JP5602782B2 - Information provider terminal and information transaction method - Google Patents

Description

The present invention relates to an information provider terminal used in an information transaction system , and in particular personal information (static information such as address, name, age, and sex, profile information such as hobbies and preferences, health / physical condition, action history, etc. An invention related to an information transaction system that provides a mechanism for distributing data on the network of owners and managers, such as all kinds of electronic information related to individuals) and computerized business information held by corporations / organizations such as companies It is. Data that is generated or collected by individuals and corporations targeted by the system of the present invention and considered to have ownership and management rights will be collectively referred to as personal management data.

  Personal information on the network includes specific services such as Amazon (registered trademark) (credit card information, purchase history on the site, etc.), Google (registered trademark) (personal profile, email, schedule, search history, etc.) Accumulated data linked to services provided by providers or specific applications (photographs, GPS logs, pedometer logs, weights in health management applications, changes in body fat percentage, etc.) executed on smartphones and personal computers There are cases in which a part of the archive is provided and an interface is provided for the user's individual, but it is not mutually usable between different services and applications, but individual behavior history data, corporate business data Includes information that is valuable to the third party. Despite to have a mechanism that the administrator of these data causes the cross flow with the principal does not exist at present.

  Personal management data often contains information that is valuable to the third party. Information obtained by statistically processing purchase histories of all products among personal behavior histories is very useful for product development and marketing by companies. In addition, the records of deliveries and operations accumulated for the company by the shipping company and the like include information such as actual road conditions and traffic conditions. Until now, there is a form in which a specific company provides a specific service to individuals, etc., and provides a data archive that collects such information, and a processed analysis of it to a third party for a fee, As an example, Cookpad (registered trademark) provides cooking recipe disclosure and search services to individuals, while collecting collected recipes and search logs and selling them to the food industry (however, to third parties) (There is only a procedure for information distribution, such as information provision, and specific technical elements cannot be confirmed.)

  When distributing (trading) the value of personal management data over a network, with existing methods, the raw data is collected and sold in the form of files, or the raw data or information obtained from the data is in the form of a blog, etc. There are those that are publicly disclosed on the network and get money indirectly through browsing fees or affiliates through advertisements, but access to personal management data is controlled by the data owner (administrator). There is no mechanism for mutual distribution of only the information obtained from.

  In Patent Document 1, a system administrator applies data (which corresponds to a customer name list stored on a trader side in electronic commerce, etc.) into a database of static profile information such as an individual's address, name, and hobby. , We have proposed a method of deleting and selling some columns (names, addresses, etc.) in the database, processing them into the minimum database required by those who want to use the database (other vendors, etc.) .

  In Patent Document 2, for example, distribution of advertisements for individuals in electronic commerce on the Internet, etc., and in the case of distribution of advertisements that match profiles such as personal tastes and preferences, matching of personal information provision level and provision destination A mechanism has been proposed for controlling the personality on the individual side.

  Non-Patent Document 1 defines a mechanism for performing transmission / reception of data between service providers, taking over authentication, and the like by pseudonymizing users based on the specification of Security Association Markup Language (SAML).

Japanese Patent Laid-Open No. 2002-42012 JP 2001-308551 A

SAML Standard Specification Security Assessment Markup Language (SAML) v2.0, OASIS, March 2005 http: // sam. xml. org / sam-specifications http: // www. ieice. org / jpn / books / kaishikiji / 2009/200904. pdf (Japanese commentary)

  Providing personal management data to untrusted parties should be avoided from the viewpoint of preventing leakage of personal information. Whether or not the person is a trusted partner has different standards depending on the individual, and therefore the standards cannot be set uniformly.

  As a countermeasure for this, it may be possible to inquire of the data owner whether or not the personal management data may be provided. However, in this method, the data owner may receive this inquiry many times, and the burden on the data owner becomes heavy.

  Therefore, an object of the present invention is to provide an information transaction system and an information transaction method capable of determining whether or not to make an answer according to the intention of the owner of personal management data.

Information provider terminal of the present invention, in the information provider terminal for information transaction with the information collection terminal, upon receiving the information providing Yi Lai requesting provision of information from the information collection terminal, creditworthiness The credit rating of the information collector terminal is acquired from the credit management record that manages the information, the privacy level of the information requested in the information provision request is acquired from the privacy management record that manages the privacy level of the information, and the credit rating is A credit quality determination unit that determines whether or not the privacy level is lower than the privacy level, and further determines whether or not a difference between the credit level and the privacy level is less than a set value when the credit level is lower than the privacy level. If, when the credit is the difference in the privacy of the low and the credibility than the privacy degree it is less than the set value, the information Hisage The information required by the request and displays that confirms whether to answer to the information collection terminal, a confirmation unit for obtaining an input of whether to answer, input indicating the confirmation unit to answer Is obtained, the privacy level of the information described in the privacy level management record is reduced by a certain value, and when the input indicating that the confirmation unit does not answer is acquired, the privacy level of the information described in the privacy level management record is reduced. A privacy level update unit that increases a certain value, and when the credit rating is equal to or higher than the privacy level, or when the confirmation unit receives an input to answer, collects information requested in the information provision request Answer to the user terminal, when the trustworthiness is lower than the privacy and the difference between the trustworthiness and the privacy is equal to or greater than the set value Or when the confirmation unit obtains the input indicating that no reply, and an answer generator is not performed answers to the information collection terminal.

Information Transactions provider terminal of the present invention, in the information provider terminal for information transaction with the information collection terminal, upon receiving the information providing Yi Lai requesting provision of information from the information collection terminal, Obtaining the credit rating of the information collector terminal from a credit management record for managing credit, obtaining the privacy of the information requested in the information provision request from the privacy management record for managing the privacy of the information, and the credit Is determined to be lower than the privacy level, and if the reliability level is lower than the privacy level, it is further determined whether the difference between the credit level and the privacy level is less than a set value parts and, if the credit rating difference between the privacy of the low and the credibility than the privacy degree is less than the set value, the information The information required by RFI and displays that confirms whether to answer to the information collection terminal, a confirmation unit for obtaining an input of whether to answer, indicating that the confirmation unit to answer When the input is acquired, the reliability of the information collector terminal described in the credit management record is increased by a certain value, and when the input indicating that the confirmation unit does not answer is acquired, the information collector terminal described in the credit management record The credit quality update unit that lowers the credit quality of the information, and when the credit rating is equal to or greater than the privacy level, or when the confirmation unit obtains an input to reply, the information requested in the information provision request Replying to the information collector terminal, when the reliability is lower than the privacy level and the difference between the reliability and the privacy level is greater than or equal to the set value, or the confirmation There when acquiring an input to the effect that no answer, and a answer generating unit does not perform the answer to the information collection terminal.

The information transaction method of the present invention is an information transaction method executed by an information provider terminal that performs an information transaction with an information collector terminal. The credit determination unit requests provision of information from the information collector terminal. When the information provision request is received, the reliability of the information collector terminal is obtained from the credit management record for managing the credit, and the information requested in the information provision request is obtained from the privacy management record for managing the privacy of the information. get the privacy of the creditworthiness determines whether lower than the privacy of, if the credit score is lower than the privacy of further difference between the privacy of the said credit is less than the set value and whether the determined credibility determination procedure or, confirmation section, said the lower and the credit than the credit rating the privacy degree ply If the difference between the sea level is less than the set value, the information providing information requested by the request to display the effect that confirms whether or not respond to the information collection terminal, whether to answer input and confirmation procedure for acquiring the privacy level updating unit, constant Drops privacy level of the information in the privacy level management record and obtaining input to the effect that the answer in the verification procedure, not answered by the verification instructions When an input to the effect is obtained, the privacy update procedure for raising the privacy level of the information described in the privacy level management record by a certain value, and the answer generator, when the credit rating is equal to or higher than the privacy level, or the confirmation When an input for replying in the procedure is acquired, the information requested in the information provision request is answered to the information collector terminal, and the signal is sent. When the degree of privacy is lower than the privacy level and the difference between the trustworthiness level and the privacy level is equal to or greater than the set value, or when an input indicating that the answer is not made in the confirmation procedure is obtained, the information collector terminal An answer generation procedure that does not answer is executed in order.

The information transaction method of the present invention is an information transaction method executed by an information provider terminal that performs an information transaction with an information collector terminal. The credit determination unit requests provision of information from the information collector terminal. When the information provision request is received, the reliability of the information collector terminal is obtained from the credit management record for managing the credit, and the information requested in the information provision request is obtained from the privacy management record for managing the privacy of the information. get the privacy of the creditworthiness determines whether lower than the privacy of, if the credit score is lower than the privacy of further difference between the privacy of the said credit is less than the set value and whether the determined credibility determination procedure or, confirmation section, said the lower and the credit than the credit rating the privacy degree ply If the difference between the sea level is less than the set value, the information providing information requested by the request to display the effect that confirms whether or not respond to the information collection terminal, whether to answer input a verification procedure for acquiring, credit updating unit, constant price increases the credibility of the information collection terminal that is described in the credit management record and obtaining input to the effect that the answer in the verification procedure, not answered by the verification instructions and the information collection terminal creditworthiness of Ru constant Drops credit degree update procedure and obtains the input of effect are described in the credit management record, answer generating unit, if the credibility is the privacy of more, or When an input indicating that a response is made in the confirmation procedure is acquired, the information requested in the information provision request is answered to the information collector terminal, and the credit rating is higher than the privacy level. Answer generation procedure for not responding to the information collector terminal when the difference between the credit rating and the privacy score is not less than the set value, or when an input indicating that no response is made in the confirmation procedure is acquired. and, the order is executed.

  ADVANTAGE OF THE INVENTION According to this invention, this invention can provide the information transaction system and the information transaction method which can determine whether to reply according to the intention of the owner of personal management data.

The schematic diagram of the information transaction system concerning this embodiment is shown. An example of a transaction sequence is shown. Another example of the sequence from the questionnaire performer pseudonym issuance step S201 to the response collection step S206 is shown. An example of the real name record in the transaction support server 30 is shown. An example of the query record in the transaction support server 30 is shown. An example of the transaction record in the transaction support server 30 is shown. The flow of processing from query acquisition to answer creation and reply in the respondent terminal 20 is shown. The functional block diagram of the data access management part 22 and the data storage part 21 which perform a query / answer process is shown. An example of the contents of a query is shown. An example of a condition C template is shown. An example of the template of the process F is shown. An example of the function J determined by the combination of the condition C and the process F is shown. An example of the function J is shown. 4 shows a configuration example of a data processing unit according to a second embodiment. The flowchart of the information transaction method which concerns on Embodiment 2 is shown. An example of a credit management record is shown. An example of a privacy management record is shown.

  Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiments described below are examples of the present invention, and the present invention is not limited to the following embodiments. In the present specification and drawings, the same reference numerals denote the same components.

  The system configuration of the information transaction system according to the present invention includes (1) restricting external access to personal management data, thereby preventing “outflow of raw data” and “specific restricted data retrieval, "Statistics and analysis processing" can be performed safely to extract only valuable information from raw personal management data. (2) Questions (below) , Query) and returning an answer (answer) to the query to realize indirect access to personal management data. (3) At that time, unspecified majority, living in specific target area, specified A mechanism for passing a query anonymously or with a real name to a management entity (individuals, corporations) of a large number of specific personal management data such as the target age group, and (4) providing valuable information It is disclosed from the administrator's point of view and the resistance to the use of personal management data that is referred to in order to be released (corresponding to the degree of privacy infringement), as well as objective information value (information volume, transaction examples, etc.) Value of the subject personal management data itself, and the creditworthiness of the transaction partner (the entity that accesses the personal management data and retrieves the information = the sender of the query) and the transaction (5) The exchange of information value (buying and selling) is executed while ensuring anonymity, and duplicate transactions (identical Consists of a mechanism that prevents anonymous answers from being returned multiple times to the same query issued by the same query issuer for personal management data, and multiple transactions can be made in this way. It is intended to be.

  More specifically, the information collected by an individual electronically is collected and collected for individuals via an anonymous questionnaire, and the compensation is paid to the individual based on the contents of the questionnaire. A system for displaying appropriate advertisements will be described as an example.

(Embodiment 1)
FIG. 1 shows a schematic diagram of an information transaction system according to the present embodiment. The information transaction system according to the present embodiment includes a questionnaire performer server 10 that is an information collector terminal, an answerer terminal 20 that is an information provider terminal, a transaction support server 30, a credit information server 40, and a question distribution server. A query distribution server 50, an answer collection server 60, and a point server 70.

  The questionnaire executor server 10, the respondent terminal 20, the query distribution server 50, and the answer collection server 60 exchange questionnaires and responses, and the transaction support server 30, the credit information server 40, and the point server 70 have credit functions for information transactions and Responsible for the mechanism to solve financial transactions. In addition, the function of the respondent terminal 20 (method of determining the content of the answer and the method of restricting information to be answered), the function of the query distribution server 50 and the answer collection server 60 (maintaining anonymity, distributing a query to a specific number of users, (Recovery function) will be described separately.

  Each element in FIG. 1 will be described. The personal (and corporate) terminal that owns / manages personal management data is the respondent terminal 20 (owned by user A) and sends a query as an information provision request to the personal management data to obtain some information. The terminal that is owned and managed by the main subject is assumed to be the questionnaire executor server 10 (owned by user B). If it explains with a model of a questionnaire, it will be fundamental that a questionnaire implementer gives a reply (answer) to a respondent by giving a questionnaire (query). Since this exchange is assumed to be performed via the network, when the respondent terminal 20 and the survey performer server 10 directly communicate, the respondent terminal 20 and the survey performer server 10 are anonymous from the IP address or the like. It becomes difficult to guarantee the sex. Therefore, in the present invention, the query distribution server 50 that distributes queries and the answer collection server 60 that collects results (answers) are relayed, and the respondent terminal 20 and the surveyor server 10 asynchronously send and receive queries and answers. By exchanging queries and answers, the guarantee of anonymity is strengthened.

  A simple query and answer can be exchanged only by the system including the questionnaire server 10, the respondent terminal 20, the query distribution server 50, and the answer collection server 60. The respondent terminal 20, the query distribution server 50, and the answer collection The server 60 enables a large-scale, high-speed, and anonymous internet questionnaire that is different from the conventional internet questionnaire. In addition to this, the feature of the system configuration according to the present embodiment is that a transaction support server 30, a credit information server 40, and a point server 70 are provided.

<Transaction of information that ensures anonymity>
(1) With the combination of the transaction support server 30 and the credit information server 40, even if the user A and the user B are both anonymous, the trustworthiness of B viewed from A can be confirmed.
(2) With the combination of the transaction support server 30 and the point server 70, the compensation payment (money, points, etc.) from B to A for the information provision by the answer (answer) of the user A to the questionnaire (query) of the user B This is possible while maintaining anonymity.

  FIG. 2 shows an example of a transaction sequence. Before starting the procedure, the real name information of the user A and the real name information of the user B are registered in the transaction support server 30 in advance in different procedures. The information transaction method according to the present embodiment includes an information provision request distribution procedure, an answer procedure, and a point clearing procedure in order. In the information provision request distribution procedure, a questionnaire practitioner pseudonym issue step S201, a questionnaire (query) distribution step S202, a questionnaire (query) acquisition step S203, and a questionnaire response pseudonym acquisition step S204 are executed. To do. In the reply procedure, a reply transmission (answer placement) step S205 and a reply collection (answer collection) step S206 are executed. In the point clearing procedure, the point clearing step S207 is executed.

Questioner issuer pseudonym issuing step (S201)
The questionnaire executor server 10 creates a questionnaire (query) as an information provision request, assigns a query ID (QID) as an identification mark of the information provision request, and together with real name information including the real name of the user B, the transaction support server 30 is requested to issue a pseudonym in this query. The transaction support server 30 confirms the real name registration of B in its own database, generates a temporary name (Ba) of the user B for the query ID (while the query ID is valid), and stores it in the own database. After recording, the pseudonym is returned to the questionnaire executor server 10.

Questionnaire (query) distribution step (S202)
The questionnaire implementer server 10 describes the query ID and the pseudonym of the user B acquired in step S201 in the questionnaire (query), and arranges them in the query distribution server 50 in a state that can be acquired from the respondent terminal 20.

Questionnaire (query) acquisition step (S203)
The respondent terminal of the user A acquires the questionnaire (query) arranged in the query distribution server 50 in step S202, and obtains the query ID and the pseudonym Ba of the user B.

Step for obtaining a pseudonym for answering a questionnaire (S204)
The respondent terminal 20 requests the transaction support server 30 to issue a pseudonym in this query together with the query ID acquired in step S203, the pseudonym Ba of B, and the real name of the user A. The transaction support server 30 confirms the real name registration of A in its own database, generates a temporary name (Aa) of the user A (only while the query ID is valid) for the query ID, and stores it in the own database. After recording, the answer status of the record is set as unanswered, and the same pseudonym Aa is returned to the respondent terminal 20.

Response sending (answer arrangement) step (S205)
The respondent terminal 20 creates an answer to the questionnaire by performing a query process, writes the query ID, the pseudonym of B, and the pseudonym of A, and arranges them in the answer collection server 60. At this time, the contents of the questionnaire (answer), the query ID, the pseudonym of B, and the pseudonym of A can be divided and handled when the electronic signature is given by the user A + (query ID) , B pseudonym, A pseudonym) and (query ID, B pseudonym, A pseudonym) are respectively digitally signed.

Response collection (answer collection) step (S206)
The questionnaire server 10 makes an inquiry to the answer collection server 60 asynchronously, and if a questionnaire (query) corresponding to a combination of (query ID, pseudonym Ba of user B) is arranged (stored), the contents Request acquisition. At that time, the answer collection server 60 extracts (query ID, user B's pseudonym Ba, user A's pseudonym Aa) from the corresponding answer, and requests the transaction support server 30 to check double answers and fraudulent answers. The transaction support server 30 confirms from the (query ID, the pseudonym of the user B, the pseudonym of A) that there is a respondent to the query (exists in the record), and if it does not exist, it is an illegal answer immediately. (NG) is returned to the answer collection server 60. If it exists and the answer status is unanswered, OK is returned to the answer collection server 60, and NG is returned otherwise. When the answer collection server 60 receives NG, it does nothing. As a result, multiple responses due to anonymity (injustice transactions in which an individual impersonates a plurality of people and responds to the same questionnaire multiple times) can be prevented. When the answer collection server 60 receives OK, the answer collection server 60 sends the contents of the questionnaire response to the questionnaire executor server 10, and sends an answer to the transaction support server 30 (query ID, user B pseudonym Ba, user A pseudonym Aa). Tell the content has been delivered. When the transaction support server 30 receives the delivered response, the transaction support server 30 sets the corresponding response count record as answered. At the same time, the transaction support server 30 transmits (query ID, the real name of the user B, the real name of the user A) to the point server 70 and informs that it has been answered.

Point clearing step (S207)
The point server 70 acquires the real name of the user B and the real name of the user A regarding the answered query, and transfers the price designated by the transaction support server 30 from the user B to the user A (such as remittance).

  As described above, the information transaction system according to the present embodiment includes the questionnaire operator server 10, the respondent terminal 20, and the transaction support server 30, and in order to perform step S 201 to step S 205 in order, the anonymity of the questionnaire respondent and the questionnaire operator A questionnaire can be conducted while maintaining Moreover, since the information transaction system which concerns on this embodiment is further provided with the query distribution server 50 and the answer collection | recovery server 60, it can strengthen anonymity maintenance of a questionnaire respondent and a questionnaire implementer. Furthermore, since the information transaction system according to the present embodiment further includes the point server 70, the information transaction (money transaction) is enabled while maintaining the anonymity of the questionnaire respondent.

(Option 1)
The combination of the query ID and the pseudonym Ba of the user B can be substituted by a query hash value H (Ba, QID) that is a hash value calculated by the transaction support server 30 from the two types of information. In this case, the transaction support server 30 stores the hash function obtained by calculating the query hash value together with the query ID and the user B's pseudonym Ba.
Further, the combination of the query ID, the pseudonym Ba of the user B and the pseudonym Aa of the user A can be substituted by a transaction hash value H (Ba, QID, Aa) which is a hash value calculated by the transaction support server from the same three types of information. It is. In this case, the transaction support server 30 stores the hash function obtained by calculating the transaction hash value together with the query ID, the pseudonym Ba of the user B, and the pseudonym Aa of the user A.
In this way, the use of the hash value has an effect that the kana of B and the kana of A are not specified.

(Option 2)
Regarding the transaction conditions for presenting the price of the answer such as the price, the transaction condition recorded in the transaction support server 30 in step S204 is recorded by the user B transmitting to the transaction support server 30 when creating the query in step S201. May be transmitted to the user A and used as a material for answer determination in the respondent terminal 20. Further, at the time of settlement by the point server 70 in step S207, the price can be used according to transaction conditions.

(Option 3)
The surveyor server 10 and the respondent terminal 20 may transmit authentication information such as an electronic signature when accessing each server. Thereby, alteration of the data in each server, such as transaction support server 30, and impersonation to others can be prevented.

(Option 4)
In the sequence shown in FIG. 2, the procedure for acquiring the pseudonyms of the user A and the user B is performed in connection with the query such as the generation of a query. However, the user A and the user B can also acquire the pseudonym independently. It is. FIG. 3 shows an example of the sequence from the questionnaire issuer kana issuance step S201 to the response collection step S206 in this case. In this sequence, steps S301 to S305 are sequentially provided instead of steps S201 to S205 described in FIG. Steps S301 to S304 are executed in the information provision request distribution procedure. In the reply procedure, step S305 is executed.

  In step S301, the questionnaire executor server 10 transmits the real name of the user B to the transaction support server 30, and makes a request for issuing a pseudonym. Transaction support server 30 issues pseudonym Ba of user B and registers it in the database, and returns pseudonym Ba to surveyor server 10. In this sequence, the pseudonym Ba is friendly regardless of whether the query ID is valid.

  In step S <b> 302, the respondent terminal 20 transmits the real name of the user B to the transaction support server 30 and makes a request for issuing a pseudonym. Transaction support server 30 issues pseudonym Aa of user A and registers it in the database, and returns pseudonym Aa to respondent terminal 20. In this sequence, the pseudonym Aa is valid regardless of whether the query ID is valid.

  In step S303, a questionnaire (query) distribution procedure is performed. That is, the questionnaire implementer server 10 describes the query in a state where the query ID and the pseudonym Ba of the user B acquired in step S301 can be acquired from the respondent terminal 20 in the questionnaire (query). To place. Then, the query distribution server 50 transmits the query ID, the pseudonym Ba of the user B, and the transaction conditions to the transaction support server 30. The transaction support server 30 registers the query ID, the pseudonym Ba of the user B, and the transaction conditions in the database.

  In step S304, a questionnaire (query) acquisition procedure is performed. Specifically, the respondent terminal 20 acquires a questionnaire (query) arranged in the query distribution server 50 in step S303, and obtains a query ID, a user B pseudonym Ba, and a transaction condition.

  In step S305, a reply transmission (answer arrangement) procedure is performed. Specifically, the respondent terminal 20 creates an answer to the questionnaire by performing a query process, and arranges it in the answer collection server 60.

  In addition, when the user B acquires the kana independently from the query, that is, when the user B conducts the questionnaire a plurality of times using the kana Ba, the query ID and the kana are not specified so that the user B's kana Ba is not specified. It is preferable to use the query hash value H (Ba, QID) instead of the combination of Ba. In addition, when the user A acquires the kana independently of the query, that is, when the user A answers the questionnaire a plurality of times using the kana Aa, the query ID is set so that the kana Aa of the user A is not specified. It is preferable to use the transaction hash value H (Ba, QID, Aa) instead of the combination of the pseudonym Ba and the pseudonym Aa.

  4, 5, and 6 show the configuration of a database related to transactions in the transaction support server 30. In the transaction support server 30, authentication information such as real names and certificates of users (users A and B) participating in the transaction is registered in advance (FIG. 4). In step S201 shown in FIG. 2 and step S303 shown in FIG. 3, the transaction support server 30 creates and manages a query record that can be uniquely identified by the query ID and the pseudonym of the user B (FIG. 5). Furthermore, when a transaction from the respondent terminal 20 occurs in step S204 shown in FIG. 2 and step S305 shown in FIG. 3 for a specific query described in the record, the query ID, the pseudonym Ba of the user B, the user A transaction unit that can be uniquely identified by A's pseudonym Aa is managed as a transaction record (FIG. 6). The query record and the transaction record related thereto disappear when the query (in the example, a questionnaire) ends.

<Acquisition of credit information>
In step S205 shown in FIG. 2 and step S305 shown in FIG. 3, when the user A creates an answer to the query from the user B, the respondent terminal 20 evaluates the trustworthiness of the user B, and By all means, it is determined what question items (specifically, access to user A's personal management data) are permitted. In the transaction procedure shown above, since the respondent terminal 20 of the user A is not informed of the real name of the user B, the reliability cannot be evaluated based on the real name of the user B.

  Therefore, in this embodiment, the respondent terminal 20 of the user A sends the pseudonym Aa of the user A and the pseudonym Ba of the user B to the credit information server 40, and the credit information server 40 inquires the transaction support server 30 about both pseudonyms. Then, the credit information server 40 obtains the real names of the user A and the user B. The credit information server 40 acquires the credit rating of the user B viewed from the user A from the real name of the user B from a database registered in advance. Then, the credit information server 40 transmits the credit rating of the pseudonym Ba to the respondent terminal 20 of the user A. Thereby, the respondent terminal 20 of the user A can acquire the reliability of the pseudonym Ba.

<Answer generation from queries, means of answering>
FIG. 7 shows the flow of processing from query acquisition to answer creation and answering at the respondent terminal 20. As shown in FIG. 9, the query includes an identification number unique to the query composed of the query ID and the pseudonym Ba of the user B, transaction conditions as the price of the answer, execution conditions indicating the timing of creating the answer, and a question content list. Is described. In the respondent terminal 20, the query can be acquired (received) by a specific service application, but is transferred to the data access management unit 22 in the protected area as it is. In this case, if the query content is not encrypted, the service application can refer to the content. The protected area refers to an area that is separated by software by a system management function such as an OS, can communicate only with a specific API from a service application outside the protected area, and guarantees the independence of internal data. . It can be realized by mutually protected processes and independent virtual machine mechanisms. The data access management unit 22 analyzes the contents of the query and determines whether or not the entire query and each question included in the query can be answered according to the answer policy generated by the policy management unit 23. When it is determined that a reply is possible, the personal management data in the data storage unit 21 is accessed and a query is processed to obtain a reply.

  Here, although the respondent terminal 20 is a mobile communication terminal such as a mobile phone or a smartphone, the data storage unit 21, the data access management unit 22, and the policy management unit 23 are stored in the same housing as the respondent terminal 20. There is no need to be. For example, when the data used by the respondent terminal 20 is distributed and stored in a plurality of terminals, the plurality of terminals serve as the data storage unit 21. Further, when the data used by the respondent terminal 20 is managed by a predetermined management server, the management server serves as the data storage unit 21. Similarly to the data storage unit 21, the data access management unit 22 and the policy management unit 23 may be configured by a plurality of terminals, or may be a predetermined server.

FIG. 8 is a functional block diagram of the data access management unit 22 and the data storage unit 21 that perform query / answer processing.
The query analysis unit 224 performs the following processing on the query acquired from the service management unit 24.

・ If encrypted, remove the encryption.
-If the electronic signature is described in the query, verify the electronic signature.
-Check the format of the entire query.
The query content is matched with a query template 226 prepared in advance, the query score for each item of the query template 226 is acquired, and then converted into a query dedicated to the data storage unit (DB) 21. FIG. 9 shows an example of the contents of the query. The query includes, for example, items of query ID, executor pseudonym, transaction condition, execution condition, question content list, and answer collection server. The query ID describes information for identifying the query. In the performer kana, the pseudonym Ba of the user B is described. In the transaction conditions, the value of the query answer paid from the user B is indicated by a numerical value or the like (Y). The execution condition describes the timing of creating an answer such as a question content calculation and answer generation / answer condition. In the question content list, the question number, its condition C, and processing F are described. The answer collection server describes the answer sending destination.
Transfer the entire converted query to the data processing unit 223.

The data processing unit 223 executes the following processing for the converted query.
The query ID, the user B's pseudonym Ba, and the transaction conditions are extracted and output to the policy management unit 23. As a result, the policy management unit 23 can acquire the query executable score table from the credit information server 40 and determine whether or not the answer is possible.
・ If you want to respond by monitoring the time based on the execution conditions, set a timer. If you respond to specific personal management data conditions, register in the real-time monitoring unit 222. The DB read unit 221 is instructed to convert the list query, and the data storage unit 21 is accessed.
After all the answers to the query are completed, an answer is given to the entire query and sent to the answer generation unit 225. As a result, the answer generation unit 225 places the answer (answer) in the answer collection server 60.

The real-time monitoring unit 222 executes the following processing.
The registered conditions are monitored, and if the conditions are satisfied, the data processing unit 223 is instructed to execute the corresponding query.

The answer generation unit 225 executes the following processing.
-Format the answer format.
When signing or encrypting or signing and encrypting, signing or encrypting or signing and encrypting is executed.
Return the answer to a specific answer collection server 60 according to the answer collection server information.

  The above is the flow of the query / answer process.

  In this embodiment, based on the policy of the individual who should be the manager of the personal information, whether or not to use the personal information calculated from the creditworthiness of the business partner, the data processing method, and the value exchanged with the personal information, Whether or not to use fine-grained data that reflects the individual's intention without providing raw data by managing the raw data only on a personal management computer such as a terminal and arranging the data processing function on the computer Control.

  In addition, the data processing is performed on the respondent terminal 20 without leaking the raw data from the respondent terminal 20, and only the information required by the user B as the trading partner is provided. By having a procedure for determining whether or not to use fine personal data in consideration of the creditworthiness and transaction conditions of a certain user B, information transaction in a form that protects privacy and raw data is realized. In addition, by using real-time monitoring of events that occur sequentially, such as action history, and determining whether the data can be used, it is possible to use data that is predicted to be stored in the future.

  Further, the transaction support server 30 having a procedure for converting the user B on the service provider side into a pseudonym, and managing and converting the pseudonym / real name, and data exchange of a system different from this (meaning that the network and the administrator are different) An intermediate server (corresponding to the query distribution server 50 or the answer collection server 60) is used, and a query ID for identifying only the pseudonym and transaction on the service provider side (here, user B corresponding to the questionnaire executor) is used. Thus, real-time / kana conversion and data transmission / reception are realized asynchronously. This makes it possible to send and receive data and perform transactions (including settlement) without specifying both of them while anonymizing both data senders and receivers.

The effects produced by the invention are as follows.
-Since answers are automatically derived from digital data stored by individuals, there is no interaction with humans, and the accuracy of answers and the speed of questions (amount of questions) are improved.
・ Although it is an automatic answer, the accumulated raw data is not leaked by masking the access means that directly outputs the raw data. In addition, by making it possible to set an operation policy for data in advance, it is possible to prevent provision of information not intended by the owner (individual) of personal management data.
-The right or wrong answer for each question and the contents of the answer can be controlled by the creditworthiness of the subject (such as a company that wants to collect information) and the price of information acquisition.
・ Allows information transactions (money transactions) while maintaining the anonymity of respondents.
・ Prevent multiple responses due to anonymity (illegal transactions by impersonating multiple people and responding to the same questionnaire multiple times).
・ Control the timing of answers and answer questions about future behavior.

<About the mechanism that does not leak raw data>
(1) Data storage (overall configuration)
It is assumed that personal management data is stored in some database. This corresponds to the data storage unit 21 in FIGS. Here, the type of database is not specified. The DB reading unit 221 directly accesses this database and reads data. The DB reading unit 221 generalizes the procedure for retrieving data from the database in the following manner.

・ Read all data corresponding to condition C from the database. A read timeout with a specified time is assumed. The condition C refers to all methods capable of classifying a specific data group in the database and does not depend on the database recording method.

(2) Acquisition of reliability from a pseudonym Restriction of reference by the owner (manager) of the corresponding data is imposed on reading and processing of personal management data in the data storage unit 21. The determination is made based on the trustworthiness (corresponding to a level value indicating the trustworthiness) of the user B who is the source of the query. Therefore, the policy management unit 23 transmits the pseudonym Ba of the query issuer to the credit information server 40, and acquires the level value of the credit recorded in advance in the credit information server 40. At this time, the conversion from the pseudonym to the real name is executed between the credit information server 40 and the transaction support server 30 by resolving the pseudonym and the real name.

(3) How to read and process the stored data (processing flow)
The query is received by the query analysis unit 224, and the content is analyzed. The query analysis unit 224 extracts the following information described in the query.
-Query executor (a pseudonym)
・ Transaction conditions (offer price)
・ Execution conditions / Question list (question items)
-Answer collection server information

Among these pieces of information, in accordance with the question content list, in accordance with the query template, the DB read unit 221 is instructed to read data, the specified processing is executed on the obtained result data, and the result for the question content is obtained. Get. At this time, the process is generalized as follows.
The DB reading unit 221 reads all data corresponding to the condition C from the database. FIG. 10 shows an example of the condition C template. The template of the condition C is a database command, for example, a command string such as SQL. By referring to the template of condition C, a code predetermined as a search condition can be converted into a database command. As a result, it is possible to prevent a search condition keyword from leaking on the network.
The data processing unit 223 performs the process F on the data read by the DB reading unit 221 and obtains the result R. FIG. 11 shows an example of the template for the process F. The template of the processing F is a processing method. For example, the data group corresponding to the condition C is subjected to statistical processing such as average, variance, maximum value, minimum value, etc. Refers to ambiguity processing such as conversion to the address of a prefecture (such as a prefecture unit or East or West Japan). By referring to the template of the process F, it is possible to convert a code predetermined as the calculation process into a processing method. As a result, it is possible to prevent a situation where calculation processing leaks on the network.

At this time, the following two methods are used together as a method for limiting the content of the answer to the query.
Limit the condition C of data read from the database. Specifically, the read for a specific attribute is rejected.
Limit the processing F to be performed on the read data.
Hereinafter, the restriction method will be described.

(4) Data reading restriction method and data processing restriction method Each item in the question content list is designated by a combination of processing F to be performed on a data group that meets the condition C. The determination as to whether or not to execute the question content is performed by reading a function J for a determination registered in advance determined by a combination of the condition C and the process F as shown in FIG. For example, the condition J that matches the condition C is selected from the conditions C1 to Cp, the process that matches the process F is selected from the processes F1 to Fq, and the function J defined by the combination of the selected condition and the process is selected. Are extracted from the functions J11 to Jpq. FIG. 13 shows an example of the function J. Function J is a function of transaction conditions and query issuer's creditworthiness, and presents the result of processing F1 to Fq on the data group corresponding to conditions C1 to Cp to the query sender of credit rating X It returns whether or not it is possible to reply with transaction conditions Y such as price.

Data read by the DB read unit 221 restricts the designation of the condition C for selecting data to be accessed using a preset template.
A list corresponding to the condition C that can be used by the query executor is set in the template for the condition C, and the question content that uses the condition C that is not in the list is not executed.
At the same time, for the combination of processing F with respect to the condition C, a function J for determining whether processing is possible and the level that can be executed is read out using a template as shown in FIG.
In response to questions that can be answered, the DB reading unit 221 reads from the database and the data processing unit 223 executes processing according to the condition C and processing F to which each question answer corresponds. Result R (s) is created.

(5) Data output When the answer generation unit 225 obtains answers to all questions that can be answered from the data processing unit 223, the answer R is transferred as an answer (file) to the answer collection server 60 specified in the query. .

(6) Method of controlling execution of data access and output based on condition matching The processing for preventing the raw data from the above (1) to (5) from being leaked is performed with respect to the query received by the respondent terminal 20 This is a series of processes for determining whether or not to answer and returning an answer. In this case, the process from the reception of the query to the answering of the answer is continuously executed, but the calculation of the answer to the question and the answering answer can be controlled by the execution condition described in the query.

The personal management data stored in the data storage unit 21 is recorded in a time series like a life log, or is recorded for each event, and additional data is sequentially updated. ing. This data update is monitored by the real-time monitoring unit 222, and when the updated content matches a specific condition, an answer to the question content and a reply for creating an answer are executed. For question items to be evaluated in real time, whether or not execution is possible is evaluated by the method of (4), and if possible, condition matching and processing are performed on data updated by the real time monitoring unit. For real-time monitoring, “is real-time monitoring” is added to the conditions.
This real-time monitoring is executed when an execution condition item is specified in the query.

As described above, taking the questionnaire system as an example, the system and method according to the present embodiment have the following effects.
-Since answers are automatically derived from digital data stored by individuals, there is no interaction with humans, and the accuracy and speed of answers (question amount) are improved.
-Since the process F is performed, the raw data accumulated in the data storage unit 21 does not flow out.
Since the function J is read and it is determined whether or not the question can be answered, it is possible to prevent provision of unintended information by the individual management data holder (individual).
-The right or wrong answer for each question can be controlled by the creditworthiness of the entity that conducts the questionnaire (such as a company that wants to collect information) and the suggested price for information acquisition.
・ Allows information transactions (money transactions) while maintaining the anonymity of respondents.
・ Prevent multiple responses due to anonymity (illegal transactions by impersonating multiple people and responding to the same questionnaire multiple times). You can answer questions about future behavior by controlling the timing of the answers.

(Embodiment 2)
The information transaction system according to the present embodiment is characterized in that the data access management unit 22 determines whether to make a reply according to the intention of the user A. In this embodiment, for the sake of simplicity, the processing according to this embodiment is performed instead of the data reading restriction method and the data processing restriction method described with reference to FIG. 12 in the first embodiment.

  FIG. 14 shows a configuration example of the data processing unit according to the present embodiment. The data processing unit 223 includes a credit determination unit 31, a confirmation unit 32, a record update unit 33, and a query processing unit 34. FIG. 15 shows a flowchart of the information transaction method according to the present embodiment. The information transaction method according to the present embodiment sequentially includes a credit determination procedure, a confirmation procedure, a privacy update procedure, and an answer processing procedure. In the credit determination procedure, steps S401 to S402 are executed. In the confirmation procedure, step S403 is executed. In the privacy level update procedure, step S404 or S406 is executed. In the reply processing procedure, step S405 or S407 is executed.

  In step S401, the credit quality determination unit 31 inquires of the credit information server 40 about the credit level X of the pseudonym Ba and inquires about the privacy level Z of the information requested in the information provision request. The credit information server 40 queries the transaction support server 30 for the real name of the pseudonym Ba, acquires the real name B, and acquires the credit rating X of the real name B with reference to the credit management record. In addition, the credit information server 40 refers to the privacy level management record and acquires the privacy level Z of the information i requested in the information provision request. Then, the credit information server 40 transmits the credit level X of the pseudonym Ba and the privacy level Z of the information i to the credit level determination unit 31.

  FIG. 16 shows an example of the credit management record. FIG. 17 shows an example of the privacy level management record. In the credit management record, the credit rating X of each information collector is recorded together with the real name of the information collector. In the privacy level management record, the privacy level Z of information stored as personal management data is recorded for each type of information. The privacy level Z is, for example, high when the information type i is the name of the user A, and low when the information type i is a hobby. The reliability degree X and the privacy degree Z recorded in these records are digitized and can be set from the respondent terminal 20.

Next, the reliability determination unit 31 determines whether or not the reliability X of the transmission source of the information provision request is lower than the privacy level Z of the information.
If X ≧ Z, the creditworthiness determination unit 31 outputs an answer to the query processing unit 34 and proceeds to step S405.
On the other hand, if X <Z, the creditworthiness determination unit 31 proceeds to step S402.

In step S402, the trustworthiness determination unit 31 calculates a difference between the trustworthiness X and the privacy degree Z, and determines whether or not the difference is less than a predetermined set value.
If the difference is greater than or equal to the set value, the trustworthiness determination unit 31 outputs a message indicating that no answer is given to the query processing unit 34 and proceeds to step S407.
On the other hand, when the difference is less than the set value, the trustworthiness determination unit 31 outputs the trustworthiness X of the user Ba and the requested information to the confirmation unit 32, and the process proceeds to step S403.

  In step S403, the confirmation unit 32 outputs the reliability of the user Ba and the requested information to a display unit (not shown) of the respondent terminal 20. As a result, a confirmation message is displayed on the display unit. The confirmation message includes the information collector's trustworthiness X and information i, asking whether or not to provide information. The user A inputs to the respondent terminal 20 whether or not to reply based on the confirmation message. When the input to the effect that the confirmation unit 32 answers is obtained, the process proceeds to step S404. When the input indicating that the confirmation unit 32 does not answer is acquired, the process proceeds to step S406.

  In step S404, the record updating unit 33 lowers the privacy level Z of the requested information by a certain value, and among the privacy levels stored in the credit information server 40, the privacy level of the information i input when the user A responds. Update. For example, when the privacy level is 20 levels from level 1 to level 20, the privacy level is lowered by level 1.

  In step S <b> 405, the query processing unit 34 performs processing according to the question content list condition C and processing F described in the query, and outputs the processing result to the answer generation unit 225.

  In step S406, the record update unit 33 raises the privacy level Z of the requested information by a certain value, and among the privacy levels stored in the credit information server 40, the record i of the information i that is input by the user A is not answered. Update the privacy level. For example, when the privacy level is 20 levels from level 1 to level 20, the privacy level is increased by level 1.

  In step S407, the query processing unit 34 outputs to the answer generation unit 225 that the question content list described in the query is not processed.

  The above is the flow of the information transaction method according to the present embodiment. The information transaction method according to the present embodiment confirms whether or not the information can be disclosed to the user A who is the information owner when the credit rating X of the user B is close to the privacy Z of the information. . At this time, if the user A accepts the disclosure, the privacy level of the information is slightly lowered. If you refuse, raise the privacy of the information.

Considering the data reading restriction method and the data processing restriction method described with reference to FIG. 12 in the first embodiment, the following is a generalization.
The privacy level of the requested information i is priv (i), the reliability of the information requester B is cred (B), the value of the information is pri (i, cred (B)), and the user B's Let the offer price be p. Further, ε is the difference when asking the user A whether or not disclosure is possible, and ν is the updated value. In this case, ν is sufficiently smaller than ε.

  In step S401, it is determined whether or not an answer is made using the function J as described in FIGS. 12 and 13 instead of comparing the trustworthiness level X and the privacy level Z.

  At this time, it is determined whether or not to answer depending on whether or not the value pri (i, cred (B)) of the information determined by the reliability X of the user B and the privacy of the information i is equal to or higher than the user B's suggested price p. May be. In this case, if pri (i, cred (B)) <p, information is not passed unconditionally to the other party. Here, pri (i, cred (B)) represents the value of the information i with respect to the credit Cred (B) of the user B. In general, the higher the trustworthiness of the user B, the lower the value of information, and the lower the trustworthiness, the higher the value of information.

  Next, if | priv (i) -cred (B) | <ε in step S402, the process proceeds to step S403, and the information owner is asked whether or not to pass i information to user B. If B is anonymous, it asks user B who has credit of credit (B) whether to pass i information.

  If the user A passes the information i, the privacy level priv (i) of the information is updated to priv (i) -ν (S404). On the contrary, if the user A does not pass the information i, the privacy level priv (i) of the information is updated to priv (i) + ν (S406).

  If the user B is not anonymous, the credit degree cred (B) of the user B may be updated in step S404 and step S406. In this case, in step S404, the credibility cred (B) of the user B is updated to cred (B) + ν. On the other hand, if the owner does not pass the information i, the credit Cred (B) of the user B is updated to cred (B) -ν in step S406.

When B is anonymous, ε may be a function determined by the information i and the current time t. For example, if the time when the information respondent answered the question about the information i at the respondent's terminal is T _i , if ε is gradually increased as the value of t−T _i increases, When a certain amount of time has passed since the last inquiry regarding certain information i, it is confirmed again whether or not information is to be passed to the user. By doing so, it becomes possible to confirm to the respondent whether there is any change in the privacy level of the information at regular intervals.

  If the user B is not anonymous, both the privacy level priv (i) of information and the credit level cred (B) of the user B may be updated in steps S404 and S406. In this case, if the user B requests the same information i many times and the user A accepts the disclosure, the difference between cred (B) and priv (i) increases by 2ν each time the disclosure is accepted. Therefore, after the n-th time when 2nν> ε, the present system does not ask the user A the same thing, and automatically determines whether or not to allow disclosure of information to the other party. By repeating this operation, the privacy level of each information and the trustworthiness of each information collector are automatically corrected, and more appropriate processing can be automatically performed without bothering the user A.

When B is not anonymous, ε may be a function determined by the user B and the current time t. For example, if the time information respondents were answers questions about the user B in the respondent's terminal, or the last time there was a user B and exchanges and T _B, increasing the ε value of t-T _B If the time is increased gradually according to the above, after a certain amount of time has passed since the last inquiry, it is confirmed again whether or not to pass information to the user. By doing so, it becomes possible to confirm to the respondent whether there is a change in the reliability of the other party at regular intervals.

  The present invention can be applied to the information communication industry.

10: Questionnaire server 20: Respondent terminal 21: Data storage unit 22: Data access management unit 23: Policy management unit 24: Service management unit 221: DB reading unit 222: Real-time monitoring unit 223: Data processing unit 224: Query Analysis unit 225: Answer generation unit 226: Query template 30: Transaction support server 31: Credit determination unit 32: Confirmation unit 33: Record update unit 34: Query processing unit 40: Credit information server 50: Query distribution server 60: Answer collection server 70: Point server

Claims (4)

In the information provider terminal that conducts information transactions with the information collector terminal,
Upon receiving the information providing Yi Lai requesting provision of information from the information collection terminal, the privacy of which obtains the credibility of the information collecting terminal from credit management record for managing the credit, manages the privacy of the information Obtaining the privacy level of the information requested in the information provision request from the management record , determining whether the credit rating is lower than the privacy level, and if the trust level is lower than the privacy level, further A credit quality judgment unit for judging whether or not the difference between the credit quality and the privacy level is less than a set value;
If the credit rating difference and the creditworthiness and the privacy of lower than the privacy degree is less than the set value, whether to answer the information that is requested in an information request to the information collection terminal A confirmation unit for displaying confirmation and obtaining an input as to whether or not to answer ,
When an input indicating that the confirmation unit answers is acquired, the privacy level of the information described in the privacy level management record is reduced by a certain value, and when an input indicating that the verification unit does not respond is acquired, the privacy level management record describes A privacy level update unit that increases the privacy level of the information being
When the credit rating is equal to or higher than the privacy rating, or when the confirmation unit obtains an input to reply, the information requested in the information provision request is answered to the information collector terminal, and the credit rating is If the privacy level is lower than the privacy level and the difference between the trustworthiness level and the privacy level is greater than or equal to the set value, or if an input indicating that the confirmation unit does not respond is obtained, an answer to the information collector terminal is given. An answer generator not to perform,
An information provider terminal comprising: In the information provider terminal that conducts information transactions with the information collector terminal,
Upon receiving the information providing Yi Lai requesting provision of information from the information collection terminal, the privacy of which obtains the credibility of the information collecting terminal from credit management record for managing the credit, manages the privacy of the information Obtaining the privacy level of the information requested in the information provision request from the management record , determining whether the credit rating is lower than the privacy level, and if the trust level is lower than the privacy level, further A credit quality judgment unit for judging whether or not the difference between the credit quality and the privacy level is less than a set value;
If the credit rating difference and the creditworthiness and the privacy of lower than the privacy degree is less than the set value, whether to answer the information that is requested in an information request to the information collection terminal A confirmation unit for displaying confirmation and obtaining an input as to whether or not to answer ,
When the input that the confirmation unit answers is obtained, the reliability of the information collector terminal described in the credit management record is increased by a certain value, and when the input that the confirmation unit does not reply is obtained, the credit is recorded in the credit management record A creditworthiness update unit that lowers the creditworthiness of the information collector terminal being
When the credit rating is equal to or higher than the privacy rating, or when the confirmation unit obtains an input to reply, the information requested in the information provision request is answered to the information collector terminal, and the credit rating is If the privacy level is lower than the privacy level and the difference between the trustworthiness level and the privacy level is greater than or equal to the set value, or if an input indicating that the confirmation unit does not respond is obtained, an answer to the information collector terminal is given. An answer generator not to perform,
An information provider terminal comprising: In the information transaction method executed by the information provider terminal that performs information transactions with the information collector terminal ,
When the credit quality judgment unit receives an information provision request for requesting provision of information from the information collector terminal, the credit rating of the information collector terminal is obtained from the credit management record for managing the credit quality, and the privacy level of the information is determined. When the privacy level of the information requested in the information provision request is acquired from the privacy level management record to be managed, it is determined whether or not the credit level is lower than the privacy level, and the credit level is lower than the privacy level the, a further credit determination procedure for determining whether or not the difference of the privacy of the said credit is less than the set value,
Confirmation unit, if the credit rating difference between the privacy of the low and the credibility than the privacy degree is less than the set value, the answer information being requested in an information request to the information collection terminal A confirmation procedure for displaying whether or not to answer, and obtaining an input as to whether or not to answer ,
When the privacy level update unit acquires an input indicating that the answer is made in the confirmation procedure, the privacy level of the information described in the privacy level management record is decreased by a certain value, and when an input indicating that the answer is not made in the check procedure is acquired A privacy level update procedure for raising the privacy level of the information described in the privacy level management record by a certain value;
The answer generation unit answers the information collector terminal with the information requested in the information provision request when the credit rating is equal to or higher than the privacy level or when an input indicating that the answer is made in the confirmation procedure is obtained. When the credit is lower than the privacy and the difference between the trust and the privacy is greater than or equal to the set value, or when an input indicating that no response is made in the confirmation procedure is obtained, the information collector Answer generation procedure that does not reply to the terminal,
Information transaction method to execute in order. In the information transaction method executed by the information provider terminal that performs information transactions with the information collector terminal ,
When the credit quality judgment unit receives an information provision request for requesting provision of information from the information collector terminal, the credit rating of the information collector terminal is obtained from the credit management record for managing the credit quality, and the privacy level of the information is determined. When the privacy level of the information requested in the information provision request is acquired from the privacy level management record to be managed, it is determined whether or not the credit level is lower than the privacy level, and the credit level is lower than the privacy level the, a further credit determination procedure for determining whether or not the difference of the privacy of the said credit is less than the set value,
Confirmation unit, if the credit rating difference between the privacy of the low and the credibility than the privacy degree is less than the set value, the answer information being requested in an information request to the information collection terminal A confirmation procedure for displaying whether or not to answer, and obtaining an input as to whether or not to answer ,
When the credit update unit obtains an input indicating that the response is made in the confirmation procedure , the credit rating of the information collector terminal described in the credit management record is increased by a certain value, and when the input indicating that the response is not made is obtained a credit degree update procedure Ru constant Lowers credibility of the information collection terminal that is described in credit management record,
The answer generation unit answers the information collector terminal with the information requested in the information provision request when the credit rating is equal to or higher than the privacy level or when an input indicating that the answer is made in the confirmation procedure is obtained. When the credit is lower than the privacy and the difference between the trust and the privacy is greater than or equal to the set value, or when an input indicating that no response is made in the confirmation procedure is obtained, the information collector Answer generation procedure that does not reply to the terminal,
Information transaction method to execute in order.

Images