JP7559756B2 - Information system, information terminal, information processing method, and information providing method - Google Patents

Description

This technology relates to an information system that provides personal information to a third party while ensuring the privacy of the information owner, an information terminal that provides the information owner's personal information to the information system, and information processing methods and information provision methods related to these.

Currently, services that handle personal information generally operate in a format in which the service provider receives the information provided by the information owner, retains it, and uses it.
Data distribution is a conventional technology that can support the realization of such a service. For example, in Patent Document 1, personal information is divided into identification information such as a name that can identify the individual, and attribute information such as an address, telephone number, date of birth, age, sex, height, and weight, and the identification information is further divided into a last name and a first name, and each divided piece of information is distributed and recorded in separate data files, thereby protecting personal information from the fact that information recorded in only one data file is not useful even if any of the data files is leaked.
Furthermore, Patent Document 2 discloses that when personal information is divided into several parts and stored on the storage medium of a divided management server, the divided stored data is stored as plain text or hash values depending on the protection level.

JP 2007-035022 A JP 2006-189925 A

However, to date, no technology has been known that distributes and stores multiple pieces of information that make up personal information across multiple information systems, for example operated by different entities, as in the present technology. With technologies such as those in cited documents 1 and 2 above, which distribute and store information in the databases of a single information system, for example, if an unauthorized user were to gain access to the system, there is a risk of leakage on a database-by-database basis, and no matter how distributed the data stored in the databases, it is only a matter of time before any single piece of personal information is restored.

In light of the above circumstances, the objective of this technology is to provide an information system, information terminal, information processing method, and information provision method that can improve the functionality and performance of a system that stores and manages information in a distributed manner, such as improving resistance to attacks from unauthorized users attempting to leak information and adjusting the scope of disclosure of personal information to information users.

In order to achieve the above object, an information system according to an embodiment of the present disclosure includes:
a storage unit for storing one or more pieces of fragment information among a plurality of pieces of fragment information constituting the personal information of an information owner, and one or more hash values each indicating all the other pieces of fragment information;
The information processing system includes a control unit that receives an information request from an information user, extracts one or more corresponding fragment information and one or more hash values from the storage unit, and requests one or more fragment information indicated by the one or more extracted hash values from another information system in which fragment information other than the stored fragment information among the plurality of fragment information is stored.

There may be a plurality of other information systems, and each of the other information systems may store all of the plurality of fragment information pieces other than the fragment information stored in the storage unit in a distributed manner, and the control unit may be configured to request one or more fragment information pieces indicated by the one or more extracted hash values, respectively, from each of the other information systems.

The control unit may be configured to perform information processing based on the one or more pieces of extracted fragmentary information and the one or more pieces of fragmentary information obtained from the other information system, and to respond with the results to the terminal of the information user.

The control unit may be configured, when it detects a leak of the hash value of the storage unit, to request other information systems in which the fragment information indicated by the leaked hash value is stored to be prohibited from accessing the fragment information, and to invalidate the leaked hash value and update it to a new hash value.

The multiple pieces of information may be multiple pieces of information with different attributes that are generated synchronously in conjunction with the actions of the information owner.

The multiple pieces of fragmented information may be multiple pieces of information that structurally fragment the personal information.

The personal information may be a numeric string having a predetermined number of digits, and the multiple pieces of fragmented information may be multiple pieces of information obtained by fragmenting the numeric string into numbers for each digit.

The hash value may be a hash value publicly key encrypted by an authorized authority.

The hash value may be added with identification information that identifies the other information system in which the fragmentary information indicated by the hash value is stored, and the control unit may be configured to request the fragmentary information indicated by the hash value from the other information system identified by the identification information.

The hash value may be given within a range determined for each of the other information systems.

The control unit may be configured to query a repository that manages the mapping between the hash value and the other information systems, and identify the other information systems in which the fragmented information indicated by the hash value is stored.

The information terminal of the present disclosure also includes a control unit that generates multiple pieces of fragment information constituting the personal information of an information owner, generates hash values of the multiple pieces of fragment information generated, transfers a combination of one or more pieces of fragment information and one or more hash values of one or more pieces of fragment information other than the multiple pieces of fragment information among the multiple pieces of fragment information and the multiple hash values of the fragment information to be stored in one of multiple information systems connected via a network, and transfers the one or more pieces of fragment information indicated by the one or more hash values stored in the information system to be stored in a distributed manner in one or more other information systems.

The control unit of the information terminal may be configured to assist in determining the type of information to be distributed and stored in each of the multiple information systems using a graphical user interface.

In addition, in the information processing method disclosed herein, the control unit receives an information request from an information user's terminal, extracts one or more pieces of fragment information and one or more hash values from a storage unit that stores one or more pieces of fragment information among multiple pieces of fragment information constituting personal information and one or more hash values that respectively indicate the other one or more pieces of fragment information, and requests one or more pieces of fragment information that are respectively indicated by the one or more extracted hash values from another information system in which fragment information among the multiple pieces of fragment information other than the fragment information stored in the storage unit is stored.

In addition, the information provision method disclosed herein includes a control unit that generates multiple pieces of fragment information constituting the personal information of an information owner, generates hash values for the multiple pieces of fragment information generated, transfers a combination of one or more pieces of fragment information and one or more hash values of one or more pieces of fragment information other than the multiple pieces of fragment information and the multiple hash values of the fragment information to be stored in one of multiple information systems connected via a network, and transfers one or more pieces of information indicated by the one or more hash values stored in the information system to be stored in a distributed manner in one or more other information systems.

FIG. 1 is a diagram showing an overall configuration of an information bank system 100 according to an embodiment of the present invention. FIG. 2 is a diagram showing an information distribution form in a plurality of information systems 1a, 1b, and 1c of the information bank system 100 of FIG. FIG. 3 is a block diagram showing the configuration of each device constituting the information bank system 100 of FIG. 2. 2 shows an operation sequence when storing information in the information bank system 100 of FIG. 1 . 13 is a diagram showing an example of a user interface for determining a distribution method displayed on a display screen D of the owner terminal 2. FIG. FIG. 2 is a diagram showing an operational sequence when an information user U2 in the information bank system 100 of FIG. 1 makes an information request. FIG. 1 is a diagram showing an example in which fragmented information is stored in unequal numbers among a plurality of information systems 1a, 1b, and 1c. FIG. 13 is a diagram showing an example in which, when each of the pieces of fragmentary information A, B, and C is a three-digit numeric string, the values of each digit of the numeric string are distributed and stored in three information systems 1a, 1b, and 1c. FIG. 11 is a diagram for explaining a process for dealing with leakage of a hash value. FIG. 13 is a diagram showing access revocation due to leakage of a hash value. FIG. 13 is a diagram showing rehashing in response to leakage of a hash value. FIG. 13 is a diagram illustrating public key encryption of a hash value. 11 is a diagram illustrating a method for identifying an information system in which fragmented information indicated by a hash value is stored. FIG. 1A to 1C are diagrams showing variations in information distribution patterns in a plurality of information systems 1a, 1b, and 1c.

Hereinafter, an embodiment of the present technology will be described with reference to the drawings.
First Embodiment
(Outline of this embodiment)
1, the information bank system 100 of this embodiment includes multiple information systems 1a, 1b, 1c of multiple information banks A, B, C which are multiple operating entities constituting the cloud 1, a terminal of an information owner U1 (hereinafter referred to as "owner terminal 2") which is an information terminal that provides personal information so that it is distributed and stored in the multiple information systems 1a, 1b, 1c, and a terminal of a user U2 (hereinafter referred to as "user terminal 3") which uses the personal information distributed and stored in the multiple information systems 1a, 1b, 1c. Here, each of the information systems 1a, 1b, 1c is composed of one or more information processing devices such as interconnected server devices.

Each of the information systems 1a, 1b, 1c comprises a database 14 that stores one or more pieces of fragment information out of the multiple pieces of fragment information that constitute the personal information of the information owner U1 and one or more hash values that respectively indicate all of the other pieces of fragment information, and a control unit 10 that receives an information request from an information user U2, extracts the corresponding one or more pieces of fragment information and one or more hash values from the database 14, and requests one or more pieces of fragment information that are respectively indicated by the one or more extracted hash values from other information systems in which fragment information out of the multiple pieces of fragment information other than the stored fragment information is stored.

FIG. 2 is a diagram showing a form of information distribution in a plurality of information systems 1a, 1b, and 1c.
In the figure, columns A, B, C, D, E, and F are multiple pieces of fragmentary information that are generated synchronously in association with, for example, the actions of the information owner U1, and that constitute a single set of significant personal information 5. Of these pieces of fragmentary information A-F, the first information system 1a stores fragmentary information C and D, the hash values of fragmentary information A and B, and the hash values of fragmentary information E and F as one record. The second information system 1b stores fragmentary information A and B, the hash values of fragmentary information C and D, and the hash values of fragmentary information E and F as one record. The third information system 1c stores fragmentary information E and F, the hash values of fragmentary information A and B, and the hash values of fragmentary information C and D as one record. In this specification, the fragmentary information A-F stored in a distributed manner in each of the information systems 1a, 1b, and 1c is referred to as "public information" in the sense that it is real data, and the hash values may be referred to as "private information."

The owner terminal 2 has a control unit 20 which generates various information such as product information associated with the purchase, payment information such as amount, biometric information such as heart rate, blood pressure, respiratory rate, and even time information and location information (latitude and longitude) as multiple fragmentary information A, B, C, D, E, and F which constitute personal information 5, generates storage records for each information system a1, b1, and c1, and transmits them to each information system a1, b1, and c1.

The user terminal 3 requests information from, for example, the first information system 1a that has logged in through authentication, and the first information system 1a receives multiple pieces of information collected from one or more information systems, or information based on the multiple pieces of collected information. The received information is stored in the storage unit of the user terminal 3 and is presented to the information user U2, for example, via a display or the like.

The control unit 10 of the first information system 1a, upon receiving an information acquisition request from the user terminal 3, can acquire one or more pieces of fragmentary information stored as public information in the database 14 within its own system, as well as one or more pieces of fragmentary information stored as public information in the database 14 of each of the other information systems 1b and 1c to which access has been authorized, by making a request to the other information systems 1b and 1c based on the hash value acquired from the database 14 of the first information system 1a.

On the other hand, even if an unauthorized intrusion by an unauthorized information user into an information system results in the leakage of fragmentary information stored as disclosure information in that information system, the damage can be kept low because the leaked fragmentary information is only a part of the multiple fragmentary information that make up personal information 5 of information owner U1. Also, because the fragmentary information indicated by the hash value is stored in another information system, the unauthorized information user would need to intrude into that information system through an attack as well.

(Functional configuration of the information bank system)
FIG. 3 is a block diagram showing the configuration of each device that constitutes the information bank system 100.
In addition, due to limitations of paper size, in the figure, only the first information system 1a and the second information system 1b are shown, and the third information system 1c is omitted from the illustration.

(Configuration of Owner Terminal 2)
The owner terminal 2 is a device that can be carried by the information owner U1, such as a smartphone, a tablet terminal, or a wearable device such as a watch, wristwatch, or bracelet. The owner terminal 2 includes typical computer hardware elements such as a CPU, ROM, RAM, communication device, display, and user input unit, and software elements such as a program. The RAM stores the above programs, and the CPU executes various arithmetic processes to execute the programs. The owner terminal 2 also includes various biosensors that generate biometric information of the information owner U1, a GPS unit that can obtain location information, and other detectors and measuring instruments necessary for generating personal information.

The owner terminal 2 has a control unit 20. The control unit 20 includes one or more information generation units 21, an information collection unit 22, a distribution policy determination unit 23, an information fragmentation unit 24, a hash generator 25, and an information transmission unit .
The information generating unit 21 generates biometric information, location information, time information, and other payment information associated with online purchasing actions from the outputs of the biometric sensor, GPS unit, and other detectors and measuring devices. These pieces of information can be considered as multiple pieces of information with different attributes that are generated synchronously in association with the actions of the information owner U1.
The information collection unit 22 selects multiple types of information from the multiple pieces of information generated by the one or more information generation units 21 in accordance with a distribution policy, and collects them as multiple pieces of information that constitute the personal information 5.

The distribution policy determination unit 23 uses a graphical user interface to have the information owner U1 determine a distribution policy, such as the type of information to be collected by the information collection unit 22 from among the multiple pieces of information obtained by the information generation unit 21, and which information bank (information system) to deposit the information in. The distribution policy determination unit 23 also assists in determining a policy for further fragmenting the information generated by the information generation unit 21 into multiple pieces of information. For example, location information obtained by a GPS unit can be fragmented into latitude and longitude.

The information fragmentation unit 24 fragments a specific type of information in accordance with a distribution policy.
Here, the multiple types of information collected by the information collection unit 22 in accordance with the distribution policy and the multiple pieces of information into which some of the collected information has been further fragmented by the information fragmentation unit 24 are referred to in this specification as ``multiple fragmented pieces of information constituting personal information 5.''

The hash generator 25 calculates a hash value of the fragment information.
The information transmission unit 26 transmits a first record for each information bank, which includes one or more pieces of fragmentary information registered as public information in the database 14 of the information bank's information system and one or more hash values registered as private information, to the first information system 1a, the second information system 1b, and the third information system 1c in accordance with the distribution policy. At this time, a bank ID that identifies the information bank in which the target fragmentary information is stored is added to each hash value. Furthermore, the information transmission unit 26 generates a second record for each information bank, which includes the first record and each hash value of one or more pieces of fragmentary information included in the first record, and transmits the second record to the same information system 1a, 1b, or 1c as the destination of the first record.

(Information System Configuration)
Each of the information systems 1a, 1b, and 1c is composed of one or more server devices. The information systems 1a, 1b, and 1c are used as a cloud 1 from an owner terminal 2 and a user terminal 3. A storage device for a database is connected to the above-mentioned server device locally or through a network. The server device has typical computer hardware elements and software elements such as a program for operating a computer as an information system. The computer hardware elements include, for example, a CPU, a ROM, a RAM, an input device and a display for a user interface, a communication device, and an interface with storage. The above-mentioned program is stored in the RAM, and the CPU executes various arithmetic operations to execute the program.

The information systems 1a, 1b, and 1c each have a control unit 10. The control unit 10 has an information receiving unit 11, an information updating unit 12, a hash table 13, a database 14, an information request receiving unit 15, an information processing unit 16, an information reply unit 17, a query implementation unit 18, a other bank query sending unit 19a, a other bank data receiving unit 19b, a query receiving unit 19c, and a data reply unit 19d. The information systems 1a, 1b, and 1c may have the same configuration.

In these functional blocks, the information receiving unit 11 , the information updating unit 12 , the hash table 13 , and the database 14 are involved in the operation of registering the information transmitted from the owner terminal 2 in the database 14 .
That is, the information receiving unit 11 receives a first record including one or more pieces of fragment information and one or more hash values transmitted from the owner terminal 2, and a second record including hash values corresponding to each of the one or more pieces of fragment information stored in the database 14.

The information update unit 12 stores the first record received by the information receiving unit 11 in the database 14 .
The hash table 13 registers a correspondence table between one or more hash values included in the second record received by the information receiving unit 11, i.e., one or more hash values each corresponding to one or more pieces of fragment information stored in the database 14, and index keys that identify the one or more pieces of fragment information stored in the database 14.

In the functional blocks of the information systems 1a, 1b, and 1c, the information request receiving unit 15, the information processing unit 16, the information response unit 17, the query implementation unit 18, the other bank query sending unit 19a, the other bank data receiving unit 19b, the query receiving unit 19c, and the data response unit 19d are involved in the operation of processing information requests from the user terminal 3.
The information request receiving unit 15 receives an information acquisition request from the user terminal 3 .
The query implementation unit 18 retrieves a corresponding record from the database 14 based on the information acquisition request received by the information request receiving unit 15, and supplies one or more pieces of fragmented information in the retrieved record to the information processing unit 16. The query implementation unit 18 also supplies one or more hash values in the record retrieved from the database 14 to the other row query sending unit 19a.

The other-bank query sending unit 19a generates a query including the above-mentioned hash value, and sends it to the information system of the other information bank indicated by the bank ID added to the hash value.
The query receiving unit 19c receives a query including a hash value addressed to its own information bank.
The query execution unit 18 searches the hash table 13 for an index key that corresponds to the hash value included in the query received by the query reception unit 19c, and extracts the corresponding fragment information from the database 14 based on this index key.
The data reply unit 19d returns the fragmented information extracted from the database 14 to the information system of the information bank that sent the query.
The other row data receiving unit 19 b receives fragmented information returned from the information system to which the query was sent, and supplies it to the information processing unit 16 .
The information processing unit 16 performs a predetermined information process on the multiple pieces of fragmented information obtained by the query execution unit 18 and the other row data receiving unit 19b.
The information reply unit 17 replies with a report on the results of processing performed by the information processing unit 16 on the multiple pieces of fragmented information as a response to the information acquisition request from the user terminal 3 .

(Configuration of user terminal 3)
The user terminal 3 is an information processing device such as a smartphone, a tablet terminal, a personal computer, etc. The user terminal 3 includes typical computer hardware elements such as a CPU, a ROM, a RAM, a communication device, a display, a user input unit, etc., and software elements such as a program. The RAM stores the above-mentioned program, and the CPU executes various arithmetic operations to execute the program.

Functionally, the user terminal 3 has an information request sending unit 31 and an information result receiving unit 32, and may further be equipped with a storage unit (not shown) for storing the information results received by the information result receiving unit 32, and a display unit for presenting the information results to the information user U2.
The information request sending unit 31 requests information results from the information system 1a of any first information bank in the information bank system 100.
The information result receiving unit 32 receives a report of processing results based on one or more fragmentary pieces of information collected by the first information system 1a from one or more information systems including itself in response to an information request sent from the user terminal 3 to the first information system 1a, and stores the report in the storage unit or outputs it to the display unit.

<Explanation of operation>
Next, the operation of the information bank system 100 of this embodiment will be described.
(1. Operation when saving information)
FIG. 4 shows an operation sequence for storing information in the information bank system 100 of this embodiment.
Each information generating unit 21 of the owner terminal 2 generates information such as biometric information, payment information, location information, and time information of the information owner U1 (S1). The information collecting unit 22 collects the information generated by the information generating unit 21 (S2).
The distribution policy determination unit 23 is started when collecting information for the first time. The distribution policy determination unit 23 determines a distribution method based on input from the information owner U1, such as which information among the generated pieces of information should be collected as pieces of fragmentary information that constitute a set of personal information 5, and in what combination the collected pieces of fragmentary information should be distributed and stored as public information in a number of information banks, and registers information about the determined distribution method in the update hash database 14a (S3). This step of determining the distribution policy is performed only for the first time or when there is a change in the distribution method, and is performed in other cases.

(Decision on the distribution method)
Here, a supplementary explanation will be given regarding the method for determining the distribution method.
It is desirable to decide in what combination the information of the information owner U1 is to be distributed and stored as public information in a plurality of information banks, taking into consideration the magnitude of the risk of information leakage. The decision may be made by the information owner U1 himself, or information regarding information combinations preferable from the viewpoint of risk management may be preset in the owner terminal 2, and the information owner U1's decision-making may be guided on a user interface based on this preset information. Alternatively, an inquiry may be made to a repository that manages recommended information regarding information combinations preferable from the viewpoint of risk management, and a recommended combination that meets the conditions specified by the information owner U1 may be introduced. Furthermore, the recommended combination may be customized and used by the information owner U1 himself.

Figure 5 is a diagram showing an example of a user interface for determining a distribution method displayed on the display screen D of the owner terminal 2. This user interface has an information bank selection area 41 and a fragment information type selection area 42. In the information bank selection area 41, icons 43, 44, and 45 for each information bank are arranged, and in the fragment information type selection area 42, icons 46, 47, 48, and 49 for each fragment information type are arranged. The information owner U1 can then link the information bank (information system) with the type of fragment information to be stored therein by dragging icons that the information owner U1 wants to associate with each other between the information bank selection area 41 and the fragment information type selection area 42. For example, in the example of Figure 5, a distribution policy is determined in which payment information and time information related to shopping are stored as public information in information bank A (first information system 1a), location information in information bank B (second information system 1b), and heart rate information in information bank C (third information system 1c).

When deciding on a distribution method, the distribution policy decision unit 23 of the owner terminal 2 may perform a risk assessment in the case where multiple pieces of information selected to be stored in one information bank are leaked, and feed back the result to the information owner U1. The information owner U1 can reconsider the distribution method from the feedback of the risk assessment, and specify a change to a distribution policy with a lower risk using a user interface. In addition, risk assessment may be performed not only when deciding on a distribution method, but also on distribution methods that have already been decided and are in operation, and the result may be presented to the information owner U1.
Furthermore, the distribution policy determination unit 23 of the owner terminal 2 may calculate a combination of fragmentary information with the minimum risk, and recommend it to the information owner U1 via the user interface.

For example, even if the above fragmentary information were to leak from the first information system 1a in which payment information and time information are stored as disclosure information, the leaked information is unlikely to be misused since no information regarding the place where the payment is made (location information) is obtained. Therefore, it is desirable to store the payment information, time information, and location information in separate personal information systems. In addition, it is known that a person's heart rate often increases when making a large amount of payment, so it is desirable to store the payment information and heart rate information in separate information systems so that a large amount of payment cannot be identified from the heart rate.

4, after the distribution method is determined, the information collection unit 22 selects information to be collected as fragment information from the plurality of pieces of information generated by the information generation unit 21 in accordance with the distribution method (S2), and supplies the selected information to the information fragmentation unit 24. The information fragmentation unit 24 generates a hash value of the fragment information collected by the information collection unit 22 using a hash generator 25.
In addition, the information fragmentation unit 24 further fragments a specific type of fragment information collected by the information collection unit 22, such as location information consisting of latitude and longitude, into multiple fragment information, such as latitude information and longitude information, in accordance with a determined distribution method, and generates a hash value for each of the fragment information using the hash generator 25 (S4).

Next, the information transmission unit 26 generates a first record for database storage for each information bank and a second record for updating the hash table from the multiple fragmented information and multiple hash values generated by the information fragmentation unit 24 in accordance with the distribution policy, and transmits them to each information system 1a, 1b, 1c (S5).

When the first information system 1a receives the first record and the second record from the owner terminal 2 at the information receiving unit 11 (S6), the information updating unit 12 registers the hash value contained in the second record in the hash table 13 (S7), and further registers the contents of the received first record in the database 14 (S8). Furthermore, the information updating unit 12 records in the hash table 13 an index key that identifies the fragmentary information registered as public information in the database 14 in association with the registered hash value. Similarly, in the other information systems 1b and 1c, the hash tables 13 and databases 14 are updated based on the contents of the first record and the second record received from the owner terminal 2.

(2. Actions taken when an information consumer U2 requests information)
FIG. 6 is a diagram showing an operation sequence when an information user U2 makes an information request.
The information user U2 of the user terminal 3 is authenticated by the first information system 1a under the condition of permission from the information owner U1, and starts accessing the first information system 1a while holding the authentication token. The first information system 1a allows access with the authentication token. A series of information accesses with a certain context is collectively referred to as a session here. In addition, the information user U2 can obtain an authorization token indicating an access right to information held by the second information system 1b and the third information system 1c based on permission from the information owner U1. The first information system 1a can obtain fragmented information by a hash value from the information system that is the target of the authorization token, on the condition that there is an authorization token. For example, if the information user U2 holds the authorization tokens for the fragmented information held by the second information system 1b and the third information system 1c, the first information system 1a executes the acquisition of fragmented information by a hash value from the second information system 1b and the third information system 1c. However, if the information consumer U2 only has an authorization token for the fragmented information held by the second information system 1b, the first information system 1a only executes acquisition of the fragmented information by hash value from the second information system 1b. Below, the operation at the time of information request from the information consumer U2 will be described on the assumption that the information consumer U2 has authorization tokens for each of the fragmented information held by the second information system 1b and the third information system 1c.

The information request sending unit 31 of the user terminal 3 sends an information acquisition request regarding the personal information 5 of the information owner U1 to the first information system 1a (S11). When the first information system 1a receives this information acquisition request at the information request receiving unit 15, it supplies the information acquisition request to the query implementation unit 18 (S12). The query implementation unit 18 retrieves a relevant record from the database 14 based on the information acquisition request (S13), and supplies one or more pieces of information in the retrieved record to the information processing unit 16 (S14). The query implementation unit 18 also supplies one or more hash values in the record to the other row query sending unit 19a (S15).

The other bank query sending unit 19a sends a query including the hash value provided by the query execution unit 18 to the information system of the information bank corresponding to the bank ID added to the hash value (S16). Here, we will explain the case where the query including the hash value is sent to the second information system 1b.

The second information system 1b receives the query including the hash value at the query receiving unit 19c and supplies it to the query implementation unit 18 in its own information system 1b (S17). The query implementation unit 18 retrieves an index key for retrieving from the hash table 13 the fragment information corresponding to the hash value included in the query in the database 14, and supplies this to the query implementation unit 18 (S18). The query implementation unit 18 retrieves the corresponding fragment information from the database 14 using this index key (S19). The fragment information retrieved from the database 14 is returned to the first information system 1a by the data reply unit 19d (S20, S21).

The first information system 1a receives the fragmented information returned from the information system 1b at the other bank data receiving unit 19b and supplies it to the query implementation unit 18. The fragmented information supplied from the other bank data receiving unit 19b to the query implementation unit 18 is supplied from the query implementation unit 18 to the information processing unit 16 (S14).

When the hash value of the fragmentary information stored in the third information system 1c is extracted from the record extracted from the database 14 in S13, the query implementation unit 18 transmits a query including that hash value to the third information system 1c. This causes the third information system 1c to return the corresponding fragmentary information to the first information system 1a. In this way, the multiple fragmentary information pieces constituting the personal information 5 that are distributed and stored in the multiple information systems 1a, 1b, and 1c are gathered together in the first information system 1a.

The information processing unit 16 of the first information system 1a processes the fragmented information collected from the multiple information systems 1a, 1b, and 1c as described above, and generates a report that is the processing result (S22). The generated report is sent to the user terminal 3 by the information reply unit 17 (S23), and is received by the information result receiving unit 32 of the user terminal 3 (S24).

(Relationship between authorization tokens and reports)

The type of fragmented information that is the source of the report provided to the information consumer U2 may be restricted by the type of authorization token that the information consumer U2 possesses.
For example, if the information user U2 does not possess both an authorization token for the fragmentary information of the second information system 1b and an authorization token for the fragmentary information held by the third information system 1c, the first information system 1a executes information processing within the scope of the fragmentary information stored as disclosure information in its own database 14. For example, if payment information and time information are stored in its own database 14, a report on the time of day when the average customer spending is high or the time period when the number of purchases is high is created.

On the other hand, if information user U2 possesses an authorization token for the fragmentary information of the second information system 1b and an authorization token for the fragmentary information of the third information system 1c, the first information system 1a can create a report on the results of information processing based on the fragmentary information stored as disclosure information in the second information system 1b and the third information system 1c, together with the fragmentary information stored as disclosure information in its own database 14. For example, if location information is stored in the second information system 1b and heart rate information is stored in the third information system 1c, the first information system 1a can create a more advanced information report, such as areas with large payment amounts and the correlation between a purchaser's heart rate and payment amount.

In this way, the multiple pieces of fragmentary information collected in the first information system 1a are provided to the information user U2 as the results of, for example, statistical processing in the information processing unit 16, which is more effective in protecting the privacy of the individual information owner than providing the multiple pieces of fragmentary information directly to the information user U2.

In the above example of operation when the information user U2 requests information, the information user U2 of the user terminal 3 is authenticated by the first information system 1a and starts accessing the first information system 1a while holding an authentication token. However, in the information bank system 100 of this embodiment, a plurality of pieces of information constituting the personal information 5 are distributed and stored in the database 14 of each of the information systems 1a, 1b, and 1c, and hash values of all pieces of information other than the pieces of information stored in the information system itself among the plurality of pieces of information constituting the personal information 5 are stored. Therefore, the information user U2 of the user terminal 3 can collect the plurality of pieces of information distributed and stored as disclosure information in the database 14 of each of the information systems 1a, 1b, and 1c to the information system from which the access was started, as in the case of starting access to the first information system 1a, by being authenticated by the second information system 1b and starting accessing the second information system 1b while holding an authentication token, or by being authenticated by the third information system 1c and starting accessing the third information system 1c while holding an authentication token, and can perform information processing.

<First Modification>
In the above first embodiment, the public information of a plurality of pieces of fragmented information constituting personal information is distributed equally among a plurality of information systems and deposited. However, the ratio of the number of pieces of fragmented information to be distributed among the plurality of information systems can be determined arbitrarily.

Figure 7 shows an example in which fragment information is stored in unequal numbers among multiple information systems 1a, 1b, and 1c. In this example, of six pieces of fragment information A, B, C, D, E, and F that make up personal information, four pieces of fragment information B, C, D, and E are stored in the first information system 1a, one piece of fragment information A is stored in the third information system 1c, and one piece of fragment information F is stored in the third information system 1c. As for hash values, the hash values of two pieces of fragment information A and F are stored in the first information system 1a, the hash values of five pieces of fragment information B, C, D, E, and F are stored in the second information system 1b, and the hash values of five pieces of fragment information A, B, C, D, and E are stored in the third information system 1c. In this way, by allowing each information system 1a, 1b, 1c to store an uneven number of fragmentary information, a competitive edge is created that attracts information to the information system itself, and by combining this with the introduction of a mechanism that allows the operating entity to obtain benefits according to the degree of contribution of the information provided to information user U2, it is expected that the scale, services, and reliability of the entire information bank system 100 will be improved.

<Second Modification>
In the first embodiment, data that can be understood by itself, such as sensor output data, is treated as one piece of fragmentary information. However, even if it is just one piece of fragmentary information, there may be a case where leakage of the information may cause a great deal of damage.

Therefore, each piece of information may be structurally divided into smaller pieces of information, and each piece of information may be distributed and stored in a plurality of information systems.
8 shows an example in which each of the fragment information A, B, and C is a three-digit numeric string, and the values of each digit of the numeric string are distributed and stored in three information systems 1a, 1b, and 1c. In this example, the first digit of each of the three-digit numeric strings of the fragment information A, B, and C is stored as public information in the first information system 1a, the second digit is stored as public information in the second information system 1b, and the third digit is stored as public information in the third information system 1c. The first information system 1a further stores hash values of the second and third digits, the second information system 1b further stores hash values of the first and third digits, and the third information system 1c further stores hash values of the first and second digits.

In this way, the fragmented information is structurally fragmented into multiple pieces of smaller information and stored in a distributed manner across multiple information systems 1a, 1b, and 1c, and the information other than the public information portion is stored as a hash value in each information system 1a, 1b, and 1c, thereby reducing the risk of leakage at the fragmented information level.

In addition, in this modified example, there is no need to distribute and store multiple fragmentary pieces of information that make up personal information 5 across multiple information systems 1a, 1b, and 1c.

<Third Modification>
In the first embodiment, if a hash value is leaked from an information system due to an attack, the possibility cannot be denied that the fragmented information stored in another information system may also be leaked due to unauthorized access to the other information system using the hash value. Therefore, when the control unit 10 of the information system detects leakage of a hash value from its own information system, it requests the other information system in which the fragmented information indicated by the leaked hash value is stored to prohibit access to the corresponding fragmented information, and invalidates the hash value registered in its own information system and updates it to a new hash value.

For example, as shown in FIG. 9A, assume that hash values for fragment information A, B, C, and D are leaked due to an attack on one of three information systems 1a, 1b, and 1c, the third information system 1c. When the control unit 10 of the third information system 1c detects this hash value leak, it immediately requests the other information systems 1a and 1b to revocation access to the fragment information indicated by the leaked hash value. In response to this revocation request, the control unit 10 of the first information system 1a prohibits access to the fragment information C and D indicated by the leaked hash value, as shown in FIG. 9B. Similarly, in response to the revocation request, the control unit 10 of the second information system 1b also prohibits access to the fragment information A and B indicated by the leaked hash value, as shown in FIG. 9B. Next, the control unit 10 of the third information system 1c generates a new hash value (NEW_HASH) to replace the leaked hash value, replaces the old leaked hash value with this new hash value (NEW_HASH), and transmits a rehash request including this new hash value (NEW_HASH) to each of the first information bank system and the second information system 1b, as shown in Fig. 9C. Upon receiving the rehash request, the control units 10 of the first information bank system and the second information system 1b update their own hash tables 13 with the new hash value (NEW_HASH) included in the rehash request.

This makes it possible to prevent fragmented information from being leaked from other information systems due to hash values leaked from one information system.

<Fourth Modification>
The hash value specifying the fragment of information deposited for each information bank may be public key encrypted by an authority determined for each information bank.
For example, as shown in FIG. 10, the first information system 1a stores fragment information C and D out of multiple pieces of fragment information C, D, E, and F that make up personal information, the third information system 1c stores multiple pieces of fragment information E and F, and further the first information system 1a stores hash values of the fragment information E and F stored in the third information system 1c, and the third information system 1c stores hash values of the fragment information C and D stored in the first information system 1a.
Here, the hash values of the fragment information C and D are public key encrypted by the institution X, and the hash values of the fragment information E and F are public key encrypted by the institution Y. Therefore, in order to obtain the fragment information C and D as hash values from the third information system 1c to the first information system 1a, the encrypted hash value (Coded_HASH) must be decrypted by the institution X. Similarly, in order to obtain the fragment information E and F as hash values from the first information system 1a to the third information system 1c, the encrypted hash value (Coded_HASH) must be decrypted by the institution Y.

This makes it possible to further strengthen resistance to unauthorized acquisition of fragmentary information using leaked hash values. Furthermore, to invalidate hash values that have been decrypted once, each institution X and Y may generate new hash values that have been public-key encrypted, and use the new hash values to update the databases 14 and hash tables 13 of each information system 1a and 1c.

<Fifth Modification>
In the first embodiment described above, a method of adding a bank ID to a hash value was adopted as a method for identifying an information system that holds the corresponding fragment information based on a hash value. However, it is also possible to consider a method in which a range of hash values is determined in advance for each information system.
Furthermore, as shown in FIG. 11, a repository 51 is prepared to manage the mapping between hash values or hash value ranges and banks, and each time an information system requests fragmented information from another information system using a hash value, the repository 51 is queried as to which information system corresponds to that hash value.

<Sixth Modification>
By providing the owner terminal 2 with a function for retaining hash values of multiple pieces of fragment information stored in a plurality of information systems, when it is desired to update the fragment information stored in each information system, the repository 51 mentioned in the fifth variant example can be queried using the hash value to request the information system from which the fragment information is to be requested, and the fragment information in the database 14 can be updated by specifying the hash value to that information system.

<Seventh Modification>
In the first embodiment described above, as shown in Fig. 2, among the multiple pieces of fragment information A-F constituting the personal information 5 of the information owner U1 in the multiple information systems 1a, 1b, and 1c, the first information system 1a stores the fragment information C and D, the hash values of the fragment information A and B, and the hash values of the fragment information E and F as one record, the second information system 1b stores the fragment information A and B, the hash values of the fragment information C and D, and the hash values of the fragment information E and F as one record, and the third information system 1c stores the fragment information E and F, the hash values of the fragment information A and B, and the hash values of the fragment information C and D as one record. This is because, regardless of which of the information systems 1a, 1b, and 1c the information user U2 starts accessing, all of the fragment information A-F constituting the personal information 5 can be collected in the information system from which the information user U2 starts accessing. On the other hand, in a case where the information system from which access is started is fixed, for example, when it is decided that the third information system 1c will receive an information request from the information user U2, the hash value may be stored only in the third information system 1c, and only fragmentary information may be stored in the other information systems 1a and 1b, as shown in Fig. 12. Also, such a storage policy may be determined at the owner terminal 2.

(Effects of the information bank system disclosed herein)
As described above, according to the information bank system 100 of the present technology, multiple pieces of information constituting personal information are distributed and stored in multiple information systems, so even if an unauthorized information user intrudes into some information systems through an attack, causing the fragmented information stored in the information systems to be leaked as disclosure information, the leaked fragmented information is only a part of the multiple pieces of information constituting the personal information 5, so damage can be kept low. Furthermore, since the fragmented information indicated by the hash value is stored in another information system, the unauthorized information user must also attempt to intrude into that information system through an attack. This provides an information bank system that is highly resistant to information leaks.

The scope of information disclosure can be controlled by authorizing the use of information on an information system basis. Furthermore, the distribution policy determined by the owner terminal 2 can determine the combination of types of fragmentary information to be stored as public information in each information system so that the information owner U1 will not suffer effective damage even if the information is leaked. For example, in a case where purchase information, location information, and time information exist, storing the location information and time information in one information system could potentially compromise the privacy of the information owner U1 if this information were to be leaked, so the information user U2 can determine the distribution policy on the owner terminal 2 to avoid such combinations.

On the other hand, even if the information owner U1 restricts the authorization for information disclosure on an information system basis, the information system can generate useful information through statistical processing within the scope of fragmentary information for which information disclosure has been authorized, and provide it to the information user U2. For example, in a case where purchase information, location information, and time information exist, even if the information owner U1 has not authorized the use of the disclosure information of the information system that stores the location information, if the information owner U1 has authorized the use of the disclosure information of another information system that stores the purchase information and time information, the information processing unit 16 can perform information processing such as analysis of time periods when products are sold. Alternatively, if the information owner U1 has authorized only the use of the disclosure information of the information system that stores the location information, the information processing unit 16 can perform information processing such as population analysis.

Public key encryption of the hash value by the authorized authority provides robustness, such as ensuring that users with less authority than the authorized authority cannot access all of the information unless a court orders disclosure.

The information bank system 100 disclosed herein can also be applied to a system that digitalizes the contents of garbage disposal by garbage collection agencies. Garbage disposed of by individuals contains a lot of personal information, and by distributing and storing garbage information and personal information in multiple information systems, it is possible to protect the privacy of individuals while identifying individuals who have disposed of garbage in a malicious manner, for example, under conditions where permission is obtained from both the garbage collection agency and the police.

By using repository 51, it becomes possible to respond more quickly to dynamic changes such as the entry or withdrawal of information banks, or mergers and acquisitions, without having to recreate hash values. It is also possible to transfer held information between information systems in response to these changes. Even if the configuration of the information systems does not change, trading of held information between information systems is also possible.

The distribution policy for fragmented information can be based on a preset for each device, such as a sensor. In this case, the optimal storage destination for fragmented information can be determined through discussion between the device vendor and the operator of the information system, in order to avoid combinations of information that would increase the risk of leakage.

[Another configuration of the present technology]
The present technology can also be configured as follows.
(1) a storage unit that stores one or more pieces of fragmented information among a plurality of pieces of fragmented information constituting the personal information of an information owner, and one or more hash values that respectively indicate all of the other pieces of fragmented information;
a control unit that receives an information request from an information user, extracts one or more pieces of fragment information and one or more hash values corresponding to the request from the storage unit, and requests one or more pieces of fragment information indicated by the one or more extracted hash values from another information system in which fragment information other than the stored fragment information among the plurality of pieces of fragment information is stored;
An information system having the above.
(2) The information system according to (1) above,
The other information systems include a plurality of the other information systems, and all the fragmented information other than the fragmented information stored in the storage unit among the plurality of fragmented information is stored in a distributed manner in each of the other information systems;
The control unit is configured to request, from the other information systems, one or more pieces of fragment information indicated by the one or more extracted hash values, respectively.
(3) The information system according to (1) or (2),
The control unit is configured to perform information processing based on the extracted one or more pieces of fragmentary information and one or more pieces of fragmentary information acquired from the other information system, and to respond with the result to the terminal of the information user.
(4) The information system according to any one of (1) to (3),
The information system is configured such that, when the control unit detects a leak of the hash value in the storage unit, it requests other information systems in which fragmentary information indicated by the leaked hash value is stored to be prohibited from accessing the fragmentary information, and also invalidates the leaked hash value and updates it to a new hash value.
(5) The information system according to any one of (1) to (4),
The plurality of pieces of information are a plurality of pieces of information having different attributes and which are generated synchronously in association with the actions of the information owner.
(6) The information system according to any one of (1) to (4),
The plurality of pieces of information are pieces of information obtained by structurally fragmenting the personal information.
(7) The information system according to (6),
An information system, wherein the personal information is a numeric string having a predetermined number of digits, and the plurality of pieces of information are pieces of information obtained by fragmenting the numeric string into numeric values for each digit.
(8) The information system according to any one of (1) to (7),
The hash value is a hash value public key encrypted by an authority.
(9) The information system according to any one of (1) to (8),
Identification information for identifying the other information system in which the fragmented information indicated by the hash value is stored is added to the hash value; and
The control unit is configured to request fragment information indicated by the hash value from the other information system identified by the identification information.
(10) The information system according to any one of (1) to (8),
The hash value is given within a range determined for each of the other information systems.
(11) The information system according to any one of (1) to (8),
The control unit is configured to query a repository that manages mapping between the hash value and the other information system, and identify the other information system in which the fragmented information indicated by the hash value is stored.
(12) An information terminal comprising: a control unit that generates multiple pieces of fragment information constituting personal information of an information owner, generates hash values of the multiple pieces of fragment information generated, transfers a combination of one or more pieces of fragment information and one or more hash values of one or more pieces of fragment information other than the multiple pieces of fragment information among the multiple pieces of fragment information and the multiple hash values of the fragment information to be stored in one of multiple information systems connected via a network, and transfers the one or more pieces of fragment information represented by the one or more hash values stored in the information system to be stored in a distributed manner in one or more other information systems.
(13) The information terminal according to (12),
The control unit is configured to store multiple pieces of fragment information in a distributed manner in the multiple information systems, and to store, for each information system, hash values of all pieces of fragment information other than the one or more pieces of fragment information stored therein.
(14) The information terminal according to (12) or (13),
The information terminal is configured such that the control unit uses a graphical user interface to assist in determining the types of fragmented information to be distributed and stored in each of a plurality of information systems.
(15) The information terminal according to (14),
The control unit is configured to guide the information owner's decision-making through a graphical user interface when determining multiple types of fragmentary information to store in one information system, based on information regarding combinations of fragmentary information that are preferable from a risk management perspective.
(16) The control unit
receiving an information request from an information user's terminal, extracting one or more pieces of fragment information and one or more hash values corresponding to the one or more pieces of fragment information constituting the personal information from a storage unit that stores one or more pieces of fragment information and one or more hash values that respectively indicate the other one or more pieces of fragment information;
An information processing method, which requests one or more pieces of fragment information indicated by the one or more extracted hash values from another information system in which fragment information other than the fragment information stored in the storage unit is stored among the plurality of pieces of fragment information.
(17) The information processing method according to (16),
The other information systems include a plurality of the other information systems, and all the fragmented information other than the fragmented information stored in the storage unit among the plurality of fragmented information is stored in a distributed manner in each of the other information systems;
the control unit requests the other information systems to transmit one or more pieces of fragmented information indicated by the one or more extracted hash values, respectively.
(18) The information processing method according to (16) or (17),
The control unit performs information processing based on the one or more pieces of extracted information and one or more pieces of fragmented information acquired from the other information system, and responds with the result of the processing to the terminal of the information user.
(19) The information processing method according to any one of (16) to (18),
When the control unit detects a leak of the hash value in the storage unit, the control unit requests other information systems in which fragmented information indicated by the leaked hash value is stored to prohibit access to the fragmented information, and invalidates the leaked hash value and updates it to a new hash value.
(20) The information processing method according to any one of (16) to (19),
The information processing method, wherein the plurality of pieces of information are a plurality of pieces of information having different attributes and which are generated synchronously in association with the actions of the information owner.
(21) The information processing method according to any one of (16) to (19),
The information processing method, wherein the plurality of pieces of information are pieces of information obtained by structurally fragmenting the personal information.
(22) The information processing method according to (21),
An information processing method, wherein the personal information is a numeric string having a predetermined number of digits, and the plurality of pieces of information are pieces of information obtained by fragmenting the numeric string into numerical values for each digit.
(23) The information processing method according to any one of (16) to (22),
The information processing method, wherein the hash value is a hash value public-key encrypted by an authority.
(24) The information processing method according to any one of (16) to (23),
Identification information for identifying the other information system in which the fragmented information indicated by the hash value is stored is added to the hash value; and
The control unit requests fragment information indicated by the hash value from the other information system identified by the identification information.
(25) The information processing method according to any one of (16) to (23),
The hash value is given within a range determined for each of the other information systems.
(26) The information processing method according to any one of (16) to (23),
The control unit is configured to query a repository that manages mapping between the hash value and the other information system, and identify the other information system in which the fragmented information indicated by the hash value is stored.
(27) The control unit generates a plurality of pieces of information constituting the personal information of the information owner,
An information providing method which generates hash values of the generated fragment information, transfers a combination of one or more fragment information and one or more hash values of one or more fragment information other than the fragment information among the fragment information and the multiple hash values of the fragment information to be stored in one information system out of multiple information systems connected via a network, and transfers one or more pieces of information represented by the one or more hash values stored in the information system to be stored in a distributed manner in one or more other information systems.
(28) The information providing method according to (27),
The control unit distributes and stores multiple pieces of fragmented information in the multiple information systems, and stores hash values of all pieces of fragmented information other than the one or more pieces of fragmented information stored in each information system.
(29) The information providing method according to (27) or (28),
The control unit uses a graphical user interface to assist in determining the types of fragmented information to be distributed and stored in a plurality of information systems.
(30) The information providing method according to (29),
The control unit, when determining multiple types of fragmented information to store in one information system, guides the information owner in making a decision through a graphical user interface based on information regarding combinations of fragmented information that are preferable from a risk management perspective.

U1... Information owner U2... Information user 1... Cloud 1a... First information system 1b... Second information system 1c... Third information system 2... Owner terminal 3... User terminal 5... Personal information 10... Information system control unit 11... Information receiving unit 12... Information updating unit 13... Hash table 14... Database 15... Information request receiving unit 16... Information processing unit 17... Information reply unit 18... Query implementation unit 19a... Other bank query sending unit 19b... Other bank data receiving unit 19c... Query receiving unit 19d... Data reply unit 20... Owner terminal control unit 21... Information generating unit 22... Information collecting unit 23... Distribution policy decision unit 24... Information fragmentation unit 25... Hash generator 26... Information sending unit 31... Information request sending unit 32... Information result receiving unit 51... Repository 100... Information bank system

Claims (14)

a storage unit for storing one or more pieces of fragment information among a plurality of pieces of fragment information constituting the personal information of an information owner, and one or more hash values each indicating all the other pieces of fragment information;
a control unit that receives an information request from an information user, extracts one or more pieces of fragment information and one or more hash values corresponding to the request from the storage unit, and requests one or more pieces of fragment information indicated by the one or more extracted hash values from another information system in which fragment information other than the stored fragment information among the plurality of pieces of fragment information is stored;
Equipped with
The other information systems include a plurality of the other information systems, and all the fragmented information other than the fragmented information stored in the storage unit among the plurality of fragmented information is stored in a distributed manner in each of the other information systems;
the control unit is configured to request one or more pieces of fragment information indicated by the one or more extracted hash values, respectively, from the other multiple information systems;
the control unit is configured to perform information processing based on the one or more pieces of extracted information and the one or more pieces of fragmented information acquired from the other information system, and to respond with the result of the processing to the terminal of the information user;
The control unit is configured, when detecting leakage of the hash value of the storage unit, to request another information system in which the fragmented information indicated by the leaked hash value is stored to prohibit access to the fragmented information, and to invalidate the leaked hash value and update it to a new hash value.
Information systems. 2. The information system of claim 1 ,
The plurality of pieces of information are a plurality of pieces of information having different attributes and which are generated synchronously in association with the actions of the information owner. 2. The information system of claim 1 ,
The plurality of pieces of information are pieces of information obtained by structurally fragmenting the personal information. 4. The information system according to claim 3 ,
An information system, wherein the personal information is a numeric string having a predetermined number of digits, and the plurality of pieces of information are pieces of information obtained by fragmenting the numeric string into numeric values for each digit. 2. The information system of claim 1 ,
The hash value is a hash value public key encrypted by an authority. 2. The information system of claim 1 ,
Identification information for identifying the other information system in which the fragmented information indicated by the hash value is stored is added to the hash value; and
The control unit is configured to request fragment information indicated by the hash value from the other information system identified by the identification information. 2. The information system of claim 1 ,
The hash value is given within a range determined for each of the other information systems. 2. The information system of claim 1 ,
The control unit is configured to query a repository that manages mapping between the hash value and the other information system, and identify the other information system in which the fragmented information indicated by the hash value is stored. and a control unit that generates a plurality of pieces of fragment information constituting the personal information of an information owner, generates hash values of the generated plurality of pieces of fragment information, transfers a combination of one or more pieces of fragment information and one or more hash values of one or more pieces of fragment information other than the plurality of pieces of fragment information among the plurality of pieces of fragment information and the plurality of hash values of the fragment information to be stored in one of a plurality of information systems connected via a network, and transfers the one or more pieces of fragment information respectively indicated by the one or more hash values stored in the information system to be stored in a distributed manner in one or more other information systems. 10. An information terminal according to claim 9 ,
The control unit is configured to store multiple pieces of fragment information in a distributed manner in the multiple information systems, and to store, for each information system, hash values of all pieces of fragment information other than the one or more pieces of fragment information stored therein. An information terminal according to claim 10 ,
The information terminal is configured such that the control unit uses a graphical user interface to assist in determining the types of fragmented information to be distributed and stored in each of a plurality of information systems. 12. An information terminal according to claim 11 ,
The control unit is configured to guide the information owner in making a decision through a graphical user interface based on information regarding a combination of fragmented information that is preferable in terms of risk management when determining multiple types of fragmented information to be stored in one information system. The control unit:
receiving an information request from an information user's terminal, extracting one or more pieces of fragment information and one or more hash values corresponding to the one or more pieces of fragment information constituting the personal information from a storage unit that stores one or more pieces of fragment information and one or more hash values each representing the other one or more pieces of fragment information;
requesting one or more pieces of fragment information indicated by the one or more extracted hash values from another information system in which fragment information other than the fragment information stored in the storage unit is stored among the plurality of pieces of fragment information;
performing information processing based on the one or more pieces of fragmented information extracted and the one or more pieces of fragmented information acquired from the other information system, and responding with the result of the processing to the terminal of the information user;
When a leak of the hash value of the storage unit is detected, a request is made to another information system in which the fragmented information indicated by the leaked hash value is stored to prohibit access to the fragmented information, and the leaked hash value is invalidated and updated to a new hash value.
Information processing methods. A control unit generates a plurality of pieces of information constituting the personal information of the information owner,
a method of providing information, which generates hash values of the generated multiple pieces of fragment information, transfers a combination of one or more pieces of fragment information and one or more hash values of one or more pieces of fragment information other than the multiple pieces of fragment information among the multiple pieces of fragment information and the multiple hash values of the fragment information to be stored in one information system among multiple information systems connected via a network, and transfers one or more pieces of information represented by the one or more hash values stored in the information system to be stored in a distributed manner in one or more other information systems.

Images