JP2006268378A - Information protection system, information protection apparatus and program thereof - Google Patents

Abstract

PROBLEM TO BE SOLVED: To surely prevent leakage of information such as personal information that needs to be prevented from leaking from an external access to a production system.
SOLUTION: An inquiry information generating means (2) for generating inquiry information obtained by adding a masking instruction tag to data of a predetermined item included in inquiry information described in a predetermined markup language; and a masking instruction tag Conversion means (4) for converting the data of the added predetermined item into irreversible masked data that can be recognized only at a predetermined ratio.
[Selection] Figure 1

Description

  In a network environment using the WWW, it relates to a technology for realizing protection (leakage prevention) of information that needs to be prevented from leaking, such as stored personal information, and in particular, development of software / system for accessing personal information. The present invention relates to an information protection technique capable of achieving both access to a production system and protection of personal information to be accessed when it is performed.

In recent years, in the financial and insurance industries, network services for Web-type agents and customers using WWW (World Wide Web) have become widespread. In order to provide such a service, the service provider accumulates data including a large amount of personal information in a database, and data including personal information between the service provider side system and the terminal device of the agency or customer side. Are being sent and received.
On the other hand, new services are developed to improve services, and functions of existing services are enhanced. Along with this, new development and improvement of the system and software and databases incorporated in this system are being carried out in order to develop such services and enhance the functions of existing services.

  Of course, the users who can access the Web system for agents or customers need to be limited to agents or customers who have access rights to the personal information provided. On the other hand, in the monitoring of the Web type system or the development / maintenance of the system, a situation may arise in which an external vendor or the like in charge of operation or development has to access the production system. Even in this situation, it is desirable to ensure an environment in which the production system can be accessed without fear of leakage of personal information.

  In a general system, a user such as an agent or a customer who owns the access right, for example, installs an authentication server called a reverse proxy server having a so-called SSO (single sign on) function at the front of a web server group. Through this, access according to the access authority can be performed (see, for example, Patent Document 1).

  On the other hand, when an external vendor monitors, develops, or maintains a system, it has traditionally been based on a “non-disclosure agreement”. In development, if possible, prepare a simulated environment and create test data or production data. The system is verified by performing heavy-duty operations such as creating and putting in pseudo data masked with.

Japanese Patent Laid-Open No. 10-269184

However, in some cases, the method of performing verification using test data or pseudo data in a pseudo environment can perform only insufficient evaluation. For example, the actual response in the production system could not be verified.
In addition, if development and maintenance is outsourced to an external vendor as described above and access to the production system is unavoidable for development, even if a confidentiality obligation is imposed on this external vendor, the database for storing personal information is optional. If access is made possible, there is a possibility that personal information will be leaked from outsiders, and it will not be possible to give customers complete security about the protection of personal information.

  The present invention has been made in view of the above problems, and is an information protection system that can reliably prevent leakage of information such as personal information that needs to be prevented from leaking against external access to the production system, An object is to provide an information protection device and a program thereof.

  In order to solve the above-mentioned problem, an invention according to claim 1 is an information protection system for restricting data browsing of a predetermined item included in inquiry information provided via a network, and includes a predetermined markup language. Inquiry information generating means for generating inquiry information in which a masking instruction tag is added to the data of the predetermined item included in the inquiry information described in the above, and data of the predetermined item to which the masking instruction tag is added Conversion means for converting into irreversible masked data that can be recognized only at a predetermined ratio.

  Moreover, the invention according to claim 2 is the information protection system according to claim 1, wherein the conversion unit masks a masked identification tag for associating the masked data with data before masking. It is added to data.

  The invention according to claim 3 is the information protection system according to claim 2, wherein the masked identification tag is not displayed by the browsing software for the inquiry information, and the masked identification tag is added. When the transmitted data is returned via the network, it is added so as to be returned together with the data.

  According to a fourth aspect of the present invention, in the information protection system according to the third aspect, when the masking identification tag is added to the data returned from the user side, the conversion means Is replaced with data before masking corresponding to the masked identification tag.

  The invention according to claim 5 is the information protection system according to any one of claims 1 to 4, wherein the masking instruction tag includes information indicating the predetermined ratio, and the conversion means Is characterized in that the target data is converted based on the information indicating the predetermined ratio.

  The invention according to claim 6 is the information protection system according to any one of claims 1 to 4, wherein the masking instruction tag includes information indicating a masking level, and the conversion means Is characterized in that the target data is converted based on the information indicating the level of masking and the authority level of the user viewing the inquiry information.

  The invention according to claim 7 is the information protection system according to any one of claims 1 to 6, wherein the inquiry information generation means and the conversion means are configured separately. And

  The invention according to claim 8 is an information protection device for restricting data browsing of a predetermined item included in inquiry information provided via a network, wherein the predetermined keyword included in the inquiry information is provided. A conversion means for converting data of a predetermined item corresponding to the above into irreversible masked data that can be recognized only at a predetermined ratio is provided.

  The invention according to claim 9 is the information protection apparatus according to claim 8, wherein the masked identification tag for associating the masked data with the data before masking is added to the masked data. Is further provided.

  The invention according to claim 10 is the information protection device according to claim 9, wherein the masked identification tag is not displayed by the browsing software for the inquiry information, and the masked identification tag is added. When the transmitted data is returned via the network, it is added so as to be returned together with the data.

  In addition, in the information protection device according to claim 10, the conversion unit is configured such that, when the masked identification tag is added to data returned from the user side, the data protection device Is replaced with data before masking corresponding to the masked identification tag.

  The invention according to claim 12 is the information protection device according to any one of claims 8 to 11, wherein the conversion means is a ratio corresponding to an authority level of a user who browses the inquiry information. Only the corresponding item is converted into irreversible masked data that can be recognized.

  The invention according to claim 13 is a system in which an authentication device for authenticating a user and the information protection system according to any one of claims 1 to 7 are connected, The conversion means is a system characterized by converting the inquiry information provided from the inquiry information generation means to a specific user authenticated by the authentication device into inquiry information including the masked data. .

  Further, the invention described in claim 14 is an authentication device that performs user authentication, a server that distributes inquiry information for the user in response to a request from the user side terminal device, and 13. A system connected to and configured with the information protection device according to claim 12, wherein the conversion means provides an inquiry provided from the server to a specific user authenticated by the authentication device. A system for converting information into query information including the masked data.

  Further, the invention according to claim 15 is the system according to claim 14, wherein the authentication device gives data returned from a specific user authenticated by the authentication device to the information protection device, and the information When the data returned from the specific user includes the masked identification tag, the protection device converts the data with the masked identification tag added to the data before masking corresponding to the masked identification tag. It replaces and gives to the said server, It is characterized by the above-mentioned.

  The invention described in claim 16 is a computer-readable program that realizes the inquiry information generating means according to any one of claims 1 to 7 by being installed in a computer.

  The invention according to claim 17 is a computer-readable program that realizes the conversion means according to any one of claims 1 to 7 by being installed in a computer.

  The invention according to claim 18 is a computer-readable program for realizing the information protection apparatus according to any one of claims 8 to 12 by being installed in a computer.

According to the present invention, information such as personal information that needs to be prevented from being leaked is converted into irreversible masked data that can be recognized only at a predetermined rate. Can be reliably prevented.
In addition, when an outside person is forced to access the production system to confirm the operation of the production system with information such as personal information that needs to be prevented from leaking for development and maintenance. However, since leakage of personal information and the like can be prevented, it is possible to give a complete sense of security to customers regarding the protection of personal information.

  First, a network environment including a system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 shows an outline thereof.

As shown in the figure, a regular user (for example, the insurance agent shown in the figure) or a specific user (for example, the system development / maintenance company shown in the figure) is predetermined via the Internet. Is connected to a system 100 that provides information (inquiry information).
In the system 100, there is an authentication server 1 having a user authentication function at its front end, and behind this authentication server 1, a Web server 2 that distributes inquiry information according to a request (request) from a user, There is a personal information protection device 4 for converting inquiry information distributed from the Web server 2 to the specific user and specific information returned from the user side (information including masked data). Are connected via an internal network (such as a LAN).

The Web server 2 includes a database (DB) 3 for storing information such as customer information, contract information, accident information (in this case, an insurance service is taken as an example) that is the basis of information to be distributed, and a personal information protection device 4. Includes a conversion information management table 5 to be described later.
As shown in the figure, according to the present invention, screen information that gives an original inquiry screen is distributed from the system 100 to a legitimate user (here, an agent), and system development / Screen information that provides an inquiry screen with personal information masked is distributed to the maintenance company so that the development and maintenance of the system can be executed using the production system while protecting the personal information.

  Next, details of the authentication server 1, the Web server 2, and the personal information protection device 4 will be described.

  The authentication server 1 has an authentication function for a user. Generally, the authentication server 1 receives a user ID and a password transmitted from a user side terminal (for example, a PC), and these and a registered user ID. And authenticate and identify users by comparing passwords. The user ID and password may be held by the authentication server 1 itself, or may be held in the DB 3 or other storage device of the Web server 2 so that the authentication server 1 obtains them as necessary. Good.

  After the authentication process, the authentication server 1 sends a request from a user who has been authenticated as a valid user to the Web server 2 or personal information protection depending on whether the request is a legitimate user or a person in charge of system development / operation. Transfer to device 4. In this embodiment, when the user is a regular user, a request from the user is sent to the Web server 2, and when the user is a person in charge of system development / operation, the request from the user is personal. The information is sent to the information protection device 4.

  Here, the request transferred to the Web server 2 or the personal information protection device 4 is converted to the Web server 2 or the personal information protection device 4, respectively, and user information for identifying the user is added. This user information can identify whether the user is a regular user or a system development / operation person. When the user fails in authentication, the authentication server 1 transmits screen information or notification for giving an error display screen to the user side terminal to the user side terminal.

The Web server 2 generates screen information (here, an HTML file) for giving a screen of a processing result (inquiry information) according to a request from the user side to the user side terminal. In this specification, the inquiry information is not distinguished from the screen information (HTML file) for giving the inquiry information screen to the user terminal.
The Web server 2 generates normal screen information based on the user information added to the request by the authentication server 1 and returns the screen information to the authentication server 1 when the user is a regular user. . On the other hand, if the user is a person in charge of system development / operation, screen information surrounding the item to be masked (character string) is generated by a masking instruction tag (described later) and returned to the personal information protection device 4 To do. It should be noted that which items are to be masked and how much masking is to be performed are predetermined.

  Further, as a configuration different from the above, even when the Web server 2 returns the screen information to the authentication server 1, a configuration in which the screen information that always surrounds the item to be masked (character string) with the masking instruction tag is generated. It is good. By doing so, it is not necessary for the Web server 2 to change the method of generating screen information depending on whether the user is a regular user or a specific user for masking.

  When the request from the user side terminal given by the authentication server 1 includes a masked identification tag (described later) serving as a restoration keyword, the personal information protection device 4 uses the conversion information management table 5 (see FIG. 2). Retrieve the restoration information corresponding to this masked identification tag (that is, the original data (original data) of the masked item data), and the part (character string) enclosed by the masked identification tag Is restored to the data before masking, and the restored request is transferred to the Web server 2.

  A normal Web system has a function (so-called hyperlink) that “links” using various items including personal information held on the screen or behind the screen (HTML file source). Since the personal information protection device 4 operates as described above, for example, even if the hyperlink address data and related data returned from the user terminal are masked (in this case, these data are Since the reply data from the user side is transferred to the Web server 2 by returning to the data before masking, the hyperlink processing is normally performed by the Web server 2. Is made.

  In addition, the personal information protection device 4 uses the irreversible masked data that can be identified only at a predetermined ratio for the predetermined items of the HTML file (screen information) received from the Web server 2 and distributed to the user side terminal. Perform masking. Specifically, a masking instruction tag is added to the item data to be masked included in the HTML file given from the Web server 2, and the personal information protection device 4 detects this masking instruction tag. Then, masking is performed so that the portion surrounded by the masking instruction tag cannot be identified by a predetermined ratio indicated by the masking instruction tag (described later).

  Then, a masked identification tag is added to the data of the item that has been masked (the target data is enclosed in the masked identification tag, and when the data is returned from the user terminal, this masked identification tag is added. Is also added so that it can be returned in a state of being added). The masked HTML file is converted to a destination of the authentication server 1 and transferred to the authentication server 1. Masking is performed in this way, but when masking is performed, original data to be masked, data after masking, data for masking instruction tag, masking identification tag, etc. are converted for each session. It is held and managed as an information management table 5.

Here, FIG. 2 shows an example of the conversion information management table 5 for a certain session.
This table includes an item name to be masked, a masking instruction tag for the item, original data before masking, a masking identification tag, and data after masking. A masking instruction tag is predetermined for each item to be masked. For example, the masking instruction tag for the “securities number” item is “<secret050>”, and the security number enclosed by using this tag. Instructing masking to make data 50% indistinguishable. That is, “050” following “secret” indicates that the masking should be 50%.

  In this example, when the personal information protection device 4 performs masking, the original data “C123456789” is converted into “C * 2 * 4 * 6 * 8 *” after 50% masking. Of the 50% to be masked, which part of the original data is to be masked may be determined at random. As in this example, a plurality of types of masking ratios (for example, how many characters are masked out of 10 characters) are provided, but this requires different confirmation of data contents depending on the user. Because. For example, when it is necessary for the system developer to check whether the item data contains alphanumeric characters, the degree of masking should be set in advance for such items to the required level. deep.

  Next, an example of an HTML file generated by the Web server 2 for a specific user who is not a regular user is shown below.

  In this way, the masking instruction tag is embedded so as to surround the data of the item to be masked.

  Next, an example of an HTML file converted by the personal information converting device 4 (conversion example of the HTML file) is shown below.

  In this way, the converted HTML file is a file in which the masked identification tag is embedded so as to surround the data of the masked item. For hyperlinks, <A href = https: // www. amgs1. ms-ins. Some of them are masked with non-display items such as “com / agent / AAA99 <mask006> ** 9 * </ mask006> ′>”.

  Here, FIG. 3 shows an original screen display example corresponding to the HTML file, and FIG. 4 shows a screen display example by the converted HTML file (in the above example). The masked screen shown in FIG. 4 is displayed with the masked items masked at a predetermined ratio with respect to the original screen shown in FIG. 3 (in the figure, the original character is “*”). Converted to). Note that the masking instruction tag and the masking identification tag used in this embodiment are dedicated tags that are not displayed on the screen of the user terminal.

  FIGS. 3 and 4 are simple screen display examples according to the above example. Specifically, the display screen on the user terminal after masking is the same as the original screen (FIG. 5). It becomes like 6. As described above, in the present embodiment, the irreversible information that is masked (cannot be restored) is given to a specific user without modifying the contents of the data in DB3. Information leakage can be surely prevented. In addition, when a specific user is a person who develops and maintains a system, it is possible to perform development and maintenance using the production system through the personal information conversion device 4.

Next, a second embodiment will be described.
In the above-described embodiment, the masking ratio tag is directly instructed by the masking instruction tag added to the HTML file generated by the Web server 2, but in this embodiment, the masking instruction tag is set to the authority level of the user. The level of masking according to is to be indicated.
For example, data with a masking instruction tag generated by the Web server 2 <secret050> C123456789 </ secret050>
<Seclevel01> C123456789 </ seclevel01> using a tag indicating the level of masking
Change as follows.

  The personal information protection device 4 is based on such a tag indicating the level of masking, and according to the authority level of the actual user (this is determined based on the user information added to the request), For example, as shown below, masking according to the instructed masking level and the authority level is performed (even though the masking level is the same, the degree of masking is changed according to the authority level).

For example, at the level of seclevel01,
User A: Authority level A (masked 0%) Generated information C123456789
User B: Authority level B (masked 20%) Information generated C1 * 345 * 789
User C: Authority level C (masked 50%) Generated information C * 2 * 4 * 6 * 8 *
User D: Authority level D (masked 80%) Generated information *** 3 ****** 8 *
Information about which user has which authority level may be held in any of the authentication server 1, the Web server 2 or the DB 3, the personal information device 4, or another storage device.

Next, a third embodiment of the present invention will be described.
In each of the above embodiments, the Web server 2 is configured to generate an HTML file in which the masking instruction tag for instructing masking is added to the inquiry information provided to the user. The personal information protection device 4 is configured to perform the masking independently without any modification to the Web server 2 in the back end (the other functional configurations are the same as any one of the above-described embodiments). That is, no special tag is added to the HTML generated by the Web server 2 at the back end, and the personal information protection device 4 automatically performs masking independently.

  The personal information protection device 4 is in the + N-th cell (which is predetermined) based on keywords representing item attributes such as “securities number”, “address”, “name”, “birth date” and the like to be masked. The display items (other than HTML reserved words) or non-display items are automatically masked. Such a masking rule (including which item is to be masked in what percentage and the degree of masking according to the authority level of the user) can be provided in the personal information protection device 4.

In the present embodiment, for example, the source generated by the Web server 2 is <TD> Securities number </ TD>.
<TD><Ahref='JavaScript:execPOL()'> C123456789 </A></TD>
In this case, the keyword representing the item attribute to be masked is “securities number”, the target item to be actually masked is +1 from this keyword (that is, the next item), the display / The personal information protection device 4 is assumed to be a display item other than non-display, and the ratio or level of masking is 50% or XX.
<TD> Securities number </ TD>
<TD><Ahref='JavaScript:execPOL()'><mask002> C * 2 * 4 * 6 * 8 * </ mask002></A></TD>
An HTML file converted as follows is generated. In this example, the display item “C123456789”, which is the next item after the keyword “securities number”, is masked by 50%.

  As described above, since the personal information protection device 4 performs masking independently, in this embodiment, it is possible to obtain an advantage that there is no need to modify the system such as the Web server 2 in the back end.

  In each of the above embodiments, the authentication server 1, the Web server 2, and the personal information protection device 4 are configured as separate units. However, for example, the authentication server 1 and the personal information protection device 4 are configured as an integrated device. Can do.

  Next, a series of operations of the user terminal and the entire system shown in FIG. 1 will be described with reference to flowcharts shown in FIGS.

  First, when the system is accessed from a user terminal (such as a PC), the authentication server 1 authenticates the user (step S101). If the authentication fails (authentication NG in the determination in step S101), the authentication server 1 returns screen information or a notification for displaying an error on the user side terminal. As a result, the user terminal displays an error display screen informing the user that the authentication has failed (step S102).

  On the other hand, if the authentication by the authentication server 1 is successful (authentication is OK in the determination in step S101), the authentication server 1 further determines whether the user is a regular user or a specific user (in this case, the system development / operation staff). Is determined (step S103).

(A) When the user is a regular user In this case, the process proceeds from the user determination in step S103 to step S104.
In step S104, the authentication server 1 that has received the request from the user terminal of the end user converts the content of the request into a request to the Web server 2 (here, the request destination is changed to the Web server 2) and is used. This request is transferred to the Web server 2 by adding user information for identifying the person.

  Next, in step S105, when the Web server 2 receives a request from the authentication server 1, screen information (HTML file) for processing the request and displaying the processing result (inquiry information) on the user terminal. ) Is generated. Based on the user information added to the previously received request, since the user is a legitimate user in this case, the return destination (destination) of this screen information is set as the authentication server 1 and returned to the authentication server 1. To do. As described above, when the user is a regular user, the screen information including the inquiry information generated by the Web server 2 is returned to the authentication server 1 without passing through the personal information protection device 4.

Next, in step S106, the authentication server 1 converts the return destination (destination) of the screen information received from the Web server 2 to the user side terminal, and returns it to the user side terminal via the Internet.
Next, in step S107, the user terminal that has received the screen information from the Web server 2 interprets the screen information (HTML file) by the function of the Web browser installed in the terminal, and generates a display screen. The screen is displayed on the display of the user terminal.

(B) When the user is a person in charge of system development / operation In this case, the process proceeds from the user determination in step S103 to step S108 (FIG. 7).
In step S108, the authentication server 1 that has received the request from the user-side terminal once sets the request destination as the personal information protection device 4, adds user information for identifying the user, and protects the request with the personal information protection. Transfer to device 4. When the authentication server 1 and the personal information protection device 4 are configured by the same device, the request is transferred within the same device, and the authentication server 1 that is also the personal information protection device 4 performs the next step. The process of S109 is executed.

  Next, in step S109, the personal information protection device 4 determines a session from the content of the request, and searches for a restoration keyword (that is, a masked identification tag) included in the request. When this request includes a restoration keyword, the above-described conversion information management table 5 is searched to obtain restoration information (information before masking, that is, original data), and a portion surrounded by the restoration keyword is obtained. Restore by replacing with original data. Further, the content of the request is converted into a request to the Web server 2 (here, the request destination is changed to the Web server 2), and the request is transferred to the Web server 2. On the other hand, when the restoration keyword is not included, the content of the received request is converted into a request to the Web server 2 as it is (here, the request destination is changed to the Web server 2) and transferred to the Web server 2.

  Next, in step S110, when the Web server 2 receives the request from the personal information protection device 4, the Web server 2 processes the request and displays screen information (display information) on the user side terminal (display information). HTML file). This screen information includes the above-described masking instruction tag. However, when the personal information protection device 4 performs the masking process independently (in the third embodiment), the Web server 2 The same normal screen information as the screen information for the user is generated.

  Then, based on the user information added to the previously received request (since the user is a person in charge of system development / operation), the personal information protection device 4 is used as the personal information protection device 4 and the personal information protection device 4 Return to 4. Thus, if the user is a person in charge of system development / operation, the return destination is the personal information protection device 4. Of course, when the authentication server 1 and the personal information protection device 4 are configured as the same device, the return destination of the screen information is returned to the authentication server 1 which is also the personal information protection device 4.

  Next, in step S <b> 111, the personal information protection device 4 searches the screen information received from the Web server 2 for a maxing instruction tag. Here, the portion surrounded by the masking instruction tag is masked as described above according to the type of the masking instruction tag. Then, an identification keyword (which matches the restoration keyword, that is, a masked identification tag) for making masking identifiable with respect to the masked character string is generated, and the mask is created with this identification keyword. Perform masking around both ends of the converted character string. Further, the conversion information management table 5 is registered in the database together with the session information (as described above, the conversion information management table 5 is managed for each session), and the processing result after masking is displayed. The screen information is sent to the authentication server 1 after the destination is converted to the authentication server 1.

  Next, in step S112, the authentication server 1 converts the return destination (destination) of the screen information after masking received from the personal information protection device 4 into a user side terminal, and the user side terminal via the Internet. Reply to

  Next, in step S113, the user terminal that has received the screen information for displaying the processing result from the Web server 2 interprets this screen information (HTML file) by the function of the Web browser installed in the terminal. Then, a display screen is generated, and the screen is displayed on the display of the user terminal.

  As mentioned above, although the detail was demonstrated about embodiment of this invention, the above-mentioned authentication server 1, Web server 2, personal information protection apparatus 4, and each function part which comprises these are the programs which implement | achieve those functions, respectively. Needless to say, it can also be realized by installing it on a general-purpose server computer or the like. In addition, although HTML (HyperText Markup Language) is exemplified as the markup language, other markup languages that can be used in the Web system (for example, those that use XML (extensible Markup Language)) can also be used.

It is a figure which shows the outline | summary of the network environment containing the system which is one embodiment of this invention. It is an example of the conversion information management table. It is an example of an original screen display corresponding to an exemplary HTML file. It is the example of a screen display by the example converted HTML file. It is an example of a specific original display screen. It is an example of the display screen in the user side terminal after concrete masking implementation. It is a flowchart explaining a series of operation | movement of the user side terminal which implements this invention, and the whole system. It is a flowchart (continuation) explaining a series of operation | movement of the user side terminal which implements this invention, and the whole system.

Explanation of symbols

1 ... Authentication server (authentication device)
2 ... Web server (inquiry information generation means)
3 ... DB
4 ... Personal information protection device (conversion means, information protection device)
5 ... Conversion information management table

Claims (18)

An information protection system for restricting data browsing of a predetermined item included in inquiry information provided via a network,
Inquiry information generating means for generating inquiry information in which a masking instruction tag is added to data of the predetermined item included in the inquiry information described in a predetermined markup language;
An information protection system comprising: conversion means for converting the data of the predetermined item to which the masking instruction tag is added into irreversible masked data that can be recognized only at a predetermined ratio.   2. The information protection system according to claim 1, wherein the conversion unit adds a masking identification tag for associating the masked data with data before masking to the masked data.   The masked identification tag is not displayed in the browsing software for the inquiry information, and is added so that the data with the masked identification tag is returned together with the data when the data is returned via the network. The information protection system according to claim 2, wherein:   When the masking identification tag is added to the data returned from the user side, the conversion means replaces the data with data before masking corresponding to the masked identification tag, The information protection system according to claim 3.   The said masking instruction tag contains the information which instruct | indicates the said predetermined ratio, The said conversion means converts the data of object based on the information which instruct | indicates the said predetermined ratio. Item 5. The information protection system according to Item 4.   The masking instruction tag includes information indicating a level of masking, and the conversion unit is configured to apply target data based on information indicating the level of masking and an authority level of a user viewing the inquiry information. The information protection system according to any one of claims 1 to 4, wherein the information protection system is converted.   The information protection system according to any one of claims 1 to 6, wherein the inquiry information generation unit and the conversion unit are configured separately. An information protection apparatus for restricting data browsing of a predetermined item included in inquiry information provided via a network,
An information protection apparatus, comprising: conversion means for converting predetermined item data corresponding to a predetermined keyword included in the inquiry information into irreversible masked data that can be recognized only at a predetermined ratio.   9. The information protection apparatus according to claim 8, further comprising means for adding a masking identification tag for associating the masked data with data before masking to the masked data.   The masked identification tag is not displayed in the browsing software for the inquiry information, and is added so that the data with the masked identification tag is returned together with the data when the data is returned via the network. The information protection apparatus according to claim 9, wherein   When the masking identification tag is added to the data returned from the user side, the conversion means replaces the data with data before masking corresponding to the masked identification tag, The information protection apparatus according to claim 10.   12. The conversion unit according to claim 8, wherein the conversion unit converts the corresponding item into irreversible masked data that can be recognized only at a rate corresponding to an authority level of a user who browses the inquiry information. The information protection apparatus according to any one of the above. An authentication device for authenticating the user;
A system connected to the information protection system according to any one of claims 1 to 7,
The conversion means converts the inquiry information provided from the inquiry information generation means to a specific user authenticated by the authentication device into inquiry information including the masked data. An authentication device for authenticating the user;
In response to a request from the user terminal device, a server that distributes inquiry information for the user,
A system configured to be connected to the information protection device according to any one of claims 8 to 12,
The conversion means converts the inquiry information provided from the server to a specific user authenticated by the authentication apparatus into inquiry information including the masked data.   The authentication device gives data returned from a specific user authenticated by the authentication device to the information protection device, and the information protection device adds the masked identification tag to the data returned from the specific user. 15. The system according to claim 14, wherein when the data is included, the data to which the masked identification tag is added is replaced with the data before masking corresponding to the masked identification tag and is provided to the server.   A computer-readable program that realizes the inquiry information generating means according to any one of claims 1 to 7 by being installed in a computer.   A computer-readable program that realizes the converting means according to any one of claims 1 to 7 by being installed in a computer. A computer-readable program for realizing the information protection apparatus according to any one of claims 8 to 12 by being installed in a computer.

Images