JP7621423B2 - Information processing device, program and method - Google Patents

Description

The present invention relates to an information processing device, a program, and a method.

Patent Literature 1 discloses an information display device that automatically sets the device to prevent others from peeking when it is determined that there is a risk of others peeking. Patent Literature 2 discloses an electronic device that performs anti-peeking control when it detects the line of sight of a person other than the user. Patent Literature 3 discloses a technology that acquires line-of-sight information of a user's gaze on a screen image for each user and displays which display area in the screen image the user has gazed on.
(Prior Art Literature)
(Patent Documents)
(Patent Document 1) JP 2012-129701 A (Patent Document 2) Japanese Patent No. 6474921 (Patent Document 3) Japanese Patent No. 6485522

In a first aspect of the present invention, an information processing device is provided. The information processing device, for example, conceals a part of a generated image generated by an image generating device and generates a display image to be displayed on an image display device. The information processing device, for example, includes a work position identification unit that identifies a work position, which is one or more positions or ranges located in a part of the generated image and is a position or range specified or referenced by a user of the image display device. The information processing device, for example, includes a target area determination unit that determines a target area, which is an area to be concealed, based on the work position identified by the work position identification unit. The information processing device, for example, includes a work area determination unit that determines a work area, which is an area located in a part of the generated image and includes the work position.

The information processing device may include a division unit that divides the generated image into a plurality of sections. The information processing device may include a value derivation unit that derives the value of information contained in each section for at least a portion of the plurality of sections. In the information processing device, the target area determination unit may determine the target area based on the value derived by the value derivation unit and the work position identified by the work position identification unit.

In the above information processing device, the target area determination unit may (a) determine that at least one of the multiple sections that is located outside the range of the working area and has a value greater than a predetermined first degree is to be concealed. The target area determination unit may (b) determine that the working area is not to be concealed if the working area does not include any of the multiple sections whose value is greater than a predetermined second degree. The target area determination unit may (c) determine that at least one of the multiple sections whose value is greater than the second degree is to be concealed if the working area includes any of the multiple sections whose value is greater than the second degree. In the above information processing device, the second degree may be greater than the first degree. In the above information processing device, the working area determination unit may determine the range of the working area based on the value derived by the value derivation unit, which is (i) the value of information included in a section that includes the working position among the multiple sections, or (ii) the value of information included in the working position.

The information processing device may include a mode determination unit that determines a mode of concealment of the target area based on the value derived by the value derivation unit, which is the value of the information included in the target area. The information processing device may include a proximity detection unit that detects the approach of the user to the image display device when the distance between the user and the image display device becomes smaller than a predetermined value. In the information processing device, the mode determination unit may determine to reduce the size of at least one selected from the group consisting of character strings, pictures, diagrams, tables, photographs, and videos, and parts of these, included within the working area, when the approach of the user to the image display device is detected.

In a second aspect of the present invention, a method for generating an image is provided. The method is, for example, a method for generating a display image to be displayed on an image display device by concealing a part of a generated image generated by an image generating device. The subject of operation of each step of the method may be a computer.

The above method includes, for example, a work position identification step of identifying a work position, which is one or more positions or ranges located in a part of the generated image and which is a position or range specified or referenced by a user of the image display device. The above method includes, for example, a target area determination step of determining a target area, which is an area to be concealed, based on the work position identified in the work position identification step. The above method includes, for example, a work area determination step of determining a work area, which is an area located in a part of the generated image and which includes the work position.

In a third aspect of the present invention, a program is provided. The program may be a program for causing a computer to function as the information processing device according to the first embodiment. The program may be a program for causing a computer to execute the method according to the second embodiment. A computer-readable medium for storing the program may be provided. The computer-readable medium may be a non-transitory computer-readable medium. The computer-readable medium may be a computer-readable recording medium.

Note that the above summary of the invention does not list all of the necessary features of the present invention. Also, subcombinations of these features may also be inventions.

1 shows an example of a system configuration of an information leakage prevention system 100. An example of an original image 200 is shown diagrammatically. An example of an output image 300 is shown diagrammatically. 13 illustrates an example of information processing in the control device 170. 2 shows an example of the internal configuration of the control device 170. 13 shows an example of the internal structure of the value map generator 582. 7 shows an example of a data structure of a data table 700. 13 shows an example of an internal configuration of the concealment processing unit 584. 9 shows an example of a data structure of a data table 900. 10 shows an example of a data structure of a data table 1000. 13 illustrates an example of information processing in the leakage prevention support unit 586. 13 is a schematic diagram showing another example of information processing in the leakage prevention support unit 586. 2A and 2B show schematic diagrams of another example of a method for dividing the original image 200. An example of the system configuration of a computer 3000 is shown in schematic form.

The present invention will be described below through embodiments of the invention, but the following embodiments do not limit the invention according to the claims. Furthermore, not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention. In the drawings, the same reference numbers may be used for identical or similar parts, and duplicate explanations may be omitted. Furthermore, a person skilled in the art who has come across the description of this specification will be able to understand that technical matters described in one embodiment may also be applied to other embodiments to the extent that there is no technical contradiction.

(Overview of information leakage prevention system 100)
An overview of the information leakage prevention system 100 will be described with reference to Figures 1, 2, and 3. Figure 1 shows an example of a system configuration of the information leakage prevention system 100. In this embodiment, the information leakage prevention system 100 can conceal a part of information presented to a user. The information leakage prevention system 100 conceals a part of an image displayed by a terminal managed by the information leakage prevention system 100, for example, in response to an instruction from an administrator of the terminal or a user of the terminal.

In this embodiment, the information leakage prevention system 100 is described in detail using an example in which the information leakage prevention system 100 (i) first generates an original image 200 that has not been subjected to an anonymization process, and (ii) then anonymizes at least a portion of the original image 200 to generate an output image 300 to be presented to a user. FIG. 2 shows an example of the original image 200. FIG. 3 shows an example of the output image 300.

As shown in FIG. 1, in this embodiment, the information leakage prevention system 100 includes, for example, a user terminal 120. In this embodiment, the user terminal 120 includes, for example, a housing 130, a display device 140, an environmental sensor 150, an input device 160, and a control device 170. In this embodiment, the display device 140 includes, for example, a display area 142. In this embodiment, the environmental sensor 150 includes a distance sensor 152, a camera 154, and a radio wave detector 156.

In this embodiment, the user terminal 120 outputs various types of information to the user. The user terminal 120 may output information by image or by sound. The user terminal 120 may accept information input from the user. The user terminal 120 is configured to be able to execute various types of information processing.

In this embodiment, the details of the user terminal 120 are described using as an example a case where the user terminal 120 outputs an image. For example, a user of the user terminal 120 inputs instructions to the user terminal 120 via the input device 160 for the BIOS, operating system (sometimes referred to as OS), or application program (sometimes referred to as program) running on the user terminal 120. The user terminal 120 executes information processing according to the instructions, and displays an image showing the results of the information processing in the display area 142.

In this embodiment, the user terminal 120 generates the output image 300 by concealing a part of the original image 200 generated by a program running on the user terminal 120, for example. The user terminal 120 displays the output image 300 in the display area 142 of the display device 140. As a result, the output image 300 is presented to the user. According to this embodiment, a part of the output image 300 is concealed. Therefore, even if the output image 300 displayed in the display area 142 is viewed by a person other than the user who is in the vicinity of the display area 142, information leakage can be suppressed. Examples of the program that generates the original image 200 include a BIOS, an operating system (sometimes referred to as an OS), and various application programs.

Examples of the user terminal 120 include a personal computer and a mobile terminal. Examples of the mobile terminal include a mobile phone, a smartphone, a PDA (registered trademark), a tablet, a notebook computer or laptop computer, and a wearable computer.

In this embodiment, the housing 130 supports the display device 140, the environmental sensor 150, the input device 160, and the control device 170. At least a portion of each of the display device 140, the environmental sensor 150, the input device 160, and the control device 170 may be housed inside the housing 130, or may be attached to the outside of the housing 130.

In this embodiment, the display device 140 outputs various images. The display device 140 may output an image or stop outputting an image according to instructions from the control device 170. The display device 140 may adjust the brightness or contrast of an image according to instructions from the control device 170. The display device 140 can output an image, stop outputting an image, or adjust the brightness or contrast of an image according to instructions from the control device 170, for example, by controlling the operation of pixels based on data output by the control device 170. Examples of the display device 140 include a display and a projector.

In this embodiment, the display area 142 displays an image (sometimes referred to as an output image) output by the display device 140. In this embodiment, the display area 142 is disposed in the housing 130. In this embodiment, the display area 142 is disposed on approximately the same surface as at least a portion of the environmental sensor 150.

In this embodiment, the environmental sensor 150 acquires various information related to the surrounding environment of the display area 142. The environmental sensor 150 may include one or more sensors for acquiring the above-mentioned various information. Examples of the above-mentioned sensors include a sensor for acquiring various images, a sensor for acquiring sound, a sensor for detecting brightness, a sensor for detecting temperature, a sensor for detecting distance or depth, a receiver for receiving wireless signals, and the like. The information acquired or generated by one or more sensors included in the environmental sensor 150 is output to the control device 170, for example.

In this embodiment, the distance sensor 152 measures the distance between the distance sensor 152 and each of one or more objects arranged around the display area 142. Examples of the periphery of the display area 142 include positions within the range of the viewing angle of the display area 142, and positions whose distance from the display area 142 is within a predetermined numerical range. The distance sensor 152 may acquire point cloud data of each of the above objects. The point cloud data may be three-dimensional point cloud data.

The relative positional relationship between the display area 142 and the distance sensor 152 is known. Therefore, the distance sensor 152 may derive the distance between the display area 142 and each of the above-mentioned objects based on the distance between the distance sensor 152 and each of the above-mentioned objects and the relative positional relationship between the display area 142 and the distance sensor 152.

The distance sensor 152 may detect the approach of the user of the user terminal 120 to the display device 140 or the display area 142. For example, the distance sensor 152 measures the distance between the user of the user terminal 120 and the display device 140 or the display area 142. When the distance between the user of the user terminal 120 and the display device 140 or the display area 142 becomes smaller than a predetermined value, the distance sensor 152 may detect the approach of the user to the image display device.

The details of the principle and/or procedure by which the distance sensor 152 measures the above distance are not particularly limited. Examples of the distance sensor 152 include (i) a sensor that captures an image, and (ii) a sensor that measures the distance to an object using sound waves, ultrasound, electromagnetic waves, lasers, etc. Examples of the distance sensor 152 include a stereo camera, a monocular camera depth distance measurement device (sometimes referred to as a monocular depth estimation device), LiDAR, a non-contact proximity sensor, etc. Optical components such as a fisheye lens and an ultra-wide-angle lens may be attached to the above camera.

In this embodiment, the camera 154 captures an image of the periphery of the display area 142. The image may be a still image or a moving image. The details of the camera 154 are not particularly limited. The camera 154 may be an image sensor for capturing a two-dimensional image, or an infrared camera for capturing an infrared image (sometimes called a thermal image). The camera 154 may be a monocular camera or a stereo camera. The camera 154 may be a 180-degree camera or a 360-degree camera. In addition, if the distance sensor 152 is equipped with an image sensor, the user terminal 120 may not be equipped with the camera 154.

In this embodiment, the radio wave detector 156 detects radio waves of a wireless signal. The radio wave detector 156 may measure the strength of the wireless signal. Examples of wireless signals include a GPS signal, a WiFi (registered trademark) signal, and a Bluetooth (registered trademark) signal. This allows, for example, the control device 170 to analyze the detected radio waves to estimate the installation position of the display area 142.

In this embodiment, the input device 160 accepts input from the user of the user terminal 120. Examples of the above input include input related to the operation and/or settings of the user terminal 120, input related to the operation and/or settings of various programs running on the user terminal 120, and input related to the content of the work executed by the programs. The input device 160 outputs information input by the user to the input device 160 to the control device 170. Examples of the input device 160 include a keyboard, a pointing device, a touch panel, a camera, and a microphone.

In this embodiment, the control device 170 controls the user terminal 120. The control device 170 executes various information processing in the user terminal 120. Details of the control device 170 will be described later.

The above information processing method may be a method for generating a display image to be displayed on an image display device by concealing a part of a generated image generated by an image generating device. Each step of the above information processing method is executed by, for example, a computer.

In one embodiment, the method includes, for example, an image acquisition step of acquiring a generated image, which is an image generated by an image generation device. The method includes, for example, a division step of dividing the generated image into a plurality of sections. The method includes, for example, a value derivation step of deriving the value of information contained in each section for at least a portion of the plurality of sections. The method includes, for example, a work position identification step of identifying a work position. In the method, the work position is one or more positions or ranges arranged in a portion of the generated image, and is (i) a position or range of an input by a user of the image display device, and/or (ii) a position or range of the user's line of sight. The method includes, for example, a target area determination step of determining a target area, which is an area to be concealed, based on the value derived in the value derivation step and the work position identified in the work position identification step.

In another embodiment, the above method includes a work position identification step of identifying a work position, which is, for example, one or more positions or ranges located in a part of the generated image and which is a position or range specified or referenced by a user of the image display device. The above method includes, for example, a target area determination step of determining a target area, which is an area to be concealed, based on the work position identified in the work position identification step. The above method includes, for example, a work area determination step of determining a work area, which is an area located in a part of the generated image and which includes the work position.

(Outline of original image 200 and output image 300)
2 and 3, the original image 200 and the output image 300 will be described in detail, taking as an example a case where a window 210 is displayed full-screen when a program (sometimes referred to as a concealment program) for concealing a part of the original image 200 is executed. As described above, in this embodiment, the information leakage prevention system 100 (i) first generates the original image 200 that has not been subjected to concealment processing, and (ii) then conceals at least a part of the original image 200 to generate the output image 300 to be presented to the user. The output image 300 includes an area (sometimes referred to as a concealment area) in which at least a part of the information (sometimes referred to as presented information) to be presented to the user is concealed.

As shown in FIG. 2, in this embodiment, the original image 200 has an image of a window 210 displayed full screen. In this embodiment, the window 210 includes a control area 212 and an image output area 214.

As described above, window 210 corresponds to the anonymization program. Original image 200 shows an example of a screen displayed in display area 142 after the anonymization program has been launched and in a state in which the anonymization program is not yet executing an anonymization process.

In this embodiment, the control area 212 is provided with one or more objects for displaying various information related to the control of the window 210 and/or the control of the concealment program. For example, the control area 212 is provided with an object 222 for presenting the user with operations (sometimes referred to as a menu) available to the user, and an object 224 for presenting the user with ON/OFF of the concealment process.

The control area 212 may include an object (not shown) for presenting the name of the concealed program (sometimes called the title) to the user, an object (not shown) for allowing the user to change the size of the window 210, and an object (not shown) for allowing the user to select whether to display or hide the window 210.

In this embodiment, the image output area 214 displays, for example, a background image (not shown) generated by the OS, presentation information 216 which is information presented to the user by the OS, and images of a window 230 and a window 240 corresponding to a program or file other than the OS and the concealment program. In this embodiment, the window 230 includes a control area 232, an image output area 234, and presentation information 236. In this embodiment, the window 240 includes a control area 242, an image output area 244, and presentation information 246.

In this embodiment, the control area 232 has one or more objects arranged therein for displaying various information relating to the control of the window 230 and/or the control of the program or file corresponding to the window 230. The image output area 234 displays presentation information 236, which is information presented to the user by the program or file corresponding to the window 230.

In this embodiment, the control area 242 has one or more objects arranged therein for displaying various information relating to the control of the window 240 and/or the control of the program or file corresponding to the window 240. The image output area 244 displays presentation information 246, which is information presented to the user by the program or file corresponding to the window 230.

As shown in FIG. 3, in this embodiment, the output image 300 has an image of the window 210 displayed full screen. In this embodiment, the window 210 includes a control area 212 and an image output area 214.

As described above, window 210 corresponds to the anonymization program. Output image 300 shows an example of a screen displayed in display area 142 when the anonymization program has completed its startup and is performing an anonymization process.

In this embodiment, the control area 212 is provided with one or more objects for displaying various information related to the control of the window 210 and/or the control of the concealment program. According to this embodiment, in addition to the objects 222 and 224, the control area 212 is provided with an object 326 for presenting the operation mode of the concealment process to the user, and an object 328 for presenting the type and/or strength of the concealment process to the user.

In this embodiment, one or more objects 318 for concealing at least a portion of the presented information 216 are arranged in the image output area 214. Similarly, one or more objects 338 for concealing at least a portion of the presented information 236 are arranged in the image output area 234. Furthermore, one or more objects 348 for concealing at least a portion of the presented information 246 are arranged in the image output area 244.

The images of these objects are not particularly limited as long as they are capable of concealing the image of the original image 200. Furthermore, the degree of concealment (sometimes referred to as strength) may be determined by initial settings, or may be determined by the administrator or user as described above. Details of the images of these objects will be described later.

In this embodiment, a viewing area 360 is set in the output image 300 for the user to view information contained in the original image 200. One or more viewing areas 360 may be set in the output image 300. The viewing area 360 is set, for example, to include one or more viewing positions 362, which are positions or ranges where the degree to which the user requesting viewing while working is estimated to exceed a predetermined level. An object may be placed on the inner and outer boundaries of the viewing area 360 to indicate the boundary, or no object may be placed on the boundary.

According to one embodiment, the anonymization process is not performed within the viewing area 360. This allows the user to view the information located within the viewing area 360. As a result, the user can continue working even while the anonymization process is being performed.

According to another embodiment, the concealment process is also performed inside the viewing area 360. In this case, the degree of concealment inside the viewing area 360 may be weaker than the degree of concealment outside the viewing area 360. This allows the user to view the information placed inside the viewing area 360. On the other hand, the information placed inside the viewing area 360 can be prevented from being viewed by people other than the user who are present in the vicinity of the display area 142.

According to yet another embodiment, the need for concealment processing within the viewing area 360 is switched depending on the state of the user. For example, the control device 170 analyzes an image of the user captured by the camera 154 to determine whether an event related to the user's state has occurred. If it is determined that the above event has not occurred, the control device 170 determines whether or not concealment processing within the viewing area 360 is required depending on the various embodiments described above. On the other hand, if it is determined that the above event has occurred, the control device 170 decides to conceal the inside of the viewing area 360. Examples of the above event include an event in which the user has closed their eyes, an event in which a saccade has occurred, and the like.

The viewing position 362 may be a position or range located in a portion of the original image 200. In one embodiment, the viewing position 362 may be a position or range specified or referenced by a user. In another embodiment, the viewing position 362 may be (i) a position or range of input by a user, and/or (ii) a position or range of a user's line of sight. In yet another embodiment, the viewing position 362 may be a position or range pointed to by a user's finger, hand, or arm (which may be referred to as a user's finger, etc.).

Examples of the position of the user's input include the position of a pointer, cursor, etc. Examples of the range of the user's input include the range selected by a pointer, cursor, etc. There are no particular limitations on the device used for the above input. Examples of the above devices include a keyboard, a pointing device, a microphone (voice input), a gesture recognition device (gesture input), etc. The position or range of the user's gaze is determined, for example, by the control device 170 analyzing an image of the user captured by the camera 154.

The position pointed to by the user's finger or the like is determined, for example, by the control device 170 analyzing data of the user's finger or the like acquired by a gesture recognition device. Examples of gesture recognition devices include a camera (for example, camera 154) and a LiDAR (for example, distance sensor 152).

More specifically, the control device 170 first analyzes data of the user's fingers, etc. acquired by the gesture recognition device, and determines the relative positional relationship between the user's fingers, etc. and the representative point of the user terminal 120. The control device 170 also analyzes the above data and determines the posture of the user's fingers, etc. Next, the control device 170 identifies the position pointed to by the user's fingers, hand, or arm in the display area 142 of the display device 140, based on the above relative positional relationship and the posture of the user's fingers, etc.

The range pointed to by the user's finger, etc. may be an area that (i) includes the position pointed to by the user's finger, hand, or arm, and (ii) has a predetermined shape and/or size. The range pointed to by the user's finger, etc. may be adjusted according to the relative positional relationship between the user's finger, etc. and the representative point of the user terminal 120.

Comparing a case where the control device 170 determines the viewing position 362 based on the position or range pointed to by the user's finger or the like with a case where the control device 170 determines the viewing position 362 based on the position or range of the user's line of sight, the accuracy of the viewing position 362 is improved by the control device 170 determining the viewing position 362 based on the position or range pointed to by the user's finger or the like. As a result, the user experience is improved.

The information leakage prevention system 100 may be an example of an information processing device. The user terminal 120 may be an example of an information processing device. The display device 140 may be an example of an image display device. The environment sensor 150 may be an example of a proximity detection unit. The distance sensor 152 may be an example of a proximity detection unit. The control device 170 may be an example of an image generation device or an information processing device. The original image 200 may be an example of a generated image. The output image 300 may be an example of a display image. The object 318 or the area in which the object 318 is arranged may be an example of a target area. The object 338 or the area in which the object 338 is arranged may be an example of a target area. The object 348 or the area in which the object 348 is arranged may be an example of a target area. The viewing area 360 may be an example of a work area. The viewing position 362 may be an example of a work position.

(An example of another embodiment)
In this embodiment, the details of the information leakage prevention system 100 have been described using as an example a case in which the user terminal 120 conceals a part of the original image 200 to generate the output image 300. However, the information leakage prevention system 100 is not limited to this embodiment. In other embodiments, the user terminal 120 may be configured to be able to communicate with another computer arranged outside the user terminal 120, and may execute the various information processes described above in cooperation with the other computer. For example, at least a part of the control device 170 may be realized by the other computer.

In this embodiment, the details of the information leakage prevention system 100 are described using as an example a case where the display area 142 and the environmental sensor 150 are arranged on approximately the same plane. However, the information leakage prevention system 100 is not limited to this embodiment. In other embodiments, as long as the relative positional relationship between the display area 142 and the environmental sensor 150 can be identified, at least one of the display area 142 and the environmental sensor 150 may be arranged outside the housing 130.

In this embodiment, the details of the information leakage prevention system 100 have been described using as an example a case in which the above-mentioned concealment objects 318, objects 338, and objects 348 are arranged in a part of the image output area 214, and the viewing area 360 is arranged in another part of the image output area 214. However, the information leakage prevention system 100 is not limited to this embodiment. In other embodiments, the image output area 214 may be entirely concealed except for the inside of the viewing area 360. The concealment objects may be referred to as concealment objects.

In this embodiment, the details of the information leakage prevention system 100 are described using as an example a case where there is a single legitimate user who can receive the presented information output by the user terminal 120. However, the information leakage prevention system 100 is not limited to this embodiment. In other embodiments, there may be multiple legitimate users who can receive the presented information output by the user terminal 120. In this case, the screen displayed in the display area 142 may have multiple viewing areas 360 corresponding to each of the multiple users.

For example, while user A operates user terminal 120, user A and user B may view images displayed in display area 142. Following the same procedure as when there is a single user, control device 170 determines one or more viewing positions 362 corresponding to user A and one or more viewing positions 362 corresponding to user B. Following the same procedure as when there is a single user, control device 170 also determines the range of one or more viewing areas 360 corresponding to user A and the range of one or more viewing areas 360 corresponding to user B.

Any known authentication method may be used to authenticate each of user A and user B as a legitimate user. The control device 170 may determine whether a person is a legitimate user or an illegitimate user based on the distance from the user terminal 120.

In this embodiment, the details of the information leakage prevention system 100 have been described by taking as an example a case in which the above-mentioned concealment process is executed while the concealment process function is enabled. However, the information leakage prevention system 100 is not limited to this embodiment. In other embodiments, the information leakage prevention system 100 executes the above-mentioned concealment process while (i) the concealment process function is enabled and (ii) peeking by a person who is not a legitimate user is detected. This improves the user experience. Any known method may be adopted to detect peeking by a person who is not a legitimate user.

In this embodiment, the details of the information leakage prevention system 100 have been described using as an example a case in which the information leakage prevention system 100 manages information presented by an image displayed in a single display area 142. However, the information leakage prevention system 100 is not limited to this embodiment.

In another embodiment, the information leakage prevention system 100 may manage information presented by images displayed in multiple display areas 142. For example, the user terminal 120 includes multiple display devices 140 or display areas 142, and the control device 170 manages the generation and/or display of the screens displayed on each of the multiple display devices 140 or display areas 142.

More specifically, the control device 170 may control the color, pattern, and/or range of one or more concealment objects arranged on the display screen of each of the multiple display devices 140 or display areas 142, and may control the range of one or more viewing areas arranged on the display screen of each of the multiple display devices 140 or display areas 142. For example, when the user's line of sight is located inside the first display area 142 and a cursor or pointer is arranged in the second display area 142, one or more first viewing areas are arranged inside the first display area 142, and one or more second viewing areas are arranged inside the second display area 142. Thereby, for example, a screen in which the viewing areas are arranged may be displayed on each of the multiple display devices 140 or display areas 142.

Examples of the range of an object include the position of the object in display area 142, the size of the object, and/or the shape of the object. Examples of the range of a viewing area include the position of the viewing area in display area 142, the size of the viewing area, and/or the shape of the viewing area.

In yet another embodiment, the control device 170 may control the manner of information concealment in each of the multiple display devices 140 or display areas 142. The control device 170 controls the manner of information concealment, for example, so that the manner of information concealment in a display device or display area in which the position and/or range of the user's gaze is located differs from the manner of information concealment in a display device or display area in which the position and/or range of the user's gaze is not located. The control device 170 may control the manner of information concealment so that the strength of information concealment in a display device or display area in which the position and/or range of the user's gaze is located is greater than the strength of information concealment in a display device or display area in which the position and/or range of the user's gaze is not located.

(Overview of concealment processing)
Fig. 4 shows an example of information processing in the control device 170. Specifically, an example of the above-mentioned anonymization processing will be described with reference to Fig. 4. According to this embodiment, first, in step 422 (step may be abbreviated as S), the control device 170 starts the above-mentioned anonymization program.

As a result, the window 210 corresponding to the anonymization program is displayed full screen in the foreground. The image displayed in the window 210 immediately after the anonymization program is started is generated, for example, based on the settings related to the anonymization program.

(a) If the settings related to the anonymization program indicate that a predetermined image or an image generated or selected by a predetermined algorithm is to be displayed immediately after startup, the control device 170 displays the image in the display area 142. (b) If the settings related to the anonymization program indicate that anonymization processing is not necessary immediately after startup, the control device 170, for example, determines to display the original image 200 in the display area 142. (c) If the settings related to the anonymization program indicate that anonymization processing is necessary immediately after startup, the control device 170, for example, determines to anonymize at least a part of the original image 200 according to the settings related to the anonymization program. The control device 170, for example, determines to display the output image 300 in the display area 142. In this case, the details of the anonymization processing (for example, the target and manner of anonymization, etc.) may be determined based on the settings described above.

In one embodiment, the anonymization program startup process is executed automatically when the user terminal 120 is started. In another embodiment, the anonymization program startup process is executed in response to a user instruction.

In yet another embodiment, if it is not confirmed that the user terminal 120 is located within a predetermined area, the start-up process of the concealment program may be automatically executed. Examples of predetermined areas include an area in which the administrator of the user terminal 120 has permission to use the user terminal 120, a room used by an organization to which the user belongs, the user's office, the user's home, and the like. Whether or not the user terminal 120 is located within a predetermined area may be determined based on an image of the surroundings of the display area 142 captured by the camera 154, or may be determined based on information contained in a wireless signal detected by the radio wave detector 156.

Next, in S424, the control device 170 determines the target of anonymization. For example, the control device 170 determines an operation mode related to the target of anonymization. Examples of operation modes related to the target of anonymization include (a) a mode in which anonymization is performed in principle, and an exception is not performed on an area estimated to be necessary for the user's work (sometimes referred to as a first mode), and (b) a mode in which anonymization is not performed in principle, and an exception is performed on an area estimated to be viewed by a person other than the user near the display area 142 (sometimes referred to as a second mode).

In this embodiment, in order to facilitate understanding of the information leakage prevention system 100, the details of the information leakage prevention system 100 are described using an example in which the control device 170 operates in the first mode. The control device 170 can be configured to be able to change the operating mode related to the object of concealment, for example, in response to an instruction from an administrator or a user.

Then, the control device 170 executes a process for generating an image for updating the display screen of the display area 142. For example, first, in S432, the control device 170 generates the original image 200. The control device 170 generates the original image 200 based on, for example, output from the OS and/or an application program other than the concealment program.

Next, in S434, the control device 170 analyzes the original image 200 and extracts one or more pieces of presentation information contained in the original image 200. Examples of the presentation information include at least one selected from a group consisting of a character string, a picture, a diagram, a table, a photograph, and a video, as well as some of these. The control device 170 generates a database (sometimes referred to as a value map) that stores information indicating the range that each of the one or more pieces of presentation information occupies in the original image 200 and information indicating the value of each of the one or more pieces of presentation information in association with each other. Details of the value map will be described later.

Next, in S436, the control device 170 determines the extent of the viewing area 360 described above. In one embodiment, the control device 170 determines the extent of the viewing area 360 based on, for example, a position or range specified or referenced by the user. In another embodiment, the control device 170 determines the extent of the viewing area 360 by, for example, analyzing the user's line of sight and/or operation. Details of the procedure for determining the extent of the viewing area 360 will be described later.

The control device 170, for example, acquires information indicating the viewing position 362 specified by the user via any device used by the user. This allows the control device 170 to determine the position or range specified by the user. The viewing position 362 or the range of the viewing area 360 determined by analyzing the user's operation may be an example of the position or range specified by the user.

The control device 170 acquires information indicating the user's movements, voice, and/or line of sight, for example, from the environmental sensor 150. The control device 170 estimates the viewing position 362 based on the user's movements, voice, and/or line of sight. This allows the control device 170 to determine the position or range referenced by the user. The viewing position 362 or the range of the viewing area 360 determined by analyzing the user's line of sight may be an example of the position or range referenced by the user.

Next, in S438, the control device 170 determines the extent of the concealment area described above. As described above, the user cannot view the presented information located inside the concealment area.

In one embodiment, the control device 170 determines the range of the anonymized area based on the range of the viewing area 360. The control device 170, for example, determines that all or part of the outside of the viewing area 360 is to be anonymized. The control device 170 may determine that no anonymized area is provided inside the viewing area 360. In another embodiment, the control device 170 determines the range of the anonymized area based on a value map. The control device 170 determines the range of the anonymized area, for example, so that information having a value exceeding a predetermined standard is anonymized. In yet another embodiment, the control device 170 determines the range of the anonymized area based on the range of the viewing area 360 and the value map. The control device 170 determines the range of the anonymized area based on, for example, a first criterion for determining the range of the anonymized area inside the viewing area 360 and a second criterion for determining the range of the anonymized area outside the viewing area 360, so that information having a value exceeding each standard is anonymized.

The control device 170 also determines the mode of concealment for each of the one or more concealment regions. Examples of the mode of concealment include the type of concealment processing (sometimes referred to as the concealment method) and the strength of the concealment processing. The control device 170 can make the presented information invisible or difficult to see by adjusting the mode of the concealment processing.

Examples of types of concealment include conversion to another image and superimposition of another image. Examples of conversion to another image include mosaic processing, blurring, and mixing. Examples of the strength of the concealment process include the degree of mixing of another image, the degree of superimposition of another image, the transmittance of the superimposed image, the display size of the presented information (e.g., the size of characters), the contrast of the presented information, the color of the presented information and background, and the brightness of the screen or part of the screen. Examples of the degree of mixing of another image include the fineness of the mosaic and the strength of blurring.

For example, in the output image 300 described in relation to FIG. 3, objects 318, 338, and 348 are arranged in the concealed region. As a result, the presentation information 216, 236, and 246 of the original image 200 described in relation to FIG. 2 are concealed. The presentation information that is concealed by each object may be referred to as the presentation information corresponding to each object.

As described above, the image of each object in the output image 300 is, for example, an image obtained by mosaic processing the image of the presentation information corresponding to each object (sometimes referred to as a mosaic processed image). By arranging the above-mentioned mosaic processed image at the position of each object in the output image 300, an output image 300 in which important presentation information is concealed is obtained.

Next, in S442, the control device 170 applies a concealment process to the concealed area of the original image 200 to generate the output image 300. In addition, in S444, the control device 170 controls the display device 140 to display the output image 300 in the display area 142. The control device 170 repeats the processes of S432 to S444. This completes the concealment process.

Figure 5 shows an example of the internal configuration of the control device 170. In this embodiment, the control device 170 includes, for example, a setting information storage unit 520, a program control unit 532, a window control unit 534, an input control unit 540, and an output control unit 550. In this embodiment, the output control unit 550 includes an original image generation unit 560, a window information acquisition unit 572, a line of sight information acquisition unit 574, an operation information acquisition unit 576, and an image processing unit 580. In this embodiment, the image processing unit 580 includes a value map generation unit 582, a concealment processing unit 584, a leakage prevention support unit 586, and an output image generation unit 588.

In this embodiment, the setting information storage unit 520 stores information (sometimes referred to as setting information) relating to various settings of the information leakage prevention system 100 and/or the user terminal 120. The setting information includes, for example, information relating to the settings of the anonymization program. Examples of the settings of the anonymization program include (i) settings relating to the necessity or target of anonymization by the anonymization program and/or the mode of the anonymization, and (ii) various settings relating to the processing immediately after the anonymization program is started.

In this embodiment, the program control unit 532 controls various programs that run on the user terminal 120. The program control unit 532 may control the startup process of the above programs, may control the operation of the above programs, or may control the termination process of the above programs.

In this embodiment, the window control unit 534 executes various controls related to windows corresponding to various programs running on the user terminal 120. The window control unit 534 outputs, for example, various information related to the above-mentioned windows (sometimes referred to as window information) to the window information acquisition unit 572. Examples of the window information include information indicating the range of the window on the screen (e.g., position, shape, size, etc.), information regarding various objects arranged in the window, and information indicating the type of flag assigned to the window. Examples of the above-mentioned flags include no copying, no screenshots, and no capture.

In this embodiment, the input control unit 540 controls various types of information input to the user terminal 120. In one embodiment, the input control unit 540 acquires data output by the environmental sensor 150. The input control unit 540 acquires, for example, image data output by the camera 154, and outputs the image data to the line of sight information acquisition unit 574.

In another embodiment, the input control unit 540 controls the operation of the input device 160. The input control unit 540, for example, accepts various instructions input by the user to the input device 160. Examples of the above instructions include instructions regarding the operation of the user terminal 120, instructions for various programs running on the user terminal 120, and the like. This allows the input control unit 540 to, for example, identify the position or range of the input by the user.

The input control unit 540, for example, outputs the above instruction to the operation information acquisition unit 576. The input control unit 540 may output information indicating the position or range of the input by the user to the operation information acquisition unit 576. The input control unit 540 may output information indicating the content input by the user to the input device 160 to the operation information acquisition unit 576.

In this embodiment, the output control unit 550 controls the output of information presented to the user. In one embodiment, the output control unit 550 controls the output of image information. In another embodiment, the output control unit 550 controls the output of audio information.

In this embodiment, the original image generating unit 560 generates the original image 200. In this embodiment, the window information acquiring unit 572 acquires window information relating to each of one or more windows included in the original image 200 from the window control unit 534.

In this embodiment, the gaze information acquisition unit 574 acquires an image of the user captured by the camera 154 from the input control unit 540. The gaze information acquisition unit 574 analyzes the image of the user to identify the position and/or range of the gaze in the original image 200. Any known method may be used as a method for identifying the position and/or range of the gaze.

In one embodiment, the gaze information acquisition unit 574 analyzes the image to identify a normal vector of the user's face. The gaze information acquisition unit 574 uses the normal vector of the user's face to estimate the position and/or range of the user's gaze in the original image 200. In another embodiment, the gaze information acquisition unit 574 analyzes the image to identify a normal vector of the user's iris. The gaze information acquisition unit 574 uses the normal vector of the user's iris to estimate the position and/or range of the user's gaze in the original image 200.

In this embodiment, the operation information acquisition unit 576 acquires various information (sometimes referred to as operation information) input by the user to the input device 160 from the input control unit 540. As described above, examples of the operation information include (i) information indicating various instructions or contents input by the user to the input device 160, and (ii) information indicating the position or range of the input by the user.

In this embodiment, the image processing unit 580 conceals a portion of the original image 200 generated by the original image generation unit 560, and generates an output image 300 to be displayed in the display area 142 of the display device 140. The image processing unit 580 may control the operation of the display device 140 to display the output image 300 in the display area 142.

In this embodiment, the value map generator 582 generates the value map described above. Details of the value map generator 582 will be described later. In this embodiment, the anonymization processor 584 executes the anonymization process described above. Details of the anonymization processor 584 will be described later.

The leak prevention support unit 586 executes various processes (sometimes referred to as support processes) for preventing information leaks. Examples of support processes include (a) a process for encouraging the user to take a specific action for preventing information leaks, (b) a process for causing the control device 170 to execute a specific information process for preventing information leaks, and (c) a process for outputting a sound indicating the status of the concealment process by the control device 170.

The specific action is, for example, changing the physical position and/or attitude of the user terminal 120. For example, the user can change the physical attitude of the user terminal 120 by rotating the user terminal 120 clockwise or counterclockwise. The specific information processing is, for example, (i) a process for changing the position, shape, and/or size of the viewing area 360 in the display area 142, (ii) a process for changing the target and/or state of anonymization when the length of the period during which no input from the user is detected exceeds a predetermined value, and (iii) a process for changing the target and/or state of anonymization between one display area 142 and another display area 142 when the user terminal 120 has multiple display areas 142.

In one embodiment, the leak prevention support unit 586 analyzes the image captured by the camera 154 to determine whether or not there are two or more people around the display area 142. For example, even if there is another person behind the user, the user may rotate the user terminal 120, making it difficult for that person to view the display area 142. Therefore, when it is determined that there are two or more people around the display area 142, the leak prevention support unit 586 executes a process to prompt the user to change the orientation of the user terminal 120 (e.g., the orientation of the normal vector of the display area 142). For example, the leak prevention support unit 586 controls the output image generation unit 588 to generate and output an image suggesting the rotation direction of the user terminal 120.

In another embodiment, the leakage prevention support unit 586 automatically adjusts the range of the viewing area 360. Examples of the range of the viewing area 360 include the position, shape, and/or size of the viewing area 360 in the display area 142. For example, even if there is another person behind the user, the line of sight of the other person to the vicinity of the center of the display area 142 is blocked by the body of the user. Therefore, the other person cannot view the presented information arranged near the center of the display area 142. Therefore, for example, when the viewing area 360 is arranged at the edge of the display area 142, the leakage prevention support unit 586 controls the output image generation unit 588 to move the information arranged inside the viewing area 360 to the vicinity of the center of the display area 142. This can guide the user's line of sight.

In yet another embodiment, when the length of the period during which the input control unit 540 does not detect any input from the user exceeds a predetermined value, the leak prevention support unit 586 decides to cancel the setting of the viewing area 360. This changes the target of concealment. The leak prevention support unit 586 also controls the output image generation unit 588 to update the screen displayed in the display area 142. Since the viewing area 360 does not exist on the updated screen, all of the presented information arranged in the display area 142 can be automatically concealed. Note that at least a portion of the presented information (for example, high-value presented information described below) may be automatically concealed.

In yet another embodiment, when the user terminal 120 has multiple display areas 142, the leak prevention support unit 586 decides not to set a viewing area 360 for displays other than the main display (sometimes referred to as sub-displays). This allows at least a portion of the presented information (e.g., high-value presented information, which will be described later) displayed on the sub-display to be automatically concealed.

For example, when the control device 170 outputs an image to a display built into the housing 130 of the user terminal 120 and to a projector connected to the user terminal 120, a viewing area 360 is set in the image output to the display, and a viewing area 360 is not set in the image output to the projector. As a result, for example, in the image displayed on the display, the presented information arranged inside the viewing area 360 is not concealed. On the other hand, for example, in the image projected onto the screen by the projector, all presented information is concealed.

In yet another embodiment, when the user terminal 120 has a plurality of display areas 142, the leak prevention support unit 586 monitors whether or not a user input is detected for each of the plurality of display areas 142. When the length of a period during which no user input is detected for at least one display area 142 exceeds a predetermined value, the leak prevention support unit 586 decides to cancel the setting of the viewing area 360 in the above display area 142. In addition, the leak prevention support unit 586 updates the screen displayed in the above display area 142, and displays a screen on which the concealment process has been performed in the display area 142. As a result, for example, at least a portion of the presented information (e.g., high-value presented information described later) displayed on a display on which no user input is detected for a relatively long period of time can be automatically concealed.

In yet another embodiment, the leak prevention support unit 586 may transmit the contents of the concealed presentation information by voice. The leak prevention support unit 586 may also transmit the reason why the presentation information is concealed by voice. The leak prevention support unit 586 may output the audio information via a directional speaker, earphones, or headphones arranged on the user terminal 120.

In this embodiment, the output image generation unit 588 generates an image in which at least a portion of the original image 200 generated by the original image generation unit 560 has been subjected to anonymization processing by the anonymization processing unit 584. The output image generation unit 588 may generate an image in which at least a portion of the original image 200 generated by the original image generation unit 560 has been subjected to assistance processing by the leak prevention assistance unit 586. The output image generation unit 588 may generate an image in which at least a portion of the original image 200 generated by the original image generation unit 560 has been subjected to anonymization processing by the anonymization processing unit 584 and assistance processing by the leak prevention assistance unit 586.

As a result, an output image 300 is generated. The output image generation unit 588 controls the operation of the display device 140 to display the generated output image 300 in the display area 142. Note that the user terminal 120 may output an image to the display device 140, which presents information to the user of the user terminal 120, and to a device other than the display device 140 (sometimes referred to as an other device). In this case, it may be that the other device does not require information to be kept confidential.

Therefore, in one embodiment, when the user terminal 120 outputs an image to the other device described above in response to an explicit instruction from the user, the output image generating unit 588 may output the original image 200 instead of the output image 300. The user terminal 120 may include a first memory (sometimes referred to as a VRAM) for storing the output image 300, and a second memory (sometimes referred to as a VRAM) that is different from the first memory and for storing the original image 200.

In another embodiment, when the user terminal 120 outputs an image to the other device in response to an explicit instruction from the user, the output image generating unit 588 may output an image with a lower degree of concealment to the other device compared to the output image 300 output to the display device 140. The user terminal 120 may include a first memory (sometimes referred to as a VRAM) for storing the image to be output to the display device 140, and a second memory (sometimes referred to as a VRAM) that is different from the first memory and for storing the image to be output to the other device.

For example, when a screen capture process is performed in response to an instruction from a user, the output image generation unit 588 may control the operation of the display device 140 to display the original image 200. Similarly, when a screen sharing process or desktop sharing process is performed in response to an instruction from a user, the output image generation unit 588 may control the operation of the display device 140 to display the original image 200.

The input control unit 540 may be an example of a work position identification unit. The output control unit 550 may be an example of an image generation device or an information processing device. The original image generation unit 560 may be an example of an image generation device. The image processing unit 580 may be an example of an information processing device.

Figure 6 shows an example of the internal structure of the value map generator 582. In this embodiment, the value map generator 582 includes a high value area determiner 622 and a value determiner 624.

In this embodiment, the high value area determination unit 622 analyzes the original image 200 and determines the range of an area (sometimes referred to as a high value area) in the original image 200 that contains the presented information. The high value area determination unit 622 may determine the range of the high value area in the original image 200 using known pattern recognition technology, image recognition technology, and/or natural language processing technology.

Examples of the range of a high value area include the position, shape, and size of a high value area in the original image 200. By determining the range of one or more high value areas contained in the original image 200, the original image 200 is divided into a plurality of sections. Note that even if the original image 200 contains only one high value area, it may be divided into two sections: the high value area and an area other than the high value area.

Examples of the presented information include at least one selected from the group consisting of a character string, a picture, a diagram, a table, a photograph, a video, and parts of these. Examples of parts of a character string include proper nouns, verbs, subjects of the verbs, and objects of the verbs contained in the character string. Examples of parts of a picture, photograph, or video include a person's face.

In this embodiment, the value determination unit 624 determines the value of the presented information contained in at least one of the high value areas. For example, for at least one high value area included in the original image 200, the value determination unit 624 derives the value of the presented information contained in each high value area based on at least one of (a) the type of presented information contained in each high value area, (b) the operation history of the pointing device by the user in each high value area, (c) the tracking history of the user's gaze in each high value area, (d) the flag assigned to the window to which each high value area belongs, (e) the type of application that displays information in the window to which each high value area belongs, and (f) the URI of the information displayed in the window to which each high value area belongs.

The value determination unit 624 may determine the value of each piece of presented information based on the type of each piece of presented information. The value determination unit 624 determines the value of the presented information included in each high value area based on, for example, a score that is predetermined for each type of presented information. Examples of the type of presented information include a character string, a picture, a diagram, a table, a photograph, and a video. The type of presented information may be a proper noun, a verb, a subject of the verb, an object of the verb, a human face, and the like.

The value determination unit 624 may determine the value of each piece of presented information based on the type of pointing device operation performed on each piece of presented information. The value determination unit 624 determines the value of the presented information included in each high value area based on, for example, a predetermined score for each operation of the pointing device by the user.

For example, presented information included in an area where the frequency of user click operations is greater than a predetermined value is presumed to be information of high value to the user. Similarly, presented information included in an area selected by a user's drag operation is presumed to be information of high value to the user. By assigning a score to each operation of the pointing device by the user, information of high value to the user can be extracted.

The value determination unit 624 determines the value of the presented information contained in each high-value area based on, for example, the length of time the user's gaze dwells on the area. For example, presented information contained in an area where the user's gaze dwells for a long time is estimated to be information of high value to the user.

The value determination unit 624 may determine the value of the presented information contained in a window based on the type of flag assigned to the window. The value determination unit 624 determines the value of the presented information contained in each window, for example, based on a predetermined score for each of the above flags. For example, information displayed in a window that has been assigned a flag such as no copying or no screenshots is presumed to be highly valuable to the user.

The value determination unit 624 may determine the value of the presented information included in a window based on the type of application that displays information in the window. The value determination unit 624 determines the value of the presented information included in each window based on, for example, a score that is predetermined for each of the above types of applications.

For example, information displayed by a calculator application program is presumed to be of low value to the user. On the other hand, information displayed by a spreadsheet, presentation, or document creation application program is presumed to be of high value to the user.

The value determination unit 624 may determine the value of the presented information contained in a window based on the URI of the information displayed in the window. The value determination unit 624 determines the value of the presented information contained in each window, for example, based on a score that is predetermined for each of the above-mentioned URIs. For example, information posted on a website published on the Internet is estimated to be less valuable than information on an intranet.

In this embodiment, the value determination unit 624 may generate the value map described above. The value map stores, for example, information indicating the range occupied by each of one or more high value areas included in the original image 200 and information indicating the value of the presented information included in each of the one or more high value areas in association with each other. Details of the value map will be described later.

The high value area determination unit 622 may be an example of a division unit. The value determination unit 624 may be an example of a value derivation unit. At least one of the one or more high value areas may be an example of at least a portion of a plurality of sections. The presented information included in each high value area may be an example of information included in each section.

Figure 7 shows an example of the data structure of data table 700. Data table 700 may be an example of the value map described above. Data table 700 is generated, for example, by value map generator 582 and stored in setting information storage unit 520.

In this embodiment, the data table 700 includes one or more records corresponding to one or more high value areas. Each of the one or more records stores, in association with each other, an area ID 722 that is identification information of a specific high value area, information indicating an area 724 that the specific high value area occupies in the original image 200, and information indicating a value 726 of the presented information included in the specific high value area. In this embodiment, the area 724 that the specific high value area occupies is represented, for example, by the position of a representative point of the high value area in the original image 200 and the shape and size of the high value area.

Figure 8 shows an example of the internal configuration of the anonymization processing unit 584. In this embodiment, the anonymization processing unit 584 includes a mode determination unit 820, a viewing area determination unit 832, a viewing level determination unit 834, an anonymization area determination unit 842, and an anonymization mode determination unit 844.

In this embodiment, the mode determination unit 820 determines the operation mode for the object of anonymization described above. As described above, examples of the operation mode for the object of anonymization include (a) a mode in which the anonymization process is performed in principle, and the anonymization process is not performed exceptionally in an area estimated to be necessary for the user's work, and (b) a mode in which the anonymization process is not performed in principle, and the anonymization process is performed exceptionally in an area estimated to be viewed by a person other than the user who is present near the display area 142.

In one embodiment, the mode determination unit 820 determines the operation mode based on the setting information stored in the setting information storage unit 520. In another embodiment, the mode determination unit 820 determines the operation mode based on an instruction from an administrator or user of the user terminal 120.

In this embodiment, the viewing area determination unit 832 determines one or more viewing areas 360. For example, the viewing area determination unit 832 first identifies a specific position of the original image 200 as the above-described viewing position 362. Specifically, the viewing area determination unit 832 identifies the viewing position 362 based on (i) the position or range of the user's input and/or (ii) the position or range of the user's line of sight.

In one embodiment, the viewing area determination unit 832 acquires information indicating the position or range of the user's input from the operation information acquisition unit 576. Examples of the position or range of the user's input include the position of the pointer or cursor in the original image 200, and the range dragged in the original image 200. The viewing area determination unit 832 identifies the position or range of the input as the viewing position 362. As described above, the position or range of the user's input may be an example of a position or range specified by the user.

In another embodiment, the viewing area determination unit 832 obtains, for example, from the window control unit 534, information indicating the position or range of a window used in connection with input by the user. Examples of windows used in connection with input include various windows corresponding to an input assistance program or an input method editing program (sometimes referred to as an IME). The viewing area determination unit 832 identifies the position or range of the above-mentioned window as the viewing position 362. The position or range of a window used in connection with input may be an example of a position or range specified by the user.

In yet another embodiment, the viewing area determination unit 832 acquires information indicating the position or range of the user's gaze in the original image 200 from the gaze information acquisition unit 574. The viewing area determination unit 832 identifies the above-mentioned gaze position or range as the viewing position 362. As described above, the user's gaze position or range may be an example of a position or range referenced by the user.

Next, the viewing area determination unit 832 determines a specific range including the viewing position 362 as the viewing area 360. The viewing area determination unit 832 may determine the range of the viewing area 360 based on the value of the presented information arranged in the vicinity of the viewing position 362. For example, the viewing area determination unit 832 determines the range of the viewing area 360 such that the greater the value of the presented information, the smaller the size of the viewing area 360.

For example, if the viewing position 362 is the position of a pointer or cursor, the viewing position 362 indicates a specific position on the original image 200. In this case, the viewing area determination unit 832 may determine the range of the viewing area 360 based on the value of the presented information contained in the high-value area that includes the viewing position 362. For example, if the viewing position 362 is a dragged range, the viewing position 362 indicates a specific range on the original image 200. In this case, the viewing area determination unit 832 may determine the range of the viewing area 360 based on the value of the information contained in the viewing position 362.

The viewing area determination unit 832 may determine the range of the viewing area 360 based on the operation history of the pointing device by the user and/or the tracking history of the user's gaze. Examples of the range of the viewing area 360 include the shape, size, etc.

For example, the viewing area determination unit 832 determines whether the viewing position 362 is part of a horizontally written document or part of a vertically written document based on the user's pointing device operation history and/or the user's gaze tracking history. If the viewing position 362 is determined to be part of a horizontally written document, the viewing area determination unit 832 may determine the range of the viewing area 360 so that the shape of the viewing area 360 is horizontally long. If the viewing position 362 is determined to be part of a vertically written document, the viewing area determination unit 832 may determine the range of the viewing area 360 so that the shape of the viewing area 360 is vertically long.

For example, the viewing area determination unit 832 determines the user's input or line of sight movement speed based on the user's pointing device operation history and/or the user's line of sight tracking history. The viewing area determination unit 832 may adjust the range of the viewing area 360 based on at least one of the user's input or line of sight movement direction and movement speed.

For example, the viewing area determination unit 832 adjusts the range of the viewing area 360 so that the size of the viewing area 360 increases as the user's input or line of sight movement speed increases. The viewing area determination unit 832 may adjust the range of the viewing area 360 so that the length from the viewing position 362 to the end on the movement direction side is greater than the length from the viewing position 362 to the end on the opposite side to the movement direction.

The viewing area determination unit 832 may adjust the range of the viewing area 360 so that the viewing area 360 does not interfere with the user's operation of the pointing device. For example, the viewing area determination unit 832 adjusts the range of the viewing area 360 so that at least one of the one or more viewing areas 360 is positioned at the position of the pointer or cursor described above. This prevents the pointer or cursor from being covered by an object for concealing the presented information. As a result, the above-mentioned object is prevented from interfering with the user's input operation.

In this embodiment, the viewing level determination unit 834 determines, for each of one or more viewing areas 360, the degree to which it is estimated that the user needs to view that area in order to continue working (sometimes referred to as the viewing level). In one embodiment, the viewing level determination unit 834 may determine that all viewing areas 360 extracted by the viewing area determination unit 832 have the same viewing level. The viewing level determination unit 834 may determine that areas not extracted as viewing areas 360 by the viewing area determination unit 832 have a lower degree of the above compared to the viewing areas 360.

In another embodiment, the viewing level determination unit 834 may determine the viewing level of each of the one or more viewing areas 360 based on the user's operation history of the pointing device and/or the tracking history of the user's gaze. For example, the viewing level determination unit 834 determines the viewing level of each of the one or more viewing areas 360 such that the longer the dwell time of the pointer or cursor or the user's gaze is, the higher the viewing level is.

In this embodiment, the concealment area determination unit 842 determines an area to be concealed in the original image 200 (sometimes referred to as a concealment area). The concealment area determination unit 842 determines the range of the concealment area based on, for example, the value derived by the value determination unit 624 and the viewing position 362 or the viewing area 360 identified by the viewing area determination unit 832.

When the purpose is to prevent information leakage, it is desirable to conceal areas with a large value derived by the value determination unit 624 (for example, high-value areas). Furthermore, it is desirable that the greater the value derived by the value determination unit 624, the stronger the concealment. On the other hand, the smaller the degree of concealment within the viewing area 360, the greater the convenience for the user. The concealment area determination unit 842 determines the concealment area by taking into account the balance between these two.

In one embodiment, the concealment area determination unit 842 determines that concealment is to be applied to at least high-value areas located outside the range of the viewing area 360. In another embodiment, the concealment area determination unit 842 determines that concealment is to be applied to at least high-value areas located outside the range of the viewing area 360, the high-value areas having a value greater than a predetermined first degree.

In yet another embodiment, if the viewing area 360 includes a high-value area, the anonymization area determination unit 842 determines that at least the high-value area is to be anonymized. The anonymization area determination unit 842 may determine that other areas within the viewing area 360 are not to be anonymized.

In yet another embodiment, if the viewing area 360 includes a high-value area whose value is greater than a second predetermined degree, the anonymization area determination unit 842 determines that at least the high-value area is to be anonymized. The anonymization area determination unit 842 may determine that other areas within the viewing area 360 are not to be anonymized.

In yet another embodiment, if the viewing area 360 does not include a high-value area whose value is greater than a predetermined second degree, the anonymization area determination unit 842 determines that the viewing area 360 is not anonymized. The second degree may be greater than the first degree described above.

In this embodiment, the concealment mode determination unit 844 determines the mode of concealment to be applied to each of one or more concealment regions. As described above, examples of the concealment mode include the type or method of concealment processing, the strength of the concealment processing, etc.

In one embodiment, the anonymization mode determination unit 844 determines the anonymization mode in each anonymization area based on the value of the presented information included in each anonymization area. The anonymization mode determination unit 844 may obtain the value of the presented information included in each anonymization area by referring to the value map generated by the value map generation unit 582.

The anonymization mode determination unit 844 determines the anonymization mode in each anonymization area so that, for example, the greater the value of the presented information, the lower the visibility of the anonymization method that is adopted. The anonymization mode determination unit 844 determines the anonymization mode in each anonymization area so that, for example, the greater the value of the presented information, the stronger the anonymization process.

In another embodiment, the concealment mode determination unit 844 may adjust the display mode of the presented information displayed within the viewing area 360. For example, if the user attempts to view the display area 142 while hiding it with his or her body, the distance between the user and the display area 142 becomes closer. Therefore, even if the presented information displayed in the display area 142 is made smaller, the user can still recognize the presented information. On the other hand, it becomes difficult for people other than the user who are present around the display area 142 to recognize the presented information.

More specifically, the anonymization mode determination unit 844 adjusts the display mode of the presented information displayed within the viewing area 360 based on the distance between the user and the display area 142. For example, the anonymization mode determination unit 844 acquires data output by the distance sensor 152. This allows the anonymization mode determination unit 844 to acquire information indicating the distance between the user and the display area 142. When the distance between the user and the display area 142 becomes smaller than a predetermined value, the anonymization mode determination unit 844 detects the user's approach to the display area 142. When the user's approach to the display area 142 is detected, the anonymization mode determination unit 844 determines to reduce the size of at least one selected from the group consisting of character strings, pictures, figures, tables, photographs, and videos, and parts of these, contained within the viewing area 360.

In this case, the anonymization mode determination unit 844 may determine the size of the presentation information presented inside the viewing area 360 based on the distance between the user and the display area 142. The anonymization mode determination unit 844 may determine the size of the presentation information presented inside the viewing area 360 using a continuous function that is inversely proportional to the above distance. Note that the calculation of the above distance is not limited to a method using the distance sensor 152. In other embodiments, the anonymization mode determination unit 844 may estimate the above distance using the size of a bounding box of the user's face detected by face detection technology using a monocular camera and the size of a standard human face.

When a user attempts to view the display area 142 while hiding it with their body, the distance between the user and the display area 142 becomes closer. This makes it difficult for people other than the user who are in the vicinity of the display area 142 to peek at the information presented in the display area 142. Thus, when the user's approach to the display area 142 is detected, the anonymization mode determination unit 844 may determine to (i) increase the size of at least one selected from the group consisting of character strings, pictures, diagrams, tables, photographs, and videos, and parts of these, contained within the viewing area 360, and/or (ii) increase the range of the viewing area 360.

In another specific example of adjusting the display mode of the presented information displayed within the viewing area 360, the anonymization mode determination unit 844 adjusts the display mode of the presented information displayed within the viewing area 360 based on the number of people present around the display area 142. For example, the anonymization mode determination unit 844 acquires information acquired by the environmental sensor 150 (e.g., image data of an image captured by the camera 154). The anonymization mode determination unit 844 analyzes the information using a known face detection technique to detect a human face. This allows the anonymization mode determination unit 844 to determine the number of people present around the display area 142.

The anonymization mode determination unit 844 determines the size of the presentation information to be presented inside the viewing area 360, for example, based on the number of people present around the display area 142 or the number of detected human faces. The anonymization mode determination unit 844 may determine the size of the presentation information to be presented inside the viewing area 360 using a continuous function proportional to the number of people or faces.

In yet another specific example of adjusting the display mode of the presented information displayed within the viewing area 360, the anonymization mode determination unit 844 adjusts the display mode of the presented information displayed within the viewing area 360 based on the distance between the user and the display area 142 and the number of people present around the display area 142. The anonymization mode determination unit 844 determines the size of the presented information presented within the viewing area 360 based on, for example, the distance between the user and the display area 142 and the number of people present around the display area 142. The anonymization mode determination unit 844 may determine the size of the presented information presented within the viewing area 360 using a continuous function that is inversely proportional to the distance and proportional to the number of people or faces.

The viewing area determination unit 832 may be an example of a work position identification unit or a work area determination unit. The concealment area determination unit 842 may be an example of a target area determination unit or a proximity detection unit. The high value area may be an example of a section whose value is greater than a predetermined first degree. The high value area included within the viewing area 360 may be an example of a section whose value is greater than a predetermined second degree.

(An example of another embodiment)
In this embodiment, the details of the information leakage prevention system 100 have been described by taking as an example a case in which the anonymization processing unit 584 determines the anonymization area and/or the anonymization mode by referring to the value map generated by the value map generating unit 582. However, the method of using the value map is not limited to this embodiment.

In another embodiment, the value map is used to emphasize and present information that is highly valuable to the user. For example, the control device 170 has an operating mode for highlighting information that is highly valuable to the user. The control device 170 uses the value map to extract presented information that has a value exceeding a predetermined standard. The control device 170 generates a display image in which the extracted presented information is emphasized more than other information. The control device 170 generates the display image by, for example, adjusting the color, pattern, size, font, brightness, contrast, and/or animation or movement of the extracted presented information. The control device 170 controls the display device 140 to display the generated image in the display area 142.

Figure 9 shows an example of the data structure of the data table 900. The data table 900 stores various information related to each of the one or more viewing areas 360. The data table 900 is generated by, for example, the anonymization processing unit 584 and stored in the setting information storage unit 520.

In this embodiment, the data table 900 includes one or more records corresponding to one or more viewing areas 360. Each of the one or more records stores, in association with each other, an area ID 922 that is identification information of a specific viewing area 360, information indicating an area 924 that the specific viewing area 360 occupies in the original image 200, and information indicating a viewing level 926 of the specific viewing area 360. In this embodiment, the area 924 that the specific viewing area 360 occupies is represented, for example, by the position of a representative point of the viewing area 360 in the original image 200 and the shape and size of the viewing area 360.

Figure 10 shows an example of the data structure of the data table 1000. The data table 1000 stores various settings related to the anonymization process. The data table 1000 is stored, for example, in the setting information storage unit 520. The data table 1000 is used, for example, to determine the anonymization area in the anonymization area determination unit 842. The data table 1000 is used, for example, to determine the anonymization mode in the anonymization mode determination unit 844.

As described above, it is preferable that anonymization be applied to areas where the presented information is highly valuable (e.g., high-value areas). On the other hand, it is preferable that anonymization is not applied or that the strength of anonymization is weak in the viewing area.

The data table 1000 stores information for specifying whether or not anonymization processing is required 1026, depending on the combination of the value level 1022 of the presented information and the viewing level 1024 at the position where the presented information is located. Similarly, the data table 1000 stores information for specifying the mode of anonymization 1028, depending on the combination of the value level 1022 of the presented information and the viewing level 1024 at the position where the presented information is located.

For example, when the value level of a particular presented information is at its maximum, the particular presented information is anonymized regardless of the viewing level at the position where the particular presented information is located. In addition, in order to reliably prevent leakage of the particular presented information, the manner of anonymization is determined so that the particular presented information is not disclosed at all.

For example, if the value level of a particular presentation information is at a minimum, then the specific presentation information is not anonymized regardless of the viewing level at the location where the specific presentation information is placed. For example, if the viewing level at the location where the specific presentation information is placed is at a maximum, then the specific presentation information is not anonymized regardless of the value of the specific presentation information.

Figure 11 shows an example of information processing in the leak prevention support unit 586. According to this embodiment, an overview of the processing for encouraging the user to take a specific action to prevent information leakage is explained using an example in which a person 24 other than the user 22 of the user terminal 120 is present behind the user 22.

In this embodiment, the person 24 is located to the left and behind the user 22. Therefore, when the user 22 rotates the user terminal 120 horizontally in a clockwise direction, the person 24 can easily view the display area 142. On the other hand, when the user 22 rotates the user terminal 120 horizontally in a counterclockwise direction, it becomes difficult for the person 24 to view the display area 142.

Therefore, according to this embodiment, the leakage prevention support unit 586 controls the output image generation unit 588 to display the guidance image 1118 in a part of the display area 142, thereby controlling the user's behavior. Specifically, the leakage prevention support unit 586 adjusts the display position of the guidance image 1118 to encourage the user to rotate the user terminal 120 horizontally counterclockwise. In this way, the leakage prevention support unit 586 can use the guidance image 1118 to encourage the user to change the horizontal orientation of the user terminal 120.

The leakage prevention support unit 586 first acquires data of the image captured by the camera 154. The leakage prevention support unit 586 analyzes the image captured by the camera 154 to determine whether or not two or more people are present around the display area 142. If two or more people are present around the display area 142, the leakage prevention support unit 586 identifies the relative positional relationship between the people. Based on the relative positional relationship between the objects, the leakage prevention support unit 586 determines the rotation direction of the user terminal 120 in which information leakage is further suppressed. As described above, in this embodiment, information leakage is further suppressed by rotating horizontally counterclockwise.

The leak prevention support unit 586 controls the output image generation unit 588 to output the image 1102 to the display area 142. In the image 1102, a portion of the right side of the image output area 214 is covered by the guidance image 1118. This allows the leak prevention support unit 586 to prompt the user to rotate the user terminal 120 counterclockwise.

When the user rotates the user terminal 120 counterclockwise, the leakage prevention support unit 586 controls the output image generation unit 588 to output the image 1104 in the display area 142. The guidance image 1118 is not displayed in the image 1104, and the user can continue working as usual.

On the other hand, when the user rotates the user terminal 120 clockwise, the leakage prevention support unit 586 controls the output image generation unit 588 to output the image 1106 to the display area 142. A larger portion of the image 1106 is covered by the guidance image 1118 compared to the image 1102. This allows the leakage prevention support unit 586 to prompt the user to rotate the user terminal 120 counterclockwise.

Figure 12 shows an outline of another example of information processing in the leak prevention support unit 586. According to this embodiment, an overview of processing for automatically adjusting the range of the viewing area 360 is described.

According to this embodiment, at time ta, the viewing area 360 is located at the bottom right edge of the image output area 214. Therefore, the leakage prevention support unit 586 decides to gradually move the position of the viewing area 360 closer to the center of the display area 142. As the viewing area 360 moves, the leakage prevention support unit 586 also moves the position of the window 240 corresponding to the viewing area 360.

According to this embodiment, the leak prevention support unit 586 controls the output image generation unit 588 so that, for example, the image output area 214 of the window 240 and the viewing area 360 moves from the lower right edge to the lower center from time ta to time tb. Similarly, the leak prevention support unit 586 controls the output image generation unit 588 so that the window 240 and the viewing area 360 moves from the lower center to the center from time tb to time tc.

(An example of another embodiment)
In the present embodiment, an overview of the process for automatically adjusting the range of viewing area 360 has been described by taking as an example a case in which the range of viewing area 360 is automatically adjusted by automatically moving the position of viewing area 360. However, the process for automatically adjusting the range of viewing area 360 is not limited to the present embodiment.

In other embodiments, the anonymization processing unit 584 or the leak prevention support unit 586 may adjust the range of the viewing area 360 taking into account the display delay associated with the anonymization process. As described above, according to the user terminal 120 of this embodiment, the range of the viewing area 360 also changes as the position of the presentation information itself to be anonymized moves. For example, when a part of a video being played is anonymized, or when a part of a document being edited is anonymized, the position of the presentation information to be anonymized changes.

The anonymization processing unit 584 or the leakage prevention support unit 586, for example, first estimates a movement vector of the presentation information to be anonymized. In addition, the anonymization processing unit 584 or the leakage prevention support unit 586 estimates a display delay time. Next, the anonymization processing unit 584 or the leakage prevention support unit 586 estimates the position of the presentation information to be anonymized at the time when the delay time has elapsed based on the movement vector and the delay time. Based on the estimated position, the anonymization processing unit 584 or the leakage prevention support unit 586 determines the range of the viewing area 360 or the range in which the anonymization object is to be superimposed.

The above movement vector is determined, for example, by identifying an instance of an object through image recognition and estimating the movement vector at two times. The above movement vector is derived, for example, by inferring the matching coordinate transformation matrix RT or the coordinate transformation matrix RT with the smallest deviation based on the gradation gradient state in a BOX range of a certain image RECT unit (rectangle) at two times.

Figure 13 shows a schematic diagram of another example of a method for dividing the original image 200. In this embodiment, the image output area 214 is divided into a plurality of unit areas 1310. The plurality of unit areas 1310 have, for example, the same shape and size.

In this embodiment, the high value area determination unit 622 may determine whether each of the multiple unit areas 1310 corresponds to a high value area. The value determination unit 624 may determine the value of the presented information contained within each of the multiple unit areas 1310.

According to another embodiment, the value determination unit 624 first determines the value of the presented information contained within each of the multiple unit areas 1310. Next, the high value area determination unit 622 determines whether each of the multiple unit areas 1310 is a high value area based on the value of each of the multiple unit areas 1310.

In this embodiment, the viewing area determination unit 832 may determine whether or not each of the multiple unit areas 1310 corresponds to a viewing area. The viewing level determination unit 834 may determine a viewing level for each of the multiple unit areas 1310. The viewing level determination unit 834 may determine a viewing level for an area of the multiple unit areas 1310 that is determined to correspond to a viewing area.

In this embodiment, the concealment area determination unit 842 may determine, for each of the multiple unit areas 1310, whether or not the area corresponds to a concealment area. The concealment mode determination unit 844 may determine the concealment mode for each of the multiple unit areas 1310. The concealment mode determination unit 844 may determine the concealment mode for an area among the multiple unit areas 1310 that is determined to correspond to a concealment area.

The unit area 1310 may be an example of a partition.

Figure 14 shows an example of a computer 3000 in which multiple aspects of the present invention may be embodied in whole or in part. At least a part of the information leakage prevention system 100 may be realized by the computer 3000. For example, at least a part of the user terminal 120 is realized by the computer 3000 or a part thereof. For example, at least a part of the user terminal 120 and the control device 170 are realized by the computer 3000 or a part thereof.

A program installed on the computer 3000 may cause the computer 3000 to function as or perform operations associated with an apparatus according to an embodiment of the present invention or one or more "parts" of the apparatus, and/or to perform a process or steps of the process according to an embodiment of the present invention. Such a program may be executed by the CPU 3012 to cause the computer 3000 to perform certain operations associated with some or all of the blocks of the flowcharts and block diagrams described herein.

The computer 3000 according to this embodiment includes a CPU 3012, a RAM 3014, a GPU 3016, and a display device 3018, which are interconnected by a host controller 3010. The computer 3000 also includes input/output units such as a communication interface 3022, a hard disk drive 3024, a DVD-ROM drive 3026, and an IC card drive, which are connected to the host controller 3010 via an input/output controller 3020. The computer also includes legacy input/output units such as a ROM 3030 and a keyboard 3042, which are connected to the input/output controller 3020 via an input/output chip 3040.

The CPU 3012 operates according to the programs stored in the ROM 3030 and the RAM 3014, thereby controlling each unit. The GPU 3016 acquires image data generated by the CPU 3012 into a frame buffer or the like provided in the RAM 3014 or into itself, and causes the image data to be displayed on the display device 3018.

The communication interface 3022 communicates with other electronic devices via a network. The hard disk drive 3024 stores programs and data used by the CPU 3012 in the computer 3000. The DVD-ROM drive 3026 reads programs or data from the DVD-ROM 3001 and provides the programs or data to the hard disk drive 3024 via the RAM 3014. The IC card drive reads programs and data from an IC card and/or writes programs and data to an IC card.

The ROM 3030 stores therein a boot program or the like that is executed by the computer 3000 upon activation, and/or a program that depends on the hardware of the computer 3000. The input/output chip 3040 may also connect various input/output units to the input/output controller 3020 via a parallel port, a serial port, a keyboard port, a mouse port, etc.

The programs are provided by a computer-readable storage medium such as a DVD-ROM 3001 or an IC card. The programs are read from the computer-readable storage medium, installed in the hard disk drive 3024, RAM 3014, or ROM 3030, which are also examples of computer-readable storage media, and executed by the CPU 3012. The information processing described in these programs is read by the computer 3000, and brings about cooperation between the programs and the various types of hardware resources described above. An apparatus or method may be constructed by realizing the operation or processing of information in accordance with the use of the computer 3000.

For example, when communication is performed between computer 3000 and an external device, CPU 3012 may execute a communication program loaded into RAM 3014 and instruct communication interface 3022 to perform communication processing based on the processing described in the communication program. Under the control of CPU 3012, communication interface 3022 reads transmission data stored in a transmission buffer area provided in RAM 3014, hard disk drive 3024, DVD-ROM 3001, or a recording medium such as an IC card, and transmits the read transmission data to the network, or writes received data received from the network to a reception buffer area or the like provided on the recording medium.

The CPU 3012 may also cause all or a necessary portion of a file or database stored on an external recording medium such as the hard disk drive 3024, the DVD-ROM drive 3026 (DVD-ROM 3001), an IC card, etc. to be read into the RAM 3014, and perform various types of processing on the data on the RAM 3014. The CPU 3012 may then write back the processed data to the external recording medium.

Various types of information, such as various types of programs, data, tables, and databases, may be stored on the recording medium and may undergo information processing. The CPU 3012 may perform various types of processing on the data read from the RAM 3014, including various types of operations, information processing, conditional judgment, conditional branching, unconditional branching, information search/replacement, etc., as described throughout this disclosure and specified by the instruction sequence of the program, and writes back the results to the RAM 3014. The CPU 3012 may also search for information in a file, database, etc. in the recording medium. For example, when multiple entries each having an attribute value of a first attribute associated with an attribute value of a second attribute are stored in the recording medium, the CPU 3012 may search for an entry whose attribute value of the first attribute matches a specified condition from among the multiple entries, read the attribute value of the second attribute stored in the entry, and thereby obtain the attribute value of the second attribute associated with the first attribute that satisfies a predetermined condition.

The above-described program or software module may be stored in a computer-readable storage medium on the computer 3000 or in the vicinity of the computer 3000. In addition, a recording medium such as a hard disk or RAM provided in a server system connected to a dedicated communication network or the Internet can be used as a computer-readable storage medium, thereby providing the above-described program to the computer 3000 via the network.

Although the present invention has been described above using an embodiment, the technical scope of the present invention is not limited to the scope described in the above embodiment. It is clear to those skilled in the art that various modifications or improvements can be made to the above embodiment. Furthermore, the details described for a specific embodiment can be applied to other embodiments to the extent that they are not technically inconsistent. It is clear from the claims that such modifications or improvements can also be included in the technical scope of the present invention.

The order of execution of each process, such as operations, procedures, steps, and stages, in the devices, systems, programs, and methods shown in the claims, specifications, and drawings is not specifically stated as "before" or "prior to," and it should be noted that the processes may be performed in any order, unless the output of a previous process is used in a later process. Even if the operational flow in the claims, specifications, and drawings is explained using "first," "next," etc. for convenience, it does not mean that it is necessary to perform the processes in this order.

For example, the present specification discloses the following:
(Item A)
An information processing device that conceals a part of a generated image generated by an image generating device and generates a display image to be displayed on an image display device,
a value derivation unit that derives a value of information included in each of at least a portion of the multiple sections set in the generated image;
a work position identification unit that identifies a work position, which is one or more positions or ranges arranged in a part of the generated image, and which is (i) a position or range of an input by a user of the image display device and/or (ii) a position or range of the user's line of sight;
a target area determination unit that determines a target area, which is an area to be concealed, based on the value derived by the value derivation unit and the work position identified by the work position identification unit;
An information processing device comprising:
(Item B)
1. A method for generating a display image to be displayed on an image display device by concealing a part of a generated image generated by an image generating device, comprising:
A value derivation step of deriving a value of information contained in each of at least a portion of the multiple sections set in the generated image;
a work position identification step of identifying one or more positions or ranges arranged in a part of the generated image, the work position being (i) a position or range of an input by a user of the image display device and/or (ii) a position or range of the user's line of sight;
a target area determination step of determining a target area, which is an area to be concealed, based on the value derived by the value derivation unit and the work position identified in the work position identification step;
The method comprising:

For example, the present specification discloses the following:
(Item B-1)
An information processing device that conceals a part of a generated image generated by an image generating device and generates a display image to be displayed on an image display device,
A division unit that divides the generated image into a plurality of partitions;
a value derivation unit that derives a value of information included in each of the plurality of sections for at least a portion of the sections;
a work position identification unit that identifies a work position, which is one or more positions or ranges arranged in a part of the generated image, and which is (i) a position or range of an input by a user of the image display device and/or (ii) a position or range of the user's line of sight;
a target area determination unit that determines a target area, which is an area to be concealed, based on the value derived by the value derivation unit and the work position identified by the work position identification unit;
An information processing device comprising:
(Item B-2)
A working area determination unit is further provided that is disposed in a part of the generated image and determines a working area that is an area including the working position,
The target region determination unit is
(a) determining that at least one of the plurality of sections is to be concealed, the section being located outside the range of the working area and having a value greater than a predetermined first degree;
(b) determining that the work area is not to be concealed if the work area does not include any of the plurality of areas whose value is greater than a second predetermined degree;
(c) when the working area includes a section among the plurality of sections whose value is greater than the second degree, determining that at least the section whose value is greater than the second degree is to be concealed;
The second degree is greater than the first degree.
The information processing device according to item B-1.
(Item B-3)
The work area determination unit determines a range of the work area based on the value derived by the value derivation unit, which is (i) a value of information included in a section including the work position among the plurality of sections, or (ii) a value of information included in the work position.
The information processing device according to item B-2.
(Item B-4)
and a mode determining unit that determines a mode of concealment of the target region based on the value derived by the value derivation unit, the value being a value of the information included in the target region.
The information processing device according to item B-1.
(Item B-5)
a proximity detection unit that detects the proximity of the user to the image display device when a distance between the user and the image display device becomes smaller than a predetermined value,
the mode determination unit determines, when the approach of the user to the image display device is detected, to reduce a size of at least one selected from the group consisting of a character string, a picture, a diagram, a table, a photograph, a video, and a part thereof included in the working area.
The information processing device according to item B-4.
(Item B-6)
The value derivation unit,
Deriving a value of the information contained in each partition based on at least one of (a) the type of information contained in each partition, (b) the user's pointing device operation history in each partition, (c) the user's gaze tracking history in each partition, (d) a flag assigned to the window to which each partition belongs, (e) the type of application that displays information in the window to which each partition belongs, and (f) the URI of the information displayed in the window to which each partition belongs, for at least a portion of the plurality of partitions.
The information processing device according to item B-1.
(Item B-7)
A program for causing a computer to function as the information processing device according to any one of items B-1 to B-6.
(Item B-8)
1. A method for generating a display image to be displayed on an image display device by concealing a part of a generated image generated by an image generating device, comprising:
A segmentation step in which a computer divides the generated image into a plurality of partitions;
A value derivation step in which the computer derives a value of information included in each of the plurality of sections for at least a portion of the plurality of sections;
A work position identification step in which the computer identifies a work position, which is one or more positions or ranges arranged in a part of the generated image, and which is (i) a position or range of an input by a user of the image display device and/or (ii) a position or range of the user's line of sight;
a target area determination step in which the computer determines a target area, which is an area to be concealed, based on the value derived by the value derivation unit and the work position identified in the work position identification step;
The method comprising:

22 User 24 Person 100 Information leakage prevention system 120 User terminal 130 Housing 140 Display device 142 Display area 150 Environmental sensor 152 Distance sensor 154 Camera 156 Radio wave detector 160 Input device 170 Control device 200 Original image 210 Window 212 Control area 214 Image output area 216 Presentation information 222 Object 224 Object 230 Window 232 Control area 234 Image output area 236 Presentation information 240 Window 242 Control area 244 Image output area 246 Presentation information 300 Output image 318 Object 326 Object 328 Object 338 Object 348 Object 360 Viewing area 362 Viewing position 520 Setting information storage unit 532 Program control unit 534 Window control unit 540 Input control unit 550 Output control unit 560 Original image generation unit 572 Window information acquisition unit 574 Line-of-sight information acquisition unit 576 Operation information acquisition unit 580 Image processing unit 582 Value map generation unit 584 Concealment processing unit 586 Leakage prevention support unit 588 Output image generation unit 622 High-value area determination unit 624 Value determination unit 700 Data table 722 Area ID
724 Range 726 Value 820 Mode determination unit 832 Viewing area determination unit 834 Viewing level determination unit 842 Concealment area determination unit 844 Concealment mode determination unit 900 Data table 922 Area ID
924 Range 926 Viewing level 1000 Data table 1022 Level 1024 Viewing level 1026 Necessity 1028 Mode 1102 Image 1104 Image 1106 Image 1118 Guidance image 1310 Unit area 3000 Computer 3001 DVD-ROM
3010 host controller 3012 CPU
3014 RAM
3016 GPU
3018 Display device 3020 Input/output controller 3022 Communication interface 3024 Hard disk drive 3026 DVD-ROM drive 3030 ROM
3040 Input/Output Chip 3042 Keyboard

Claims (6)

An information processing device that conceals a part of a generated image generated by an image generating device and generates a display image to be displayed on an image display device,
a work position specification unit that specifies a work position, which is one or more positions or ranges arranged in a part of the generated image and is a position or range designated or referenced by a user of the image display device;
A division unit that divides the generated image into a plurality of partitions;
a value derivation unit that derives a value of information included in each of the plurality of sections for at least a portion of the sections;
a target area determination unit that determines a target area, which is an area to be concealed, based on the value derived by the value derivation unit and the work position identified by the work position identification unit;
a work area determination unit that is disposed in a portion of the generated image and that determines a work area that is an area including the work position;
Equipped with
The target region determination unit is
(a) determining that at least one of the plurality of sections is to be concealed, the section being located outside the range of the working area and having a value greater than a predetermined first degree;
(b) determining that the work area is not to be concealed if the work area does not include any of the plurality of areas whose value is greater than a second predetermined degree;
(c) when the working area includes a section among the plurality of sections whose value is greater than the second degree, determining that at least the section whose value is greater than the second degree is to be concealed;
The second degree is greater than the first degree.
Information processing device. The work area determination unit determines a range of the work area based on the value derived by the value derivation unit, which is (i) a value of information included in a section including the work position among the plurality of sections, or (ii) a value of information included in the work position.
The information processing device according to claim 1 . and a mode determination unit that determines a mode of concealment of the target region based on the value derived by the value derivation unit, the value being a value of the information included in the target region.
The information processing device according to claim 1 . a proximity detection unit that detects the proximity of the user to the image display device when a distance between the user and the image display device becomes smaller than a predetermined value,
the mode determination unit determines, when the approach of the user to the image display device is detected, to reduce a size of at least one selected from the group consisting of a character string, a picture, a diagram, a table, a photograph, a video, and a part thereof included in the working area.
The information processing device according to claim 3 . A program for causing a computer to function as the information processing device according to any one of claims 1 to 4 . 1. A method for generating a display image to be displayed on an image display device by concealing a part of a generated image generated by an image generating device, comprising:
a work position identification step in which a computer identifies a work position, which is one or more positions or ranges located in a portion of the generated image and which is a position or range designated or referenced by a user of the image display device;
A segmentation step of dividing the generated image into a plurality of partitions;
A value derivation step of deriving a value of information contained in each of the plurality of sections for at least a portion of the plurality of sections;
a target area determination step in which the computer determines a target area, which is an area to be concealed, based on the value derived in the value derivation step and the work position identified in the work position identification step;
A working area determination step in which the computer determines a working area that is a region that is arranged in a part of the generated image and includes the working position;
having
The target region determination step includes:
(a) determining that at least one of the plurality of sections is to be concealed, the section being located outside the range of the working area and having a value greater than a predetermined first degree;
(b) determining that the work area is not to be concealed if the work area does not include any of the plurality of areas whose value is greater than a second predetermined degree;
(c) determining that, when a partition whose value is greater than the second degree is included among the plurality of partitions within the working area, concealment is to be applied to at least the partition whose value is greater than the second degree;
having
The second degree is greater than the first degree.
method .