JP2019028940A - Data management program and data management method - Google Patents

Abstract

An object of the present invention is to allow only genuine users to access data while suppressing data leakage. A data management program (40) includes an acquisition function (401) for acquiring information indicating whether or not biometric information is authentic, and a specific terminal (1) when information indicating that biometric information is authentic is acquired. A computer has a distribution function 402 that generates a plurality of distributed data that cannot be restored independently from the original data that is stored so as to be referenced from the computer, and a storage function 403 that divides and stores the plurality of distributed data in a plurality of storage devices. let it run. The data management program 40 also includes an acquisition function 401 that acquires information indicating whether or not the biological information is authentic, and an acquisition function 401 that acquires information indicating that the biological information is authentic. The computer is caused to execute a collection function 406 for collecting distributed data stored in each of at least two storage devices and an integration function 407 for generating original data from the collected distributed data. [Selection drawing] Fig. 2

Description

  The present invention relates to a data management program and a data management method.

  At present, secret sharing, which is one of information security technologies, is attracting attention. Secret sharing is a technique for storing a plurality of distributed data generated from original data as secret information according to a predetermined rule in a plurality of storage devices and restoring the original data from the plurality of distributed data as necessary. . In secret sharing, the original data cannot be restored from each of the distributed data, so that even if one of the shared data leaks, the original data cannot be restored, and the secret information can be prevented from leaking. . For example, Patent Document 1 uses a secret sharing method to receive shared information from k devices (k: a positive integer) when restoring authentication information, and restore authentication information from the received shared information. An authentication program that performs authentication by comparing the restored authentication information with the input authentication information is disclosed.

JP 2010-011109 A

  However, when a biometric authentication template necessary for user authentication leaks, this authentication program may leak data that can be referred to from a terminal accessible by the biometric information paired with the template at the time of authentication. . In addition to the biometric information paired with the template at the time of authentication, a method of authenticating using the terminal identification number is also conceivable, but it may be difficult for the user to exchange the terminal.

  SUMMARY An advantage of some aspects of the invention is that it provides a data management program capable of allowing only a genuine user to access data while suppressing data leakage.

  A data management program according to an aspect of the present invention provides an acquisition function that acquires information indicating whether or not biometric information is authentic, and when information indicating that the biometric information is authentic is acquired A computer having a distributed function for generating a plurality of distributed data that cannot be restored alone from original data stored so as to be referable from a terminal, and a storage function for storing the plurality of distributed data in a plurality of storage devices. Let it run.

  When a data management program according to an aspect of the present invention acquires an acquisition function for acquiring information indicating whether or not biometric information is authentic, and information indicating that the biometric information is authentic, a plurality of A computer is caused to execute a collection function for collecting distributed data stored in each of at least two storage devices of the storage devices and an integration function for generating original data from the collected distributed data.

  According to the present invention, it is possible to allow only a genuine user to access data while suppressing data leakage.

FIG. 1 is a diagram illustrating an example of a terminal, a storage device, and a management server according to the present embodiment, and their connection relationship. FIG. 2 is a diagram illustrating an example of functions of the data management program according to the present embodiment. FIG. 3 is a flowchart showing a method of applying the secret sharing method to the original data by the data management program according to the present embodiment. FIG. 4 is a flowchart showing a method of generating original data from a plurality of distributed data by the data management program according to the present embodiment.

  A preferred embodiment of the present invention will be described with reference to the accompanying drawings. In addition, in each figure, what attached | subjected the same code | symbol has the same or similar structure.

[Embodiment]
First, a terminal, a storage device, and a management server according to the present embodiment and their connection relationship will be described with reference to FIG. FIG. 1 is a diagram illustrating an example of a terminal, a storage device, and a management server according to the present embodiment, and their connection relationship.

  As shown in FIG. 1, a terminal 1, a storage device 21, a storage device 22, a storage device 23, and a management server 3 are connected to a network NW so that they can communicate with each other. The network NW is, for example, the Internet.

  The terminal 1 includes a display unit 11 and a biometric authentication device 12. The terminal 1 is, for example, a mobile phone, a smartphone, or a tablet. The display unit 11 is a display, for example. The biometric authentication device 12 is, for example, a fingerprint authentication device, a vein authentication device, a face authentication device, a hand authentication device, an iris authentication device, or a voiceprint authentication device, and may correspond to FIDO (Fast Identity Online). Note that the terminal 1 may be connected to another biometric authentication device instead of including the biometric authentication device 12.

  The storage device 21, the storage device 22, and the storage device 23 are storage means configured to be able to write and read data, for example, a database server. The storage device 21, the storage device 22, and the storage device 23 are managed by different management entities, for example, different cloud service providers, and are independent of each other. Note that each of the storage device 21, the storage device 22, and the storage device 23 may be a plurality of storage areas that are physically separated in one database server managed by one cloud service provider. Further, a storage device other than the storage device 21, the storage device 22, and the storage device 23 may be connected to the network NW, and data may be written to and read from four or more storage devices. .

  The management server 3 is configured to be communicable with the terminal 1 via the network NW, and is a computer device that receives deletion information to be described later. For example, the management server 3 is a database server. The management server 3 is managed by a business operator who has concluded a use contract for a data management program 40 described later.

  Next, functions of the data management program according to the present embodiment will be described with reference to FIGS. 1 and 2. FIG. 2 is a diagram illustrating an example of functions of the data management program according to the present embodiment.

  For example, the data management program 40 is installed in the terminal 1, and has a secret sharing function 41 and a restoration function 42 as shown in FIG.

  The secret sharing function 41 is a function that generates a plurality of shared data from the original data stored so that it can be referred to from the terminal 1, and stores the data in a plurality of storage devices. Specifically, the secret sharing function 41 is realized by the acquisition function 401, the distribution function 402, and the storage function 403 shown in FIG. Further, the delete command function 404 and the transmission function 405 shown in FIG. 2 are selective functions associated with the secret sharing function 41.

  The restoration function 42 is a function for collecting the distributed data stored in each of at least two storage devices among the plurality of storage devices and restoring the original data. Specifically, the restoration function 42 is realized by an acquisition function 401, a collection function 406, and an integration function 407. Also, the enabling function 408, the determination function 409, and the overwrite function 410 illustrated in FIG. 2 are selective functions associated with the restoration function 42.

  The secret sharing function 41 of the data management program 40 will be described.

  The acquisition function 401 acquires information indicating whether the biological information is authentic. This biometric information is authentication information input to the biometric authentication device 12 by the user of the terminal 1, and is, for example, a fingerprint, a vein, a face, a handprint, an iris, or a voiceprint. By authentication based on biometric information, it is possible to authenticate that the person who operates the terminal 1 is a genuine user who is permitted to use the data management program 40 installed in the terminal 1. The user referred to here is, for example, a sales staff who is entrusted by a business operator or the like who has concluded a use contract for the data management program 40 and performs business activities using his / her terminal 1.

  When the information indicating that the biometric information is authentic is acquired, the distribution function 402 generates a plurality of distributed data that cannot be restored alone from the original data stored so that it can be referred to from the terminal 1. That is, the distribution function 402 applies a secret sharing scheme to one piece of original data to generate a plurality of distributed data. In addition to the case where the original data is stored in the terminal 1, the original data is stored in a place other than the terminal 1 by an external storage means such as a cloud service. It means to include.

  The original data is secret information having a property that should be managed in a secret manner, for example, an address book including the name, telephone number, address, etc. of the customer with whom the user is in contact using the terminal 1, and customer attributes including. The customer attributes referred to here are data representing the progress of sales activities for each customer, such as “Applying”, “Negotiating”, “Contractor”, “Unsuccessful”, and the like. For example, the original data is displayed as address book information or customer attributes that are meaningful to the user only when displayed on the display unit 11 of the terminal 1.

  Distributed data is information that is generated so that original data cannot be restored alone.For example, bit information that is sufficient to restore original data alone is missing, and for the first time based on a plurality of distributed data. The original data is recoverable information. That is, such distributed data is data that does not make sense to the user alone. For example, the distributed data is generated by masking some bits of the original data according to a predetermined rule, for example. Specifically, it is generated by skipping bit information at a predetermined bit position for each distributed data and compressing the bit information. For this reason, even if some shared data leaks, some bit information is missing, so that the original data is not restored, and secret information does not leak. Further, the distribution function 402 may further encrypt and store each of the plurality of distributed data after the secret sharing process. In this embodiment, it is assumed that the secret sharing process is performed so that the original data can be restored based on the shared data of any two storage devices of the storage device 21, the storage device 22, and the storage device 23. .

  The storage function 403 stores each of the plurality of distributed data in a plurality of storage devices. For example, the storage function 403 stores the distributed data A in the storage device 23 and the storage device 21 as shown in FIG. Similarly, the storage function 403 stores the distributed data B in the storage device 21 and the storage device 22. The storage function 403 stores the distributed data C in the storage device 22 and the storage device 23. In the present embodiment, the original data can be restored from the three data of distributed data A, distributed data B, and distributed data C. That is, if the distributed data of any two storage devices among the storage device 21, the storage device 22, and the storage device 23 is acquired, the original data can be restored.

  Note that the storage function 403 may store each of the distributed data A, the distributed data B, and the distributed data C in at least one of the storage device 21, the storage device 22, and the storage device 23. The storage function 403 may store the distributed data A, the distributed data B, and the distributed data C in a storage device designated in advance. The storage device in which the distributed data is stored may be specified by, for example, a business operator who has concluded a use contract for the data management program 40 or may be automatically specified by the storage function 403. As the number of storage devices in which the storage function 403 stores distributed data increases, the security of the original data tends to become stronger. In addition, when each storage device storing the distributed data by the storage function 403 is managed by a plurality of business operators, the independence of the storage device is increased, and the security of the original data tends to be strengthened.

  The deletion command function 404 transmits to the terminal 1 a deletion command instructing to delete the original data after the plurality of distributed data are stored separately in the plurality of storage devices. For example, as shown in FIG. 1, the delete command function 404 stores the distributed data A in the storage device 21 and the storage device 22, the distributed data B is stored in the storage device 22 and the storage device 23, and the distributed data C is stored. After being stored in the device 23 and the storage device 21, a delete command is transmitted to the terminal 1. When the terminal 1 receives the deletion command, the terminal 1 displays an image indicating the deletion command on the display unit 11 and stores the original data in its own storage means regardless of whether or not the original data is deleted. The user is prompted to delete the original data from the external storage means when the original data is deleted. Thereby, the deletion command function 404 can suppress the leakage of the original data due to the user losing the terminal 1 or the terminal 1 itself being stolen. In addition, it is possible to prevent the original data itself stored in the terminal 1 from being illegally accessed and leaked to the outside. Note that the terminal 1 may automatically delete the original data when receiving the delete instruction.

  In addition, the deletion command function 404 is configured to issue a deletion command that instructs to delete the original data when the plurality of distributed data is stored separately in the plurality of storage devices and the original data is stored so as to be referable from the terminal 1. You may transmit to the terminal 1. For example, as shown in FIG. 1, the delete command function 404 stores the distributed data A in the storage device 21 and the storage device 22, the distributed data B is stored in the storage device 22 and the storage device 23, and the distributed data C is stored. When the original data is stored in the device 23 and the storage device 21 and can be referred to from the terminal 1, a deletion command may be transmitted to the terminal 1. Here, when the terminal 1 receives the deletion instruction, only when the original data has not been deleted, the terminal 1 displays an image indicating the deletion instruction on the display unit 11 and stores the original data in its storage means. The user is prompted to delete the original data if it is stored, and to delete the original data from the external storage means if it is stored externally. As a result, the deletion command function 404 prompts the user to delete the original data from the terminal 1 or external storage means only when the user has forgotten or neglected to delete the original data. Can be suppressed. Note that the terminal 1 may automatically delete the original data when receiving the delete instruction.

  The transmission function 405 transmits deletion information indicating that the original data has been deleted from the terminal 1 when the original data is stored so that it can be referred to from the terminal 1. For example, in the transmission function 405, as shown in FIG. 1, the distributed data A is stored in the storage device 21 and the storage device 22, the distributed data B is stored in the storage device 22 and the storage device 23, and the distributed data C is stored in the storage device. 23, the deletion information is transmitted to the management server 3. Thereby, the transmission function 405 can notify the fact that the original data is correctly deleted to a business operator who has concluded a use contract for the data management program 40 installed in the terminal 1.

  The restoration function 42 of the data management program 40 will be described.

  The acquisition function 401 acquires information regarding whether or not the biological information is authentic. The acquisition function 401 in the restoration function 42 is the same as the acquisition function 401 in the secret sharing function 41.

  When the information indicating that the biological information is authentic is acquired, the collection function 406 collects distributed data stored in each of at least two storage devices among the plurality of storage devices. For example, the collection function 406 collects distributed data A and distributed data B from the storage device 21 and collects distributed data C from the storage device 22. For example, the collection function 406 collects the distributed data A from the storage device 21, collects the distributed data B from the storage device 22, and collects the distributed data C from the storage device 23.

  The integration function 407 generates original data from the collected distributed data. For example, the integration function 407 decodes data combining the distributed data A, the distributed data B, and the distributed data C, and generates original data. Further, for example, when at least one of the distributed data A, the distributed data B, and the distributed data C is encrypted at the time of storage, the data is decrypted and combined to generate original data. The original data is provided so as to be visible to the user without being stored in the storage means of the terminal 1. For example, by directly compositing in a temporary storage area such as an image memory of the display unit 11 of the terminal 1, it is displayed recognizable to the user as character information or image information.

  The activation function 408 enables the acquisition function 401, the collection function 406, and the integration function 407 during a preset time period. For example, the enabling function 408 enables these three functions at 9:00 am when the sales staff starts the sales activity using the terminal 1 and disables these three functions at 5:00 pm when the sales activity ends. Thereby, the enabling function 408 suppresses the effort of the user of the terminal 1 to start up the data management program 40 every day or prevents the user of the terminal 1 from forgetting to start up the data management program 40. Can do. In addition, since the enabling function 408 automatically enables these three functions, the user can be prevented from using the original data illegally during business hours.

  The determination function 409 determines whether at least one of the collected distributed data has been tampered with. Whether or not it has been tampered with may be determined by comparing the determination information acquired and stored before storage with the determination information acquired at the time of collection. For example, the determination function 409 may determine whether the hash value, length, or regular expression obtained by combining the hash value, length, or regular expression acquired before the secret sharing method is applied to the correct original data and the collected distributed data. If the regular expression is different, it is determined that at least one of the collected distributed data has been tampered with. Further, for example, the determination function 409 includes the hash value, length, or regular expression of each distributed data when the distributed data is generated from correct original data, and the hash value, length, or regular expression of the distributed data collected from each storage device. If the regular expression is different, it is determined that the distributed data has been tampered with. The latter method has an advantage that the distributed data that has been falsified can be identified.

  In these cases, for example, the determination information is stored in a storage device that is different from the storage device in which the storage function 403 stores the distributed data. The determination information is stored for the first time when the distribution function 402 generates a plurality of distributed data and the storage function 403 stores them in a plurality of storage devices. Further, each time the distributed data is generated and stored again for the same original data, the determination information is also updated. The determination function 409 may determine that the distributed data has been tampered with when the update date and time acquired and recorded when the secret sharing method is applied and the update date and time of the collected distributed data are different. it can.

  Therefore, the determination function 409 can suppress generation of data different from the original data from the tampered distributed data or display on the display unit 11 of the terminal 1. Note that the correct hash value and regular expression of the original data are, for example, stored in a storage device that does not store distributed data and is connected to the network NW, and is appropriately acquired by the determination function 409. .

  When it is determined that at least one of the collected distributed data has been tampered with, the overwrite function 410 overwrites the distributed data that has been determined to be tampered with the correct distributed data. For example, the determination function 409 generates data using the distributed data B in the storage device 21, and the integration function 407 generates correct original data using the distributed data B in the storage device 22. When it is determined that the distributed data A and the distributed data C that are used are the same and the distributed data B in the storage device 21 has been tampered with, the overwrite function 410 stores the distributed data stored in the storage device 21. Data B is overwritten with distributed data B stored in the storage device 22. Thereby, the overwrite function 410 can suppress the generation of the original data from the distributed data in which the integration function 407 is falsified.

  A method of applying the secret sharing method to the original data by the data management program according to the present embodiment will be described with reference to FIG. FIG. 3 is a flowchart showing a method of applying the secret sharing method to the original data by the data management program according to the present embodiment.

  In the acquisition step S11, the data management program 40 uses the acquisition function 401 to acquire information indicating whether the biological information is authentic. Next, the data management program 40 uses the distribution function 402 to generate a plurality of distributed data from the original data in the distribution step S12. Finally, in the storage step S13, the data management program 40 stores a plurality of distributed data in a plurality of storage devices by using the storage function 403.

  With reference to FIG. 4, a method for the data management program according to the present embodiment to generate original data from a plurality of distributed data will be described. FIG. 4 is a flowchart showing a method of generating original data from a plurality of distributed data by the data management program according to the present embodiment.

  In the acquisition step S21, the data management program 40 uses the acquisition function 401 to acquire information indicating whether the biological information is authentic. Next, the data management program 40 collects distributed data stored in each of at least two storage devices by the collection function 406 in the collection step S22. Finally, the data management program 40 generates original data from the distributed data by the integration function 407 in the integration step S23.

  The embodiment that is an example of the present invention has been described above. The data management program 40 can be referred to from a specific terminal 1 when an acquisition function 401 for acquiring information indicating whether or not biometric information is authentic and information indicating that the biometric information is authentic are acquired. A computer executes a distribution function 402 that generates a plurality of distributed data that cannot be restored alone from stored original data, and a storage function 403 that stores a plurality of distributed data in a plurality of storage devices.

  Since the operations of the distribution function 402 and the storage function 403 start after the acquisition function 401 operates, the user of the terminal 1 can easily use the distribution function 402 and the storage function 403. In addition, the data management program 40 stores a plurality of distributed data generated from the original data separately in a plurality of storage devices, and the original data cannot be restored by the distributed data alone, thereby suppressing the leakage of the original data. can do. Furthermore, a business operator, etc., who has concluded a contract for using the data management program 40 can own the original data and safely manage the original data which is confidential information without risking the leakage of the original data. it can.

  When the acquisition function 401 for acquiring information indicating whether or not the biometric information is authentic and the information indicating that the biometric information is authentic are acquired, the data management program 40 includes at least two of the plurality of storage devices. A computer is caused to execute a collection function 406 for collecting distributed data stored in each of the storage devices and an integration function 407 for generating original data from the collected distributed data.

  Since the operation of the collection function 406 and the integration function 407 starts after the acquisition function 401 operates, the user of the terminal 1 can easily use the collection function 406 and the integration function 407. Further, since the data management program 40 generates original data in a temporary storage area such as an image memory from the distributed data after the user performs biometric authentication, it is possible to suppress the leakage of the original data. Furthermore, a business operator, etc., who has concluded a contract for using the data management program 40 can own the original data and safely manage the original data which is confidential information without risking the leakage of the original data. it can.

  Note that the type of biometric information acquired by the acquisition function 401 in the secret sharing function 41 and the restoration function 42 may be set according to the security level of the original data. For example, the acquisition function 401 acquires information on whether or not the fingerprint is authentic when the original data includes the attribute “negotiations” of the customer with a security level of medium, and the attribute of the customer with a high security level When the original data includes “contractor”, information regarding whether or not at least one of the fingerprint and the iris is authentic may be acquired. As a result, the data management program 40 can strictly manage access to the original data with high importance and facilitate access to the data with low importance. Further, for example, when the user uses another terminal in addition to the terminal 1 in sales activities, the types of biometric information acquired by the acquisition function 401 in the secret sharing function 41 and the decryption function are different from those in the terminal 1 It may be different from the terminal.

  The embodiments described above are for facilitating the understanding of the present invention, and are not intended to limit the present invention. Each element included in the embodiment and its arrangement, material, condition, shape, size, and the like are not limited to those illustrated, and can be changed as appropriate. In addition, the structures shown in different embodiments can be partially replaced or combined.

  DESCRIPTION OF SYMBOLS 1 ... Terminal, 11 ... Display part, 12 ... Biometric authentication apparatus 21, 22, 23 ... Storage device, 3 ... Management server, 40 ... Data management program, 41 ... Secret sharing function, 42 ... Restoration function, 401 ... Acquisition function , 402 ... Distribution function, 403 ... Storage function, 404 ... Delete command function, 405 ... Transmission function, 406 ... Collection function, 407 ... Integration function, 408 ... Enable function, 409 ... Determination function, 410 ... Overwrite function, A, B, C ... distributed data, NW ... network

Claims (13)

An acquisition function for acquiring information indicating whether or not the biometric information is authentic;
When information indicating that the biometric information is authentic is acquired, a distributed function that generates a plurality of distributed data that cannot be restored alone from original data stored so that it can be referred to from a specific terminal;
A storage function for storing the plurality of distributed data in a plurality of storage devices;
Data management program that causes a computer to execute.   2. The computer according to claim 1, further comprising a deletion command function for transmitting a deletion command to the terminal to delete the original data after the plurality of distributed data are stored separately in the plurality of storage devices. Data management program.   When the plurality of distributed data are stored separately in the plurality of storage devices and the original data is stored so that it can be referred to from the terminal, a deletion command is sent to the terminal to delete the original data. The data management program according to claim 1, further causing the computer to execute a deletion command function to be performed.   4. The data management program according to claim 1, further causing a computer to further execute a transmission function of transmitting deletion information indicating that the original data has been deleted when the original data has been deleted. 5.   The data management program according to any one of claims 1 to 4, wherein the type of the biological information is set according to a security level of the original data.   The data management program according to claim 1, wherein the distributed function further encrypts each of the plurality of distributed data. An acquisition function for acquiring information indicating whether or not the biometric information is authentic;
When information indicating that the biological information is authentic is acquired, a collection function for collecting distributed data stored in each of at least two storage devices among a plurality of storage devices;
An integration function for generating original data from the collected distributed data;
Data management program that causes a computer to execute.   The data management program according to claim 7, further causing the computer to execute an enabling function for enabling the acquisition function, the collection function, and the integration function during a preset time period.   The data management program according to claim 7 or 8, further causing a computer to execute a determination function for determining whether or not at least one of the collected distributed data has been tampered with.   The computer according to claim 9, wherein when it is determined that at least one of the collected distributed data is falsified, the computer further executes an overwriting function of overwriting the distributed data determined to be falsified with correct distributed data. The data management program described.   The data management program according to any one of claims 7 to 10, wherein the type of the biological information is set according to a security level of the original data. An acquisition step of acquiring information indicating whether or not the biological information is authentic;
When information indicating that the biometric information is authentic is obtained, a distribution step for generating a plurality of distributed data that cannot be decoded alone from original data stored so as to be referred from a specific terminal;
A storage step of storing the plurality of distributed data in a plurality of storage devices;
Data management method. An acquisition step of acquiring information indicating whether or not the biological information is authentic;
A collection step of collecting distributed data stored in each of at least two storage devices among a plurality of storage devices when information indicating that the biological information is authentic is acquired;
An integration step of generating original data from the collected distributed data;
Data management method.

Images