JP7663121B2 - Data service providing method and system - Google Patents

Description

Embodiments of the present invention relate to a data service providing method and a data service providing system. This application claims priority based on Japanese Patent Application No. 2021-079205, filed in Japan on May 7, 2021, the contents of which are incorporated herein by reference.

There are service businesses that provide services that utilize data, including users' personal data. For example, there are data service businesses that provide customized information that is optimal for users using a wide variety of data, such as shopping history and health care information. In such data service businesses, it is desirable to be able to handle data seamlessly.

Japanese Patent Application Publication No. 2020-13193

The problem that this invention aims to solve is to provide a data service providing method and a data service providing system that can handle data seamlessly.

The data service providing method of the embodiment is a data service providing method for providing a data service to a registered user, and includes a data acquisition step for acquiring first data, an access policy setting step for setting an access policy for the first data, a data generation step for generating second data used in a data service provided to the user from the first data based on the access policy, and a data providing step for providing a data service based on the second data.

FIG. 1 is a configuration diagram of a data service providing system according to a first embodiment. FIG. 2 is a diagram showing a specific example of the data service providing system. FIG. 2 is a functional block diagram of the data service providing system. FIG. 2 is a functional block diagram of a provided data control unit of the data service providing system. FIG. 2 is a functional block diagram of an access policy control unit of the data service providing system. 11A and 11B are diagrams showing specific examples of access policies that can be set for each data provision mode in an individual user access policy. 11A and 11B are diagrams showing specific examples of consent policies in individual user access policies and access policies that can be set for each usage region. 11A and 11B are diagrams showing specific examples of access policies that can be set for each life cycle of acquired data in an individual user access policy. 13 is a diagram showing a specific example of an access policy that can set whether or not each data type of acquired data can be combined in an individual user access policy. FIG. 11 is a diagram showing a specific example of a data type handling policy. FIG. 13 is a diagram showing an example of a data item newly created based on a combination policy. FIG. 2 is a functional block diagram of a linkage information recording unit of the data service providing system. FIG. 13 is a diagram showing an example of a generated virtual table. FIG. 13 is a diagram showing another example of a generated virtual table. FIG. 2 is a functional block diagram of a data access control unit of the data service providing system. 13 is an example of a personal user application display screen. 13 is an example of a personal user application display screen. 13 is an example of a personal user application display screen. 13 is an example of a personal user application display screen. FIG. 2 is a diagram showing the data service providing system that operates in conjunction with a cooperative application of a service business.

Below, the data service providing method and data service providing system of the embodiment are described with reference to the drawings.

(First embodiment)
[Data service providing system 100]
FIG. 1 is a configuration diagram of a data service providing system 100 according to the first embodiment.
The data service providing system 100 is a system that provides data services to registered users (individual users U and service providers SP). "Providing data services" includes not only providing data itself, but also providing data analysis results and various services based on data.

The data service providing system 100 is composed of one or more servers. The basic infrastructure of the data service providing system 100 is constructed using a known data distributed processing system. The functions of the data service providing system 100 are realized by a program executed in the processor of the server.

FIG. 2 is a diagram showing a specific example of the data service providing system 100. As shown in FIG.
2 includes servers SV1, SV2, SV3, and SV4. The servers SV1, SV2, SV3, and SV4 are servers including hardware such as a processor such as a CPU, a memory, a recording medium such as a hard disk or a flash memory, and a communication device.

The servers SV1, SV2, SV3, and SV4 may be servers with different types of OS, software, etc. Furthermore, the servers SV1, SV2, SV3, and SV4 may be operated by different operating entities. The servers SV1, SV2, SV3, and SV4 may be installed in different countries or different regions.

All hardware and software resources of servers SV1 and SV2 are occupied by the data service providing system 100. On the other hand, only a portion of the hardware and software resources of servers SV3 and SV4 are provided to the data service providing system 100. In other words, the data service providing system 100 may be a system that combines on-site servers such as servers SV1 and SV2 with cloud servers such as servers SV3 and SV4 that provide IaaS (Infrastructure as a Service), PaaS (Platform as a Service), or SaaS (Software as a Service). In the following explanation, "server" includes any of the above servers.

The functional blocks of the data service providing system 100 described below (data acquisition unit 1, access policy control unit 2, collaboration control unit 3, provided data generation unit 4, data access control unit 5, etc.) are realized by the operation of servers (e.g., servers SV1, SV2, SV3, SV4 illustrated in FIG. 2) that are distributed and arranged via the network NW. Note that the functional blocks of the data service providing system 100 may be realized by the operation of a single server.

As shown in Figure 1, the data service providing system 100 is connected via a network NW to a data device 200 managed by a data provider DP, a terminal 300 (hereinafter referred to as personal terminal 300) such as a smartphone, tablet terminal, or personal computer owned by an individual user U, a management device 400 owned by an administrator A of the data service providing system 100, and a service providing device 500 owned by a service provider SP. The data device 200, management device 400, and service providing device 500 may be a system composed of one or more servers.

The network NW may be a wide area network (WAN) such as the Internet, a private network (LAN) within the building in which the data service providing system 100 is installed, or a combination of these. The network NW may be either wired or wireless. Other devices such as access points may be involved in communication between the devices.

FIG. 3 is a functional block diagram of the data service providing system 100. As shown in FIG.
The data service providing system 100 includes a data acquisition unit 1 , an access policy control unit 2 , a cooperation control unit 3 , a provided data generation unit 4 , and a data access control unit 5 .

The data acquisition unit 1 acquires data including personal data of an individual user U from the data device 200 of the data provider DP and records it as acquired data (first data) D. The data access control unit 5 controls the system to respond to data service requests from service providers SP, etc. The provided data generation unit 4 generates provided data (second data) from the acquired data (first data) D in response to a data access request via the data access control unit 5. The access policy control unit 2 controls the access policy for the acquired data (first data) D when generating the provided data (second data). The collaboration control unit 3 controls collaboration with a service business SB (Service business) and a data provision business DB (Data provision business).

[Data Acquisition Unit 1]
FIG. 4 is a functional block diagram of the data acquisition unit 1.
The data acquisition unit 1 acquires data including personal data of an individual user U from a data device 200 of a data provider DP, and records the data as acquired data (first data) D (data acquisition step). In addition, the data acquisition unit 1 provides the acquired data D to a provided data generation unit 4. The data acquisition unit 1 has a data import interface 11 and an acquired data recording unit 12.

The data import interface 11 is an interface for acquiring data from the data device 200 of the data provider DP. The data device 200 of the data provider DP provides data, including personal data of an individual user U, acquired with the consent of the individual user U to the data service providing system 100 via the data import interface 11.

The data import interface 11 acquires data from the data device 200 of the data provider DP based on a contract with the data provider DP, and records the data in the acquired data recording unit 12. For example, the data import interface 11 periodically acquires data in bulk from the data device 200 of the data provider DP and updates the acquired data D recorded in the acquired data recording unit 12 (bulk type). The data import interface 11 may also acquire data in real time from a device connected via an API (Application Programming Interface) (streaming type).

The acquired data recording unit 12 is a data storage that records acquired data (first data) D acquired from the data provider DP. The acquired data (first data) D may be the raw data acquired from the data provider DP, or may be processed data that has been processed into a standard data format by a data processing unit (not shown). The processed data is, for example, statistical data, aggregated data, anonymized data, etc.

In this embodiment, the data service providing system 100 has three data acquisition units 1. In the following description, when distinguishing between the three data acquisition units 1, they are referred to as a first data acquisition unit 1A, a second data acquisition unit 1B, and a third data acquisition unit 1C, respectively.

The data acquisition unit 1 (first data acquisition unit 1A, second data acquisition unit 1B, and third data acquisition unit 1C) acquires and records acquired data D including multiple data types with different handling policies. Data including multiple data types with different handling policies is also called a "data group."

The first data acquisition unit 1A acquires and records purchasing data D1 provided by the first data providing business DB1, for example, from a data device 200 (hereinafter also referred to as "data device 200A") managed by the data provider DP1. The purchasing data D1 is, for example, purchasing detail data on a receipt and payment data. The data import interface 11 (hereinafter also referred to as "data import interface 11A") of the first data acquisition unit 1A is an interface capable of acquiring purchasing data D1 from the data provider DP1.

The second data acquisition unit 1B acquires and records HR (Human Resources) data D2 provided by the second data providing business DB2, for example, from a data device 200 (hereinafter also referred to as "data device 200B") managed by the data provider DP2. The HR data D2 is, for example, personnel order data, attendance data, salary data, and training data. The data import interface 11 (hereinafter also referred to as "data import interface 11B") of the second data acquisition unit 1B is an interface capable of acquiring the HR data D2 from the data provider DP2.

The third data acquisition unit 1C acquires and records health data D3 provided by the third data provision business DB3, for example, from a data device 200 (hereinafter also referred to as "data device 200C") managed by the data provider DP3. The health data D3 is, for example, health checkup data and daily vital health data. The data import interface 11 (hereinafter also referred to as "data import interface 11C") of the third data acquisition unit 1C is an interface capable of acquiring health data D3 from the data provider DP3.

The data import interface 11 (data import interface 11A, data import interface 11B, and data import interface 11C) differs depending on the type of data handled and the data provider. Note that the data import interface 11 may be a general-purpose interface that can be used regardless of the type of data handled or the data provider.

The data acquisition unit 1 (first data acquisition unit 1A, second data acquisition unit 1B, and third data acquisition unit 1C) is a distributed storage provided in different servers, and can store the acquired data D including multiple data types with different handling policies in a distributed manner. The data acquisition unit 1 (first data acquisition unit 1A, second data acquisition unit 1B, and third data acquisition unit 1C) may be provided on the same server. The acquired data D may be data including personal data such as the three education data (intellectual education data, physical education data, moral education data), education attendance data, qualification acquisition data, medical examination data, power consumption data, gas usage data, water usage data, communication details data, schedule data, music/video viewing data, etc.

In this embodiment, "purchase data", "HR data", and "health data" are used as examples of multiple data types with different handling policies, but the multiple data types with different handling policies are not limited to this. For example, when purchasing data is acquired from multiple different data providers, it may be treated as acquired data including a single data type with different handling policies. In addition, purchasing data obtained by using an electronic receipt mechanism that is difficult for an individual user U to tamper with or counterfeit, and purchasing data input by an individual user U through camera photography or manual input using a predetermined application running on a mobile terminal or the like based on information written on a paper receipt (medium reliability purchasing data) may be treated as acquired data including data types with different handling policies. Furthermore, acquired data including data types with different handling policies are not limited to data acquired from a data provider. Data acquired directly from an individual user U by an operator of the data service providing system 100 may also be treated as acquired data including data types with different handling policies.

[Access policy control unit 2]
FIG. 5 is a functional block diagram of the access policy control unit 2.
The access policy control unit 2 controls the access policy for the acquired data D recorded in the acquired data recording unit 12. The access policy refers to whether or not access to the acquired data D is permitted, the access conditions, etc. The access policy may include information on the deletion deadline for the acquired data D, the data usage deadline after conversion, such as anonymization, from the raw data at the time of acquisition, and the life cycle, etc. The access policy may include information on whether or not combined use with different types of data is permitted. The access policy control unit 2 has an access policy interface 21 and an access policy recording unit 24.

The access policy interface 21 is an interface connected to the personal terminal 300 and the management device 400 owned by administrator A of the data service providing system 100. Specifically, the access policy interface 21 includes an API that connects the personal terminal 300 and the management device 400 with the access policy recording unit 24. The access policy interface 21 has a personal user interface 22 and an administrator interface 23.

The personal user interface 22 includes an API that connects the personal terminal 300 and the access policy recording unit 24. The personal user interface 22 also connects the personal terminal 300 and the data access control unit 5, as shown in FIG. 3.

The administrator interface 23 includes an API that connects the management device 400 owned by administrator A and the access policy recording unit 24.

The access policy recording unit 24 records the access policy for the acquired data D. The access policy recorded in the access policy recording unit 24 is managed by an individual user U and an administrator A via the access policy interface 21. The access policy recording unit 24 has a first access policy recording unit 25 and a second access policy recording unit 26.

The first access policy recording unit 25 records the access policy set by the individual user U via the individual user interface 22. The access policies recorded by the first access policy recording unit 25 include an individual user access policy 251 and a comprehensive access policy 252.

The individual user access policy 251 is an access policy set for each individual user U regarding whether or not the service business S can access the acquired data D including the personal data of the individual user U. The individual user access policy 251 is an access policy set for the personal data of the individual user U for various conditions, such as for each data providing business DB that provided the acquired data D, for each service business SB that uses the acquired data D, for each data type or purpose of use of the acquired data D, for each data providing mode, for each consent policy, for each region of use, and for each life cycle of the acquired data D. The individual user U can set the individual user access policy 251 for all combinations of these conditions.

The access policy that can be set for each data providing business DB in the individual user access policy 251 is, for example, whether data access is permitted when the data providing business DB that provided the acquired data D is the "first data providing business DB1" or the "second data providing business DB2."

The access policy that can be set for each service business SB in the individual user access policy 251 is, for example, data access permission when the service business SB is the "first service business SB1" or the "second service business SB2". The access policy may be data access permission that can be set for each service provider SP, such as "service provider SP1" that provides the "first service business SB1" and the "second service business SB2". The access policy may also be data access permission that can be set for each provider category that classifies the service providers SP, such as "medical care", "finance", "entertainment", and "academic institutions".

The access policy that can be set for each service business SB in the individual user access policy 251 is, for example, whether data access is permitted based on attribute information such as business category, industry, or business type, such as when the service business SB is a "public utility business" or a "profit-making business."

The access policy that can be set for each data type in the individual user access policy 251 is, for example, whether or not data access is permitted when the data type is "purchase data D1" or "health data D3."

The access policy that can be set for each purpose of use in the individual user access policy 251 is, for example, whether data access is permitted when the purpose of use is "statistical use that does not identify an individual" or "non-statistical use that identifies an individual." Note that "identifying an individual" may include cases where the personally identifiable information does not identify an individual but can identify different individual users.

Figure 6 is a diagram showing a specific example of an access policy that can be set for each data provision mode in the individual user access policy 251. The specific example shown in Figure 6 is matrix data in which an access policy is set for each data type and data provision mode. The access policy that is set is whether or not the service business SB can access the acquired data D, specifically "service business SB that agrees to use" and "service business SB that does not agree to use." The figure in parentheses indicates the purpose of use.

For example, in the specific example shown in Figure 6, when the data type is purchasing data, consent has been given to the corporate service business S0001 (shown as "Company S0001" in Figure 6) that data can be provided in a form that identifies an individual if the purpose of use is service collaboration. Also, in the specific example shown in Figure 6, provision of data in a form that identifies an individual is suspended (prohibited) to the corporate service business S1001 (shown as "Company S1001" in Figure 6) regardless of the purpose of use.

For example, in the specific example shown in Figure 6, it has been agreed that data may be provided in anonymized form to the corporate service business 2001 (shown as "Company S2001" in Figure 6) if the purpose of use is for product development by the company providing the corporate service business 2001. Also, in the specific example shown in Figure 6, there is no service business SB for which the provision of data in anonymized form has been suspended (prohibited).

For example, in the specific example shown in Figure 6, if the data type is purchasing data, the provision of data in the form of statistical data obtained by statistically processing the "purchasing data" is comprehensively agreed to for all service businesses SB. Also, in the specific example shown in Figure 6, if the data type is health data, the provision of data in the form of statistical data obtained by statistically processing the "health data" is comprehensively agreed to for medical service businesses SB.

Figure 7 is a diagram showing a specific example of the consent policy in the individual user access policy 251 and the access policy that can be set for each region of use. For example, in the specific example shown in Figure 7, for a member (individual user U) with member ID: #0081100100000002, if the data type of the acquired data D is purchase data and raw data that can identify an individual is provided, the consent of the member (consent each time) is required each time the service business SB uses it, and an access policy is set that limits the region of use to Japan.

Figure 8 is a diagram showing a specific example of an access policy that can be set for each life cycle of acquired data D in individual user access policy 251. For example, in the specific example shown in Figure 8, for a member (individual user U) with member ID: #0081100100000002, an access policy is set in which the data type of acquired data D is purchase data, the raw data of the purchase data is stored for three years, and the usage period for the raw data of the purchase data that has been pseudonymized is up to three years after withdrawal.

Figure 9 is a diagram showing a specific example of an access policy that can set whether or not to allow combinations of each data type of acquired data D in individual user access policy 251. For example, in the specific example shown in Figure 9, for a member (individual user U) with member ID: #0081100100000002, an access policy is set that allows purchasing data to be combined with different data (purchasing data, HR data, health data, educational training data, education attendance data, qualification acquisition data, communication details data, schedule data, viewing data) and provided (however, depending on the combination, the destination may be limited to health businesses, medical institutions, etc.). Note that different data here is not limited to data of different data types, but also includes data of the same type but from different sources, etc.

The individual user access policy 251 shown in Figures 7 to 8 can also be set for each individual user U. Note that the individual user access policy 251 shown in Figures 7 to 8 may be common to individual users U belonging to a set group or to all individual users U.

The comprehensive access policy 252 is an access policy that comprehensively specifies the individual user access policies 251. The comprehensive access policy 252 roughly indicates whether or not access to the personal data of an individual user U is permitted, for example, by using a gradual index from level 1 to level 5. By setting the comprehensive access policy 252, an individual user U can roughly set the individual user access policy 251 for each individual user U, without having to set all of the individual user access policies 251.

In the following description, "individual user access policy 251" includes individual user access policy 251 that is loosely set by comprehensive access policy 252.

A personal user U can access the personal user access policy 251 using an application implemented using the API of the personal user interface 22. The application may be a native application running on the personal terminal 300, or a web application running on the data service providing system 100. In the following description, an application implemented using the API of the personal user interface 22 is also referred to as a "personal user application AP1."

The second access policy recording unit 26 records the access policy set by the administrator A via the administrator interface 23. The access policies recorded by the second access policy recording unit 26 include virtual table definition information 261, a data type handling policy 262, a data type combination policy 263, and a service business access policy 264.

The virtual table definition information 261 is definition information used to set an access policy, and defines the specifications of the virtual table T generated by the provided data generation unit 4. The specifications defined in the virtual table definition information 261 are, for example, a schema indicating the structure and data items (columns) of the virtual table T. The "data item" is the type of data (content, data type, etc.) handled by the virtual table T.

Data items that are not defined in the virtual table definition information 261 cannot be accessed from the data access control unit 5. The data items to be defined may be data items that are already included in the acquired data D, or may be newly created data items by combining data items from different acquired data D.

The data type handling policy 262 is an access policy that sets the handling of acquired data D for each data type. The data type handling policy 262 is, for example, a handling policy for purchasing data D1, a handling policy for HR data D2, and a handling policy for health data D3. By setting a handling policy for each data type, the data service providing system 100 can handle a wide variety of acquired data D.

FIG. 10 is a diagram showing a specific example of the data type handling policy 262. As shown in FIG.
The acquired data D is classified into one of five information handling levels based on the data type, as shown in Fig. 10. The data type handling policy 262 sets, for example, a means of identity verification of the individual user U, a means of authenticating the individual user U, a regional restriction on the storage area of the acquired data D, a data storage method, etc. for each of the five information handling levels. Note that the information handling levels shown in Fig. 10 are values indicating that the larger the number, the stricter the restrictions on the handling of data.

The data type combination policy 263 is an access policy that sets a combination of acquired data D of different data types. The data type combination policy 263 is, for example, a rule for using purchasing data D1 and health data D3 in combination.

Figure 11 is a diagram showing an example of a data item newly created based on the data type combination policy 263. Data items of acquired data D of different data types are combined and used as a new data item based on the data type combination policy 263. For example, as shown in Figure 11, the data items "food purchase date and time" and "name of purchased food" of purchasing data D1 and the data item "exercise date and time" of health data D3 are combined and used as a new data item "name of food purchased before and after exercise". By setting the data type combination policy 263, it is possible to easily generate a new data item that seamlessly associates data items of data types with different handling policies.

It is preferable that the information handling level for data combining acquired data D with different information handling levels is set to the highest information handling level of the acquired data D used in the combination. For example, the information handling level for data combining purchasing data with information handling level 2 and HR data with information handling level 3 is "3." Note that data types may be further subdivided and information handling levels set for each data item. In this way, if the HR data includes a data item that contains My Number information, the data item can be set to an information handling level appropriate for specific personal information handling.

The data type combination policy 263 may be a rule for combining and using acquired data D with different reliability levels. For example, the acquired data D includes purchase data (high reliability purchase data, first purchase data) obtained using an electronic receipt mechanism that is difficult for an individual user U to modify or forge, and purchase data (medium reliability purchase data, second purchase data) input by an individual user U through camera photography or manual input using a predetermined application running on a mobile terminal or the like based on information written on a paper receipt. In this case, the data type combination policy 263 may be a rule for prohibiting the combination of high reliability purchase data (first purchase data) and medium reliability purchase data (second purchase data) with different reliability levels. This makes it possible to prohibit the combination of high reliability purchase data (first purchase data) that is difficult to modify or forge, and is free of misjudgments by applications on a mobile terminal or the like or erroneous input by an individual user, with the second purchase data with a relatively low reliability level, thereby providing a highly reliable data service.

The service business access policy 264 is an access policy set for each service business SB based on a contract with the service provider SP, etc., specifying whether the service business SB can access the acquired data D. The service business access policy 264 is set for each "data item" defined in the virtual table definition information 261. The service business access policy 264 can be set comprehensively, for example, so as not to allow the first service business SB1 to access all data items related to the HR data D2.

The administrator A can access the first access policy recording unit 25 and the second access policy recording unit 26 using an application implemented using the API of the administrator interface 23. The application may be a native application that runs on the management device 400 owned by the administrator A, or a web application that runs on the data service providing system 100.

[Cooperation control unit 3]
FIG. 12 is a functional block diagram of the cooperation control unit 3.
The linkage control unit 3 controls the mutual linkage between the individual user U, the service business SB, and the data providing business DB. The linkage control unit 3 has a linkage interface 31 and a linkage information recording unit .

The collaboration interface 31 is an interface that is connected to the service providing device 500 owned by the service provider SP and the management device 400 owned by the administrator A of the data service providing system 100. Specifically, the collaboration interface 31 includes an API that connects the service providing device 500 and the management device 400 with the collaboration information recording unit 34. The collaboration interface 31 has a service business collaboration interface 32 and an administrator collaboration interface 33.

The service business collaboration interface 32 includes an API that connects the service providing device 500 owned by the service provider SP and the collaboration information recording unit 34.

The administrator collaboration interface 33 includes an API that connects the management device 400 owned by administrator A to the collaboration information recording unit 34.

In addition, the collaboration interface 31 may have a data provision business collaboration interface that connects the data device 200 owned by the data provider DP to the collaboration information recording unit 34.

The association information recording unit 34 records association information of users of the data service providing system 100. The association information recording unit 34 has a business association information recording unit 35 and an individual user association information recording unit 36. The business association information recording unit 35 records data provision business association information 351 and service business association information 352.

The data provision business collaboration information 351 includes metadata indicating details such as member ID data (hereinafter referred to as "first linked member ID data") and item code included in the data provided by the data provider DP in the data provision business DB. The data provision business collaboration information 351 also includes contract management information (which may include terms of use and consent data for the terms of use) that specifies the contents of the usage contract with the data provider DP.

The service business collaboration information 352 is data showing details such as the member ID data (hereinafter referred to as "second linked member ID data") used in the service business SB. The second linked member ID data is used by the service business SB when reading data via the data access control unit 5. The service business SB can update the service business collaboration information 352 and obtain collaboration information via the service business collaboration interface 32. The service business collaboration information 352 also includes contract management information (which may include terms of use and consent data for the terms of use) including the contents of the service contract for the service business SB with the service provider SP.

The personal user association information recording unit 36 records data such as the member ID data of a registered personal user U who uses the data service providing system 100. The administrator A can update the data recorded in the personal user association information recording unit 36 via the administrator association interface 33.

The linkage control unit 3 generates linkage information that associates the first linked member ID data and the second linked member ID data with the member ID data in the related individual user linkage information recording unit 36. This allows the individual user U, the service business SB, and the data providing business DB to link with each other in the data service provided by the data service providing system 100.

In addition, the first linked member ID data and the second linked member ID data may not be member ID data itself, but may be data indicating linkage information.

[Provision data generation unit 4]
The provided data generation unit 4 generates provided data (second data) from the acquired data (first data) D in response to a data access request from a registered user (individual user U and service provider SP) via the data access control unit 5. The data that the registered user (individual user U and service provider SP) can read via the data access control unit 5 is not the acquired data D recorded in the acquired data recording unit 12, but the provided data (second data).

The provided data generating unit 4 generates a virtual table T corresponding to the data access request as provided data (second data). The virtual table T is a table that is generated for each data access request and is not recorded in its entirety in a non-volatile recording unit. The provided data generating unit 4 responds to a data access request from the data access control unit 5 based on the generated virtual table T. As shown in FIG. 3, the provided data generating unit 4 has an access control integration unit 41 and a virtual table generating unit 42.

In response to a data access request from the data access control unit 5, the access control integration unit 41 integrates the access policy recorded in the access policy recording unit 24 and the linkage information generated in the linkage information recording unit 34 to generate "access control information."

The generated access control information includes an individual user access policy 251 for the personal data of multiple individual users U contained in the acquired data D acquired by a data access request from the data access control unit 5.

The generated access control information includes the service business access policy 264 set for the service business SB that made the data access request.

The generated access control information includes association information that associates the member ID data in the personal user association information recording unit 36 with the first associated member ID data and the second associated member ID data.

The virtual table generation unit 42 generates a virtual table (second data) T from the acquired data (first data) D based on the access control information generated by the access control integration unit 41.

Specifically, the virtual table generation unit 42 acquires from the data acquisition unit 1 the acquisition data D required to respond to a data access request from the data access control unit 5 based on the linkage information, etc., contained in the access control information.

Specifically, the virtual table generating unit 42 generates a virtual table (second data) T from the acquired data (first data) D based on the individual user access policy 251 included in the access control information. For example, if an individual user U restricts the use of personal data for the service business SB that made the data access request or for the purpose of use, the virtual table generating unit 42 generates a virtual table T that does not include and deletes the relevant personal data.

Specifically, the virtual table generating unit 42 generates a virtual table (second data) T from the acquired data (first data) D based on the service business access policy 264 included in the access control information. For example, if an individual user U restricts the use of a specific data item for the service business SB that has made a data access request, the virtual table generating unit 42 generates a virtual table T that does not include and deletes the relevant data item.

FIG. 13 is a diagram showing an example of the virtual table T that is generated.
The virtual table generation unit 42 generates a virtual table T for each service business SB for which a data access request has been made. For example, as shown in FIG. 13, the virtual table generation unit 42 creates a first virtual table T1 for a data access request from a first service business SB1. The virtual table generation unit 42 also creates a second virtual table T2 for a data access request from a second service business SB2. The virtual table generation unit 42 also creates a third virtual table T3 for a data access request from a third service business SB3. However, when the access control information for multiple data access requests is the same, the virtual table generation unit 42 may generate only one virtual table T to respond to multiple data access requests with the same access control information.

FIG. 14 is a diagram showing another example of the virtual table T to be generated.
The virtual table generating unit 42 may generate a hierarchical virtual table T linked in multiple stages. For example, as shown in FIG. 14, the hierarchical virtual table T4 is linked to a virtual table of purchase data (upper virtual table), a virtual table in which purchase data of a specific region is extracted from the upper virtual table, and a virtual table in which purchase data of a specific product is extracted from the upper virtual table. In addition, the hierarchical virtual table T5 is linked to a virtual table in which purchase data and HR data are merged based on the data type combination policy 263 (upper virtual table), a virtual table which is statistical data calculated from the upper virtual table, and a virtual table in which anonymization processing is performed on the upper virtual table based on the individual user access policy 251. By constructing the virtual table T hierarchically, the virtual table generating unit 42 can omit duplicated processing when generating the virtual table T.

The access policy of a hierarchical virtual table T may inherit the access policy of an upper-layer virtual table. For example, in a hierarchical virtual table T4, when the virtual table of purchasing data (upper-layer virtual table) is at information handling level 2, the lower-layer virtual table T linked to the virtual table of purchasing data (upper-layer virtual table) may inherit information handling level 2.

In the hierarchical virtual table T5, the virtual table that has been anonymized from the upper virtual table, which has an information handling level of 3, has been changed to information that cannot be used to identify individuals. Therefore, the information handling level of the anonymized virtual table may be lowered compared to the upper virtual table, to an information handling level of 2.

[Data access control unit 5]
FIG. 15 is a functional block diagram of the data access control unit 5.
The data access control unit 5 responds to a data service request from a registered user (individual user U and service provider SP). After receiving the data service request, the data access control unit 5 issues a data access request to the provided data generation unit 4 in order to access the provided data (second data) required to provide the requested data service. The data access control unit 5 provides a data service to the data service requester based on the provided data (second data) acquired from the provided data generation unit 4. The provision of the data service includes not only the provision of the data itself, but also the provision of data analysis results and the provision of various services based on the data. In addition, examples of a method of providing a data service include a method of allowing a user to access the provided data generated in the data service providing system 100, and a method of sending the generated provided data to the user via a specified network. Each data service request includes an ID or the like that can be identified by the service provider SP, service business SB, or individual user U that is the access source, and each data service requester can be identified.

The data access control unit 5 has a data access interface 52 for the service business and a data access interface 53 for individual users.

The service business data access interface 52 includes an API that connects the service providing device 500 owned by the service provider SP and the provided data generation unit 4. The service business SB can receive data services from the data service providing system 100 via the service business data access interface 52.

The service business data access interface 52 includes, for example, an API for data search, an API for data analysis, and an API for visualizing the results of data analysis.

The personal user data access interface 53 connects the personal user interface 22 and the provided data generation unit 4. Via the personal user interface 22 and the personal user data access interface 53, the personal user U can check how his/her own personal data is being accessed by the service business SB.

[Operation of the data service providing system 100]
Next, a description will be given of the operation of the data service providing system 100. Figures 16 to 19 show examples of display screens of the personal user application AP1 operating on the personal terminal 300.

The personal user application AP1 is an application implemented using the API of the personal user interface 22. A personal user U can access the personal user access policy 251 using the personal user application AP1. The personal user application AP1 shown in FIG. 16 displays the personal user access policy setting window 301.

The personal user access policy setting window 301 is composed of a first window 302 for setting a personal user access policy 251 for each service business SB, a second window 303 for setting a personal user access policy 251 for each data type, and a third window 304 for setting a personal user access policy 251 for each purpose of use.

In the first window 302, the individual user U can use the switch button SW to set whether or not to allow access to the personal data of the individual user U for each service business SB. In the example shown in FIG. 16, access to the personal data is permitted from the first service business SB1 and the second service business SB2, but access to the personal data is not permitted from the third service business SB3 and the fourth service business SB4.

There may be cases where the service business SB prepares an associated application AP2 that runs on the personal terminal 300. In this case, the personal user application AP1 may initiate an association between the data service providing system 100 and the associated application AP2 when the personal user U selects to allow access to the service business.

In the second window 303, the individual user U can use the switch button SW to set whether or not to allow access to the personal data of the individual user U for each data type. In the example shown in FIG. 16, access to personal data related to purchasing data D1 and health data D3 is permitted, but access to personal data related to HR data D2 is not permitted.

In the third window 304, the individual user U can use the switch button SW to set whether or not to permit access to the personal data of the individual user U for each purpose of use. In the example shown in FIG. 16, access to the personal data is permitted when the purpose of use is "statistical use without identifying the individual," but access to the personal data is not permitted when the purpose of use is "non-statistical use with identifying the individual."

The personal user access policy 251 that can be set in the personal user application AP1 may be able to set whether or not to allow access to personal data for each purpose of use for each data type. For example, the personal user access policy 251 for purchasing data D1 can be set to consent to both "statistical use that does not identify individuals" and "non-statistical use that identifies individuals." On the other hand, the personal user access policy 251 for HR data D2 can be set to consent to "statistical use that does not identify individuals" but not to "non-statistical use that identifies individuals."

Data combining purchasing data D1 and HR data D2 may be set as not permitted if access to either one of them is not permitted, but may also be set as allowing access to the combined data if either one of them is permitted.

The setting items for "non-statistical use that could identify an individual" may be subdivided. For example, it may be possible to set whether or not to permit "non-statistical use that could identify an individual" for each "purpose of use A" that uses all data items of a single purchasing data, or for each "purpose of use B" that uses purchasing data that corresponds to a specific purchasing area or specific product.

In addition, the individual user access policy 251 may be set primarily based on the purpose of use, for example, if the purpose of use is for medical research purposes, so that the use of purchasing data D1, HR data D2, and health data D3 is generally "allowed."

All of the personal user access policies 251 set in the personal user access policy setting window 301 are taken into consideration when the provided data generation unit 4 generates the provided data (second data). If at least one of the set personal user access policies 251 is "not permitted," the corresponding personal data is not used in the provided data (second data).

The personal user application AP1 shown in Figure 17 displays an access status confirmation window 305. The access status confirmation window 305 displays the access status for personal data for each service business SB obtained via the personal user data access interface 53.

The access status confirmation window 305 is composed of a fourth window 306 that displays the access status to personal data from the first service business SB1, and a fifth window 307 that displays the access status to personal data from the third service business SB3.

The settings in the first window 302 allow the first service business SB1 to access personal data. However, the settings in the second window 303 do not allow access to personal data related to HR data D2. Therefore, in the fourth window 306, purchasing data D1 and health data D3 are displayed, and HR data D2 is not displayed and is unavailable.

On the other hand, due to the settings in the first window 302, access to personal data from the third service business SB3 is not permitted. Therefore, in the fifth window 307, all data is not displayed and is unavailable.

An individual user U can use the access status confirmation window 305 to check how the individual user U's own personal data is being accessed by each service business SB, and can easily and reliably set an individual user access policy 251 using the individual user access policy setting window 301 (access policy setting step).

The access status confirmation window 305 shown in FIG. 17 shows a data display that lists only data items, which is the simplest example. The access status confirmation window 305 may show more complex data displays, such as data analysis results. In addition to the access status, the access status confirmation window 305 may show incentives acquired by the individual user U through the access. For example, the access status confirmation window 305 may show points or virtual currency acquired in one access, the degree of contribution to the global environment, and the degree of contribution to medical research. The access status confirmation window 305 may also show messages or requests from the accessing entity (service business SB) to the individual user U.

The personal user application AP1 shown in FIG. 18 displays a comprehensive access policy setting window 310. The personal user U may not set all of the personal user access policies 251 individually, but may select a comprehensive access policy 252 from a plurality of pre-prepared templates at the personal user U's discretion. The personal user U can use the radio button RB in the comprehensive access policy setting window 310 to select a comprehensive access policy 252 from a plurality of pre-prepared templates.

In the example shown in Figure 18, if individual user U selects mode X, the individual user U sets all of the individual user access policies 251. As shown in Figure 16, permission or denial of access is set individually for individual user U, all service businesses, data types, and purposes of use.

If an individual user U selects mode Y, and the data usage purpose of the service business SB of the service provider SP that uses the acquired data D is "medical research," "drug discovery research," or "earth life research," the comprehensive access policy 252 to which the individual user gives comprehensive consent is selected. If the data usage purpose of the service business SB is anything other than that, the individually set individual user access policy 251 is selected.

When individual user U selects mode Z, a template of a personal user access policy previously set by administrator A or another individual user is referenced and set as the individual user's own personal user access policy 251. Individual user U may customize the selected template and set his or her own personal user access policy 251. The template of the personal user access policy 251 may be created not only by administrator A or another individual user, but also by a template creation service provider.

The personal user application AP1 shown in FIG. 19 displays a recommended comprehensive access policy window 320. The comprehensive access policy window 320 displays a popular template ranking and recommended template candidates that are recommended based on the personal user's attributes, owned data, etc. By selecting an appropriate template from the recommended templates, the personal user U can reduce the burden of setting all of the personal user access policy 251.

Figure 20 is a diagram showing a data service providing system 100 that operates in conjunction with a collaborative application AP2 of a service business SB.

The linked application AP2 first transmits an authentication request to the data service providing system 100 to receive the provision of data services (authentication step). The data service providing system 100 receives the authentication request via the service business linkage interface 32 and checks the service business linkage information 352 recorded in the linkage information recording unit 34. If the data service is possible for the service business SB that has requested the authentication request, the service business linkage interface 32 transmits an authentication result to the linked application AP2. Here, if the data service is not possible for the service business SB that has requested the authentication request, the data service providing system 100 may transmit an authentication error result to the linked application AP2.

Next, the cooperative application AP2 sends a data service request to the data service providing system 100. The data service providing system 100 receives the data service request via the service business data access interface 52 and checks the data service content. The service business data access interface 52 issues a data access request to the provided data generation unit 4 to access the provided data (second data) required to provide the requested data service.

Next, the provided data generation unit 4 generates a virtual table T as provided data (second data) from the acquired data (first data) D in response to the data access request (data generation step). The provided data generation unit 4 creates a virtual table T each time in response to a data access request, thereby generating a virtual table T that constantly reflects the access policy that changes from moment to moment. The data access control unit 5 can provide a data service using the provided data that reflects the latest access policy.

The provided data generation unit 4 may cache the created virtual table T as temporary storage. When the next data access request occurs, the provided data generation unit 4 may reuse all or part of the cached virtual table T if the associated access policy has not been updated. By using the cached data (cache data) as temporary storage, the provided data generation unit 4 can reduce the processing load of generating the virtual table T.

Next, the service business data access interface 52 provides a data service based on the virtual table T (data provision step).

According to the embodiment described above, by setting an access policy for each data type and registered user (individual user U and service provider SP) for acquired data D including multiple data types with different handling policies, it is possible to more seamlessly manage a wide variety of acquired data D with different information management methods and handling. In addition, acquired data D including personal data of individual user U can be managed more strictly. In addition, even for acquired data including a single data type, it is possible to appropriately manage the data based on each access policy.

(Modification)
In each of the above embodiments, the provided data generating unit 4 generates a virtual table T as the provided data (second data), but the provided data generating unit 4 may generate a real table as the provided data (second data). The real table is a table that is pre-recorded in a non-volatile recording unit before a data access request. The provided data generating unit 4 periodically generates or updates the real table as the provided data based on specific specifications (for example, the provided data used for "statistical use without identifying individuals"). By using such a real table, the provided data generating unit 4 can reduce the processing load of generating the provided data.

The above-mentioned embodiment may be realized by recording the program in a computer-readable recording medium, reading the program recorded in the recording medium into a computer system, and executing it. The term "computer system" as used herein includes hardware such as an OS and peripheral devices. The term "computer-readable recording medium" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and CD-ROMs, and storage devices such as hard disks built into a computer system. The term "computer-readable recording medium" may also include devices that dynamically hold a program for a short period of time, such as a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line, and devices that hold a program for a certain period of time, such as a volatile memory inside a computer system that is a server or client in such a case. The above-mentioned program may be for realizing part of the above-mentioned functions, or may be capable of realizing the above-mentioned functions in combination with a program already recorded in the computer system.

Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the gist of the invention. These embodiments and their modifications are within the scope of the invention and its equivalents as set forth in the claims, as well as the scope and gist of the invention.

100...data service providing system, 1...data acquisition unit, 2...access policy control unit, 3...linkage control unit, 4...provided data generation unit, 5...data access control unit, 251...individual user access policy, 262...data type handling policy, 263...data type combination policy, 264...service business access policy

Claims (18)

A data service providing method for providing a data service to a registered user, comprising the steps of:
A data acquisition step of acquiring first data including a plurality of data having different handling policies;
an access policy setting step of setting an access policy for the first data;
a data generating step of generating second data used for a data service to be provided to the user from the first data based on the access policy;
a data providing step of providing a data service based on the second data;
Equipped with
the access policy includes a data combination policy that sets a combination of data of the first data that have different handling policies,
The data generating step generates the second data including data obtained by combining data of the first data, the data having different handling policies, based on the data combination policy.
Data service delivery method. The first data is stored in a distributed manner for each data item having a different handling policy.
The data service providing method according to claim 1 . The plurality of data with different handling policies include at least one of purchase data, HR data, and health data.
3. The data service providing method according to claim 1 or 2. The second data includes a new data item obtained by combining data items of the first data having different handling policies .
The data service providing method according to claim 1 . The user includes a service provider,
the access policy includes a service business access policy in which whether or not the service business of the service provider is allowed to access the first data is set for each of the service businesses;
The data service providing method according to any one of claims 1 to 4 . The users include individual users and service providers,
the access policy includes an individual user access policy in which whether or not the service provider can access the first data through the service business of the service provider is set for each individual user;
The data service providing method according to any one of claims 1 to 4 . The individual user access policy includes a policy indicating whether the access is permitted for each of the service businesses.
The data service providing method according to claim 6 . The individual user access policy includes a policy indicating whether the access is permitted for each purpose of use.
8. A method for providing data services according to claim 6 or 7 . The access policy setting step includes a step of the individual user setting the individual user access policy.
The data service providing method according to any one of claims 6 to 8 . the second data includes a virtual table;
The data service providing method according to any one of claims 1 to 9 . The virtual table has a hierarchical structure linked in multiple stages.
The data service providing method according to claim 10 . A system for providing a data service to a registered user, comprising:
a data acquisition unit that acquires first data including a plurality of data having different handling policies;
an access policy control unit that sets an access policy for the first data;
a provision data generating unit that generates second data used for a data service to be provided to the user from the first data based on the access policy;
a data access control unit that provides a data service based on the second data;
Equipped with
the access policy includes a data combination policy that sets a combination of data of the first data that have different handling policies,
the provision data generation unit generates the second data including data obtained by combining data having different handling policies among the first data based on the data combination policy;
Data service provision system. The first data is stored in a distributed manner for each data item having a different handling policy.
The data service providing system according to claim 12 . The plurality of data with different handling policies include at least one of purchase data, HR data, and health data.
The data service providing system according to claim 13 . The users include individual users and service providers,
the access policy includes an individual user access policy in which whether or not the service provider can access the first data through the service business of the service provider is set for each individual user;
The data service providing system according to any one of claims 12 to 14 . the access policy control unit has an interface through which the individual user can set the individual user access policy;
The data service providing system according to claim 15 . the provision data generation unit generates a virtual table as the second data for each request from the user.
The data service providing system according to any one of claims 12 to 16 . the provision data generation unit records the generated virtual table as temporary cache data, and generates the virtual table using the cache data at the next request of the user.
18. A data service providing system according to claim 17 .

Images