JP2012195747A - Individual information protection system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an individual information protection system in which personal information on a transmission side can be restricted by the side providing it without using a special management device, without taking costs and time and labor of processing.SOLUTION: The individual information protection system is configured to transmit and receive personal information between terminals 10 and 22 through a communication system 21. The terminal provided with the individual information includes a tamper-resistant data preservation part 16A for preserving received individual information, a data preservation time recording part 33 for timing and recording duration from the time of receiving the individual information, determination means (step S206) for permitting read of the individual information when the duration does not exceed reference possible time and denying the read of the individual information otherwise, when reading the individual information from the data preservation part, and display execution means (step S207) for displaying the individual information (personal information) at a display part 12 or the like when the determination means determines that the read of the individual information is to be permitted, or the like.

Description

  The present invention relates to an individual information protection system, and in particular, provides individual information such as personal information and device information transmitted and received between at least two terminals that can be communicably connected via a communication system. The present invention relates to an individual information protection system in which information is restricted and protected on the terminal side.

  An example of personal information will be described as an example of “individual information”. Various types of personal computers used by individuals, such as personal computers and mobile phones (including smartphones), which are connected to communication personnel such as the Internet and contain personal information between two terminals via the communication system Conventionally, a mechanism for protecting the personal information is provided in the communication configuration configured to transmit and receive the data. A typical example of a mechanism for protecting personal information is a mechanism in which data is transmitted and received between terminals via a server, and information processing for authentication and protection is performed based on the server. . The second is a mechanism for performing encryption processing on personal information.

As conventional techniques for protecting and managing personal information as described above, techniques described in Patent Documents 1 to 4 below are known.
The personal data protection and distribution method disclosed in Patent Document 1 discloses a technique in which a personal information providing company sends encrypted personal information and usage conditions to a personal information requesting company. The personal information can be used only when the conditions are met using the DRM authentication technology.
The personal information distribution management method of Patent Document 2 discloses a technique for controlling the distribution of personal information based on personal information and disclosure usage rules.
The personal information management system of Patent Document 3 discloses a technique in which a personal information management server filters and presents personal information (personal information capsule) that can be used for each client.
The personal information integrated management system of Patent Document 4 discloses a system in which the user can manage personal information of the user himself and the personal information required by the service system can be used only under conditions permitted by the user. .

JP 2004-135004 A JP 2001-066733 A JP 2006-317992 A JP 2003-044667 A

  According to the conventional mechanism for protecting personal information, a mechanism that uses the first server always requires a server, which increases the cost of the system. Further, for example, since each server handles each piece of personal information transmitted from each of a large number of terminals, the load of information processing is increased for the server. Therefore, it is necessary to improve the performance of the server, which further increases costs. In the mechanism for performing the second encryption processing, when data related to personal information is sent to the communication system, it is necessary to perform the encryption processing on the data at the transmitting terminal and send the data. In addition, it is necessary to send the encryption key separately to each terminal of the transmission destination, which further takes time.

In addition, the cited references 1 to 4 listed above disclose the prior art related to the present invention, and are included in the category of the prior art that similarly includes the above-described problems.
Furthermore, while the above description of the prior art has been described from the viewpoint of protecting “personal information”, the above-described problem is not limited to “personal information”, that is, information related to a human individual. In recent years, transmission and reception of information via a communication system have been performed between computers incorporated in various devices including terminals, machines, and electronic devices. For this reason, there is a need to protect information related to these machines and devices themselves.

  In view of the above-described problems, an object of the present invention is to transmit individual information on the transmission side without using a special management device in the configuration of a system that transmits and receives individual information between terminals and the like via a communication system. It is to provide an individual information protection system in which the providing side can restrict information and protect individual information without cost and processing.

  The individual information protection system according to the present invention is configured as follows in order to achieve the above object.

  The first individual information protection system (corresponding to claim 1) is configured to transmit and receive individual information between at least two terminals via a communication system, and one terminal is a terminal to which individual information is transmitted. In addition, the other terminal is applied in a communication system that is a terminal that transmits the individual information, and the one terminal provided with the individual information receives the tamper-resistant data storage unit that stores the received individual information and the individual information. Data storage time recording means to count and record the elapsed time from the time of recording, and when reading individual information from the data storage unit, permit reading of individual information if the elapsed time does not exceed the referenceable time, otherwise A determination means for determining that reading of the individual information is rejected in the case of, and a presentation executing means for presenting the individual information to the presenting unit when the determination means determines that reading of the individual information is permitted Configured to include.

  In the individual information protection system described above, each terminal receives individual information from another terminal that provides the individual information and stores it in the data storage unit, and then reads and displays the individual information based on the elapsed time from the time of reception. Since the display of individual information is rejected when the elapsed time exceeds the referenceable time, providing a mechanism for controlling information on the terminal makes it simple without using a special server or cryptographic processing method. It is possible to protect individual information with a simple mechanism.

In the above configuration, the second individual information protection system (corresponding to claim 2) is preferably configured such that when one terminal determines that the determination unit rejects reading of the individual information, the other individual information protection system provides the individual information. Access control means for transmitting an access notification of individual information reference to the terminal, and the other terminal that is the individual information transmission source refers to the information related to the access notification presented to the presentation unit after receiving the access notification And an access control means for transmitting an access permission notice or an access refusal notice to the terminal based on an answer necessity instruction given through the intention transmitting unit.
In the above configuration, by providing the access control means in the terminal, when the already sent individual information is in a reading refusal state based on the elapsed time criterion, the other terminal on the side providing the individual information On the other hand, since the access notification regarding the individual information reference can be transmitted, the side providing the individual information (individual information transmission source) in the final situation can perform the information restriction on the individual information.

  In the above configuration, the third individual information protection system (corresponding to claim 3) is preferably configured such that the access control means in the other terminal automatically executes a refusal determination when receiving an access notification; And a means for presenting an access denial notification and permission notification necessity inquiry message as information related to the access notification to the presenting unit, and storing information related to the reference confirmation notification destination in the data storage unit. To do.

In the fourth individual information protection system (corresponding to claim 4), in the above configuration, preferably, the access refusal notification does not respond to one terminal based on the automatic refusal determination, and the one terminal does not respond. It is characterized in that it is executed when it is judged as a refusal due to absence.
In the fifth individual information protection system (corresponding to claim 5), in the above configuration, preferably, the access refusal notice automatically sends a refusal notice to one terminal based on an automatic refusal decision. The terminal is characterized in that it is executed by receiving a rejection notice and determining that it is rejected.
In the sixth individual information protection system (corresponding to claim 6), in the above configuration, preferably, the access refusal notice automatically sends a refusal notice to one terminal based on an automatic refusal decision. It is characterized in that it is executed by judging that the terminal is rejected by not receiving the rejection notice.

  In the seventh individual information protection system (corresponding to claim 7), in the above configuration, preferably, when the access permission notification is performed, the information related to the reference confirmation notification destination stored in the data storage unit is used It is characterized by.

  In the above configuration, the eighth individual information protection system (corresponding to claim 8) is preferably configured such that, in one terminal, the notification content from the other terminal is an access permission notification or an access denial notification Is provided, and when the other determination means determines that it is an access permission notification, the presentation executing means presents the individual information to the presentation unit.

  In the ninth individual information protection system (corresponding to claim 9), in the above configuration, preferably, the individual information has access control data associated therewith, and the access control data includes data related to a referenceable time. Features.

  In the tenth individual information protection system (corresponding to claim 10), in the above configuration, preferably, the terminal records the data presentation time record that records the presentation time from when the individual information is presented to the presentation unit. The presentation executing means includes a presentation erasing means for erasing the presentation of the individual information when the presentation time exceeds a preset continuous presentation time.

  In the eleventh individual information protection system (corresponding to claim 11), in the above configuration, preferably, when the terminal is configured to be operated by human operation, the individual information is personal information, and the presentation unit Is a display unit, and the presentation executing means is a display executing means.

The present invention has the following effects.
In a system configuration that transmits and receives individual information between terminals via a communication system, the terminal has a low cost and simple structure without using a special server or other management equipment or encryption software. You can protect your personal information by itself.
Since a mechanism for controlling individual information is provided inside each terminal, the terminal itself can protect its own individual information, and individual information bypass can be prevented.
When individual information already sent to a certain terminal is in a reading refusal state based on an elapsed time criterion, the individual information is transmitted to another terminal (individual information transmission source) that provided the individual information. Sending an access notification regarding the reference of the information, the side that provided the individual information (individual information transmission source) finally decides whether to permit or deny, and this can restrict the information related to the individual information, cost, Individual information can be protected without any processing time.

It is a block diagram which shows the hardware constitutions of the terminal used for the separate information protection system which concerns on 1st Embodiment of this invention. It is a block diagram which shows the communication relationship between the terminals via a communication system. It is a functional block diagram which shows the structure of the internal function of a terminal. It is a figure which shows the data structure regarding personal information. It is a flowchart which shows the flow of transmission / reception of the personal information between terminals in 1st Embodiment of this invention. It is a block diagram which shows the hardware constitutions of the terminal used for the separate information protection system which concerns on 2nd Embodiment of this invention. It is a flowchart which shows the flow of transmission / reception of the personal information between the terminals in 2nd Embodiment of this invention. It is a partial flowchart which shows the 1st modification of the process of "execution of refusal" in 2nd Embodiment of this invention. It is a partial flowchart which shows the 2nd modification of the process of "execution of refusal" in 2nd Embodiment of this invention. It is a flowchart which shows the content of "notification of access permission again". It is a block diagram which shows the hardware constitutions of the terminal used for the separate information protection system which concerns on 3rd Embodiment of this invention. It is a block diagram which shows the hardware constitutions of the terminal used for the separate information protection system which concerns on 5th Embodiment of this invention. It is a functional block diagram which shows the function structure inside the terminal in 5th Embodiment of this invention.

  DESCRIPTION OF EMBODIMENTS Preferred embodiments (examples) of the present invention will be described below with reference to the accompanying drawings.

[First Embodiment]
FIG. 1 shows the internal hardware configuration of a typical terminal used in the individual information protection system according to the first embodiment of the present invention. Here, the term “terminal” refers to a so-called terminal (terminal device), a portable terminal such as a cellular phone, an information portable terminal, and the like, which has an input unit and an output unit, has an information processing function unit, and communicates such as the Internet. It means an electronic device that is connected to a system and can perform transmission / reception of information / data with each other.
FIG. 2 is a diagram illustrating a connection relationship for communication between terminals via a communication system for two terminals as an example. FIG. 3 shows a functional block diagram of the terminal.
In the example of the first embodiment, it is assumed that a person (user, individual) operates the terminal, and the “individual information” to be handled is “personal information” related to the operating person (user, individual). The “individual information protection system” is constructed as a “personal information protection system”. Accordingly, the first embodiment will be described as a “personal information protection system”. Note that, for example, the operation of the above-described terminal is not limited to a person (individual), and a monitoring / judgment / instruction function with a built-in computer is provided. It may be a machine or device with intelligent functions. Examples other than humans (individuals) will be described based on embodiments described later.

  In FIG. 1, the terminal 10 includes, for example, a key input operation unit 11 as an input unit, a display unit 12 as an output unit, and a CPU 13 as an arithmetic processing / control unit as hardware configurations. Further, as shown in FIG. 2, the terminal 10 is connected to another external terminal 22 through a communication system 21 such as the Internet, and can communicate with each other (information / data transmission / reception), A receiving unit 15 is incorporated. Reference numeral 16 denotes a memory. The memory 16 stores an authentication program P11, an access control program (or access management program) P12, a data storage time recording program P13, and a data display time recording program P14. As shown in FIG. 3, the function of the authentication device 31 is realized by the CPU 13 calling and executing the authentication program P11, and the access control device (or access management device) by calling and executing the access control (management) program P12. ) 32 functions are realized. Similarly, as shown in FIG. 3, when the CPU 13 calls and executes the data storage time recording program P13 and the data display time recording program P14, the data storage time recording unit 33 and the data display time recording unit 34, respectively, Will be provided. Further, a data storage unit 16A having tamper resistance for protecting unauthorized access from the outside is provided inside the memory 16. Personal information (including related access management data) is stored and stored in the data storage unit 16A.

  In the above, it is necessary for the authentication device 31 to check whether or not there is a valid communication qualification in a case where information and data are mutually transmitted and received with other terminals via the communication system 21 or the like. If there is a functional device, it is a functional device for performing authentication using a predetermined ID and password. The access control device 32 is a functional device that controls access to the terminal 10 from other external terminals by determining whether it is appropriate or illegal. The specific contents of the appropriate / incorrect judgment criteria will be described later. The data storage time recording unit 33 is a functional unit for measuring and recording the storage time of information / data provided from other external terminals and stored in the memory 16. The data display time recording unit 34 is a functional unit for measuring and recording the display time of information / data displayed on the display unit 12.

  The above-described configuration of the terminal 10 is basically installed in all terminals applied to the personal information protection system according to the present embodiment, including the other terminals 22, for example. The characteristic point is that a functional device called an access control device 32 is provided, and a mechanism related to a management unit that performs information control is provided inside the terminal 10.

  Next, a characteristic processing operation of the personal information protection system according to the present embodiment based on the access control device 32 and the like will be described with reference to FIGS. FIG. 4 shows a data structure related to personal information, and FIG. 5 shows a characteristic processing operation flow for protecting personal information between two terminals.

  As shown in FIG. 3, a file of “personal information 1” relating to the owner of the terminal 10 and the like is stored in the data storage unit 16 </ b> A in the memory 16. As shown in FIG. 4, the data structure related to “personal information 1” includes items such as “name” and “phone number” as main items of the file 41 of “personal information 1”. Further, the items of the file 42 of the “access management data 1” attached to the second are “source transmission date / time”, “hash value of personal information”, “reference confirmation notification destination”, “referenceable time”, “referenceable” Items such as “number of times” and “continuous display time” are included. Each information in the file 42 of “access management data 1” is various information used in access control (or access management) based on the access control device 32. The file 41 of “personal information 1” and the file 42 of “access management data 1” are integrally handled as data structures as indicated by a dashed line block 43.

  As a method of handling personal information inside the terminal 10, for example, when personal information transmitted from another terminal is received, it is recorded in the data storage unit 16A. When reading personal information of another person stored in the data storage unit 16A, the reading may be rejected based on a predetermined condition (elapsed time, etc.).

  Regarding personal information to be sent and received, items displayed on the display unit 12 can be arbitrarily determined by design.

Next, a characteristic processing operation flow for protecting personal information between two terminals in the first embodiment of the present invention will be described with reference to FIG.
This personal information transmission / reception is performed between the terminal 10 and the other terminal 22 described above via the communication system 21. The terminal 10 is a first terminal and the terminal 22 is a second terminal. In this embodiment, a process in which the terminal 22 as the second terminal acquires “personal information 1” from the terminal 10 as the first terminal will be described.

  In the first step S101 on the terminal 10 side, “execution of authentication” regarding the counterpart terminal 22 is performed. In step S <b> 101 of “execution of authentication”, the terminal 10 authenticates the terminal 22 by the authentication device 31. In response to the authentication operation at the terminal 10, a corresponding authentication operation is performed at the terminal 22 (step S201). In step S <b> 201 of “authentication”, the terminal 22 authenticates the terminal 10 with the authentication device 31. In the mutual authentication process, if the result of the authentication is affirmative (YES) (decision step S102), it is permitted to send and receive personal information between the two terminals 10 and 22. In this case, personal information 1 and access management data 1 are transmitted from the terminal 10 side (step S104), and the transmitted personal information 1 and access management data 1 are received on the terminal 22 side (step S202). . The transmission of the personal information 1 and the access management data 1 in the terminal 10 is executed based on a transmission command (step S103) by a user (owner or the like) A of the terminal 10 that occurs as a premise. After the mutual authentication operation, the user A gives a transmission command to the terminal 10 via the key input operation unit 11 based on a personal information transmission request or the like displayed on the display unit 12. The terminal 22 that has received the personal information 1 and the access management data 1 stores the information and data in the data storage unit 16A of the memory 16 (step S203). Further, the terminal 22 measures the elapsed time from the time when the data related to the personal information 1 etc. is received from the terminal 10 and records it in the data storage time recording unit 33 (step S204).

  It is assumed that time T has elapsed from the reception time point (the execution time point of step S202) in each of the two terminals 10 and 22 after the above processing operation. This time T corresponds to the above “elapsed time”.

  After the elapse of the above time T, the user B of the terminal 22 gives a command for reading the personal information 1 of the terminal 10 stored in the data storage unit 16A of the memory 16 to the terminal 22 on the key input operation unit 11. (Step S205). When the access control device 32 of the terminal 22 receives the personal information reading command input by the user B, the next personal information reading process is performed based on the “referenceable time” in the access management data 1 attached to the personal information 1. Is performed (step S206). According to step S206 of the personal information reading process, the output results include (1) “reading permission” and (2) “reading rejection”.

(1) In the case of reading permission The allowable range of the number of referenceable times that the elapsed time T is within a predetermined “referenceable time” (for example, 5 hours) and is determined by the partner (terminal 10). This is the case. Information relating to “referenceable time” and “referenceable number of times” is included in “access management data 1” as described above.
(2) In the case of reading refusal The value of the time T related to the “elapsed time” recorded in the data storage time recording unit 33 of the terminal 22 is larger than the “referenceable time”, or the number of readings is “referenceable number of times” It is a case where it exceeds.

  As described above, step S206 of the personal information reading process includes a determination step S206-1 for “reading permission” or “reading refusal”. If “reading permitted” is determined in the determination step S206-1, the personal information 1 is displayed on the display unit 12 and the display time is recorded in the data display time recording unit 34, and the display time is displayed. When the time exceeds “continuous display time”, a process of deleting the display related to the personal information 1 is performed (step S207). On the other hand, if “reading refusal” is determined in determination step S206-1, the following processing is executed.

  If “reading refusal” is determined in the determination step S206-1, first, the access control device 32 transmits an access notification referring to personal information to the terminal 10 in the terminal 22 (step S208). The personal information reference access notification signal SIG 1 is transmitted to the terminal 10 via the communication system 21. When the terminal 10 receives the personal information reference access notification signal SIG1 from the terminal 22 (step S105), the access control program P12 described above operates, and the message content of the notification signal SIG1 is displayed on the display unit 12 of the terminal 10. (Step S106). This message content is a request to refer to “personal information 1”. The user A of the terminal 10 confirms the message content displayed on the display unit 12, and determines whether or not to reply to the reference request from the terminal 22 (determination step S107). As a result of the determination, when it is determined to “reply” (YES) in determination step S107, a notification of access permission is transmitted to the terminal 22 (step S108), and “not answer” (NO) is determined. In the case of an access rejection, a notification of access refusal is transmitted to the terminal 22 (step S109). The “access denied notification” based on step S109 can be notified by actually transmitting a signal related to “access denied notification”, or can be substantially notified by not transmitting the signal. . After execution of steps S108 and S109, the process at the terminal 10 ends.

  On the terminal 22 side, after transmitting a personal information reference access notification signal SIG1 to the terminal 10 in step S208, an access permission notification or access rejection notification is received after a predetermined time (step S209). Note that as the contents of notification from the terminal 10, “access rejection notification” reception conceptually includes “no reception”.

  If the terminal 22 determines that the access permission notification has been received in the next determination step S210, the personal information 1 is displayed on the display unit 12, and the display time is recorded on the data display time recording unit 34. And the process (step S211) of deleting the said display when the said display interval exceeds continuous display time is performed. If it is determined in step S210 that an access refusal notification has been received, a message to that effect is displayed on the display unit 12 (step S212). After execution of steps S211 and S212, the processing at the terminal 22 ends.

Although the communication of the personal information is one-to-one communication between the two terminals 10 and 22, the communication is not limited to this, and communication between one-to-many terminals may be used.
In the above-described embodiment, the terminal includes both elements of the transmission unit and the reception unit. However, the terminal may include a transmission unit or a reception unit so that only transmission or reception is performed for each terminal.
Some terminals may not have an access control device. When providing personal information to such a terminal, an access control program for realizing the access control device in the terminal can be transmitted together with the personal information.

[Second Embodiment]
Next, with reference to FIG. 6 and FIG. 7A, the individual information protection system which concerns on 2nd Embodiment of this invention is demonstrated. Similarly to the first embodiment, the individual information protection system of the second embodiment is also a personal information protection system.
6 is similar to FIG. 1, and FIG. 7A is similar to FIG. In FIG. 6, elements that are substantially the same as those described in FIG. 1 are given the same reference numerals, and descriptions thereof are omitted. Also, in FIG. 7A, elements that are substantially the same as those described in FIG. 5 are given the same reference numerals, and descriptions thereof are omitted.

  In FIG. 6, the memory 16 stores an access control result holding program P12-1 as an element related to the access control program P12. The function of the access control program P12 and the function of the access control result holding program P12-1 in this embodiment will be described below. Other configurations are the same as those described in FIG.

With reference to FIG. 7A, a characteristic processing operation flow for protecting personal information between two terminals in the second exemplary embodiment of the present invention will be described.
In the processing operation flow of FIG. 7A, the processing operation flow in steps S101 to S105 in the terminal 10 and the processing operation flow in steps S201 to S208 in the terminal 22 are the same as those in the first embodiment described above. Description is omitted. In the flow of processing operations according to the second embodiment, the processing operations after step S105 and the processing operations after step S208 are different.

  When the terminal 10 receives the personal information reference access notification signal SIG1 from the terminal 22 (step S105), the access control program P12 described above operates. In the case of the second embodiment, this access control program P12 always executes a rejection decision (step S301). That is, when the access notification signal SIG1 is received (step S105), processing for automatically refusing the access is performed (step S301). According to the access rejection process (step S301), as a result, the terminal 10 does not make any response to the access notification from the terminal 22. On the other hand, the terminal 22 side is maintained in a standby state after step S208, but when the terminal 10 (personal information transmission source) cannot obtain an answer to the transmitted access notification signal SIG1. , Will be considered as rejected.

In addition, about the exchange procedure of said rejection response performed between the terminal 10 and the terminal 22, it is possible to change into the 1st and 2nd two types as follows.
The processing flow of the main part in the case of the first and second modification examples is shown in FIGS. 7B and 7C, respectively.
The first modification is as follows. When the access notification signal SIG1 is received (step S105), the access is automatically denied (step S301). According to the access denial processing (step S301) of the first modification, the terminal 10 automatically makes a “reply deny” in response to the access notification from the terminal 22. On the terminal 22 side, after step S208, it is maintained in a standby state, and when a “rejection reply” is obtained from the terminal 10 (personal information transmission source) side for the transmitted access notification signal SIG1 (step S20). It is determined that the request has been rejected in step S501) (step S502).
The second modification is as follows. When the access notification signal SIG1 is received (step S105), the access is automatically denied (step S301). According to the access refusal process (step S301) of the second modification example, the terminal 10 automatically “responds to refusal” in response to the access notification from the terminal 22, as in the first modification example. . On the terminal 22 side, the standby state is maintained after step S208. However, the terminal 10 (personal information transmission source) can obtain a “repudiation reply” for some reason from the terminal 10 (personal information transmission source) side with respect to the transmitted access notification signal SIG1. If not (step S601), it is determined that it has been rejected (step S602).

  Returning to FIG. 7A (the same applies to FIGS. 7B and 7C), on the terminal 10 side, the display unit 12 then notifies the user A of the result of the rejection of the access control program P12. The message “I rejected because there was an inquiry. If you want to notify permission, please perform the prescribed procedure” is displayed (step S302). Whether or not the permission notification is performed is based on the judgment of the user A who confirms the other party (user B) whose access is denied. When the user A determines to give a permission notification to the user B, a notification instruction command is input to the key input operation unit 11 of the terminal 10. When the user A determines not to give the permission notification, no input operation is performed.

  In addition, after step S302, the above-described access control result holding program P12-1 is automatically operated and described in the data storage unit 16A (tamper resistant area) of the memory 16 of the terminal 10 with reference to FIG. As the above-mentioned “access management data 1”, the “reference confirmation notification destination” (the address of the terminal 22, etc.) and the “notification result” are stored (step S303).

  In the determination as to whether or not the above-mentioned permission notification is made by the user A, only when a notification instruction command is given to the terminal 10, the “notification of access permission again” process indicated by the broken line block is performed (step S400). ), “Permission notification” is transmitted to the terminal 22. As shown in FIG. 8, the content of step S400 is to display the other party (user B) whose access has been denied (step S401), and to determine whether or not to give permission notification by user A who sees it. It consists of an input operation (determination step S402) and an access permission notification transmission (step S403). Step S401 for displaying the access denied party is provided to user A in advance as the content of the “predetermined procedure” displayed in step S302. When user A wants to give access permission notification to user B, the access control result holding program P12-1 reads the above “reference confirmation notification destination” from the data storage unit 16A, and permits it by referring to this. Or prompt the decision of refusal. After the execution of step S400, the process at the terminal 10 ends.

  On the other hand, the terminal 22 in the standby state determines whether or not the “permission notification” is received (access permission or denial) in the determination step S304. If YES (permitted) in the determination step S304, the above-described step S211 is executed, and if NO (rejected), the above-described step S212 is executed.

[Third Embodiment]
Next, an individual information protection system according to a third embodiment of the present invention will be described with reference to FIG. The individual information protection system according to the third embodiment is a modification of the personal information protection system according to the first embodiment. In the third embodiment, as described above, for example, the terminal 10 is not operated by the user A (person), but by a machine or device with an intelligent function that has a built-in computer and a determination / instruction function. Accordingly, the “personal information” is the original “individual information”. In FIG. 9, an operation device 51 is illustrated as a device for operating the terminal 10. The operating device 51 monitors and confirms the situation based on information presented from the terminal 10 (procedure PRO1), and gives command information for necessary operations to the terminal 10 (procedure PRO2). Therefore, the terminal 10 includes a “presentation execution unit 12A” instead of the “display unit 12” described above, and includes a “will communication unit 11A” instead of the “key input operation unit 11” described above. In the third embodiment, in particular, the concept of “display” for human beings is replaced with the concept of “presentation” for the operation device 51. The term “presentation” is a generic term including “display”. Further, the concept of “key input operation” for a human being can be replaced with the concept of “communication” for the operation device 51. The term “communication” is a general term including “key input operation” for humans and “operation information input” for machines.
The operating device 51 confirms the status of the terminal 10 based on the information presented from the presentation execution unit 12A. Examples of how the operating device 51 confirms the status of the terminal 10 via the presentation execution unit 12A include the following examples.
(1) The presentation data of the terminal 10 is received instead of the communication protocol.
(2) The presentation data of the terminal 10 is obtained by executing a specific API (Application Programming Interface) of the terminal 10.
(3) Presentation data is obtained from a difference in output due to a voltage change at a specific terminal of the terminal 10 (for example, 5V is permitted, 0V is rejected, etc.)
In addition, the operation device 51 transmits instruction information for operation to the terminal 10 via the intention transmission unit 11A. That is, intention information for operating the operation device 51 is given to the terminal 10. Therefore, the key input operation unit 11 described above is a unit operated based on an operator's (user A) operation intention, and the intention transmission unit 11A is a unit operated based on an operation instruction intention of the operation device 51.
Since other configurations are substantially the same as those described with reference to FIG. 1 in the first embodiment, the same components are denoted by the same reference numerals and description thereof is omitted.
In the individual information protection system according to the third embodiment, in the processing operation flow for protecting “individual information” between the two terminals described in FIG. 5, instead of the users A and B, The operating device 51 in each of the terminals 10 and 22 automatically executes its function.

[Fourth Embodiment]
The individual information protection system according to the fourth embodiment of the present invention has the characteristic configuration described in the third embodiment with respect to the personal information protection system according to the second embodiment described with reference to FIGS. Is applied as an original “individual information protection system.” According to the individual information protection system according to the fourth embodiment, not the personal information but the operating device that operates the terminal 10. Individual information can be protected.

[Fifth Embodiment]
Next, an individual information protection system according to a fifth embodiment of the present invention will be described with reference to FIGS. 10 and 11. The individual information protection system according to the fifth embodiment is a modification of the personal information protection system according to the first embodiment. In the fifth embodiment, as shown in FIG. 10, in the terminal 10 having the configuration shown in FIG. 1, in addition to the programs P11 to P14 described above, the data encryption program P21 and the data decryption program P22 are stored in the memory 16. Is remembered. For example, commercially available software is used for these programs P21 and P22. Therefore, as shown in FIG. 10, as a functional unit in the terminal 10, the data encryption processing unit 35 based on the data encryption program P21 and the data decryption program P22 are compared with the functional elements shown in FIG. A data decoding processing unit 36 is added. For example, the data encryption processing unit 35 is disposed on the output side of the transmission unit 14, and the data decryption processing unit 36 is disposed on the input side of the reception unit 15. The data encryption processing unit 35 can be arranged between the access control device 32 and the transmission unit 14, and the data decryption processing unit 36 is connected between the reception unit 15 and the authentication device 31, or between the authentication device 31 and the access. It can also be arranged between the control device 32.

  Other configurations in the terminal 10 are substantially the same as those described with reference to FIGS. 1 and 3 in the first embodiment, and thus the same components are denoted by the same reference numerals and description thereof is omitted. To do.

Note that, according to the configuration example of the fifth embodiment, the data encryption processing unit 35 based on the data encryption program P21 and the data decryption processing unit 36 based on the data decryption program P22 (public key cryptosystem). However, in consideration of the case of the common key cryptosystem, data encryption and decryption can be configured as follows.
First, the same “encryption / decryption program” is installed in each of the “data encryption processing unit 35” and “data decryption processing unit 36” separately provided as components.
Second, the “data encryption processing unit” and the “data decryption processing unit” are integrated as an “encryption / decryption processing unit” and configured as one processing element, and the “encryption / decryption processing unit” “Encryption / decryption program” is implemented.

  In the first to fourth embodiments described above, personal information (individual information) is protected without applying a special encryption processing technique. This protection method is appropriately established when information control between terminals is realized, but information control cannot be performed when data being communicated is intercepted by a malicious third party. Therefore, from the viewpoint of solving such a problem, according to the configuration of the personal information protection system according to the fifth embodiment, the encryption process is performed between terminals for the purpose of preventing information leakage. In the configuration of the personal information protection system according to the fifth embodiment, personal information is encrypted by the data encryption processing unit 35 before being transmitted at the terminal 10, and the encrypted data is transmitted when transmitted to the counterpart terminal. . Note that the communication path between the terminals may be encrypted, and unencrypted data may be transmitted.

  The configuration related to the data encryption processing in the individual (personal) information protection system according to the fifth embodiment of the present invention is the same as that of the individual information protection system (personal information protection system) according to the second to fourth embodiments described above. Of course, it can be applied and configured.

  The configurations, arrangement relationships, and mechanisms described in the above embodiments are merely schematically shown to the extent that the present invention can be understood and implemented. Therefore, the present invention is not limited to the described embodiments, and can be variously modified without departing from the scope of the technical idea shown in the claims.

  The individual information protection system according to the present invention provides a mechanism for controlling individual information in each terminal when at least two terminals transmit / receive individual information (including personal information) via a communication system. It is used to simply configure an information protection system.

DESCRIPTION OF SYMBOLS 10 Terminal 11 Key input operation part 11A Intention transmission part 12 Display part 12A Presentation execution part 13 CPU
DESCRIPTION OF SYMBOLS 14 Transmission part 15 Reception part 16 Memory 16A Data storage part 21 Communication system 22 Other terminal 31 Authentication apparatus 32 Access control apparatus (access management apparatus)
33 Data storage time recording unit 34 Data display time recording unit 35 Data encryption program 36 Data decryption program 43 Data structure 51 Operating device P11 Authentication program P12 Access control program (data management program)
P12-1 Access control result holding program P13 Data storage time recording program P14 Data display time recording program P21 Data encryption program P22 Data decryption program

Claims (11)

Communication in which individual information is transmitted and received between at least two terminals via a communication system, one of the terminals is a terminal of an individual information transmission destination and the other terminal is a terminal of an individual information transmission source In the system,
The one terminal provided with the individual information is
A tamper-resistant data storage unit for storing the received individual information;
Data storage time recording means for measuring and recording the elapsed time from the reception of the individual information;
When reading the individual information from the data storage unit, a determination is made that the reading of the individual information is permitted if the elapsed time does not exceed the reference time, and the reading of the individual information is rejected otherwise. Judgment means,
When the determination unit determines to allow reading of the individual information, a presentation executing unit that presents the individual information to a presentation unit;
An individual information protection system comprising: The one terminal includes an access control unit that transmits an access notification of the individual information reference to the other terminal that has provided the individual information when the determination unit determines to refuse reading of the individual information. ,
The other terminal that is the individual information transmission source, after receiving the access notification, refers to the information related to the access notification presented to the presentation unit, and gives a response necessity instruction given via the intention transmission unit An access control means for transmitting an access permission notice or an access denial notice to the terminal,
The individual information protection system according to claim 1. The access control means in the other terminal is:
Means for automatically performing a refusal determination upon receipt of the access notification;
Means for presenting an access refusal notification and permission notification necessity message as the information related to the access notification to the presenting unit, and storing information related to a reference confirmation notification destination in the data storage unit;
The individual information protection system according to claim 2, further comprising:   4. The access refusal notification is executed by not responding to the one terminal based on the automatic refusal determination, and determining that the access is rejected because there is no response in the one terminal. The individual information protection system described.   The access refusal notification is executed by automatically performing a refusal notification to the one terminal based on the automatic refusal determination, and determining the refusal by receiving the refusal notification at the one terminal. The individual information protection system according to claim 3, wherein:   The access refusal notification is executed by automatically notifying the one terminal based on the automatic refusal determination and determining that the one terminal does not receive the refusal notification. The individual information protection system according to claim 3.   4. The individual information protection system according to claim 3, wherein when the access permission notification is performed, information related to the reference confirmation notification destination stored in the data storage unit is used. The one terminal includes other determination means for determining whether the notification content from the other terminal is the access permission notification or the access denial notification,
3. The individual information protection system according to claim 2, wherein the presentation executing unit presents the individual information to the presenting unit when the other determining unit determines that the access permission notification is made. 4.   The individual information protection system according to claim 1, wherein the individual information includes accompanying access control data, and the access control data includes data related to the referenceable time. The one terminal has data presentation time recording means for measuring and recording a presentation time from when the individual information is presented to the presentation unit,
The said presentation execution means is provided with the presentation erasure | elimination means to erase | eliminate the presentation of the said individual information, when the said presentation time exceeds the preset continuous presentation time. Individual information protection system described in 1.   When the terminal is configured to be operated by a human operation, the individual information is personal information, the presentation unit is a display unit, and the presentation execution unit is a display execution unit. The individual information protection system of any one of Claims 1-10.

Images