of the Web server device 20 and the database device 30 in the present embodiment will be described with reference to FIG. FIG. 2 is a block diagram showing the configuration of the server device and the database device in the embodiment of the present invention.

  The database device 30 is connected to the Web server device 20 via a network such as a LAN. The database device 30 stores a coefficient set set for each type of data set. The coefficient set includes a coefficient corresponding to each item data constituting the data set. In the present embodiment, as will be described later, the coefficient set is registered in the database device 30 as a management table.

  In the data control unit 22, the Web server device 20 mainly includes a database search unit 203 and a data registration unit 207. When the data set is input, the database search unit 203 acquires a coefficient set corresponding to the input data set from the database device 30 based on the type of the input data set.

  The data registration unit 207 assigns a unique number (hereinafter referred to as “link number”) to the input data set. The data registration unit 207 calculates a key value for each item data of the input data set from the corresponding coefficient in the acquired coefficient set and the numbered link number. Then, the data registration unit 207 registers each item data of the input data set together with a corresponding key value in a separate table (hereinafter referred to as “item table”) in the database device 30.

  As described above, in the electronic data management system 10 according to the present embodiment, the electronic data (data set) registered in the database device 30 is registered in separate tables for each item data. In addition, an identifier for connecting each piece of disjoint item data, that is, a link number and a coefficient are concealed by performing calculation using both. Therefore, according to the electronic data management system 10 in the present embodiment, it is possible to further improve the security of data registered in the database device in the computer system.

  Here, the configurations of the electronic data management system 10, the Web server device 20, and the database device 30 in the present embodiment will be described more specifically with reference to FIGS. FIG. 3 is a diagram illustrating an example of a management table registered in the database device. FIG. 4 is a diagram illustrating an example of an item table registered in the database device. FIG. 5 is a diagram showing an example of the combined information table registered in the database device. FIG. 6 is a diagram illustrating an example of an access level table registered in the database device. FIG. 7 is a diagram illustrating an example of an access authority table registered in the database device.

  As shown in FIG. 2, in this embodiment, the database device 30 includes a management table 301, an item table 302, a combined information table 303, an access level table 304, and an access authority table 305 in advance at the time of system construction. Is stored. Of these, the access level tail 304 and the access authority table 305 are combined to provide access authority information that defines the scope of processing that can be performed on the data set for each authority level.

  As shown in FIG. 3, the management table 301 is a table for managing the item table. The management table 301 includes, as items, a data name 301A, an item table list 301B, a link correspondence coefficient list 301C, and an encryption correspondence list 301D.

  Among these, the data name 301 indicates the name of the type of data set to be registered. The item table list 301B is a list of names of item tables (see FIG. 4) in which each item data of the data set is registered. In the item table list 301B, each item table is configured by a character string representing a table name.

  The link correspondence coefficient list 301C indicates coefficient sets corresponding to the data set to be registered. The coefficient set includes a coefficient for each item data of the data set to be registered. In the present embodiment, each coefficient is multiplied by a link number to obtain a key value. As will be described later, the key value is registered in the item table (see FIG. 4) together with the corresponding item data.

  The encryption correspondence list 301D is a list of character strings (Y: encrypted, N: unencrypted) indicating whether item data is encrypted in each item table. In the present embodiment, each character string constituting the table list 301B, the link correspondence coefficient list 301C, and the encryption correspondence list 301D is encrypted by a block encryption method such as AES (Advanced Encryption Standard), for example. It may be made.

  As shown in FIG. 4, the item table 302 is a table in which each item data of a data set to be registered is registered, and is created for each item data included in the data set to be registered. In other words, as many item tables 302 as the number of item tables described in the item table list 301B of the management table 301 are created.

  The item table 302 has a key value 302A and data 302B as items. The key value 302A is represented by a product of a link number unique to each data and a coefficient defined for each item table. Further, the item table 302 is encrypted and registered when the character string defined in the encryption correspondence list 301D is “Y”, and is registered without being encrypted when it is “N”.

  As shown in FIG. 5, the combined information table 303 includes, as items, a data name 303A, a link number 303B, and a key value list 303C. The data name 303A is the same as the data name 301A shown in FIG. 3, and indicates the type of data set to be registered. As described above, the link number 303B is a unique number assigned to the data set to be registered.

  The key value list 303C is a list of key values calculated for each item data. In the present embodiment, as described above, the key value is calculated by multiplying the coefficient corresponding to the item data by the link number 303B. In the present embodiment, the character string representing the key value list 303C may be encrypted.

  As shown in FIG. 6, the access level table 304 defines authority levels. The access level table 304 includes, as items, an authority level (access level) 304A to be defined, a data name 304B, and an authority level name (authority name) 304C to be defined. The data name 304B is the same as the data name 301A shown in FIG. 3, and indicates the type of data set in which the authority level to be defined is set.

  As shown in FIG. 7, the access authority table 305 defines the authority given to the authority level defined in FIG. The access authority table 305 has, as items, an authority name 305A, a search authority 305B, an input authority 305C, an update authority 305D, and a deletion authority 305E.

  The authority name 305A is the same as the authority name 304C shown in FIG. 6, and indicates the name of the authority level to be defined. The search right 305B is indicated by a list of names of the item table 302 that can be searched when searching for item data or when combining item data. The input right 305C indicates whether data can be registered. The update right 305D indicates whether data can be updated. The deletion right 305E indicates whether or not data can be deleted.

  As shown in FIG. 2, in the present embodiment, the Web server device 20 includes a data receiving unit 201, an access authority in the data control unit 22 in addition to the database search unit 203 and the data registration unit 207 described above. An information acquisition unit 202, an item table operation unit 204, an encryption unit 205, a decryption unit 206, a data combination unit 208, and a return unit 209 are provided.

  The data receiving unit 201 receives various data input by the user at the terminal 40 via the application 21 and outputs the received data to the access authority information acquiring unit 202. Specifically, when the user instructs registration of the data set to the database device 30, the data receiving unit 201 receives the data set (registration data) 51 to be registered and the user information 52 from the application 21. And the data name 53 are received. The user information 52 is information (access level 304A) indicating the authority level set for the user. The data name 53 is a name of the type of registered data (data name 301).

  On the other hand, when the user instructs the database device 30 to search for a data set, the data receiving unit 201 receives search data 54, user information 52, and a data name 53 from the application 21. In this case, the search data 54 includes item data included in a registered data set.

  The access authority information acquisition unit 202 receives data from the data reception unit 201. Then, the access authority information acquisition unit 202 uses the access level table 304 and the access authority table 305 based on the user information 52 and the data name 53, and includes a data set including the access authority information for the registered data 51 or the search data 54. Get access authority information about.

  The item table operation unit 204 passes to the data registration unit 207 information for specifying a link number necessary for registering each item data in the item table. The data registration unit 207 assigns a link number based on the information received from the item table operation unit 204.

  The encryption unit 205 encrypts all or a part of item data included in the input data set, and information on various tables registered in the database device 30. The decryption unit 206 decrypts the encrypted item data and the encrypted table information.

  When a data set search is instructed, the data combining unit 208 acquires each item data from the corresponding item table, combines the acquired item data, and restores one data set. The return unit 209 returns data to the application 21.

[System configuration: Data registration processing]
Here, each part which comprises the Web server apparatus 20 is demonstrated more concretely along the process at the time of the Web server apparatus 20 registering a data set.

  First, the user connects to the Web server device 20 from the terminal 40 via the network and requests login authentication. When the user requests registration of electronic data (data set) after the login authentication is completed, the data set to be registered, the data name of the data set, and the user information of the data set are stored in the data control from the application 21. The data is received by the data receiving unit 201 of the unit 22.

  The data receiving unit 201 receives a data set to be registered (registration data 51), user information, 52, and a data name 53, and then passes them to the access authority information acquisition unit 202. The access authority information acquisition unit 202 acquires access authority information about the user from the access level table 304 and the access authority table 305 based on the user information 53 and the data name 53. The access authority information acquisition unit 202 passes the acquired access authority information, the data set to be registered, and the data name to the database search unit 203.

  The database search unit 203 confirms whether the user has a right to register the data set to be registered based on the access authority information. When the database search unit 203 can confirm that the user has the right, the database search unit 203 acquires the item table list 301B, the link correspondence coefficient list 301C, and the encryption correspondence list 301D from the management table 301.

  If the information about the acquired table is encrypted, the database search unit 203 passes the acquired information about the table to the decryption unit 206 to obtain decrypted data. Further, the database search unit 203 passes the decrypted table information, registration data 51, access authority information, and data name 53 to the item table operation unit 204.

  The item table operation unit 204 divides the data set to be registered for each item data, and identifies the item data set to “N: unencrypted” in the encryption correspondence list 301D among the divided item data. To do.

  In addition, the item table operation unit 204 specifies a corresponding item table 302 from a plurality of previously created item tables 302 using the specified item data, and sets the key value 302A of the specified item table 302. get. The “corresponding item table 302” means, for example, an item table in which item data of the same type as the specified item data is registered.

  Then, the item table operation unit 204 calculates the link number by dividing the value registered in the acquired key value 302A by the coefficient corresponding to the identified item data, and the same link number as the calculated link number Determine if there is a dataset with. In addition, the item table operation unit 204 passes the determination result to the data registration unit 207.

  When the item table operation unit 204 determines that electronic data does not exist, the data registration unit 207 assigns the previously calculated link number. Then, for each item table 302, the data registration unit 207 multiplies the numbered link number by a coefficient corresponding to each item data, and registers the obtained key value 302A in the corresponding item table 302.

  Further, the data registration unit 207 encrypts the item data by the encryption unit 205 if necessary based on the list indicating encryption or non-encryption of the item data acquired from the encryption correspondence list 301D. Registered item data. Subsequently, the data registration unit 207 registers a link number in the combination information table 303 and, in addition, registers a list of key values obtained by multiplying the link number and the coefficient.

[System configuration: Data search processing]
Subsequently, each part constituting the Web server device 20 will be described more specifically along with the processing when the Web server device 20 searches for a data set.

  First, the user connects to the Web server device 20 from the terminal 40 via the network and requests login authentication. After the login authentication is completed, in order to search for data registered in the database device 30, the user uses search data (for example, item data) 54, user information 52, and a data name 53 of a data set including the search data. input. As a result, the search data 54, the user information 52, and the data name 53 are delivered from the terminal 40 to the data receiving unit 201 of the data control unit 22 via the application 21.

  The data receiving unit 201 receives the search data 54, user information 52, and data name 53, and then passes them to the access authority information acquiring unit 202. The access authority information acquisition unit 202 acquires access authority information about the user from the access level table 304 and the access authority table 305 based on the user information. The access authority information acquisition unit 202 passes the acquired access authority information, the search data 54, and the data name 53 to the database search unit 203.

  The database search unit 203 confirms whether the user has the right to search the search data based on the access authority information. When the database search unit 203 can confirm that the user has the right, the database search unit 203 acquires the item table list 301B, the link correspondence coefficient list 301C, and the encryption correspondence list 301D from the management table 301.

  If the information about the acquired table is encrypted, the database search unit 203 passes the acquired information about the table to the decryption unit 206 to obtain decrypted data. Further, the database search unit 203 passes the decrypted table information, search data, authority information, and data name to the item table operation unit 204.

  The item table operation unit 204 confirms whether the item table 302 corresponding to the input search data is an encryption target based on the encryption correspondence list 301D. Then, if the result of the confirmation indicates that the item table operation unit 204 is not an encryption target, the item table operation unit 204 searches the corresponding item table 302 using the search data. On the other hand, the item table operation unit 204 searches the corresponding item table 302 after converting the search data into an encrypted character string when it is a target of encryption as a result of the confirmation.

  Subsequently, the item table operation unit 204 divides the key value 302A of the item table 302 specified by the search by the corresponding coefficient in the link correspondence coefficient list 301C, and acquires the link number. Then, the item table operation unit 204 passes the data name 53, information about the table, access authority information, and the acquired link number to the data combination unit 208.

  First, the data combining unit 208 specifies a key value for each item data of the data set including the search data based on the link number specified by the item table operation unit 204. In addition, the data combining unit 208 acquires each item data of the data set including the search data from the item table registered in the database device 30 using the specified key value, and combines the acquired item data. .

  Specifically, the data combination unit 208 searches the combination information table 303 by the data name and the link number, and acquires the key value list 303C. Next, the data combining unit 208 searches each item table 302 for each value constituting the acquired key value list within the set authority range. Thereby, the other item data which comprises the same data set as search data are acquired.

  Further, the data combining unit 208 causes the decryption unit 206 to decrypt the data according to the contents of the encryption correspondence list 301D, if necessary, and sets the obtained item data to 1 in accordance with the arrangement method set in the original data set. The obtained data set is delivered to the return unit 209. Thereafter, the return unit 209 returns the received data set to the application 21.

[System operation]
Next, the operation of the electronic data management system 10 according to the embodiment of the present invention will be described with reference to FIGS. In the present embodiment, the electronic data management method is implemented by operating the electronic data management system 10. Therefore, the description of the electronic data management method in the present embodiment is replaced with the following description of the operation of the electronic data management system 10. In the following description, FIGS. 1 to 7 are referred to as appropriate.

[System operation: Data registration processing]
First, the operation of the electronic data management system at the time of data registration will be described with reference to FIG. FIG. 8 is a flowchart showing an operation at the time of data registration of the electronic data management system in the embodiment of the present invention.

  First, when the user connects to the Web server apparatus 20 from the terminal 40 via the network and requests login authentication of the system, the application 21 of the Web server apparatus 20 executes login authentication (step S101).

  Next, in the Web server device 20, when the login authentication is completed, the application 21 displays a data registration screen on the display screen of the terminal 40 (step S102). When the user inputs each item data, user information 52, and data name 53 on the display screen of the terminal 40, the terminal 40 displays a data set (registration data 51) composed of each item data, and user information 52. The data name 53 is transmitted to the application 21.

  The application 21 receives the registration data 51, user information 52, and data name 53 transmitted. In addition, the application 21 delivers the received registration data 51, user information 52, and data name 53 to the data control unit 22 (step S103).

  Next, the data control unit 22 starts a data set registration process (step S104). Specifically, in step S104, the data receiving unit 201 receives the registration data 51, the user information 52, and the data name 53, and passes them to the access authority information acquisition unit 202.

  Next, the access authority information acquisition unit 202 searches the access level table 304 and the access authority table 305 based on the user information 52, and acquires access authority information about the user (step S105). The access authority information acquisition unit 202 passes the acquired access authority information, the registration data 51, and the data name 53 to the database search unit 203.

  Next, the database search unit 203 searches the management table 301 using the data name 53, and acquires the item table list 301B, the link correspondence coefficient list 301C, and the encryption correspondence list 301D (step S106). In step S106, the database search unit 203 passes information about the acquired table to the decryption unit 206 as necessary to obtain decrypted data. In addition, the database search unit 203 passes information on the table, registration data 51, access authority information, and data name 53 to the item table operation unit 204.

  Next, the item table operation unit 204 divides the registration data 51 for each item data (step S107). Further, the item table operation unit 204 uses the item data to search the item table 302 to which the name described in the item table list 301B is given (step S108).

  Next, the item table operation unit 204 determines whether or not the registration data has already been registered based on the search result in step S108 (step S109). If the registration data is already registered as a result of the determination in step S109 (Yes in step S109), the return unit 209 returns an error notification to the user via the application 21 (step S111).

  On the other hand, if the result of determination in step S109 is that registration data has not yet been registered (No in step S109), the encryption unit 205 executes encryption of item data that requires encryption according to the encryption correspondence list 301D ( Step S110).

  Next, the data registration unit 207 assigns a link number for linking each item data, and performs multiplication for each item data using each coefficient and link number described in the link correspondence coefficient list 301C. The key value is obtained by executing (step S112).

  Next, the data registration unit 207 registers the key value obtained by multiplication and the corresponding item data in the corresponding item table 302 (step S113). Thereafter, the data registration unit 207 registers the data name 53, the link number, and the data obtained by encrypting the list of calculated key values in the combined information table 303 (step S114). After step S114 ends, the data registration process in the data control unit 22 ends.

[System operation: Data search processing]
Next, the operation of the electronic data management system at the time of data search will be described with reference to FIG. FIG. 9 is a flowchart showing an operation at the time of data search of the electronic data management system in the embodiment of the present invention.

  First, when a user connects to the Web server device 20 via the network from the terminal 40 and requests login authentication of the system, the application 21 of the Web server device 20 executes login authentication (step S201). Step S201 is the same processing as step S101 shown in FIG.

  Next, in the Web server device 20, when the login authentication is completed, the application 21 displays a search screen on the display screen of the terminal 40 (step S202). When the user inputs search data (item data) 54, user information 52, and data name 53 on the display screen of the terminal 40, the terminal 40 displays the search data (item data) 54, user information 52, And the data name 53 is transmitted to the application 21.

  The application 21 receives the search data 54, the user information 52, and the data name 53 that have been transmitted. Further, the application 21 delivers the received search data 54, user information 52, and data name 53 to the data control unit 22 (step S203).

  Next, the data control unit 22 starts a search process based on the search data (step S204). Specifically, in step S <b> 204, the data receiving unit 201 receives the search data 54, user information 52, and data name 53 and passes them to the access authority information acquisition unit 202.

  Next, the access authority information acquisition unit 202 searches the access level table 304 and the access authority table 305 based on the user information 52 and the data name 53, and acquires access authority information about the user ( Step S205). Step S205 is the same processing as step S105 shown in FIG. The access authority information acquisition unit 202 passes the acquired access authority information, the search data 54, and the data name 53 to the database search unit 203.

  Next, the database search unit 203 searches the management table 301 using the data name 53, and acquires the item table list 301B, the link correspondence coefficient list 301C, and the encryption correspondence list 301D (step S206). Step S206 is the same processing as step S106 shown in FIG. Also in step S206, the database search unit 203 passes information about the acquired table to the decryption unit 206 as necessary to obtain decrypted data. Further, the database search unit 203 passes information on the table, search data 54, access authority information 52, and data name 53 to the item table operation unit 204.

  Next, when a plurality of item data is included in the search data 54, the item table operation unit 204 divides the search data 54 for each item data (step S207). Subsequently, the item table operation unit 204 determines whether the item table 302 corresponding to the search data is an encryption target based on the encryption correspondence list 301D (step S208).

  As a result of the determination in step S208, if the item is to be encrypted (step S208 Yes), the item table operation unit 204 causes the encryption unit 205 to encrypt the search data (step S209), and the encrypted search. Using the data, the corresponding item table is searched (step S210). On the other hand, as a result of the determination in step S208, if it is not the object of encryption (step S208 Yes), the corresponding item table is searched using the search data as it is (step S210).

  Next, the item table operation unit 204 divides the key value 302A of the searched item table 302 by the corresponding coefficient in the link corresponding coefficient list 301C to calculate a link number (step S211). In addition, the item table operation unit 204 passes the data name 53, information about the table, access authority information, and the acquired link number to the data combining unit 208.

  Next, the data combining unit 208 searches the combined information table 303 using the data name 53 and the calculated link number, and specifies the corresponding key value list 303C (step S212). In addition, when the identified key value list 303C is encrypted, the data combination unit 208 causes the decryption unit 206 to perform decryption.

  Next, the data combining unit 208 confirms the search right 305B acquired from the access right table 305, and specifies item data described therein. Then, the data combining unit 208 searches the entire item table 302 corresponding to the specified item data using the key value acquired in step S212, and specifies item data corresponding to the search data 54. Further, the data combining unit 208 sets the identified item data as one data set (step S213).

  In step S213, the data combination unit 208 checks whether the specified item data is an encryption target in the encryption correspondence list 301D. Is decrypted.

  Thereafter, when the data combination unit 208 passes the data set to the return unit 209, the return unit 209 returns the received data set to the application 21 (step S214). After step S214 ends, the data search process in the data control unit 22 ends.

  As described above, according to the present embodiment, the identifier for uniquely managing electronic data can be concealed, so that the uniqueness of information can be lost when viewed in item data units. . Further, according to the present embodiment, since the data itself divided in the item data unit can be encrypted as necessary, the meaning of the item data alone can be lost. Furthermore, according to the present embodiment, since the access authority of the user can be defined in detail, it becomes possible to control the information to be provided in the application that uses the information.

  The program in the embodiment of the present invention may be a program that causes a computer to execute steps S101 to S114 shown in FIG. 8 and steps S201 to S214 shown in FIG. By installing and executing this program on a computer, the Web server device 20 in the present embodiment can be realized. Thereby, the electronic data management system 10 in the present embodiment can be constructed.

  In the above case, the CPU (Central Processing Unit) of the computer includes a data receiving unit 201, an access authority information acquisition unit 202, a database search unit 203, an item table operation unit 204, an encryption unit 205, a decryption unit 206, and a data registration unit. 207, functions as a data combination unit 208, and a return unit 209 to perform processing.

  Here, a computer that realizes the Web server device 20 by executing the program according to the present embodiment will be described with reference to FIG. FIG. 10 is a block diagram illustrating an example of a computer that implements the Web server device according to the embodiment of the present invention.

  As shown in FIG. 10, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These units are connected to each other via a bus 121 so that data communication is possible.

  The CPU 111 performs various calculations by developing the program (code) in the present embodiment stored in the storage device 113 in the main memory 112 and executing them in a predetermined order. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the program in the present embodiment is provided in a state of being stored in a computer-readable recording medium 120. Note that the program in the present embodiment may be distributed on the Internet connected via the communication interface 117.

  Specific examples of the storage device 113 include a hard disk and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and an input device 118 such as a keyboard and a mouse. The display controller 115 is connected to the display device 119 and controls display on the display device 119. The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, and reads a program from the recording medium 120 and writes a processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.

  Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash) and SD (Secure Digital), magnetic storage media such as a flexible disk, or CD-ROM (Compact Disk). Optical storage media such as Read Only Memory).

  Next, Example 1 of the electronic data management system in the above-described embodiment will be described with reference to FIGS. FIG. 11 is a diagram illustrating an example of personal information data used as registration data in the first embodiment. FIG. 12 is a diagram illustrating an example of an access level table registered in the database apparatus in the first embodiment. FIG. 13 is a diagram illustrating an example of an access authority table registered in the database apparatus in the first embodiment. FIG. 14 is a diagram illustrating an example of a management table registered in the database apparatus in the first embodiment.

  FIG. 15 is a diagram illustrating a format of an item table registered in the database device in the first embodiment. FIG. 16 is a diagram illustrating a correspondence list of item data and item tables registered in the database apparatus in the first embodiment. FIG. 17 is a diagram illustrating an example of an item table registered in the database apparatus in the first embodiment. FIG. 18 is a diagram illustrating an example of the combined information table registered in the database device in the first embodiment.

  In the first embodiment, the case where the data registration process is executed in the electronic data management system will be described in detail with an actual example. Further, the following description will be made along the flow shown in FIG. 8 with reference to FIG.

[Step S101]
First, when the user connects to the Web server apparatus 20 from the terminal 40 via the network and requests login authentication of the system, the application 21 of the Web server apparatus 20 executes login authentication.

[Step S102]
Next, when the login authentication is completed, the application 21 displays a data registration screen on the display screen of the terminal 40.

[Step S103]
On the screen of the terminal 40, for example, the user inputs personal information data A300 shown in FIG. 11 as registration data, inputs “level 1” as user information, and further sets “PERSONAL” as the data name 53. input. When the terminal 40 transmits these data to the Web server device 20, the application 21 receives the transmitted data. In the Web server device 20, the application 21 delivers the transmitted personal information data, user information 52, and data name 53 to the data control unit 22.

[Step S104]
Next, the data control unit 22 starts a registration process. Specifically, the data receiving unit 201 receives the human information data A301, the user information “level 1”, and the data name “PERSONAL”, and passes them to the access authority information acquiring unit 202.

[Step S105]
Next, the access authority information acquisition unit 202 searches the access level table A304 shown in FIG. 12 using the user information “level 1” and the data name “PERSONAL”, and acquires “TBL_NM_1” as the authority name. .

  Subsequently, the access authority information acquisition unit 202 uses the acquired authority name “TBL_NM_1” to search the authority name column of the access authority table A305 illustrated in FIG. Thereby, the access authority information acquisition unit 202 acquires access authority information. Specifically, the access authority information acquisition unit 202 sets “encryption (TA; TB; TC; TD; TE; TF; TG; TH; TI; TJ)” as a search right and “Y” as an input right. , “Y” is acquired as the update right, and “Y” is acquired as the deletion right. Further, the access authority information acquisition unit 202 passes the acquired access authority information, the personal information data A301, and the data name “PERSONAL” to the database search unit 203.

[Step S106]
Next, the database search unit 203 uses the data name “PERSONAL” to search the data name column of the management table A301 shown in FIG. As a result, the database search unit 203 uses the encrypted item table list “encryption (TA; TB; TC; TD; TE; TF; TG; TH; TI; TJ)” and the link correspondence coefficient list “encryption. (3; 5; 7; 9; 11; 13; 15; 17; 19; 21) "and the encryption correspondence list" Encryption (Y; Y; N; N; N; N; N; N; Y; Y ) ”.

  Since the acquired data is encrypted, the database search unit 203 passes information about the acquired table to the decryption unit 206 to obtain decrypted data. Further, the database search unit 203 passes information on the table, personal information data A 301, access authority information, and data name “PERSONAL” to the item table operation unit 204.

[Step S107]
Subsequently, the item table operation unit 204 divides the personal information data A300 for each item data along the “correspondence list between item data and item table” shown in FIG.

[Step S108]
Next, the item table operation unit 204 searches for each item table shown in FIG. 17 using the item data, and selects the item table assigned the name described in the item table list (see FIG. 14). Identify.

  Each item table shown in FIG. 17 is given a name described in the item table list shown in FIG. Further, each item table shown in FIG. 17 is defined in the form of an item table A302 shown in FIG.

[Steps S109 and S111]
Next, the item table operation unit 204 determines whether the registration data has already been registered based on the search result of step S108. As a result of the determination, if the registration data has already been registered, the return unit 209 returns an error notification to the user via the application 21.

[Step S110]
On the other hand, as a result of the determination, if the registration data is not already registered, the encryption unit 205 encrypts each item data according to the encryption correspondence list shown in FIG. In the first embodiment, the encryption unit 205 encrypts “Mr .: AAAA”, “Name: BBBB”, “Card Number: 12345”, and “Date of Birth: 19000101”.

[Step S112]
Next, the data registration unit 207 assigns a link number for linking each item data, and multiplies each coefficient described in the link correspondence coefficient list (see FIG. 14) by the assigned link number. Specifically, for example, if “3” is assigned as the link number, the coefficients described in the link correspondence coefficient list are “3; 5; 7; 9; 11; 13; 15; 17; 19; 21 ", Each is multiplied by" 3 ". As a result, “9; 15; 21; 27; 33; 39; 45; 51; 57; 63” is obtained as the multiplication value.

[Step S113]
Next, as shown in FIG. 17, the data registration unit 207 sets each multiplication value obtained in step S112 as a key value, and registers each item data in a corresponding item table.

[Step S113]
Next, as illustrated in FIG. 18, the data registration unit 207 includes a data name “PERSONAL”, a link number “3”, and a list of calculated key values “9; 15; 21; 27; 33; 39; 45. The information obtained by encrypting “; 51; 57; 63” is registered in the combined information table A303. Thereby, the data registration process in the electronic data management system ends.

  Next, Example 2 of the electronic data management system in the above-described embodiment will be described with reference to FIGS. FIG. 19 is a diagram illustrating an example of a registered data set to be searched in the second embodiment. FIG. 20 is a diagram illustrating an example of an access level table registered in the database apparatus in the second embodiment.

  FIG. 21 is a diagram illustrating an example of an access authority table registered in the database apparatus in the second embodiment. FIG. 22 is a diagram illustrating an example of a management table registered in the database apparatus in the second embodiment. FIG. 23 is a diagram illustrating a correspondence list between item data and item tables registered in the database apparatus in the second embodiment. FIG. 24 is a diagram illustrating an example of an item table registered in the database apparatus in the second embodiment. FIG. 25 is a diagram illustrating an example of the combined information table registered in the database apparatus in the second embodiment.

  In the second embodiment, the case where the data search process is executed in the electronic data management system will be described in detail with an example. Specifically, in the second embodiment, it is assumed that the sales data B300 shown in FIG. 19 is registered in the database device 30 in advance. Further, the following description will be made along the flow shown in FIG. 9 with reference to FIG.

[Step S201]
First, when a user connects to the Web server device 20 via the network from the terminal 40 and requests login authentication of the system, the application 21 of the Web server device 20 executes login authentication.

[Step S202]
Next, when the login authentication is completed, the application 21 displays a search screen on the display screen of the terminal 40.

[Step S203]
In the second embodiment, the user inputs the product name “ABCDEFG” as the search data, “Level 2” as the user information, and “URIAGE” as the data name in the second embodiment. ". When the terminal 40 transmits these data to the Web server device 20, the application 21 receives the transmitted data. In the Web server device 20, the application 21 delivers the received product name “ABCDEFG”, user information “Level 2”, and data name “URIAGE” to the data control unit 22.

[Step S204]
Next, the data control unit 22 starts a search process. Specifically, the data receiving unit 201 receives the product name “ABCDEFG” user information “Level 2” and the data name “URIAGE”, and passes them to the access authority information acquiring unit 202.

[Step S205]
Next, the access authority information acquisition unit 202 searches the access level table B304 shown in FIG. 20 using the user information “Level 2” and the data name “URIAGE”, and acquires “TBL_NM_2” as the authority name. .

  Subsequently, the access authority information acquisition unit 202 searches the authority name column of the access authority table B305 illustrated in FIG. 21 using the acquired authority name “TBL_NM_2”. Thereby, the access authority information acquisition unit 20 acquires access authority information. Specifically, the access authority information acquisition unit 202 uses “encryption (TA; TB; TC; TF)” as a search right, “Y” as an input right, “Y” as an update right, and a delete right. Get each “Y”. Further, the access authority information acquisition unit 202 passes the acquired access authority information, the product name “ABCDEFG”, and the data name “URIAGE” to the database search unit 203.

[Step S206]
Next, the database search unit 203 searches the management table B301 shown in FIG. 22 using the data name “URIAGE”, and obtains an encrypted item table list “TA; TB; TC; TD; TE; TF”. The encrypted link correspondence coefficient list “3; 5; 7; 9; 11; 13” and the encrypted encryption correspondence list “N; Y; Y; N; Y; Y” are acquired.

  In addition, the database search unit 203 passes information about the acquired table to the decryption unit 206 to obtain decrypted data. Further, the database search unit 203 passes information on the table, the product name “ABCDEFG”, the access authority information, and the data name “URIAGE” to the item table operation unit 204.

[Steps S207 and S208]
Next, the item table operation unit 204 determines whether the item table 302 corresponding to the product name “ABCDEFG” that is the search data is an encryption target, based on the encryption correspondence list 301D. In the second embodiment, since the search data does not include a plurality of item data, step S207 is not executed.

[Step S209]
Next, in the second embodiment, the search data is a product name, and the product name is an encryption target as shown in the encryption correspondence list “N; Y; Y; N; Y; Y” (see FIG. 22). Therefore, the item table operation unit 204 determines that it is an encryption target. Therefore, the item table operation unit 204 causes the encryption unit 205 to encrypt the product name “ABCDEFG”.

[Step S210]
The item table operation unit 204 searches the corresponding item table using the encrypted product name. Specifically, as can be seen from the correspondence list between the item data and the item table shown in FIG. 23, the product names exist in the item table TB shown in FIG. Accordingly, the item table operation unit 204 specifies the item table TB as the corresponding item table, and further searches the data column of the item table TB with the encrypted search data “ABCDEFG”, and the key value “15”. To get.

[Step S211]
Next, the item table operation unit 204 calculates the link number by dividing the key value of the searched item table by the corresponding coefficient in the link correspondence coefficient list. Specifically, the item table operation unit 204 describes the key value “15” obtained from the search result in the link correspondence coefficient list “3; 5; 7; 9; 11; 13” (see FIG. 22). The link number “3” is calculated by dividing by the corresponding coefficient. In addition, the item table operation unit 204 passes the data name “URIAGE”, information about the table, access authority information, and the acquired link number to the data combining unit 208.

[Step S212]
Next, the data combining unit 208 searches the combined information table B303 shown in FIG. 25 using the data name “URIAGE” and the link number “3”, and encrypts the key value list “9; 15; 21”. ; 27; 33; 39 ". In addition, the data combination unit 208 causes the decryption unit 206 to decrypt the key value list.

[Step S213]
Next, the data combining unit 208 confirms the search right “TA; TB; TC; TF” (see FIG. 21) acquired in step S205, and identifies the item table described therein. In the second embodiment, the data combining unit 208 identifies the item table TA, the item table TB, the item table TC, and the item table TF illustrated in FIG. Then, the data combining unit 208 performs a search for the identified item table using the key value “9; 15; 21; 27; 33; 39” acquired in step S212.

  As a result, the data combining unit 208 identifies “20100101”, “ABCDEFG”, “A12345”, and “100000” as item data. Further, the data combining unit 208 checks whether or not the specified item data is an encryption target in the encryption correspondence list, and if it is encrypted, causes the decryption unit 206 to decrypt it. Thereafter, the data combining unit 208 sets the identified item data as one data set.

[Step S214]
Thereafter, when the data combination unit 208 passes the data set to the return unit 209, the return unit 209 returns the received data set to the application 21. Thereby, the data search process in the electronic data management system ends.

  As described above, according to the first and second embodiments, the uniqueness of information can be completely lost in units of item data. Thereafter, the original data can be easily restored. As a result, the security of data registered in the database device is further improved.

  Part or all of the above-described embodiments and examples can be expressed by (Appendix 1) to (Appendix 20) described below, but is not limited to the following description.

(Appendix 1)
An electronic data management system for managing a data set including a plurality of item data,
A server device and a database device,
The database device stores a coefficient set that is set in advance for each type of data set and includes a coefficient corresponding to each item data,
The server device
When a data set is input, a database search unit that acquires the coefficient set corresponding to the input data set from the database device based on the type of the input data set;
Numbering a number unique to the input data set, and each item data of the input data set, the number corresponding to the coefficient corresponding to the item data in the acquired coefficient set, A data registration unit, which is registered with a calculated value, and is registered in a separate table in the database device,
An electronic data management system characterized by that.

(Appendix 2)
The server device further includes an item table operation unit,
The item table operation unit includes:
From the database device, specify a table in which item data of the same type as any item data of the input data set is registered,
From the calculated value registered in the identified table and the coefficient corresponding to the item data of the same type, a unique number of the data set including the item data of the same type is specified,
The electronic data management system according to appendix 1, wherein the data registration unit performs numbering based on the number specified by the item table operation unit.

(Appendix 3)
The server device further includes a data combining unit,
When the database search unit is instructed to search for a data set, the database search unit acquires the coefficient set corresponding to the data set to be searched from the database device,
The item table operation unit identifies, from the database device, a table in which any item data of the data set to be searched is registered, the calculated value registered in the identified table, and acquisition From the coefficient corresponding to the item data in the coefficient set is identified a unique number of the data set that is the search target,
The data combination unit specifies the calculated value for each item data of the data set that is the search target based on the unique number specified by the item table operation unit,
Using the identified calculated value, obtain each item data of the data set that is the search target from the table registered in the database device, combine the acquired item data, the search target The electronic data management system according to appendix 2, which is a data set.

(Appendix 4)
The server device further comprises an encryption unit for encrypting all or part of item data included in the input data set;
The electronic data management system according to any one of appendices 1 to 3, wherein the data registration unit registers the encrypted item data in the table in an encrypted state.

(Appendix 5)
The database device further stores access authority information that defines a range of processing that can be executed on the data set for each authority level;
When the authority level is input, the server apparatus acquires access authority information about the input authority level from the database apparatus, and executes processing within a range defined by the acquired access authority information.
The electronic data management system according to any one of appendices 1 to 4.

(Appendix 6)
A server device for managing a data set including a plurality of item data,
When a data set is input, it is set for each type of data set in advance, and the coefficient set including the coefficient corresponding to each item data is stored. A database search unit for obtaining the coefficient set corresponding to the input data set,
Numbering a number unique to the input data set, and each item data of the input data set, the number corresponding to the coefficient corresponding to the item data in the acquired coefficient set, A data registration unit, which is registered with a calculated value, and is registered in a separate table in the database device,
A server device characterized by that.

(Appendix 7)
It further includes an item table operation unit,
The item table operation unit includes:
From the database device, specify a table in which item data of the same type as any item data of the input data set is registered,
From the calculated value registered in the identified table and the coefficient corresponding to the item data of the same type, a unique number of the data set including the item data of the same type is specified,
The server device according to appendix 6, wherein the data registration unit performs numbering based on the number specified by the item table operation unit.

(Appendix 8)
And further comprising a data combination part,
When the database search unit is instructed to search for a data set, the database search unit acquires the coefficient set corresponding to the data set to be searched from the database device,
The item table operation unit identifies, from the database device, a table in which any item data of the data set to be searched is registered, the calculated value registered in the identified table, and acquisition From the coefficient corresponding to the item data in the coefficient set is identified a unique number of the data set that is the search target,
The data combination unit specifies the calculated value for each item data of the data set that is the search target based on the unique number specified by the item table operation unit,
Using the identified calculated value, obtain each item data of the data set that is the search target from the table registered in the database device, combine the acquired item data, the search target The server device according to appendix 7, which is a data set.

(Appendix 9)
An encryption unit for encrypting all or part of item data included in the input data set;
The server apparatus according to any one of appendices 6 to 8, wherein the data registration unit registers the encrypted item data in the table in an encrypted state.

(Appendix 10)
The database device further stores access authority information that defines the scope of processing that can be executed on the data set for each authority level,
When an authority level is input, the database apparatus further includes an access authority information acquisition unit that acquires access authority information about the input authority level,
The database search unit, the data registration unit, the item table operation unit, and the data combination unit execute processing within a range specified by the access authority information acquired by the access authority information acquisition unit.
The server device according to attachment 8.

(Appendix 11)
A method for managing a data set including a plurality of item data,
(A) When a data set is input, the data set is input from a database device that stores a coefficient set that is set in advance for each type of data set and includes coefficients corresponding to each item data. Obtaining the coefficient set corresponding to the input data set based on the type of:
(B) A number unique to the input data set is numbered, and each item data of the input data set is numbered with a coefficient corresponding to the item data in the acquired coefficient set Registered in a separate table in the database device together with the calculated value calculated from the number;
An electronic data management method comprising:

(Appendix 12)
(C) identifying a table in which item data of the same type as any item data of the input data set is registered from the database device;
Further including the step of identifying a unique number of a data set including the same type of item data from the calculated value registered in the identified table and the coefficient corresponding to the same type of item data,
The electronic data management method according to appendix 11, wherein in the step (b), numbering is performed based on the number specified in the step (c).

(Appendix 13)
(D) when a search for a data set is instructed, obtaining the coefficient set corresponding to the data set to be searched from the database device;
(E) Specifying a table in which any item data of the data set to be searched is registered from the database device, the calculated value registered in the specified table, and the obtained coefficient Identifying a unique number of the data set to be searched from the coefficient corresponding to the item data in the set; and
(F) Based on the unique number identified in the step (e), the calculated value for each item data of the data set to be searched is specified, and the specified calculated value is used to Obtaining each item data of the data set as the search target from the table registered in the database device, and combining the obtained item data into the data set as the search target; and ,
The electronic data management method according to appendix 12, further comprising:

(Appendix 14)
(G) further comprising the step of encrypting all or part of the item data included in the input data set;
14. The electronic data management method according to any one of appendices 11 to 13, wherein in the step (b), the encrypted item data is registered in the table in an encrypted state.

(Appendix 15)
The database device further stores access authority information that defines the scope of processing that can be executed on the data set for each authority level,
(H) When an authority level is input, the system further comprises a step of obtaining access authority information about the input authority level from the database device,
The steps (a) to (f) are executed within a range defined by the access authority information acquired in the step (h).
The electronic data management method according to attachment 13.

(Appendix 16)
A program for managing a data set including a plurality of item data by a computer,
In the computer,
(A) When a data set is input, the data set is input from a database device that stores a coefficient set that is set in advance for each type of data set and includes coefficients corresponding to each item data. Obtaining the coefficient set corresponding to the input data set based on the type of:
(B) A number unique to the input data set is numbered, and each item data of the input data set is numbered with a coefficient corresponding to the item data in the acquired coefficient set Registered in a separate table in the database device together with the calculated value calculated from the number;
A program that executes

(Appendix 17)
(C) identifying a table in which item data of the same type as any item data of the input data set is registered from the database device;
A step of identifying a unique number of a data set including the item data of the same type from the calculated value registered in the identified table and a coefficient corresponding to the item data of the same type; Let it run
The program according to appendix 16, wherein in the step (b), numbering is performed based on the number specified in the step (c).

(Appendix 18)
(D) when a search for a data set is instructed, obtaining the coefficient set corresponding to the data set to be searched from the database device;
(E) Specifying a table in which any item data of the data set to be searched is registered from the database device, the calculated value registered in the specified table, and the obtained coefficient Identifying a unique number of the data set to be searched from the coefficient corresponding to the item data in the set; and
(F) Based on the unique number identified in the step (e), the calculated value for each item data of the data set to be searched is specified, and the specified calculated value is used to Obtaining each item data of the data set as the search target from the table registered in the database device, and combining the obtained item data into the data set as the search target; and ,
The program according to appendix 17, wherein the program is further executed by the computer.

(Appendix 19)
(G) further causing the computer to execute a step of encrypting all or part of item data included in the input data set;
The program according to any one of appendices 16 to 18, wherein in the step (b), the encrypted item data is registered in the table in an encrypted state.

(Appendix 20)
The database device further stores access authority information that defines the scope of processing that can be executed on the data set for each authority level,
(H) When an authority level is input, the computer further executes a step of obtaining access authority information about the input authority level from the database device,
The steps (a) to (f) are executed within a range defined by the access authority information acquired in the step (h).
The program according to appendix 18.

  As described above, according to the present invention, the security of data registered in the database can be further improved in the computer system. The present invention is useful for various computer systems using a database.

DESCRIPTION OF SYMBOLS 10 Electronic data management system 20 Web server apparatus 21 Application program 22 Data control part 30 Database apparatus 40 Terminal 51 Registration data 52 User information 53 Data name 54 Search data 110 Computer 111 CPU
112 Main Memory 113 Storage Device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Device 119 Display Device 120 Recording Medium 121 Bus 201 Data Receiving Unit 202 Access Authority Information Obtaining Unit 203 Database Searching Unit 204 Item Table Operation Unit 205 encryption unit 206 decryption unit 207 data registration unit 208 data combination unit 209 return unit 301 management table 302 item table 303 combination information table 304 access level table 305 access authority table

Claims (8)

An electronic data management system for managing a data set including a plurality of item data,
A server device and a database device,
The database device stores a coefficient set that is set in advance for each type of data set and includes a coefficient corresponding to each item data,
The server device
When a data set is input, a database search unit that acquires the coefficient set corresponding to the input data set from the database device based on the type of the input data set;
Numbering a number unique to the input data set, and each item data of the input data set, the number corresponding to the coefficient corresponding to the item data in the acquired coefficient set, A data registration unit, which is registered with a calculated value, and is registered in a separate table in the database device,
An electronic data management system characterized by that. The server device further includes an item table operation unit,
The item table operation unit includes:
From the database device, specify a table in which item data of the same type as any item data of the input data set is registered,
From the calculated value registered in the identified table and the coefficient corresponding to the item data of the same type, a unique number of the data set including the item data of the same type is specified,
The electronic data management system according to claim 1, wherein the data registration unit performs numbering based on the number specified by the item table operation unit. The server device further includes a data combining unit,
When the database search unit is instructed to search for a data set, the database search unit acquires the coefficient set corresponding to the data set to be searched from the database device,
The item table operation unit identifies, from the database device, a table in which any item data of the data set to be searched is registered, the calculated value registered in the identified table, and acquisition From the coefficient corresponding to the item data in the coefficient set is identified a unique number of the data set that is the search target,
The data combination unit specifies the calculated value for each item data of the data set that is the search target based on the unique number specified by the item table operation unit,
Using the identified calculated value, obtain each item data of the data set that is the search target from the table registered in the database device, combine the acquired item data, the search target The electronic data management system according to claim 2, wherein the electronic data management system is a data set. The server device further comprises an encryption unit for encrypting all or part of item data included in the input data set;
The electronic data management system according to claim 1, wherein the data registration unit registers the encrypted item data in the table in an encrypted state. The database device further stores access authority information that defines a range of processing that can be executed on the data set for each authority level,
When the authority level is input, the server apparatus acquires access authority information about the input authority level from the database apparatus, and executes processing within a range defined by the acquired access authority information.
The electronic data management system in any one of Claims 1-4. A server device for managing a data set including a plurality of item data,
When a data set is input, it is set for each type of data set in advance, and the coefficient set including the coefficient corresponding to each item data is stored. A database search unit for obtaining the coefficient set corresponding to the input data set,
Numbering a number unique to the input data set, and each item data of the input data set, the number corresponding to the coefficient corresponding to the item data in the acquired coefficient set, A data registration unit, which is registered with a calculated value, and is registered in a separate table in the database device,
A server device characterized by that. A method for managing a data set including a plurality of item data by a computer ,
(A) When a data set is input, it is input by the computer from a database device that stores a coefficient set that is set in advance for each type of data set and includes coefficients corresponding to each item data. Obtaining the coefficient set corresponding to the input data set based on the type of the input data set;
(B) The computer assigns a number unique to the input data set, and each item data of the input data set is a coefficient corresponding to the item data in the acquired coefficient set. And registering it in a separate table in the database device together with the calculated value calculated from the number assigned and the number;
An electronic data management method comprising: A program for managing a data set including a plurality of item data by a computer,
In the computer,
(A) When a data set is input, the data set is input from a database device that stores a coefficient set that is set in advance for each type of data set and includes coefficients corresponding to each item data. Obtaining the coefficient set corresponding to the input data set based on the type of:
(B) A number unique to the input data set is numbered, and each item data of the input data set is numbered with a coefficient corresponding to the item data in the acquired coefficient set Registered in a separate table in the database device together with the calculated value calculated from the number;
A program that executes

Images