JP2002014862A - Information access control device and information access control method - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To enable control of access rights to personal information dispersed over a wide area based on the will of the owner of the personal information, and to secure information privacy rights. SOLUTION: An access policy received from an owner of personal information is analyzed by a rule analysis unit 431, the contents of an attribute certificate transmitted from an external access person are analyzed by an attribute information analysis unit 432, and a logical decision system 4 is analyzed.
The access right to the external access user is assigned as a role defined by the role definition unit 451 by the 33 and the access is controlled by the access management interface unit 452 to use the data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to an information access control device and an information access control method for protecting personal information in a database.

[0002]

2. Description of the Related Art With the recent spread of the Internet, personal information has been distributed on the Internet in a distributed manner. For example, a database system having a data group including personal information is accessible via the Internet. Regarding such personal information, it is considered that the owner of the personal information has an information privacy right, and the problem in view of protection of the information privacy right is becoming serious.

[0003] The information privacy right regarding personal information
It is defined as "self-information management right" and is the right to control one's own information. Accordingly, as described above, it is preferable that the personal information distributed in the Internet environment be configured such that the owner of the personal information can control the access right.

However, in a normal database system, the management of the access authority to the database is designed to be performed by the database administrator, and the owner of the personal information included in the database is required to manage his or her own information. Is not configured to control access to. Therefore, it may be inconvenient for the owner of the personal information to disclose the personal information included in the database against his / her will. In addition, for database administrators, there is a problem that confidentiality and operational load increase in order to protect personal information included in the database.

[0005]

SUMMARY OF THE INVENTION The present invention makes it possible to control the access authority to personal information distributed over a wide area on the basis of the will of the owner of the personal information and secure the information privacy right. The purpose is to:

[0006]

An information access apparatus according to the present invention comprises: a storage unit for storing a database containing personal information; and an access policy for setting an access right to the personal information in the database. An access policy receiving means for receiving from the owner, an access policy storing means for storing the access policy received by the access policy receiving means, and an access policy for storing the access policy stored in the access policy storing means. And a policy engine for controlling access to personal information.

Here, the access policy storage means and the policy engine can be set in a proxy server which controls input / output of database information stored in the storage means. In addition, the information access control method according to the present invention provides an information access control method in which data on a data server storing a database including personal information is used by an external access person accessing via the Internet via a proxy server. A control method, wherein an access policy for setting an access right to personal information in a database is received from an owner of the personal information and stored on a proxy server; an access policy receiving step; In the case where there is, an access policy analysis step of analyzing the access policy in the proxy server to determine the access authority of the external access person, and personal information in the database for the external access person based on the analyzed access authority And an access control step of utilizing

Here, the access policy accepted at the access policy accepting stage can be constituted by a policy certificate in which an electronic signature by the owner of the personal information is added to the policy data defining the access right to the personal information as an access rule. . Further, the policy data may define access authority in association with attribute information that can be authenticated by a public key certificate or the like.

[0009]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [Schematic Configuration] FIG. 1 shows a schematic configuration of a system to which an embodiment of the present invention is applied. The owner of personal information can connect to the Internet through the information owner terminal 1. This information owner terminal 1 can be constituted by a personal computer that can be used by the owner of personal information.

An external access person can connect to the Internet through the client terminal 2. Similarly, the client terminal 2 can be constituted by a personal computer that can be used by an external access person. The information system 4 that manages the database can exchange data with the information owner terminal 1, the client terminal 2, and other terminals via the Internet 3.

The information system 4 includes at least a database 43 including personal information, a data server 42 including a data search system in the database 43, and an information system 4.
A proxy server 41 for inputting and outputting data between the Internet and the Internet 3 is provided. [Information Owner Terminal] In the information owner terminal 1, an access rule creation environment 11 for setting an access right to personal information included in the database 43, a secret key management for managing a secret key for performing an electronic signature Unit 12, a policy certificate creation unit 13 for creating a policy certificate combining an access rule, a personal information identification and an electronic signature to be subjected to the access rule, and an Internet such as communication software for connecting to the Internet A connection unit 14 and the like are provided.

FIG. 3 shows an example of a policy certificate created by the policy certificate creating section 13. Policy certificate 5
Are an access rule 51 created in the access rule creation environment 11, a personal information identification 52 for specifying personal information in the database 43, and an electronic signature 53 encrypted with a secret key managed by the secret key management unit 12. It is composed of
Access rule 51, personal information identification 52, digital signature 53
Are assigned unique names each having a DN as an identifier based on the ITU-T X.500 standard.

The access rule 51 is, for example, a correspondence between an attribute described in an attribute certificate presented by an external accessor and a role related to access authority to data and services. It can be configured by setting what role is given. FIG. 4 shows an example of the access rule 51.

In FIG. 4, the directory "https: //www.ab
As access control for "/ usr / local / apache / htdocs / subarea /", if there is a pattern with an attribute presented by an external accessor, it describes an access rule to give a role as a member. Directory "https: //www.ab/usr/local/apache/htdocs/s
ubarea / "is the personal information identification 52.

In this example, in the <cond> section of the <if>, a pattern matching is performed on the attribute certificate <CLIENT # AC> presented by the external accessor. The role defined in section> is given. The organization name "CLIENT # AC # DN # O" of the attribute certificate is changed to "Fujitsu,
Ltd. "and the department name" CLIENT # AC # DN # OU "
If "matches""Staff" or "NML"
The role (can # read, can # modify, can # delete) is given. As a result, when the organization name and the department name of the attribute certificate match, the external access person is given access authority to permit reading, changing, and deleting.

When an electronic signature is added to the policy certificate 51, the "POLICY CERTIFICATE" field is followed by "POLICY CERTIFICATE".
A column “CERTIFICATE SIGNATURE” is provided, and data of an electronic signature encrypted with a secret key is arranged. [Proxy server] The proxy server 41 receives a policy certificate 5 transmitted from the information owner terminal 1. A policy storage unit 45 for storing the contents of the policy certificate 5; and a policy engine 47 for performing access control based on the contents of the policy storage unit 45.

The policy engine 47 analyzes the contents of the policy certificate received by the policy receiving section 44, and assigns a trust engine 471 for assigning the access authority of the external accessor 2 based on the access rule included in the policy certificate. And an interface unit 475 with an existing system for controlling access to data in the database 43.

The trust engine 471 includes a rule analyzer 472 for analyzing the access rule 51 included in the policy certificate 5, an attribute information analyzer 473 for analyzing the attribute of the external access user, and an attribute information analyzer 473. A logical decision system 474 for assigning a role to the external access user based on the specified attribute of the external access user and the access rule analyzed by the rule analysis unit 472.

In order to access the data in the database 43, the external accessor sends an attribute certificate indicating his / her own attribute and a public key certificate for certifying the identity to the proxy server 4. Send to An attribute certificate certifies the attributes possessed by an external accessor by a certain certificate authority, and has a data format conforming to the ITU-T X.509 attribute certificate, and is a unique name with a DN as an identifier. Data.

The public key certificate is used to authenticate the user on the network. The public key certificate has a data format conforming to the ITU-T X.509 public key certificate. can do. Of the attribute certificate and the public key certificate transmitted from the external access person, the public key certificate is evaluated by a user authentication layer such as SSL (Secure Sockets Layer) or TSL (Transport Layer Security). If the user is authenticated here, the Secure API (Application Program Interface)
Data transmitted from the external accessor 2 through e) is input to the trust engine 471 in the proxy server 47. Among them, the attribute certificate data is transmitted to the attribute information analysis unit 473, and the data content is analyzed.

FIG. 7 shows an example of the structure of the attribute certificate. Here is an example of an attribute certificate defined as an ITU-T X.509 Attribute Certificate. By defining the correspondence between attributes and roles here, setting the access rule in the policy certificate Can be. The logical decision system 474 determines the access right to be assigned to the external access user from the attribute of the external access user analyzed by the attribute information analysis unit 473 and the access rule analyzed by the rule analysis unit 472, and Make an assignment.

Interface unit 47 for existing system
The role definition unit 476 in 5 is for preliminarily defining a role used in the policy certificate. The role is
Defines the name of a collection of access rights to data and services, for example, "system doctor" in a system that manages information about an individual's medical history
The role can be set to be assigned a certain total access right to the personal information on the attending physician, such as referring to an individual's medical history, creating a medical chart, and adding a description.
Therefore, the role definition unit 476 creates a table in which the access authority is associated with the role, and manages this table.

Access management interface 477
Determines the access authority according to the role of the external access user 2 determined by the logical determination system 474 and the table managed by the role definition unit 476, and controls access to the database 43 by the external access user. [Basic Operation] The basic operation of the proxy server 47 is shown in FIG.

In step S1, it is determined whether or not a request for policy registration has been made by the owner of personal information. If it is determined that there has been a policy registration request from the information owner terminal 1, the process proceeds to step S2. In step 2,
A process for accepting a policy registration from the information owner terminal 1 is executed. In step S3, it is determined whether or not there is a request for access to the database 43 from the external access person 2. If there is an access request from the client terminal 2, the process proceeds to step S4. In step S4,
The access control is performed based on the access rule, and the client terminal 2 uses the database 43.

[Policy Registration] FIG. 9 shows a policy registration process when a policy registration request is issued by the owner of personal information. In step S11, the policy certificate 5 transmitted from the information owner terminal 1 is accepted. As described above, the policy certificate 5 can be configured from the access rule 51, the personal information identification 52, and the electronic signature 53.

In step S12, the digital signature 53 is analyzed. For example, the digital signature 53 can be restored by decrypting the digital signature encrypted with the private key of the information owner using the public key. Step S
At 13, it is determined whether or not personal authentication has been normally performed based on the content of the electronic signature 53. If the personal authentication has been successfully performed, the process proceeds to step S13. If the personal authentication has failed, the process proceeds to step S16.

At step S14, the access rule 51 in the policy certificate 5 is analyzed. Here, the access rule 51 as described above is extracted from the policy certificate 5 together with the personal information identification 52. Step S15
Now, access rule 5 extracted from policy certificate 5
1 is stored in the policy storage unit 45 together with the personal information identification 52.

In step S16, a display indicating that personal authentication has failed is transmitted to the information owner terminal 1, and the process is terminated. [Access Control] FIG. 8 is a control flowchart showing the operation of access control in step S4 shown in FIG.
This will be described based on the data flowchart shown in FIG.

In step S21, a handshake by the SSL protocol is executed. In this case, as shown in FIG. 11, the client terminal 2 issues an SSL handshake request to the server to specify an access target. In response to this, a session between the client terminal 2 and the server is established by performing an SSL handshake response from the server side. Here, during the SSL protocol, authentication of a public key certificate transmitted from the client terminal 2 is negotiated, and personal authentication of an external access person is performed, and then a session is established. When the personal authentication of the external access person succeeds, the information is transmitted to the trust engine 471 of the proxy server 47 through the Secure API. If the personal authentication has failed, a notification to that effect is transmitted to the client terminal 2 side, and the execution of the access is prompted again.

In step S21, the SSL handshake process is executed. However, it is also possible to establish a client-server session by the TSL protocol.
It can be compatible with any of the TSL protocols. If the session between the client terminal 2 and the server side is established in step S21, step S22
Move to In step S22, the client terminal 2
Send an attribute certificate request to.

In step S23, the client terminal 2
It is determined whether or not the attribute certificate has been transmitted from the. If it is determined that the attribute certificate has been transmitted from the client terminal 2, the process proceeds to step S24. In step S24, the attribute certificate is analyzed. The attribute certificate transmitted from the client terminal 2 is, as described above,
The data format can conform to the ITU-T X.509 standard, and can also conform to the IETF-PKIX standard. Here, by analyzing based on the data format of each attribute certificate, the attribute of the external access user can be determined.

In step S25, the result of analyzing the attribute certificate is compared with the access rule 51 attached to the personal information identification 52 that has made an access request, and a corresponding role is assigned. Here, as described above, the attribute of the external access person analyzed by the attribute information analysis unit 473 and the contents of the access rule analyzed by the rule analysis unit 472 are determined by the logical determination system 474,
Assign roles to give access rights corresponding to external access users. Here, the role assigned to the external access person is defined in advance by the role definition unit 476. The assigned role is transmitted to the client terminal 2 as a role certificate. At the same time, an access right corresponding to the assigned role is set for the access request from the client terminal 2.

In step S26, the client terminal 2
It is determined whether or not there has been actual data access from. Here, the personal information identification 52 for which the access request was made
When a data display request or a data download request is transmitted from the client terminal 2,
It is determined that there is a data access request, and step S27
Move to

In step S27, access control is performed based on the role assigned to the external access person, and the data in the database 43 is used. Here, it is possible or impossible to read a part or all of the personal information specified by the personal information identification 52, and it is possible to change the personal information.
The access management interface unit 477 performs access control such as “impossible” or “possible or impossible” to delete, and restricts access to external access users.

In step S28, it is determined whether or not the access from the external access user has been completed. When a signal indicating the end of access is received from the client terminal 2, this processing ends.

[0036]

According to the present invention, access control to personal information existing in an existing database distributed widely can be defined by the owner of the personal information as an access rule. It is possible to maintain the protection of privacy rights. The operation load on the database administrator can be reduced by allowing the external access user to automatically determine the access authority. Furthermore, the determination of the access authority is based on the access rules registered by the owner of the personal information, and the determination logic can be traced without fail. Can be reduced.

[Brief description of the drawings]

FIG. 1 is a schematic configuration diagram of the present invention.

FIG. 2 is a schematic configuration diagram of an information owner terminal.

FIG. 3 is an explanatory diagram showing a schematic configuration of a policy certificate.

FIG. 4 is an explanatory diagram showing an example of a policy certificate.

FIG. 5 is a schematic configuration diagram of a proxy server.

FIG. 6 is a schematic configuration diagram of a proxy server.

FIG. 7 is an explanatory diagram showing an example of an attribute certificate.

FIG. 8 is a flowchart showing the operation on the server side.

FIG. 9 is a flowchart showing the operation on the server side.

FIG. 10 is a flowchart showing the operation on the server side.

FIG. 11 is a data flowchart at the time of access.

Continued on the front page F term (reference) 5B017 AA03 BA07 CA16 5B075 KK43 KK54 KK63 UU08 5B082 EA11 HA08 5B085 AE13 AE23 AE29 BC01 BG07 5B089 GA19 GB02 JB22 KA17 KB13 KC58

Claims (5)

[Claims] A storage unit for storing a database including personal information; an access policy receiving unit for receiving, from an owner of the personal information, an access policy for setting an access right to the personal information in the database; Access policy storing means for storing an access policy received by the access policy receiving means; and controlling access to the personal information for an external accessor based on the access policy stored in the access policy storing means. An information access control device comprising: 2. The information access control according to claim 1, wherein said access policy storage means and policy engine are set in a proxy server which controls input / output of database information stored in said storage means. apparatus. 3. An information access control method in which data on a data server storing a database containing personal information is used by an external access person accessing via the Internet via a proxy server, Receiving an access policy for setting an access right to personal information in a database from the owner of the personal information and storing the access policy on the proxy server; and receiving an access from an external accessor. Analyzing an access policy in the proxy server to determine an access right of the external accessor; and analyzing personal information in the database for the external accessor based on the analyzed access right. An access control step for utilizing the Access control method. 4. An access policy accepted in an access policy accepting step is a policy certificate in which an electronic signature by an owner of the personal information is added to policy data in which access authority for personal information is defined as an access rule. The information access control method described in 1. 5. The information access control method according to claim 4, wherein said policy data defines access authority in association with attribute information that can be authenticated by a public key certificate or the like.