JP7715624B2 - Data distribution system and method for determining data usage conditions - Google Patents

Description

The present invention relates to a data distribution system and a method for determining data usage conditions, and is suitable for use in a data distribution system and a method for determining data usage conditions in which data providers and data users determine usage conditions and trade data.

In recent years, data distribution services have been offered that utilize platforms that act as intermediaries between those who provide data (data providers) and those who want the data (data users). For example, information banks are considered one form of data distribution service, and the data they distribute is personal data, including personal information.

When trading data, it is necessary for the parties involved to agree on the terms of use of the data (data usage terms). In open data trading, it is common for the data provider to disclose the data usage terms they have established, and for the data transaction to take place once the data user has agreed to the terms. It is believed that making data usage terms dynamic increases flexibility, allowing data users to obtain data that meets their requirements and enabling data providers to provide data to a wider range of users.

Negotiation is a method for dynamically determining data usage conditions in data transactions, and automatic negotiation methods have also been proposed. For example, Non-Patent Document 1 discloses that the intervention of a third-party agent (mediator) can enable automated negotiations with high social utility, and that the mediator proposes candidate conditions for negotiations regarding usage conditions for data distribution.

Takeshi Toshima and three others, "Automated Negotiation Using a Third-Party Agent to Determine the Compensation for Data Provision in Information Distribution," Transactions of the Information Processing Society of Japan, February 15, 2021, Vol. 62, No. 2, pp. 508-517

However, with conventional technologies, including the aforementioned Non-Patent Document 1, even if data usage conditions can be adjusted through automatic negotiation, it is not possible to know whether the other party will actually comply with those conditions, making it difficult to realize safe and secure data transactions. Therefore, there is a need for a system that allows data traders to determine optimal data usage conditions, taking into account whether the other party will comply with the data usage conditions.

The present invention has been made in consideration of the above points, and aims to propose a data distribution system and a method for determining data usage conditions that can increase safety and security in data transactions by enabling data traders to select and determine appropriate usage conditions by taking into account the likelihood that their counterparties will comply with the usage conditions when dynamically agreeing on data usage conditions.

In order to solve the above problem, the present invention provides a data distribution system that dynamically negotiates terms of use for data transactions, comprising one or more provider devices used by a data provider who is one of the data traders, one or more user devices used by a data user who is the other of the data traders, and a negotiation intermediation service unit that mediates negotiation of the terms of use, wherein the provider device and the user device each hold preference information indicating adjustable items in the terms of use that are permitted by the data provider or the data user, and when a data transaction is carried out between predetermined data traders, the negotiation intermediation service unit mediates negotiation of the terms of use by the data traders, and and for each of the extracted plurality of use conditions, calculates a performance possibility index indicating the possibility that the data trader will perform the use condition for each item constituting the use condition , and calculates a utility value indicating the utility that the data provider and the data user will each obtain if the use condition is used; and a second process is provided in which a predetermined number of use condition candidates are extracted from the plurality of use conditions based on the performance possibility index and the utility value calculated for each of the use conditions by the first process , and the use condition candidates are notified to the provider device and the user device.

Furthermore, in order to solve the above problem, the present invention provides a method for determining data usage conditions by a data distribution system that dynamically negotiates usage conditions for data transactions, the data distribution system having one or more provider devices used by a data provider who is one of the data traders, one or more user devices used by a data user who is the other of the data traders, and a negotiation intermediation service unit that mediates negotiation of the usage conditions, the provider device and the user device each hold preference information indicating items that are acceptable to the data provider or the data user and that can be adjusted in the usage conditions, and when a data transaction is carried out between specified data traders, the negotiation intermediation service unit extracts a plurality of usage conditions that can be implemented between the data traders based on the preference information of each of the data traders of the data transaction that is the subject of the usage conditions, and for each of the extracted plurality of usage conditions : A data usage condition determination method is provided, comprising: a first step of calculating, for each item constituting the usage conditions , a fulfillment possibility index indicating the possibility that the data trader will fulfill the usage conditions, and calculating a utility value indicating the utility that the data provider and the data user will each obtain if the usage conditions are used ; a second step of the negotiation intermediation service unit extracting a predetermined number of usage condition candidates from the plurality of usage conditions based on the fulfillment possibility and utility value indexes calculated for each of the usage conditions in the first step, and notifying the provider device and the user device of the usage condition candidates, requesting evaluation by both the data traders; and a third step of the negotiation intermediation service unit determining final usage conditions for the data transaction based on the results of the evaluations by both the data traders requested in the second step, and notifying the provider device and the user device.

This invention can enhance safety and security in data transactions where data usage conditions are dynamically agreed upon. Issues, configurations, and advantages other than those described above will become clear from the description of the following embodiments.

1 is a block diagram showing an example of the configuration of a data distribution system 1 according to a first embodiment of the present invention. FIG. 10 is a diagram illustrating an example of a usage condition management table. FIG. 2 is a sequence diagram showing an example of a procedure for agreeing on data usage conditions executed in the data distribution system 1 according to the first embodiment. 10 is a flowchart illustrating an example of a processing procedure for calculating a feasibility risk. FIG. 10 is a diagram illustrating an example of a capability management table for use control. 10 is a flowchart illustrating an example of a processing procedure for extracting use condition candidates. FIG. 10 is a diagram showing an example of a candidate recommendation message. FIG. 11 is a sequence diagram showing an example of a procedure for agreeing on data usage conditions executed in the data distribution system 1 according to the second embodiment.

Embodiments of the present invention will be described in detail below with reference to the drawings.

In the following explanation, various types of information may be described using terms such as "table," "list," and "list," but the information may also be expressed in other data structures. To indicate that it is not dependent on the data structure, "XX table," "XX list," etc. may be referred to as "XX information." When describing the content of each piece of information, terms such as "identification information," "identifier," "name," "ID," and "number" are used, but these are interchangeable.

In addition, while the following description may describe processing performed by executing a program, a program is executed by at least one processor (e.g., a CPU) to perform a predetermined process using storage resources (e.g., memory) and/or interface devices (e.g., communication ports) as appropriate, and therefore the processor may be the entity performing the processing. Similarly, the entity performing the processing by executing a program may be a controller, device, system, computer, node, storage system, storage device, server, management computer, client, or host having a processor. The entity performing the processing by executing a program (e.g., a processor) may include a hardware circuit that performs some or all of the processing. For example, the entity performing the processing by executing a program may include a hardware circuit that performs encryption and decryption, or compression and decompression. A processor operates as a functional unit that realizes a specified function by operating in accordance with a program. Devices and systems that include a processor are devices and systems that include these functional units.

A program may be installed on a device such as a computer from a program source. The program source may be, for example, a program distribution server or a computer-readable storage medium. When the program source is a program distribution server, the program distribution server includes a processor (e.g., a CPU) and storage resources, and the storage resources may further store a distribution program and a program to be distributed. The processor of the program distribution server may then execute the distribution program, causing the processor of the program distribution server to distribute the program to be distributed to other computers. Also, in the following description, two or more programs may be realized as one program, and one program may be realized as two or more programs.

Note that in the following description, when describing similar elements without distinction, the common portion (the portion excluding the subscript or subscript) of the reference numeral including the subscript or subscript number may be used, and when describing similar elements with distinction, the reference numeral including the subscript or subscript number may be used. For example, when describing a donor device without distinction, it will be referred to as "donor device 10," whereas when describing individual donor devices 10 with distinction, it will be referred to as "donor device 10-1," "donor device 10-2," ..., "donor device 10-N," etc.

(1) First Embodiment (1-1) Configuration of Data Distribution System 1 FIG. 1 is a block diagram showing an example of the configuration of a data distribution system 1 according to a first embodiment of the present invention.

As shown in FIG. 1, the data distribution system 1 comprises one or more provider devices 10, which are information processing devices used by data providers; one or more user devices 20, which are information processing devices used by data users; a catalog management service device 30 that centrally manages data catalogs; a negotiation intermediation service device 40 that mediates negotiations of data usage conditions (data usage conditions) between data providers and data users; a management terminal 51 that manages the provider devices 10 via a network; and a management terminal 52 that manages the user devices 20 via a network. The provider devices 10, user devices 20, catalog management service device 30, and negotiation intermediation service device 40 are interconnected via network 60. The provider devices 10 and management terminal 51 are connected via network 61, and the user devices 20 and management terminal 52 are connected via network 62.

In the following explanation, the terms "data provider" and "provider device 10" can be interpreted interchangeably when used in the context of the party providing the data. Similarly, the terms "data user" and "user device 20" can be interpreted interchangeably when used in the context of the party receiving the data (the party using the data).

(1-1-1) Provider device 10
The provider device 10 includes a business system 110 and a data transaction connector 120 .

The business system 110 is a system used by the data provider's organization for business purposes, and processes customer data and other data required for business purposes. The business system 110 also has the function of storing (accumulating) data processed by its own system as a data source. In data transactions using the data distribution system 1 of this embodiment, data that is available to data users from the data sources stored by the business system 110 is provided to the user device 20 via the data transaction connector 120.

The data transaction connector 120 is a processing unit through which data stored in the business system 110 is provided to data users, and has the function of processing the data to comply with specified data usage conditions (processing the data so that it can be used in accordance with the data usage conditions) and controlling the destination of the data. The data transaction connector 120 is composed of a usage conditions management unit 121 and a usage control unit 122.

The usage conditions management unit 121 is a processing unit that manages the data usage conditions applied to the data to be provided, and determines data usage conditions that can be agreed upon between trading partners through interactions with the negotiation intermediation service device 40.

The usage control unit 122 is a processing unit that provides data in a form that conforms to the data usage conditions determined by the usage condition management unit 121. The usage control unit 122 exchanges data acquired from the business system 110 with the data transaction connector 220 of the user device 20, provides data in accordance with the data usage conditions, and sends and receives control information related to data provision.

(1-1-2) User device 20
The user device 20 is configured to include a business system 210 and a data transaction connector 220 .

The business system 210 is a system used by the data user's organization for business purposes, and processes data necessary for business operations that the organization has acquired, as well as data acquired from data providers. The business system 210 also functions as a data sink, i.e., it has the function of storing (accumulating) data necessary for business operations that the organization has acquired, as well as data acquired from data providers. In data transactions using the data distribution system 1 of this embodiment, data acquired from data providers is stored (accumulated) in the business system 210 via the data transaction connector 220 and used in business operations at the data user's organization.

The data transaction connector 220 is a processing unit through which data obtained from data providers is stored in the business system 210, and has the function of processing the data to conform to specified data usage conditions and managing the data usage conditions. Like the data transaction connector 120, the data transaction connector 220 is configured with a usage conditions management unit 221 and a usage control unit 222.

The usage conditions management unit 221 is a processing unit that manages the data usage conditions applied to each data used by the data user, and determines data usage conditions that can be agreed upon between trading partners through interactions with the negotiation intermediation service device 40.

The usage control unit 222 is a processing unit that uses data in a manner that conforms to the data usage conditions determined by the usage condition management unit 221. The usage control unit 222 communicates with the data transaction connector 120 of the provider device 10 regarding the data received from the provider device 10, processes the data so that it complies with the data usage conditions (for example, deleting data after a certain period of time, allowing data to be retrieved up to a certain number of times, etc.), and sends and receives control information regarding data usage.

(1-1-3) Catalog Management Service Device 30
The catalog management service device 30 has the function of collecting, retaining, and managing metadata of the data being traded, metadata related to connectors (data trading connectors 120, 220), and metadata of organizations trading data, and further has the function of returning the relevant metadata in response to a request to obtain this metadata.

The metadata for the above data includes the title and description of the data, data specifications, data location, and default terms of use. Connector metadata also includes connector transaction history, such as the history of data transactions via the connector, the connector ID and version, and general information about the connector's functions, such as a list of the connector's functions. Organization metadata also includes the organization's ID, name, and description, as well as historical data on data transactions conducted by the organization and the organization's credibility regarding data transactions.

As shown in FIG. 1, the catalog management service device 30 is composed of a connector transaction history management unit 310, a connector function management unit 320, an organization transaction history management unit 330, an organization creditworthiness management unit 340, and a usage conditions management unit 350.

The connector transaction history management unit 310 collects and stores the history of data transactions made via a connector from the connector. Here, the data transaction history is a log managed containing the history of the transaction date and time, the data provider ID, the data user ID, the data ID, and the transaction content (e.g., data transmission, data processing, or execution of a specified process defined in the data usage conditions). In addition, the connector transaction history management unit 310 returns the relevant metadata in response to an acquisition request targeting metadata stored by the unit.

The connector function management unit 320 collects and stores information about connector functions, such as the connector ID and version, and a list of functions that the connector has. In addition, the connector function management unit 320 returns the relevant metadata in response to a request to obtain metadata stored by itself.

The organization transaction history management unit 330 collects and stores information on historical data of data transactions conducted by the organization. In addition, the organization transaction history management unit 330 returns the relevant metadata in response to an acquisition request targeting the metadata it stores. Note that the organization transaction history management unit 330 and the connector transaction history management unit 310 partially overlap in their functions and the data they handle, but while the connector transaction history management unit 310 manages historical data of data transactions via each connector on a connector-by-connector basis, the organization transaction history management unit 330 manages historical data of data transactions via all connectors owned by the organization on an organization-by-organization basis.

The organization creditworthiness management unit 340 holds information on the credibility of an organization's data transactions. "Creditworthiness" here is a numerical indicator of the degree to which the agreed-upon data usage conditions are likely to be complied with. An organization's credibility with respect to data transactions is calculated by a person or a program based on data from multiple past transactions mediated by the data distribution system 1. Specifically, the organization's credibility with respect to data transactions is calculated and determined based on, for example, whether there is a certain level of data transaction history, the number of violations of the agreed-upon data usage conditions, and whether an information security incident (such as a leak of personal data) has occurred in the organization's information system (business system 210). When the above creditworthiness is calculated by a program, for example, the organization creditworthiness management unit 340 executes the program. Taking the above into consideration, the data structure of the information held by the organization creditworthiness management unit 340 includes the organization's ID and a numerical value representing the organization's creditworthiness.

The usage conditions management unit 350 acquires and manages default values for usage conditions in data transactions (initial condition values applied when no negotiation is performed) and information regarding whether each item in the usage conditions can be adjusted. The usage conditions management unit 350 registers these values for each data provider or for each piece of data that can be provided. Below, an example of the data structure of the information (usage conditions management table) held by the usage conditions management unit 350 is explained, taking the case of registering values for each piece of data that can be provided as an example.

Figure 2 shows an example of a usage condition management table. The usage condition management table 710 shown in Figure 2 is information acquired and managed by the usage condition management unit 350, as described above.

The usage conditions management table 710 is composed of a data ID 711 indicating the ID of the transaction data, a usage conditions item 712 indicating the name of each item that makes up the data usage conditions, a default value 713 indicating the default value of the usage condition item 712, and an adjustability 714 indicating whether the value of the usage condition item 712 can be adjusted through negotiation.

The usage condition items 712 include whether a connector is used when providing data (connector use), whether there are restrictions on the purpose of use (restrictions on purpose of use), whether there are restrictions on the location of use (restrictions on location of use), etc. Also, in the example of Figure 2, if the value of the target item can be adjusted through negotiation, the adjustment possibility 714 is displayed as "adjustable," and if the value of the target item cannot be adjusted through negotiation, the adjustment possibility 714 is displayed as "not adjustable."

Such a usage conditions management table 710 is used, for example, by a data user administrator to view the usage conditions of data that are candidates for trading, check whether the usage conditions are acceptable at default values, and whether unacceptable usage condition items can be adjusted, and make a comprehensive decision on whether to negotiate the usage conditions. Furthermore, while the above decision is typically made by a person, it may also be configured to be made automatically by a program based on predetermined criteria.

(1-1-4) Negotiation intermediation service device 40
The negotiation intermediation service device 40 is a device that mediates between the data provider and the data user on data usage conditions without directly negotiating them, and presents data usage conditions that are win-win for both parties (i.e., that are beneficial to both parties). As shown in Fig. 1, the negotiation intermediation service device 40 includes a utility function management unit 410, a usage condition feasibility management unit 420, and a usage condition candidate recommendation unit 430.

The utility function management unit 410 manages the utility value each data trader (data provider and data user) will obtain when using the data usage conditions. Here, the utility function is a numerical representation of the utility (profit) that a data trader will obtain when a value for each item in the data usage conditions is given. The utility is calculated by assigning a weighting value (summing 1) to each data usage condition, and taking the sum of the products of the weight and the utility value for each individual item when the utility score for each individual item in the data usage conditions is set to 0 to 1 (for example, a higher value means more beneficial). This utility function may be determined by users at the organization that will be the data trader, or the utility function may be automatically estimated and determined from the results of asking users (or organizations) several questions about the data usage conditions.

The usage conditions fulfillment possibility management unit 420 manages, for each data trader, the degree of likelihood of fulfillment or the degree of risk of not being able to fulfill each item and value of the data usage conditions, by quantifying this. This numerical value is calculated, for example, based on the connector's functionality. If there is a connector function corresponding to each item of the data usage conditions, it is determined that there is a high likelihood of fulfillment (low risk of not being able to fulfill), and if there is no corresponding connector function, it is determined that there is a low likelihood of fulfillment (high risk of not being able to fulfill). Furthermore, calculations may also be made based not only on the connector's functionality, but also on the transaction history and creditworthiness of the organization in question.

The usage condition candidate recommendation unit 430 has the function of outputting a specified number (one or a predetermined number) of candidate data usage conditions that are suitable for both data traders based on the utility functions of the data provider and data user and the feasibility of fulfilling the data usage conditions, and notifying the data provider and data user of these candidates via their connectors.

Management terminals 51 and 52 are information processing devices that are primarily used to configure connectors for the information processing devices (provider device 10, user device 20) of the data provider or data user to which they are connected, to provide information to users upon agreement on data usage conditions, and to have users determine data usage conditions, etc. In other words, management terminals 51 and 52 have the function of exchanging messages with the connectors of the provider device 10 or user device 20 to which they are connected.

The data distribution system 1 according to this embodiment has the configuration described above, allowing the provider device 10 to determine optimal data usage conditions between the provider device 10 and the user device 20 via the negotiation intermediation service device 40. Furthermore, because the negotiation intermediation service device 40 calculates candidate data usage conditions taking into account the feasibility of the data provider and data user to fulfill them, the data provider and data user can select and agree on more appropriate data usage conditions, taking into account the feasibility of the trading partner's data usage conditions to fulfill them.

In the above explanation, data catalogs are managed centrally by the catalog management service device 30, but in the data distribution system 1 according to this embodiment, these data catalogs may be managed in a decentralized manner. Also, while the provider device 10 and user device 20 have been described separately, a person (user) or organization may also act as both a data provider and a data user, in which case the provider device 10 and the user device 20 may be the same device.

(1-2) Sequence for Agreeing on Data Usage Conditions Fig. 3 is a sequence diagram showing an example of the procedure for agreeing on data usage conditions executed in the data distribution system 1 in the first embodiment. The sequence for agreeing on data usage conditions in this embodiment will be described below with reference to Fig. 3.

In the explanation of Figure 3, procedures performed by a data provider or its organization actually mean that the provider device 10 is the main entity performing the processing corresponding to the procedure, and procedures performed by a data user or its organization actually mean that the user device 20 is the main entity performing the processing corresponding to the procedure. This also applies to the explanations of other sequence diagrams (Figure 8) and flowcharts (Figures 4 and 6) described below.

As shown in FIG. 3, first, the data user organization sends a request to the catalog management service device 30 to obtain the data usage conditions of the business partner (step S101). In response to the request in step S101, the catalog management service device 30 replies to the data user with the relevant business partner and data usage conditions (step S102).

Next, the data user reviews the data usage conditions acquired in step S102, and if they decide that they cannot agree to the data usage conditions and would like to trade under different conditions, they send a request to adjust the data usage conditions to the negotiation intermediation service device 40 (step S103). This adjustment request includes information such as a trading partner ID that can uniquely identify the trading partner (e.g., the trading partner of the data usage conditions acquired in step S102).

When the negotiation intermediation service device 40 receives a request to adjust data usage conditions, it sends a request to obtain data usage condition preferences to the data provider, the corresponding data trader, based on the trading partner ID included in the adjustment request (step S104), and obtains them (step S105). Here, data usage condition preferences refer to information indicating which of the multiple items comprising the data usage conditions are adjustable, which of the multiple items has a higher priority, etc., and also represents information such as utility functions and allowable feasibility. This preference information is required for data traders to derive candidate data usage conditions that will result in a win-win situation; it is determined in advance by the data provider and data user and is maintained and managed by each connector.

The negotiation intermediation service device 40 also sends a request to obtain data usage conditions preferences to the data users who sent a request to adjust data usage conditions in step S103 (step S106) and obtains them (step S107).

Next, the negotiation intermediation service device 40 requests the catalog management service device 30 to acquire the connector functions of the data user and data provider (step S108). In response to this request, the catalog management service device 30 acquires a list of the relevant connector functions from the database held by the connector function management unit 320, and passes this information to the negotiation intermediation service device 40 (step S109).

Next, the negotiation intermediation service device 40 requests the catalog management service device 30 to obtain the organization's creditworthiness among data users and data providers (step S110). In response to this request, the catalog management service device 30 obtains the organization's creditworthiness value from the database maintained by the organization creditworthiness management unit 340 and passes this value to the negotiation intermediation service device 40 (step S111).

Next, the negotiation intermediation service device 40 extracts all possible combinations of data usage conditions and calculates the utility value and feasibility risk for each of these data usage conditions (step S112). Details of the processing in step S112 will be described later with reference to Figure 4.

Next, the negotiation intermediation service device 40 extracts the top N candidates from the multiple data use conditions extracted in step S112, taking into account risk, based on the utility value and feasibility risk calculated in step S112, and sets these as use condition candidates to be recommended (step S113). Details of the use condition candidate extraction process in step S113 will be described later with reference to Figure 6.

Next, the negotiation intermediation service device 40 presents the candidate usage conditions and their feasibility risks determined in step S113 to the data provider and data user, and further requests the data provider and data user to evaluate each candidate usage condition (steps S114 and S115).

Then, in response to the requests in steps S114 and S115, the data provider and data user transmit the evaluation results for their respective usage condition candidates to the negotiation intermediation service device 40 (steps S116 and S117).

Next, the negotiation intermediation service device 40 determines data usage conditions that are agreeable to both the data provider and the data user based on the evaluation results (specifically, for example, OK/NG, a score indicating the level of evaluation) from both the data provider and the data user obtained in steps S116 and S117 (step S118), and notifies the data provider and the data user of the determined data usage conditions (steps S119 and S120). Here, agreeable data usage conditions are determined, for example, by extracting those for which both evaluation results are OK, and from these, extracting those for which the product of both evaluation scores is the largest. If there are multiple candidate usage conditions with the largest product of evaluation scores, it is sufficient to extract the one with the largest product of utility.

Through the above processing, the negotiation intermediation service device 40 can recommend win-win candidate usage conditions, taking into account the feasibility risks of the data usage conditions. Furthermore, the data provider and data user can each evaluate the recommended candidate usage conditions, taking into account the feasibility risks, and the final data usage conditions are determined based on the evaluation results, allowing for agreement on data usage conditions that take feasibility risks into account.

(1-2-1) Calculation of feasibility risk Figure 4 is a flowchart showing an example of the processing procedure for calculating feasibility risk. The series of processes shown in Figure 4 corresponds to the processes of steps S104 to S113 in Figure 3, and are executed by negotiation intermediation service device 40 when a request for adjustment of data use conditions is received from a data trader (step S103 in Figure 3). However, details of the process of step S206 (corresponding to step S113 in Figure 3) will be described later with reference to Figure 6.

As shown in FIG. 4, the negotiation intermediation service device 40 first obtains the preferences for data usage conditions of the relevant data traders (provider device 10, user device 20) (step S201). As described above, preferences for data usage conditions are information indicating which of the multiple items that make up the data usage conditions are adjustable, which of the multiple items has a higher priority, etc., and represent information such as utility functions and allowable feasibility. This preference information is necessary for data traders to derive candidate data usage conditions that will result in a win-win situation. It is determined in advance by the data provider and data user and is maintained and managed by each connector.

Next, the negotiation intermediation service device 40 acquires information about the connector's functions and the usage environment of the data trader connected to the connector from the catalog management service device 30 (step S202). Note that the connector's functions are not simply accepted as declared by the data trader, but rather the accuracy of the information is verified by someone other than the data trader.

Figure 5 shows an example of a usage control capability management table. The usage control capability management table 720 shown in Figure 5 is list information used when the negotiation intermediation service device 40 obtains information about the connector functions and usage environment described above, and is stored, for example, in a database held by the connector function management unit 320 of the catalog management service device 30 (although it may also be held outside the catalog management service device 30).

As shown in Figure 5, the usage control capability management table 720 is composed of the following items: connector ID 721, item 722, response level 723, response location 724, and related log output status 725.

Connector ID 721 is an identifier for uniquely identifying the connector. Item 722 indicates the name of each item in the data usage conditions provided by the connector. Support level 723 indicates the value corresponding to each item. Support location 724 indicates information about where usage control for each item is implemented, and is indicated by values such as "connector" or "usage environment." Related log output availability 725 indicates whether the corresponding function is output as a related log.

By using such a capability management table 720, the negotiation intermediation service device 40 can collect information about connectors and usage environments required to calculate feasibility.

Returning to the explanation of Figure 4, following step S202, the negotiation intermediation service device 40 acquires the organization's creditworthiness from the catalog management service device 30 (step S203). Note that although it is assumed here that the catalog management service device 30 holds and manages this information, if similar information is available from another institution, it may be acquired from elsewhere.

Next, the negotiation intermediation service device 40 extracts all possible combinations of data usage conditions between the data provider and the data user (step S204). The processing of step S204 involves combining selectable values for each item that makes up the data usage conditions to extract multiple data usage conditions that correspond to all possible combination patterns.

Next, the negotiation intermediation service device 40 calculates the feasibility risk for each item and value for each data use condition extracted in step S204 (step S205). The feasibility of each individual condition is comprehensively determined based on, for example, the presence or absence of a connector function, the presence or absence of past transaction history within the organization, and the organization's credibility. Specifically, for example, if a connector function is present, its fulfillment is technically mandatory, so the feasibility is extremely high, and the risk of the data use condition not being fulfilled is extremely low (risk level: none). Even if a connector function is absent, if past transaction history shows that the data use condition has been handled appropriately, the feasibility is considered high and the risk is low (risk level: low). Furthermore, if a connector function is absent and there is no past transaction history, the determination can be made based on the organization's credibility. If the organization's credibility is high, the feasibility of each data use condition is considered high and the risk is low (risk level: low). However, if the organization's credibility is low, the feasibility is considered low and the risk is high (risk level: high). Note that the "high" or "low" level in the above explanation can be considered to be a classification based on a predetermined threshold, and each threshold may be statically determined in advance, or may be dynamically set by a program or person depending on the situation, environment, etc.

Then, after calculating the individual risks for each data usage condition in step S205, the negotiation intermediation service device 40 finally calculates more preferable data usage condition candidates taking into account both utility and risk (step S206). Details of the processing in step S206 will be described later with reference to Figure 6.

By performing the above processing, the negotiation intermediation service device 40 can calculate the feasibility risk of each data usage condition and, based on that, extract more appropriate data usage condition candidates.

(1-2-2) Extraction of Use Condition Candidates Fig. 6 is a flowchart showing an example of the processing procedure for extracting use condition candidates. The series of processes shown in Fig. 6 corresponds to the processing of step S113 in Fig. 3, and is executed by the negotiation intermediation service device 40 after the calculation of the feasibility risk is completed.

As shown in Figure 6, first, the negotiation intermediation service device 40 combines data usage conditions based on the preferences of the data provider and data user to derive all possible combinations of data usage conditions (step S301). In the processing of step S301, for example, if there are few constraints on processing time, the utility and risk for all combinations are calculated and a more preferable subset is selected based on the calculated values. Note that if there are constraints on processing time or if the number of usage condition combinations is enormous, it is not possible (or should not be possible) to calculate all combinations, so if necessary, the number of combinations to be derived may be limited and combinations of data usage conditions may be randomly extracted.

Next, the negotiation intermediation services device 40 calculates the utility value and risk for each combination of data usage conditions derived in step S502 (step S302). The specific method for calculating risk is as described in step S205 of Figure 4.

Next, the negotiation intermediation services device 40 calculates the risk-adjusted utility for each combination (step S303). Specifically, the calculation method in step S303 can use the formula "Σ{(utility value under condition i) × (1 - (risk probability under condition i))}".

Next, the negotiation intermediation service device 40 calculates the product of the adjusted utility of the data provider and the adjusted utility of the data user for each combination (step S304).

Next, the negotiation intermediation service device 40 sorts the combinations calculated in step S304 in descending order of the product, extracts the top N candidates, and sets these as the usage condition candidates to be recommended (step S305). Here, a high product means that the benefit (utility) is high when taking into account both data traders.

By performing the above processing, the negotiation intermediation service device 40 can extract data usage conditions near the Nash equilibrium point as usage condition candidates, thereby calculating candidates that are more favorable to both the data provider and the data user.

The negotiation intermediation service device 40 then presents the extracted candidate usage conditions and the feasibility of each usage condition to the data traders (provider device 10, user device 20).

Figure 7 is a diagram showing an example of a candidate recommendation message. The candidate recommendation message 730 shown in Figure 7 is an example of a message that the negotiation intermediation service device 40 uses to present the candidate use conditions and their feasibility risks to the data traders (provider device 10, user device 20) in steps S114 and S115 of Figure 3, after the calculation of the candidate use conditions described in Figure 6.

As shown in FIG. 7, the candidate recommendation message 730 is composed of the following items: candidate number 731, item 732, value 733, performance responsibility 734, risk level 735, risk reason 736, and utility function score 737.

Candidate number 731 indicates the identifier assigned to each usage condition candidate. Item 732 indicates the name of each item that makes up the usage condition of the candidate, and value 733 indicates its value. The name indicated in item 732 indicates, for example, whether the purpose of use is restricted (restrictions on purpose of use) or whether the location of use is restricted (restrictions on location of use).

The execution responsibility 734 indicates the location of the person responsible for execution of each item, and describes the organization that should execute the item. The risk level 735 indicates a value that represents the execution possibility risk of each item. The risk level 735 may be expressed numerically or may use an enumerated value. In the case of FIG. 7, the example of risk levels described in the explanation of step S205 in FIG. 3 is applied. The risk reason 736 indicates the reason that is the basis for determining the risk level. For example, "No related
If it is written as "function implemented In A. Trust level of organization A is low," it means that "the related function has not been implemented in organization A, and the trustworthiness of organization A is low."

The utility function score 737 indicates the score of the utility function for the entire data usage conditions for each candidate. Specifically, the utility function score 737 is set to a value with a range that takes into account the risk (risk level 735) for each item of the data usage conditions of the candidate. In this example, values between 0 and 1 are set, but this is not limited to this.

As described above, the data distribution system 1 according to this embodiment calculates an index of the extent to which trading partners will comply with each item of the data usage conditions when dynamically agreeing on data usage conditions, and data traders can take this into consideration to simplify the consent process through confirmation of data provision content when providing personal data to a large number of data recipients. As a result, organizations trading data can select and determine more optimal data usage conditions by taking into account the likelihood that trading partners will comply with the data usage conditions, thereby increasing safety and security in data transactions where data usage conditions are dynamically agreed upon.

(2) Second Embodiment In the data distribution system 1 according to the first embodiment, when determining the data usage conditions, the negotiation intermediation service device 40 takes into consideration utility and feasibility and recommends candidate usage conditions that are likely to lead to agreement between both data traders, which required the catalog management service device 30 and the negotiation intermediation service device 40. However, the present invention is not limited to a configuration that includes an intermediary device such as the catalog management service device 30 or the negotiation intermediation service device 40, and can also be realized by having the data provider (provider device 10) or the data user (user device 20) possess some of the functions of the intermediary device.

In the second embodiment, therefore, we will explain the data distribution system 2 in which data traders (provider device 10, user device 20) calculate the feasibility of execution themselves by understanding the connector functions of the information processing device with which they are trading and inquiring about past performance, and then negotiate data usage conditions between traders based on the calculation results. We will focus on the differences from the first embodiment.

Compared to the configuration of the data distribution system 1 shown in FIG. 1, the data distribution system 2 according to the second embodiment differs in that it does not include a negotiation intermediation service device 40, and the functions of the negotiation intermediation service device 40 are located in the provider device 10 and the user device 20. Furthermore, the data distribution system 2 according to the second embodiment differs from the data usage conditions agreement sequence in the first embodiment in that the data provider and data user negotiate directly regarding the data usage conditions agreement sequence.

Figure 8 is a sequence diagram showing an example of the procedure for agreeing on data usage conditions executed in the data distribution system 1 in the second embodiment. The procedure shown in Figure 8 will be explained below, but the detailed technical content implemented in each procedure will not be explained here, as the explanation given in the first embodiment with reference to Figure 3 can basically be applied.

As shown in Figure 8, first, the data user requests the data usage conditions of the trading partner (data provider) (step S401) and receives the response (step S402). Next, the data user reviews the data usage conditions obtained in step S402, and if the data user does not agree with the data usage conditions and decides to trade under different conditions, he or she sends a request to adjust the data usage conditions directly to the data provider (step S403).

Next, upon receiving the request to adjust the data usage conditions, the data provider sends a request to obtain preferences for the data usage conditions to the data provider (step S404) and obtains preference information from the data provider (step S405). Here, since the data provider's preference information is held by the data provider itself, a request to obtain preferences is not necessary.

The data provider also requests the catalog management service device 30 to acquire the connector functions of the data user (step S406), and receives this from the catalog management service device 30 (step S407). Meanwhile, the data user also requests the catalog management service device 30 to acquire the connector functions of the data provider (step S408), and receives this from the catalog management service device 30 (step S409).

The data provider also requests the catalog management service device 30 to obtain the organization's credit rating among data users (step S410), and receives this from the catalog management service device 30 (step S411). Meanwhile, the data user also requests the catalog management service device 30 to obtain the organization's credit rating among data providers (step S412), and receives this from the catalog management service device 30 (step S413).

Next, the data provider extracts all possible combinations of data usage conditions and calculates the utility value and feasibility risk for each combination of data usage conditions (step S414). Furthermore, based on the calculated utility value and feasibility risk, the data provider extracts the top N candidates from the data usage conditions extracted in step S414, taking into account risk, and sets these as usage condition candidates to be recommended (step S415). The data provider then presents the usage condition candidates determined in step S415 and their feasibility risks to the data user (step S417).

The data user, to whom the candidate usage conditions were presented in step S417, evaluates each candidate usage condition and uses the evaluation results to determine agreeable data usage conditions using a predetermined determination method (step S418). The evaluation results are indicated, for example, as OK/NG and a score indicating the level of evaluation. Agreeable data usage conditions are determined, for example, by extracting those for which the evaluation results from both data traders are OK, and then extracting from these the conditions with the largest product of the evaluation scores from both parties. If there are multiple candidate usage conditions with the largest product of evaluation scores, the one with the largest product of utility can be extracted. The data user then notifies the data provider of the agreeable data usage conditions determined in step S418 (step S419).

In this example, data users decide on data usage conditions that are acceptable to them based on the candidate usage conditions presented by the data provider, but this procedure is not limited to this. For example, data traders may exchange their evaluation results for each candidate usage condition, use each other's evaluation results to decide on and present final candidate usage conditions, and if both parties agree on these, they may decide on them as acceptable data usage conditions.

Finally, the data provider and data user digitally sign the data usage conditions to prove their agreement to the final selected data usage conditions (step S420), and the process ends. Signing a digital signature is expected to have the effect of preventing tampering with the agreed-upon data usage conditions.

The processing procedure in Figure 8 described above differs significantly from the processing procedure in Figure 3 described in the first embodiment in the following respects. That is, in the processing procedure in Figure 8, the data trader collects the information necessary to calculate the feasibility risk by making a request to obtain preferences for data usage conditions (step S404), a request to obtain connector functions (steps S406, S408), and a request to obtain the organization's credit rating (steps S410, S412). Furthermore, the feasibility risk is calculated independently by the data trader (not by the negotiation intermediation service device 40).

By performing the processing shown in Figure 8 as described above, the data distribution system 2 according to the second embodiment enables data traders to adjust data usage conditions, taking into account feasibility risks, without using a negotiation intermediary service, and agree on data usage conditions that are a win-win for both parties.

Note that the above-described embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those that include all of the configurations described. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

Furthermore, in each of the above-described embodiments, processing is performed by a single catalog management service device 30 or negotiation intermediation service device 40, but processing may also be distributed across multiple devices. Furthermore, each device function may be executed on a separate machine.

Furthermore, the control and information lines shown are those considered necessary for the explanation, and do not necessarily represent all control and information lines on the product. In reality, it is safe to assume that almost all components are interconnected.

1, 2 Data distribution system 10 Provider device 110 Business system 120 Data transaction connector 121 Usage condition management unit 122 Usage control unit 20 User device 210 Business system 220 Data transaction connector 221 Usage condition management unit 222 Usage control unit 30 Catalog management service device 310 Connector transaction history management unit 320 Connector function management unit 330 Organization transaction history management unit 340 Organization creditworthiness management unit 350 Usage condition management unit 40 Negotiation intermediation service device 410 Utility function management unit 420 Usage condition fulfillment possibility management unit 430 Usage condition candidate recommendation unit 51, 52 Management terminal 60, 61, 62 Network 710 Usage condition management table 720 Capability management table 730 Candidate recommendation message

Claims (9)

A data distribution system that dynamically negotiates terms of use for data transactions,
one or more provider devices used by a data provider who is one of the data traders;
one or more user devices used by a data user who is the other party to the data transaction;
a negotiation mediation service unit that mediates negotiations of the terms of use;
Equipped with
The provider device and the user device each hold preference information indicating adjustable items in the terms of use that the data provider or the data user allows;
When data transactions are conducted between specified data traders,
The negotiation intermediation service unit
a first process for extracting a plurality of use conditions that can be implemented between the data traders based on the preference information of each of the data traders of the data transaction that is the subject of the use conditions, calculating, for each of the extracted plurality of use conditions, an index of feasibility that indicates the possibility that the data trader will implement the use condition for each item that constitutes the use condition , and calculating a utility value that indicates the utility that the data provider and the data user will each obtain if the use condition is utilized;
and a second process of extracting a predetermined number of use condition candidates from the plurality of use conditions based on the feasibility index and the utility value calculated for each use condition by the first process, and notifying the provider device and the user device of the use condition candidates. The provider device and the user device transmit and receive data and perform transactions via connectors provided therein;
The data distribution system described in claim 1, characterized in that, in the first process, the negotiation intermediation service unit calculates , for each of the extracted multiple usage conditions , an index of feasibility for each item that constitutes the usage condition based on the functions possessed by each connector of the provider device and the user device used by the data trader. The data distribution system according to claim 2, characterized in that, in the first process, the negotiation intermediation service unit calculates , for each of the extracted multiple usage conditions, an index of feasibility for each item constituting the usage condition based on past performance of data transactions via the connector in the data trader's organization. The data distribution system according to claim 1, characterized in that, in the first process, the negotiation intermediation service unit calculates the feasibility index for each of the extracted multiple terms of use for each item constituting the terms of use based on the credibility derived from past data transactions of the data trader's organization. The data distribution system according to claim 1, characterized in that, in the second process, the negotiation intermediation service unit extracts the conditions of use that exist near a Nash equilibrium point as the candidate conditions of use based on the risk derived from the feasibility index and the utility values of the data provider and the data user. The negotiation intermediation service unit
In the second process, the extracted use condition candidates are notified to the provider device and the user device together with the feasibility index and the utility value range for the use conditions of each use condition candidate, and an evaluation by both the data traders is requested;
The data distribution system described in claim 1 further comprises a third process for determining the final terms of use for the data transaction based on the results of evaluation by both of the data traders and notifying the provider device and the user device. 2. The data distribution system according to claim 1, wherein the negotiation intermediation service unit is implemented in another device connected to the one or more provider devices and the one or more user devices via a network. the negotiation intermediation service unit is implemented in at least each of the one or more provider devices,
2. The data distribution system according to claim 1, wherein the provider device executes the first process and the second process while exchanging information with the user device. A method for determining data usage conditions in a data distribution system that dynamically negotiates usage conditions for data transactions, comprising:
The data distribution system includes:
one or more provider devices used by a data provider who is one of the data traders;
one or more user devices used by a data user who is the other party to the data transaction;
a negotiation mediation service unit that mediates negotiations of the terms of use;
and
The provider device and the user device each hold preference information indicating adjustable items in the terms of use that the data provider or the data user allows;
When data transactions are conducted between specified data traders,
a first step in which the negotiation intermediation service unit extracts a plurality of use conditions that can be implemented between the data traders based on the preference information of each of the data traders of the data transaction that is the subject of the use conditions , calculates, for each of the extracted plurality of use conditions, an index of feasibility that indicates the possibility that the data trader will implement the use condition for each item that constitutes the use condition, and calculates a utility value that indicates the utility that the data provider and the data user will each obtain if the use condition is used;
a second step in which the negotiation intermediation service unit extracts a predetermined number of use condition candidates from the plurality of use conditions based on the feasibility and utility value indexes calculated for each of the use conditions in the first step, and notifies the provider device and the user device of the use condition candidates to request evaluation by both the data traders;
a third step in which the negotiation intermediation service unit determines final terms of use for the data transaction based on the results of evaluations by both of the data traders requested in the second step , and notifies the provider device and the user device of the final terms of use for the data transaction;
A data usage condition determination method comprising: