JPWO2007105273A1 - Confidential information management program, method and apparatus - Google Patents

Abstract

The feature information extraction unit cuts out a character string having a fixed character string length n as feature information while shifting one character at a time from the beginning of the secret document, assigns a secret document identifier to each cut character string, and hashes each character string as a key Register in the table. The confidential information determination unit extracts a character string having a fixed character string length n while shifting character by character from the beginning of the determination target document, and compares each extracted character string with a hash table to determine whether the determination target document includes confidential information. judge. The frequent expression extraction unit extracts a frequent expression from the collected confidential document and general document, and the feature information extraction unit cuts out a character string having a certain character string length after removing the frequent expression from the confidential reference document.

Description

The present invention relates to a confidential information management program, method and apparatus for managing confidential information in an organization such as a company or various organizations so as not to be leaked to the outside, and in particular, whether or not confidential information is included in an electronic document such as an electronic mail. The present invention relates to a confidential information management program, method and apparatus for determining information security in real time.

  Conventionally, there are many confidential documents including confidential information that should not be leaked to the outside in the document information managed by servers and databases on the company intranet. A dedicated confidential information management server and database for managing documents are arranged, and the security of confidential information is established by centrally managing confidential documents.

  In such a confidential document management system, the authority to browse for each confidential document is set, and when accessing a confidential document in the database, in addition to the authentication by the user ID and password, the presence / absence of the browsing authority is checked. The use of a confidential document is permitted only for access from a terminal having browsing authority.

  However, within a company, a person who does not necessarily have access to the database, who does not necessarily have access to the database, has the opportunity to know the contents of a confidential document or obtain a confidential document from a person with authority to view it as a document. is there. For this reason, there is a case where the confidential document itself or a part of the confidential document is attached to an e-mail and sent to the outside without being conscious of the confidential document. It is difficult to ensure sufficient security by itself.

  For this reason, efforts have been made to ensure that the person in charge is thoroughly aware of the management of confidential documents through human management, but leakage of confidential information related to confidential documents has not been completely prevented.

  For this reason, a confidential information management device that extracts the transfer information and determines whether it is a confidential document is arranged in a network system that transmits an electronic document such as an e-mail to the outside. It is conceivable to determine whether or not it is included.

In this way, the confidential information management device creates a dictionary by extracting keywords and character patterns that represent the characteristics of a confidential document for each confidential document managed by a dedicated database, and compares the transferred document with the registered contents of the dictionary. It is then determined whether it is a confidential document.
JP 2003-288366 A W004 / 034282

  However, in the determination of a confidential document using a conventional dictionary, a document including all of the keywords and character patterns extracted for a specific confidential document is determined as a confidential document, and thus there is a problem that the relevance rate is low. is there.

  In order to solve this problem, a threshold is set for the matching ratio with the keyword and the character pattern, and a document having a matching ratio equal to or higher than the threshold is set as a confidential document. However, the ratio of misjudging a general document as a confidential document increases. In order to improve the judgment accuracy, human judgment is required, which takes time and man-hours, and it is difficult to manage confidential documents with a huge number of emails and files sent and received on a daily basis. is there.

  Further, when a file including a part of a document included in the confidential document is attached to the email instead of the confidential document itself, it is often difficult to find it by machine determination or manual determination.

  In this way, with the conventional system, it is difficult to check all the contents when the confidential documents and equivalent information in the organization are taken out of the organization through the network, especially when it is taken out due to an unintended mistake etc. However, there is a problem that both accuracy and processing speed are low, although it is necessary to prevent all confidential documents from coming out by judging all documents that flow out of the organization.

The present invention provides a confidential information management program, method, and apparatus that can process determination of an electronic confidential document taken out of an organization with high accuracy and high speed.

(program)
The present invention provides a confidential information management program executed by a computer. The confidential information management program of the present invention is stored in a computer.
Character information with a fixed character string length n is extracted as feature information while shifting one character at a time from the beginning of the confidential document, a confidential document identifier is assigned to each extracted character string, and each extracted character string is registered in the hash table as a key. An extraction step;
Confidential information determination in which a character string having a fixed character string length n is cut out while shifting character by character from the beginning of the determination target document, and each cut-out character string is checked against the hash table to determine whether the determination target document includes confidential information. Steps,
Is executed.

  Here, the fixed character string length n for extracting the character string in the feature information extraction step and the confidential information determination step is classified using the hash table created while increasing the character string length by one character in the feature extraction step. When a confidential document is determined in the information determination step, the character string length that matches the discovery rate of the confidential document with respect to the change in the character string length and the character string matching rate in the discovered confidential document, or a character string length in the vicinity thereof And

The confidential information management program of the present invention further executes a frequent expression extraction step of extracting a frequent expression from the collected confidential document and general document and registering it in the frequent expression table,
In the feature information extraction step, after the frequent expression in the frequent expression table is removed from the confidential control document, a character string having a fixed character string length n is cut out.

The feature extraction step
A partial document extraction step of extracting a confidential partial document having a semantic unit such as a file unit from a plurality of confidential documents;
An identifier providing step for assigning a confidential document identifier of the confidential document corresponding to the confidential partial document;
A frequent expression removal step of removing the frequent expression of the frequent expression table from the confidential partial document;
A character string extracting step of extracting a character string having a fixed character string length n while shifting one character at a time from the beginning of the confidential partial document;
A table registration step of registering the corresponding confidential document identifier in the hash table using all the extracted character strings as keys;
Is provided.

The confidential information judgment step
A document acquisition step for acquiring a determination target document;
An identifier assigning step for assigning a document identifier to the determination target document;
A character string extraction step of extracting a character string having a constant character string length n while shifting character by character from the beginning of the determination target document;
A table collation step for collating all cut character strings with a registered character string that is a key of a hash table, and obtaining a confidential information identifier corresponding to a collation match
When one or more confidential document identifiers are acquired from the table matching step, a determination result indicating that the determination target document includes confidential information is output. When no confidential document identifier is acquired, the determination target document is confidential information. A determination output step for outputting a determination result indicating that it does not include,
Is provided.

The frequent expression extraction step
A document collection step for collecting confidential and general documents;
A character string extraction step of extracting character strings of each character string length while sequentially increasing the character string length from the collected document;
A frequency detection step of detecting the appearance frequency for each character string length;
A candidate extraction step of extracting a character string having an appearance frequency equal to or higher than a predetermined threshold for each character string length as a frequent expression candidate;
A candidate removal step of investigating the inclusion relationship of frequent expression candidates and removing the included frequent candidate character strings;
A registration step for registering the candidate remaining in the candidate removal in the candidate removal step in the frequent expression table as a frequent expression;
Is provided.

  The determination target document of the confidential information determination step includes an e-mail body and attached document, a transfer file document transferred via a network, a display document transferred to a display device for display, a print document transferred to a printer for printing, and an information device Contains documents stored in the memory.

  The confidential information determination step prohibits processing of the determination target document when it is determined that the determination target document includes confidential information.

  In the confidential information determination step, when it is determined that the determination target document includes confidential information, the processing authority of the confidential document is confirmed and the process is permitted.

  The confidential information determination step permits processing of the determination target document when it is determined that the determination target document includes confidential information, when the determination result is notified to the administrator terminal and a permission response is received.

(Method)
The present invention provides a confidential information management method. The confidential information management method of the present invention includes:
Character information with a fixed character string length n is extracted as feature information while shifting one character at a time from the beginning of the confidential document, a confidential document identifier is assigned to each extracted character string, and each extracted character string is registered in the hash table as a key. An extraction step;
A confidential information determination step of cutting out a character string having a fixed character string length n while shifting character by character from the beginning of the determination target document and determining whether or not the determination target document includes confidential information by comparing each extracted character string with a hash table. When,
It is provided with.

  The confidential information management method of the present invention further includes a frequent expression extracting step of extracting a frequent expression from the collected confidential document and general document and registering the frequent expression in a frequent expression table, and the feature information extracting step includes the frequent expression from the determination target document. After removing the frequent expression of the table, a character string having a certain character string length is cut out.

(apparatus)
The present invention provides a confidential information management device. The confidential information management device of the present invention is
Character information with a fixed character string length n is extracted as feature information while shifting one character at a time from the beginning of the confidential document, a confidential document identifier is assigned to each extracted character string, and each extracted character string is registered in the hash table as a key. The draw part,
A confidential information determination unit that extracts a character string having a constant character string length n while shifting character by character from the beginning of the determination target document and determines whether or not the determination target document includes confidential information by comparing each extracted character string with a hash table. When,
It is provided with.

The confidential information management apparatus according to the present invention further includes a frequent expression extracting unit that extracts a frequent expression from the collected confidential document and general document and registers the frequent expression in a frequent expression table, and the feature information extraction unit performs the frequent expression from the determination target document. After removing frequent expressions in the table, cut out a character string of a certain character string length.

  According to the present invention, a character string having a fixed character string length n is extracted as feature information while shifting one character at a time from the beginning of the confidential document, and the confidential document ID is registered in the hash table using the extracted character string as a key. For a document that is going to be sent from the organization to the outside, a character string of a fixed character string length n is cut out by shifting one character at a time from the beginning, matched against a hash table, and if even one confidential information ID is obtained, the confidential document is obtained. And the corresponding processing such as prohibition of transmission is executed to reliably prevent leakage of confidential documents or equivalent information.

  In this case, the fixed character string length n for extracting the character string by the feature extraction of the confidential document and the determination of the confidential information, the discovery rate of the confidential document with respect to the change of the character string length, and the character string in the detected confidential document A confidential document can be determined with high accuracy by optimizing the length of a character string having a matching relationship with the matching rate or a character string length in the vicinity thereof.

  Also, since the confidential document ID is registered in the hash table using the cut-out character string that is the characteristic information of the confidential information as a key and collation is performed with the character string cut out from the determination target document, high-speed comparison and collation are possible. It is possible to make a machine judgment as to whether or not all information going out is a confidential document.

Also, when generating a hash table for registering the feature information of confidential documents, frequent expressions that appear frequently in confidential documents but are not essential parts of the document, and that can be reproduced in confidential documents, are eliminated. By doing so, it is possible to avoid registration of a confidential document ID using an unnecessary extracted character string that is not a feature of confidential information as a key, and to improve the accuracy and processing speed of confidential information.

The block diagram of the function structure which showed embodiment of the confidential information management apparatus of this invention Block diagram of a detailed functional configuration of the embodiment of FIG. Block diagram of a hardware environment of a computer to which this embodiment is applied Flow chart of overall processing of confidential information management according to this embodiment The flowchart which showed the detail of the frequent expression extraction process in step S1 of FIG. Explanatory drawing of the processing contents of frequent expression extraction processing according to this embodiment The flowchart which showed the detail of the confidential information feature extraction process in step S2 of FIG. Explanatory drawing of processing contents of confidential information feature extraction processing according to this embodiment Characteristic chart for determining a fixed character string length n for character extraction in this embodiment Explanatory drawing of the character string extraction process by fixed character string length n in this embodiment The flowchart which showed the detail of the confidential information determination process in step S4 of FIG. Explanatory drawing of processing contents of confidential information determination processing according to this embodiment

  FIG. 1 is a block diagram of a functional configuration showing an embodiment of a confidential information management apparatus of the present invention. In FIG. 1, a confidential information management apparatus 10 of this embodiment is connected to a network 24 in an organization such as a company, and a frequent expression extraction unit 12, a confidential information feature extraction unit 14, a confidential information determination unit 16, a frequent expression. A table 18, a hash table 20, and a determination log file 22 are provided.

  A confidential document database 28 is connected to the network 24 in the organization to which the confidential information management apparatus 10 of the present embodiment is connected via a confidential document management server 26, and is handled in the organization by the confidential document database 28. All confidential documents are stored and managed. Of course, distributed confidential documents distributed to a plurality of other servers may be used instead of the centralized management by the confidential document management server 26.

  A plurality of clients 30-1 to 30-3 used by persons in charge in the organization are connected to the network 24, and are provided with displays 32-1 to 32-3, respectively. A printer 34 is connected to the network 24 as a shared device.

  Further, the network 24 is connected to external devices 46-1 to 46-4 via an external network 44 such as the Internet. In the present embodiment, a proxy server 36 that centrally processes e-mails, a gateway server 38 that performs file transfer such as FTP, and the like are located at positions corresponding to the gateways from the internal network 24 to the external network 44. A facsimile server 40 for processing electronic messages is provided.

  Further, a scan station 42 is installed in the network 24. The scan station 42 is installed at a company entrance and exit, and allows access to electronic documents stored in a portable information device 45 such as a personal computer carried by a person in charge of the company.

  The confidential information feature extraction unit 14 of the confidential information management apparatus 10 targets a confidential document stored in the confidential document database 28 as a feature information by shifting a character string having a fixed character string length n while shifting the confidential document one character at a time. And a confidential document ID corresponding to each extracted character string is assigned, and each extracted character string is registered in the hash table 20 as a key.

  The confidential information determination unit 16 acquires, as a determination target document, a document for which a determination request has been made, for example, the body or attached file of an e-mail transmitted to the outside from the proxy server 36 via the network 24, and starts from the top of the determination target document. A character string having a fixed character string length n is cut out while shifting character by character, and each cut-out character string is checked against the hash table 20 to determine whether the determination target document includes confidential information.

  The frequent expression extraction unit 12 extracts frequent expressions having a high appearance frequency for the collected confidential documents and general documents, and registers them in the frequent expression table 18. In the confidential information feature extraction unit 14, after the frequent expression registered in the frequent expression table 18 is removed from the determination target document, the hash table 20 is registered based on the character extraction with a fixed character string length n.

  As described above, when the hash table 20 is created, a character string that is frequently appearing frequently appearing information included in a confidential document, that is, a general wording used in a general document as well as a confidential document. Naturally, content that must be written, such as “This logo is a registered trademark of XX Company”, is extracted as a frequent expression and excluded from the determination of confidential documents. To increase.

  FIG. 2 is a block diagram of detailed functional configurations of the frequent expression extraction unit 12, the confidential information feature extraction unit 14, and the confidential information determination unit 16 provided in the confidential information management apparatus 10 of FIG. In FIG. 2, the frequent expression extraction unit 12 includes a document collection unit 48, a character string extraction unit 50, a frequency detection unit 52, a candidate extraction unit 54, an inclusion candidate removal unit 56, and a table registration unit 58.

  The document collection unit 48 collects confidential documents and general documents from the network in the company. The character string cutout unit 50 cuts out a character string for each character string length while sequentially increasing the character string length from the collected document. The frequency detection unit 52 detects the appearance frequency of the character string for each character string length.

  The candidate extraction unit 54 extracts a character string having an appearance frequency equal to or higher than a predetermined threshold determined for each character string length as a frequent expression candidate. The inclusion candidate removal unit 56 investigates the inclusion relation of the frequent expression candidates and removes the included frequent candidate character strings. The table registration unit 58 registers candidates remaining after candidate removal by the inclusion candidate removal unit 56 in the frequent expression table 18 as frequent expressions.

  The confidential information feature extraction unit 14 includes a partial document extraction unit 60, an ID addition unit 62, a frequent expression removal unit 64, a character string extraction unit 66, and a table registration unit 68. The partial document cutout unit 60 extracts a confidential partial document having a semantic unit such as a file unit from a plurality of confidential documents prepared for feature information extraction.

  The ID assigning unit 62 assigns the confidential document ID of the confidential document corresponding to the confidential partial document extracted by the partial document cutout unit 60. The frequent expression removal unit 64 detects and removes frequent expressions registered in the frequent expression table 18 from the confidential partial document.

  The character string cutout unit 66 cuts out a character string having a fixed character string length n while shifting characters one by one from the beginning of the confidential partial document. For example, if the character string length of the confidential partial document to be cut out is m, (mn) character strings are cut out by cutting out a character string having a fixed character string length n. The table registration unit 68 registers the corresponding confidential document ID in the hash table 20 using all the extracted character strings as keys.

  The confidential information determination unit 16 includes a document acquisition unit 70, an identifier assignment unit 72, a character string cutout unit 74, a collation unit 76, and a determination output unit 78. The document acquisition unit 70 acquires a determination target document for which a determination request has been received from a device on the network. The identifier assigning unit 72 assigns a document ID to the determination target document.

  The character string cutout unit 74 cuts out a character string having a fixed character string length n while shifting character by character from the beginning of the determination target document. The collation unit 76 collates all the extracted character strings with the registered character string that is the key of the hash table 20, and acquires the confidential document ID corresponding to the collation match. When one or more confidential document IDs are acquired from the collating unit 76, the determination output unit 78 outputs a determination result indicating that the determination target document includes confidential information, and the confidential document ID is not acquired. Outputs a determination result indicating that the determination target document does not include a confidential document.

  When the determination result of the confidential document is obtained from the determination output unit 78, a security response process corresponding to the determination result of the confidential document is performed. Although the processing is prohibited at all, if the person in charge of the terminal performing the processing has the viewing authority, the processing is permitted even for a confidential document. For the confidential document, the determination result may be notified to the management terminal that manages the confidential document, and access to the confidential document may be permitted only when an authorization response is received from the administrator terminal.

  FIG. 3 is a block diagram of a hardware environment of a computer to which this embodiment is applied. In FIG. 3, a RAM 82, a ROM 86, a hard disk drive 88, a keyboard 92, a mouse 94, a device interface 90 for connecting a display 96, and a network adapter 98 are provided for the bus 82 of the CPU 80.

  The hard disk drive 88 stores a confidential information management program that realizes the function as the confidential information management apparatus 10 of the present embodiment, and the hard disk drive 88 is loaded with the OS in the RAM 84 after the computer is booted up. The data is read from the drive 88 to the RAM 84 and executed by the CPU 80.

  FIG. 4 is a flowchart of the entire process of confidential information management according to the present embodiment, which will be described below with reference to FIG. In FIG. 4, the confidential information management process first executes a frequent expression extraction process by the frequent expression extraction unit 12 in step S <b> 1, and stores the extracted frequent expression in the frequent expression table 18.

  Subsequently, in step S2, confidential information feature extraction processing is executed by the confidential information feature extraction unit 14, and the secret information ID is stored in the hash table 20 using the extracted feature information, specifically, a character string having a fixed character string length n as a key. Registration processing is performed.

  Subsequently, whether or not there is a document determination request is checked in step S3. When the determination request is received, the process proceeds to step S4, and determination processing by the confidential information determination unit 16 is executed. If it is determined in step S5 that the confidential information has been determined, the process proceeds to step S7, where, for example, processing for prohibiting access to the determination target document is performed as confidential document handling processing. If it is determined in step S5 that the information is not confidential information, document processing is permitted in step S6.

  Subsequently, the processing result of the confidential information determination process is recorded in the determination log file 22 in step S8. Next, when it is determined in step S9 that there is an additional update of confidential information, the process returns to step S2, and the confidential information feature extraction process is performed on the additionally updated confidential document to additionally update the hash table 20. . Such processes in steps S2 to S9 are repeated until a stop instruction is issued in step S10.

  FIG. 5 is a flowchart showing details of the frequent expression extraction process in step S1 of FIG. In FIG. 5, in the frequent expression extraction process, confidential documents and general documents are collected from the network in step S1, and character strings in units of character string lengths of, for example, tens to hundreds of characters are collected from the collected documents in step S2. Cut out.

  Subsequently, in step S3, the appearance frequency is obtained for each character string length obtained by sequentially increasing the character string length for the cut character string, and the appearance frequency determination threshold is determined at the same time. Next, in step S4, a character string having a frequency equal to or higher than a threshold for each character string length is extracted as a frequent expression candidate. Subsequently, in step S5, the inclusion relationship is examined among the extracted frequent expression candidates, and the included candidates are removed. Finally, in step S6, candidates remaining after removal of the included candidates are registered in the frequent expression table 18 as frequent expressions.

  FIG. 6 specifically shows the processing contents of the frequent expression extraction processing according to the present embodiment. In FIG. 6, first, a document collection process 100 for confidential documents and general documents is performed, and as shown in a document file 102, a plurality of documents including a file ID, a file name, and file data are collected.

  Next, a frequency detection is performed in which a character string is cut out in the range of several tens to several hundred characters for each document in the document file 102, and a statistical appearance frequency is detected for each character string length in the cut character string. Processing 104 is executed. By the frequency detection process 104, as shown in the work table 106-1, the contents shown in the character string 112, the character string length 114, and the appearance frequency 116 are obtained.

  Next, frequent expression candidate extraction processing 108 is executed. In the frequent expression candidate extraction process 108, as shown in the work table 106-2, a character string having an appearance frequency exceeding a predetermined threshold is set to “1” as shown in the frequent expression candidate 118, and the threshold value is set. For character strings less than "0" indicating that they are not candidates are set.

  Next, the inclusion candidate removal processing 110 is executed, and the inclusion relationship 120 is set to “1” if it is an inclusion candidate as in the work table 106-3, and “0” is set if there is no inclusion relationship. To do. By this inclusion candidate removal processing 110, for example, the character string “□ ΔΔ ■” in the work table 106-3 is extracted as a frequent expression and registered in the frequent expression table 18.

  FIG. 7 is a flowchart showing details of the confidential information feature extraction processing in step S2 of FIG. In FIG. 7, the confidential information feature extraction process reads a confidential document group in step S <b> 1, and in step S <b> 2, for example, extracts a document in units of files as a partial document having one semantic group.

  Next, a document ID is assigned to the document cut out in step S3. In step S4, the frequent expression is removed from the confidential document based on the registered contents of the frequent expression table 18 obtained by the frequent information extraction process of FIG. Subsequently, in step S5, characters are extracted with a fixed character string length n while shifting the confidential document by one character from the beginning.

  In step S6, the document ID is registered in the hash table 20 using all the extracted character strings as keys. Such processes in steps S2 to S6 are repeated until the file unit is cut out in step S7.

  FIG. 8 is an explanatory diagram showing the processing contents of the confidential information extraction processing according to this embodiment. In FIG. 8, after reading a plurality of pieces of document information 122-1 to 122-3, a confidential document is cut out, for example, in units of files by a cutout process 124. Subsequently, the document ID assigning process 126 assigns the confidential document ID set in the cut-out source document to the cut-out secret document. Thereby, as shown in the document file 128, file data to which a file ID and a file name are assigned is created.

  Next, a specific file of the document file 128 is taken out by the text information extraction process 130, and the text information is extracted therefrom. Next, the frequent expression registered in the frequent information table 18 is removed from the text information by the frequent expression removal processing 130. Subsequently, a fixed character string cutout process 134 is executed, and a character string having a fixed character string length n is cut out while shifting one character at a time from the beginning of the text document. Finally, the confidential document ID is registered in the hash table 20 by using the hash registration process 136 with all character strings as keys.

  Here, the optimum value of the fixed character string length n for extracting the character string from the confidential document in the confidential information feature extraction processing of this embodiment will be described. FIG. 9 is a characteristic diagram for determining a fixed character string length n for performing character string extraction for feature extraction of a confidential document in this embodiment.

  In FIG. 9, the horizontal axis represents the length of a character string used to determine a confidential document, and takes a value from one character to the maximum number of characters determined by the document size. The vertical axis is displayed as a percentage. A characteristic curve 138 is a confidential document discovery rate when the character string length is sequentially increased from one character, and the confidential document discovery rate decreases as the character string length increases.

  The characteristic curve 140 is the matching ratio of the character string in the confidential document determined with respect to the change in the character string length, and as the character string length increases, the ratio of the matching character string length in the discovered confidential document increases. To do. Ultimately, when all character strings of the confidential document are character string lengths, the value of the characteristic curve 140 is 100%, that is, the confidential document and the character string length completely coincide.

  In this embodiment, the character string length n of the intersection 142 where the confidential document discovery rate characteristic curve 138 and the coincidence character string length coincidence rate characteristic curve 140 in the found confidential document intersect is the same. Is the character string length for optimal character string extraction.

  In the case of a Japanese document, it has been obtained through consideration by the inventors of the present application that the character string length n given by the intersection 142 of the characteristic curves 138 and 140 in FIG. 9 is n = 20 characters. This optimum character string length n = 20 characters is in the case of Japanese, but even in English and other languages, 20 characters can be obtained by obtaining the matching character string length n at the intersection 142 in FIG. The values before and after are obtained.

  FIG. 10 is an explanatory diagram of a character string cut-out process with a constant character string length n in the present embodiment. In FIG. 10, the character strings 152-1 and 152 are shifted from the beginning of the file character string 150 by shifting the constant character string of the character string length n determined in FIG. As shown in −2, 152-3,..., Clipping is performed until the end of the fixed character string n reaches the end of the file character string 150. In this character string extraction, if the number of characters in the file character string 150 is m, (mn) character strings are extracted.

  FIG. 11 is a flowchart showing details of the confidential information determination processing in step S4 of FIG. In FIG. 11, the confidential information determination process reads the determination target document requested in step S1, assigns a document ID in step S2, and extracts text information from the determination target document in step S3.

  Subsequently, in step S4, a character string is cut out with a constant character string length n while shifting character by character from the head of the text information. In step S5, the hash table 20 is searched with all the extracted character strings, and the matched confidential document ID is acquired.

  If it is determined in step S6 that the confidential document ID is acquired, a merge process is performed in step S7 to combine duplicate confidential document IDs into one, and then in step S8, the confidential document ID is set and output as a determination result. If the confidential document ID is not acquired in step S6, a determination result indicating that the confidential document is not applicable is set and output in step S9.

  FIG. 12 is an explanatory diagram of the processing contents of the confidential information determination processing according to the present embodiment. In FIG. 12, the e-mail 154 is acquired as the determination target document by the target document acquisition process 156, and a document ID is assigned to the acquired e-mail 154 by the document ID assignment process 158, and the mail file 160 is created. To do.

  Text information is extracted by text information extraction processing 162 for the mail data of the mail file 160. The text information is extracted from the mail body and the attached file of the mail.

  Next, by a constant character string length cutout process 164, a character string is cut out with a constant character string length n while shifting one character at a time from the beginning of the text information. Next, the hash search process 166 searches the hash table 20 using all cut-out characters, and acquires a confidential document ID corresponding to the registered character string matched.

  The work table 168 is a processing result of the hash search process, and stores the file ID 174 of the confidential document searched corresponding to the character string 170 and the character string length 172. Next, a duplicate ID merge process 176 is executed, and as shown in the determination output file 180 by the determination result output process 178, a plurality of searched confidential document IDs are output. In this case, the electronic mail 154 requested to be processed is output. A determination result indicating that contains a confidential document is output.

  Next, security handling processing when the confidential information determination unit 16 of the present embodiment determines confidential information from the target document will be described. As shown in FIG. 1, the confidential information determination unit 16 provided in the confidential information management apparatus 10 according to the present exemplary embodiment includes a document and a proxy processed by the clients 30-1 to 30-3 connected to the internal network 24. E-mail transmitted to the outside by the server 36, a transfer file such as an FTP file transferred to the outside by the gateway server 38, a facsimile file transmitted by the facsimile server 40, a document file of the portable information device 45 detected by the scan station 42, and a network A print document file or the like for the printer 34 connected to the printer 24 is a confidential information determination target.

  Further, in the clients 30-1 to 30-3, when the person in charge displays the confidential document on the displays 32-1 to 32-3, the client 30-1 to 30-3 makes a determination request to the confidential information determination unit 16, and based on the determination result. Whether or not a confidential document is displayed is controlled.

  When the confidential information determination unit 16 determines that confidential information is included in the determination target document, in principle, all access and output processing at the determination request source are prohibited. However, since the person in charge of access to the confidential document may use the confidential document, if it is determined as confidential information, it is determined whether or not the transmission authority has the browsing authority. If there is, allow access even for confidential documents.

  In addition, the use of confidential documents may be managed by the administrator, and if the user does not have viewing authority, the administrator terminal is notified of the determination result of the confidential document and waits for a permission response from the administrator terminal. Thus, access to a document including a confidential document may be permitted.

  In addition, all the determination results including the confidential information of the target file determined by the confidential information determination unit 16 are recorded in the determination log file 22, and when a leakage problem of confidential information or the like occurs, the leakage path is changed later. To be able to explore.

  The confidential information determination unit 16 in the present embodiment prevents confidential information from being taken out of the company to the outside without permission or carelessness. However, the confidential information is determined between the external devices 46-1 to 46-4. Even when exchanging information, security information can be managed by determining confidential information from a document file to be transmitted and received.

  For example, with respect to a document file transmitted / received between a company in which the confidential information management device 10 of the present embodiment is installed and an external device 46-1 provided between confidential business disclosure destinations, for example, individual business operators, When the determination unit 16 determines the confidential information, the confidential information determination unit 16 also determines the mail document received from the external device 46-1, by managing the document while creating and collating the transmission record and the reception record of the confidential information. If confidential information is included, the operator handling the external device 46-1 is notified that the confidential information has been accidentally leaked and encouraged to respond. It becomes possible.

  Also, the hash table 20, the confidential information determination unit 16, and the determination that are specifically created for the confidential document that is the target in the confidential information management apparatus 10 of this embodiment are also provided on the external device 46-1 side that exchanges confidential information in FIG. By incorporating the log file 22, the confidential document ID is determined and recorded for each exchange of confidential information at the transmission source and the transmission destination, and the transmitted confidential information ID is compared with the received confidential information ID in real time. By doing so, all confidential information can be correctly transmitted and received, and security management can be performed to confirm that there is no leakage of confidential information due to transmission / reception leakage.

  This embodiment further provides a confidential information management program to be executed by a computer. The confidential information management program of this embodiment has the processing contents shown in the flowcharts of FIGS. 4, 5, 7, and 11. Will have.

  The present invention also provides a computer-readable recording medium in which a confidential information management processing program is recorded. This recording medium can be a CD-ROM, floppy (R) disk, DVD disk, magneto-optical disk, IC card, or the like. In addition to portable storage media, storage devices such as hard disks provided inside and outside the computer system, a database for holding programs via a line, other computer systems and their databases, and further transmission media on the line .

  In the above embodiment, the character string having a certain character string length n set from the characteristic relationship of FIG. 9 is extracted as an example of character string extraction in the confidential information feature extraction unit and confidential information determination processing. In addition to the optimum constant character string length n, the hash table 20 is created by cutting out the character string for each of one more character (n + 1) or one less character (n-1). In the information determination process, it is possible to further increase the accuracy of determining the confidential information by repeating the process until the confidential ID is searched in the order of the fixed character string lengths n, (n + 1), and (n−1).

  The present invention includes appropriate modifications that do not impair the object and advantages thereof, and is not limited by the numerical values shown in the above embodiments.

Claims (20)

On the computer,
Character information extraction that extracts a character string of a fixed character string length as feature information while shifting it from the beginning of a confidential document, assigns a confidential document identifier to each extracted character string, and registers each extracted character string in a hash table as a key Steps,
Whether a character string having the same character string length as the fixed character string length is extracted while shifting one character at a time from the beginning of the determination target document, and each of the extracted character strings is checked against the hash table to determine whether the determination target document includes confidential information. A confidential information determination step for determining whether or not
A confidential information management program characterized in that
2. The confidential information management program according to claim 1, wherein the fixed character string length for extracting the character string in the feature information extraction step and the confidential information determination step is set to character string length by one character in the feature information extraction step. When a confidential document is determined in the confidential information determination step using a hash table created while increasing the confidential document discovery rate with respect to the change in the character string length, and the character string matching rate in the discovered confidential document A confidential information management program characterized by having a character string length matching or near the character string length.
The confidential information management program according to claim 1, further comprising: a frequent expression extracting step of extracting a frequent expression from the collected confidential document and general document and registering the frequent expression in a frequent expression table;
The confidential information management program, wherein the characteristic information extraction step extracts a character string having a fixed character string length after removing a frequent expression of the frequent expression table from a confidential document.
4. The confidential information management program according to claim 3, wherein the feature information extraction step includes:
A partial document extraction step of extracting a confidential partial document having a semantic unit such as a file unit from a plurality of confidential documents;
An identifier giving step for giving a confidential document identifier of a confidential document corresponding to the confidential partial document;
A frequent expression removal step of removing the frequent expression of the frequent expression table from the confidential partial document;
A character string extracting step of extracting a character string of a certain character string length while shifting character by character from the beginning of the confidential partial document;
A table registration step of registering the corresponding confidential document identifier in the hash table using all the extracted character strings as keys;
A confidential information management program characterized by comprising:
In the confidential information management program according to claim 1,
The confidential information determining step includes:
A document acquisition step for acquiring a determination target document;
An identifier giving step for giving a document identifier to the determination target document;
A character string extracting step of cutting out the character string having the fixed character string length while shifting character by character from the beginning of the determination target document;
A table collation step of collating all the extracted character strings with a registered character string that is a key of the hash table, and obtaining a confidential document identifier corresponding to a collation match;
When one or more confidential document identifiers are acquired from the table collating step, a determination result indicating that the determination target document includes confidential information is output, and when the confidential document identifier is not acquired, the determination target document is output. Is a determination output step for outputting a determination result indicating that confidential information is not included, and
A confidential information management program characterized by comprising:
4. The confidential information management program according to claim 3, wherein the frequent expression extraction step includes:
A document collection step for collecting confidential and general documents;
A character string cutting step of cutting out character strings for each character string length that sequentially increases from the collected document;
A frequency detection step of detecting the appearance frequency for each character string length;
A candidate extraction step of extracting a character string having an appearance frequency equal to or higher than a predetermined threshold for each character string length as a frequent expression candidate;
A candidate removal step of investigating the inclusion relationship of the frequent expression candidates and removing the included frequent candidate character strings;
A registration step of registering the candidate remaining in the candidate removal in the candidate removal step in the frequent expression table as a frequent expression;
A confidential information management program characterized by comprising:
2. The confidential information management program according to claim 1, wherein the determination target document of the confidential information determination step is a body and attached document of an e-mail, a transfer file document transferred via a network, and a display document transferred to a display device for display. A confidential information management program comprising: a print document transferred to a printer for printing; and a document stored in a memory of an information device.
2. The confidential information management program according to claim 1, wherein the confidential information determination step prohibits processing of the determination target document when it is determined that the determination target document includes confidential information. Management program.
2. The confidential information management program according to claim 1, wherein in the confidential information determination step, when it is determined that the determination target document includes confidential information, the processing authority of the confidential document is confirmed and the processing is permitted. A confidential information management program.
2. The confidential information management program according to claim 1, wherein in the confidential information determination step, when it is determined that the determination target document includes confidential information, the determination result is notified to the administrator terminal and a permission response is received. A confidential information management program that permits processing of the determination target document.
Character information extraction that extracts a character string of a fixed character string length as feature information while shifting it from the beginning of a confidential document, assigns a confidential document identifier to each extracted character string, and registers each extracted character string in a hash table as a key Steps,
Whether a character string having the same character string length as the fixed character string length is extracted while shifting one character at a time from the beginning of the determination target document, and each of the extracted character strings is checked against the hash table to determine whether the determination target document or confidential information is included. A confidential information determination step for determining whether or not
A method for managing confidential information, comprising:
12. The confidential information management method according to claim 11, wherein a fixed character string length for extracting a character string in the feature information extraction step and the confidential information determination step is set to one character string by the feature information extraction step. When a confidential document is determined in the confidential information determination step using a hash table created while increasing the confidential document discovery rate with respect to the change in the character string length, and the character string matching rate in the discovered confidential document A confidential information management method characterized in that the character string length matches or is near the character string length.
The confidential information management method according to claim 11, further comprising a frequent expression extraction step of extracting a frequent expression from the collected confidential document and general document and registering the frequent expression in a frequent expression table.
The feature information extraction step is characterized in that after a frequent expression in the frequent expression table is removed from a confidential reference document, a character string having a fixed character string length is cut out.
14. The confidential information management method according to claim 13, wherein the feature extraction step includes:
A partial document extraction step of extracting a confidential partial document having a semantic unit such as a file unit from a plurality of confidential documents;
An identifier giving step for giving a confidential document identifier of a confidential document corresponding to the confidential partial document;
A frequent expression removal step of removing the frequent expression of the frequent expression table from the confidential partial document;
A character string cutting step of cutting out the character string having the fixed character string length while shifting character by character from the beginning of the confidential partial document;
A table registration step of registering the corresponding confidential document identifier in the hash table using all the extracted character strings as keys;
A method for managing confidential information, comprising:
In the confidential information management method according to claim 11,
The confidential information determining step includes:
A document acquisition step for acquiring a determination target document;
An identifier giving step for giving a document identifier to the determination target document;
A character string extracting step of cutting out the character string having the fixed character string length while shifting character by character from the beginning of the determination target document;
A table collation step for collating all cut character strings with a registered character string that is a key of the hash table, and obtaining a confidential information identifier corresponding to a collation match;
When one or more confidential information identifiers are acquired from the table collating step, a determination result indicating that the determination target document includes confidential information is output, and when the confidential identification information image is not acquired, the determination target document is output. Is a determination output step for outputting a determination result indicating that confidential information is not included, and
A method for managing confidential information, comprising:
14. The confidential information management method according to claim 13, wherein the frequent expression extraction step includes:
A document collection step for collecting confidential and general documents;
A character string cutting step of cutting out character strings for each character string length that sequentially increases from the collected document;
A frequency detection step of detecting the appearance frequency for each character string length;
A candidate extraction step of extracting a character string having an appearance frequency equal to or higher than a predetermined threshold for each character string length as a frequent expression candidate;
A candidate removal step of investigating the inclusion relationship of the frequent expression candidates and removing the included frequent candidate character strings;
A registration step of registering the candidate remaining in the candidate removal in the candidate removal step in the frequent expression table as a frequent expression;
A method for managing confidential information, comprising:
12. The confidential information management method according to claim 11, wherein the determination target document of the confidential information determination step is a body and attached document of an e-mail, a transfer file document transferred via a network, and a display document transferred to a display device for display. A confidential information management method comprising: a print document to be transferred to a printer for printing; and a document stored in a memory of an information device.
12. The confidential information management method according to claim 11, wherein the confidential information determination step prohibits processing of the determination target document when it is determined that the determination target document includes confidential information. Management method.
Character information extraction that extracts a character string of a fixed character string length as feature information while shifting it from the beginning of a confidential document, assigns a confidential document identifier to each extracted character string, and registers each extracted character string in a hash table as a key And
Whether or not the determination target document contains confidential information by cutting out character strings of the same character string length of the constant character string length while shifting character by character from the beginning of the determination target document and comparing each cut character string with the hash table A confidential information determination unit for determining whether or not
A confidential information management device comprising:
The confidential information management device according to claim 19, further comprising a frequent expression extraction unit that extracts frequent expressions from the collected confidential documents and general documents and registers them in the frequent expression table,
The feature information extraction unit extracts a character string having a fixed character string length after removing a frequent expression of the frequent expression table from a confidential reference document.

Images