JP6506099B2 - DATA MASKING DEVICE, DATA MASKING METHOD, AND COMPUTER PROGRAM - Google Patents

Description

  The present invention relates to data processing technology, and more particularly to data masking technology.

  The applicant has proposed a technique for suppressing deterioration in quality as test data for a document after masking personal information (see, for example, Patent Document 1). The data conversion device of Patent Document 1 replaces a character string indicating personal information to be masked with the hash value.

JP, 2013-246547, A

  The inventor considered that if the original character string can be inferred from the masked character string, the significance of the mask may be forfeited. Also, if character strings of multiple information items related to each other such as kanji surnames and kana surnames are masked in units of one item, the relevance between the information items is broken, and it is thought that the value as test data decreases. The The present invention has been made based on the above-mentioned problem recognition of the inventor, and a main object of the present invention is to provide a data masking technology for further enhancing the usefulness of a document after information masking.

  In order to solve the above problems, a data masking device according to an aspect of the present invention determines replacement strings of a plurality of information items based on a combination of original character strings of a plurality of information items recorded in the original data. A replacement character string determination unit, and a character string replacement unit that replaces original character strings of a plurality of information items recorded in the original data with replacement character strings determined by the replacement character string determination unit.

  Another aspect of the invention is a data masking method. This method comprises the steps of: determining a replacement character string of a plurality of information items based on a combination of original character strings of a plurality of information items recorded in the original data; and original text of a plurality of information items recorded in the original data. Replacing the string with the replacement string determined in the determining step, the data masking device performing.

  Note that any combination of the above-described components, and one obtained by converting the expression of the present invention between a system, a computer program, a recording medium storing a computer program, and the like are also effective as an aspect of the present invention.

  According to the present invention, the usefulness of the document after masking information can be further enhanced.

It is a figure showing composition of an information processing system of a 1st embodiment. It is a block diagram which shows the structure of the data masking apparatus of FIG. It is a figure which shows the conversion dictionary hold | maintained at the conversion dictionary holding part of 1st Embodiment. It is a figure which shows the conversion dictionary of a modification. It is a figure which shows the conversion dictionary hold | maintained at the conversion dictionary holding part of 2nd Embodiment. It is a figure which shows the conversion dictionary hold | maintained at the conversion dictionary holding part of 2nd Embodiment. It is a figure which shows the conversion dictionary of a modification. It is a figure which shows the conversion dictionary hold | maintained at the conversion dictionary holding part of 3rd Embodiment.

  Before describing the configuration of the information processing system of the embodiment, an outline of data masking of the embodiment will be described. Hereinafter, original document data before masking data is referred to as an original document, and document data after masking data is referred to as a conversion document. Also, it is a character string recorded in the original document, that is, an original character string as original data is called an original character string. In addition, a character string for replacing the original character string, that is, a character string recorded in place of the original character string in the converted document is called a replacement character string.

  Data masking in the embodiment is to replace the original character string in the original document with a different substitution character string. In addition, while maintaining the format of the data, it can also be said that the information content pointed to by the data is made invisible or concealed.

  The first problem recognized by the inventor in data masking will be described. As a method of masking personal information, a method of replacing an original character string with a random character string has been employed in the past. For example, the original character strings "Yamada", "Sasaki", and "Tanaka" relating to the surname of a person may be replaced with "Jee", "Roii", and "Yamaou", respectively. As another method, the original character string may be replaced with a fixed character string. For example, the original character strings "Yamada", "Sasaki" and "Tanaka" may be replaced with "Sato 01", "Sato 02" and "Sato 03", respectively.

  However, such a method does not maintain the integrity of the original string and the replacement string. For example, when "Jewe", "Say", and "Yamu" are set in the information item "surname" of the converted document, the user of the converted document intuitively recognizes that their character string is "surname". Hard to determine. When "Sato 01", "Sato 02" and "Sato 03" are set in the information item "surname" of the converted document, the user of the converted document may feel uncomfortable. In addition, when a test is performed on such a converted document, it may be difficult to determine whether the test result is correct.

  Such a problem may occur similarly when replacing an original character string with a hash character string. For example, since a hash value is set to the information item "surname" of the converted document, the user of the converted document may have difficulty in intuitively determining that those character strings are "surnames", and may be uncomfortable. . In addition, it may be difficult to determine whether the test result using the converted document is correct.

  As described above, when masking is performed using a random character string or a fixed character string, the quality from the viewpoint of using the converted document may be degraded. Therefore, as another method, a method of masking in accordance with some rules has been adopted. For example, a dictionary in which “Suzuki” is associated with “Mitamura”, “Sato” with “Moriya”, and “Kikuchi” with “Nakata” is provided, and the original character strings “Suzuki”, “Sato” and “Kikuchi” are each “Mitamura”. It sometimes replaced with "Moriya" and "Nakata".

  However, in this method, since character string replacement is performed according to a predetermined rule in the dictionary, there is a problem that the original original character string can be easily estimated from the replacement character string. For example, since the appearance frequency of "Mitamura" and "Moriya" in the information item "surname" of the converted document is high, it is presumed that "Mitamura" and "Moriya" are not actually "Suzuki" or "Sato" (surname often used by Japanese) It will be done. Also, for those who have grasped the original data before masking to some extent, it was easy to guess the original original character string due to the appearance tendency of the specific replacement character string.

  Next, the second problem recognized by the inventor in data masking will be described. When multiple information items related to one another are to be replaced, if masking is performed in units of one information item, the relationship between the original character strings of the multiple information items is between the replacement strings of the multiple information items after masking. Not reflected. For example, when the information items "Kanji surname" and "Kana surname" are to be replaced, if the replacement character strings of "Kanji surname" and "Kana surname" are individually determined, the relationship between kanji and reading is broken after masking. I will.

  Specifically, it is assumed that the original character strings "Yamada", "Sasaki" and "Nakata" of the information item "Kanji surname" are replaced with replacement character strings "Sato", "Suzuki" and "Nakata", respectively. On the other hand, it is assumed that the original character strings "Yayama", "Sato" and "Nanakata" of the information item "Kana surname" are replaced with substitution characters "Tanaguchi", "Kawaguchi" and "Osanai", respectively. In this case, "Yamada" and "Yayama" in the original document become "Sato" and "Taniguchi" in the converted document, and the user of the converted document may feel uncomfortable. In addition, when a test of sorting function or searching function by kana surname is performed on such a converted document, it may be difficult to determine whether the test result is correct or not.

  In order to solve the first problem, the data masking technology according to the embodiment determines a replacement character string as a feature 1 based on a combination of original character strings of a plurality of information items (for example, a surname and a first name). In addition, in order to solve the second problem, as a feature 2, a conversion dictionary that reflects the relationship (relationship) between information items in the original document is stored, and the information in the original document is referenced with reference to the conversion dictionary. Perform masking that maintains the relationship between items.

  Hereinafter, the feature 1 will be described in the first embodiment (hereinafter referred to as the “first embodiment”), and the feature 2 will be described in the second embodiment (hereinafter referred to as the “second embodiment”). Explain. In addition, an example in which the feature 1 and the feature 2 are combined will be described in a third embodiment (hereinafter, referred to as “third embodiment”).

First Embodiment
FIG. 1 shows the configuration of the information processing system of the first embodiment. The information processing system 100 includes a production machine 10, a testing machine 12, and a data masking device 14. The production machine 10 is an information processing apparatus installed in a production environment (commercial environment), and is, for example, a web server, an application server, a database server, or a directory server. The test machine 12 is an information processing apparatus installed in a development environment or a test environment, and is, for example, a PC or a server that executes development and testing of an application deployed on the production machine 10.

  The production machine 10 holds information that should be kept secret or information that is not permitted to be released, such as personal information of a customer, an end user, or an employee of a company. The tester 12 executes a test on test data extracted from the production machine 10. In this test data, the above-mentioned secret information needs to be concealed. The data masking device 14 is an information processing device that masks various secret information such as personal information. The data masking device 14 acquires the original document 16 in which the information held in the production machine 10 is recorded, and generates a converted document 18 in which the secret information recorded in the original document 16 is masked. The conversion document 18 is provided to the tester 12 as test data.

  The original document 16 and the conversion document 18 according to the embodiment are data (for example, CSV) in tabular form (in other words, table structure) in which a plurality of records composed of contents (specifically, character strings) of a plurality of information items are recorded. File). However, the original document 16 and the conversion document 18 are not limited to tabular data as long as the information item can be identified. For example, document data of various office suites may be used, table data of RDBMS may be used, and a plain text file may be used.

  FIG. 2 is a block diagram showing the configuration of the data masking device 14 of FIG. The data masking device 14 includes a control unit 20, a storage unit 22, and an I / F unit 24. The control unit 20 executes various data processing. The storage unit 22 is a storage area for storing data to be referred to and updated by the control unit 20. The I / F unit 24 provides an interface function with an external device, and communicates with the external device according to various communication protocols. The I / F unit 24 can also be referred to as a communication unit. The control unit 20 transmits and receives data to and from the production machine 10 and the test machine 12 via the I / F unit 24.

  Each block shown in the block diagram of the present specification can be realized by hardware as an element such as a CPU of a computer or a mechanical device, and as software as a computer program or the like. It depicts the functional blocks realized by the coordination of them. Therefore, it is understood by those skilled in the art that these functional blocks can be realized in various forms by a combination of hardware and software.

  For example, a data masking program including a module corresponding to each block in the control unit 20 may be stored in a recording medium such as a DVD and installed in the data masking device 14. Then, even if the processor (CPU or the like) of the data masking device 14 reads out the data masking program stored in the local storage to the main memory and executes it, the function of each block in the control unit 20 is exhibited. Good. The storage unit 22 may be realized by the storage or memory of the data masking device 14 storing data.

  The storage unit 22 includes a replacement target information storage unit 30 and a conversion dictionary storage unit 32. The replacement target information holding unit 30 holds identification information of a masking target, in other words, an information item to be replaced. The replacement target information holding unit 30 may hold, as item identification information, a character string indicating a plurality of information items, for example, “contractor surname”, “contractor name”, “age”, “sex”, “address” and the like. Further, information indicating the recording positions of the original character strings of the plurality of information items in the original document 16, for example, the byte length from the head position of the record, the character string length, etc. may be held as item identification information.

  The conversion dictionary holding unit 32 holds dictionary data (hereinafter also referred to as “conversion dictionary”) referred to at the time of character string substitution. In the conversion dictionary of the embodiment, replacement character strings of a plurality of information items to be character string replacement targets are recorded in association with hash values. The hash value can be said to be an ID of a combination of original character strings of a plurality of information items, and can also be said to be an ID of a combination of substitution strings of a plurality of information items. It can also be said that it is a key for replacement character string search.

  FIG. 3 shows an example of the conversion dictionary held in the conversion dictionary holding unit 32 of the first embodiment. The conversion dictionary in the same figure associates a hash value with a replacement character string (for example, a fictitious surname or first name) of each of a plurality of information items "contractor surname" and "contractor name". One line (one record) of the conversion dictionary is a candidate for the replacement character string, and the conversion dictionary defines a plurality of candidates for the replacement character string across a plurality of records. The conversion dictionary holding unit 32 can also be said to be a candidate character string holding unit that holds a plurality of replacement character string candidates at different positions (that is, records with different conversion dictionaries). The conversion dictionary may be configured not to record the hash value. The conversion dictionary holding unit 32 may hold independent separate conversion dictionaries for each of the plurality of information items.

  Returning to FIG. 2, the control unit 20 includes an original document acquisition unit 34, an original character string acquisition unit 36, a replacement character string determination unit 38, a character string conversion unit 40, and a converted document output unit 42. The original document acquisition unit 34 reads the original document 16 output from the production machine 10. The original document acquisition unit 34 may communicate with the production machine 10 via the I / F unit 24 to acquire the original document 16 held by the production machine 10. The original document acquisition unit 34 may read the original document 16 from a medium (such as a DVD or a USB memory) on which the original document 16 output from the production machine 10 is recorded.

  The original character string acquisition unit 36 identifies a plurality of information items to be substituted with reference to the replacement object information holding unit 30, and acquires original character strings of the plurality of information items from the original document. For example, the original character string may be acquired from the column of the replacement target information item in the original document 16, or the original character string may be acquired from the recording position of the replacement target information item in the original document 16.

  The replacement character string determination unit 38 determines replacement character strings of the plurality of information items based on a combination of the original character strings of the plurality of information items recorded in the original data. Specifically, among a plurality of replacement character string candidates recorded in the conversion dictionary of the conversion dictionary holding unit 32, the information is recorded at a position in the dictionary specified based on a combination of original character strings of a plurality of information items. Determine the candidate as a replacement string. More specifically, a value obtained by converting a combination of original character strings of a plurality of information items by a predetermined one-way function is acquired, and a candidate held at a position in the dictionary specified based on the value is substituted character Determined as a column.

  The replacement character string determination unit 38 according to the embodiment combines original character strings of a plurality of information items to be replaced acquired by the original character string acquisition unit 36. Then, the combined character string is input to a predetermined hash function (for example, MD5 or SHA-1 or the like) determined in advance to obtain a hash value. For example, when a plurality of information items to be replaced are "contractor surname" and "contractor name", the original character string "Yamada" of "contractor surname" and the original character string "taro" of "contractor name" Get the hash value of the combined character string "Taro Yamada".

  The replacement character string determination unit 38 identifies replacement character strings of a plurality of information items to be replaced corresponding to the acquired hash value with reference to the conversion dictionary stored in the conversion dictionary storage unit 32. The replacement character string determination unit 38 uses, for masking, a replacement character string recorded at a line position of a conversion dictionary corresponding to a hash value obtained from a character string obtained by combining original character strings of a plurality of information items. Decide as. For example, you may acquire the value of "1"-"999" as a hash value. Then, the replacement character string recorded in the line position (500 line if the hash value is “500”) indicated by the hash value in the conversion dictionary is determined as a replacement character string used for masking.

  Although the replacement character string determination unit 38 may execute processing to avoid the occurrence of so-called synonyms, in which hash values overlap between different original character strings, on the other hand, the processing to avoid the generation of synonyms is suppressed. You may The converted document 18 is typically data for development and testing, and problems are less likely to occur even if the same replacement character string is assigned to different original character strings. Further, by allowing synonyms, the number of records of the conversion dictionary held by the conversion dictionary holding unit 32, that is, the number of candidates for the replacement character string can be suppressed smaller than the number of information that can be recorded as the original character string.

  The character string conversion unit 40 replaces the original character strings of the plurality of information items to be replaced recorded in the original document 16 with the replacement character string determined by the replacement character string determination unit 38. For example, the original character strings “Yamada” and “Taro” of the contractor's surname and the contractor name in one record of the original document 16 are replaced with the replacement character string “Kuriyama” “high order” determined by the replacement character string determination unit Replace. The character string conversion unit 40 generates a converted document 18 in which the original character string is converted into a replacement character string.

  The converted document output unit 42 outputs the converted document 18 generated by the character string conversion unit 40 to a predetermined device. For example, the converted document output unit 42 may transmit the converted document 18 to the tester 12 via the I / F unit 24. Also, the converted document 18 may be stored in a local storage or a predetermined recording medium.

The operation of the data masking device 14 having the above configuration will be described below.
A developer or a tester in charge of the information processing system 100 causes the recording medium to output the original document 16 including the personal information of the customer or the employee held in the production machine 10 and causes the data masking device 14 to read the recording medium. . The original document acquisition unit 34 of the data masking device 14 reads the original document 16 from the recording medium. The original character string acquisition unit 36 reads the original character strings of a plurality of information items to be replaced recorded in the original document 16 according to the item identification information stored in advance in the replacement object information holding unit 30.

  The replacement character string determination unit 38 refers to the conversion dictionary of the conversion dictionary holding unit 32 and determines a replacement character string specified by a combination of original character strings of a plurality of information items to be replaced. The character string conversion unit 40 generates a converted document 18 in which the original character string of the original document 16 is replaced with a replacement character string. The converted document output unit 42 outputs the converted document 18 to a predetermined recording medium as test data in which personal information is masked. The developers and testers output the data masking device 14 and read the converted document 18 into the tester 12 to develop and test the application.

  According to the data masking device 14 of the first embodiment, a replacement character string is determined based on a combination of original character strings of a plurality of information items in units of a plurality of information items. As a result, it is possible to suppress that the appearance tendency of the specific original character string in the original document 16 is reflected in the converted document 18. For example, even if at least one of the plurality of information items has a high frequency of appearance of a specific original character string, the specific original document is determined because a replacement character string is determined in combination with the original character strings of other information items. It can be suppressed that the appearance frequency of a character string is reflected in the appearance frequency of a specific replacement character string. As a result, it is difficult to estimate the original original character string from the replacement character string recorded in the converted document 18, and the risk of information leakage due to the converted document 18 can be reduced.

  For example, a plurality of information items are "contractor surname" and "contractor name", the first record of the original document 16 is "Suzuki" and "Taro", the second record is "Suzuki" and "Jiro", and the third record is " Suzuki "Saburo" is assumed. In this case, for example, the first record of the converted document 18 is “Sato” “Nobunaga”, the second record is “Yamaguchi” “Hideyoshi”, and the third record is “Sasaki” “Ieyasu” by the data masking of the first embodiment. Become. When “Suzuki” of “Contractor's surname” is replaced with one specific substitution string (for example, “Mitamura”), “Mitamura” is actually determined if “Mitamura” appears more frequently in converted document 18 I can guess that it is "Suzuki" or "Sato". In the data masking device 14 of the first embodiment, "Suzuki" is not simply replaced with "Mitamura", but replaced with various character strings, so it is difficult to deduce the original character string from the substituted character string. Become.

  As described above, an information item suitable for determining a replacement character string by a combination of original character strings of a plurality of information items is an information item having some tendency in the appearance frequency of a specific original character string. For example, besides the surname of a person, the name of a prefecture in an address etc., and a department name to which the user belongs can be mentioned. In the case of the prefecture name, it becomes easy to prevent that "Tokyo" and "Osaka Prefecture" of the original character strings having a large population are inferred from the replacement strings. Also, in the case of departmental signatures, it becomes easy to prevent the departmental signatures with many employees belonging to being inferred from the replacement character string. The technical idea of the embodiment determines a replacement character string of at least one information item in which a tendency tends to appear in the appearance frequency of the original character string among the plurality of information items, by combining the original character strings of the plurality of information items. It can be said that.

  Further, according to the data masking device 14 of the first embodiment, among the plurality of replacement character string candidates recorded at different positions in the conversion dictionary, the data is recorded at the position specified by the combination of original character strings of a plurality of information items. Let the candidate be a replacement string used to replace the original string. According to this configuration, a specific combination of original character strings is uniquely converted to a specific replacement string, and the uniqueness of conversion can be guaranteed.

  Further, according to the data masking device 14 of the first embodiment, a character string obtained by combining original character strings of a plurality of information items is input to a hash function to acquire a hash value. Then, among the plurality of replacement character string candidates recorded at different positions in the conversion dictionary, the candidate recorded at the position of the conversion dictionary specified by the hash value is set as a replacement character string used for replacement of the original character string. According to this configuration, only the correspondence between the hash value and the replacement character string is recorded in the conversion dictionary, so it is difficult to grasp the original character string corresponding to the replacement character string only by looking at the conversion dictionary. The safety of masking can be improved.

  The present invention has been described above based on the first embodiment. It will be understood by those skilled in the art that this embodiment is an exemplification, and that various modifications can be made to the combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

  A first modified example of the first embodiment will be described. When the original document 16 includes the first information item and the second information item, the replacement character string determination unit 38 combines the original character string of the first information item and the original character string of the second information item in the first mode. The candidate held at the position specified based on the character string may be determined as a replacement character string of the first information item. On the other hand, the replacement character string determination unit 38 determines a position specified based on a character string obtained by combining the original character string of the first information item and the original character string of the second information item in a second mode different from the first mode. The held candidate may be determined as a replacement string of the second information item.

  The example using the conversion dictionary of FIG. 3 is shown. When the first information item is the contractor's surname and the second information item is the contractor's name, the replacement character string determination unit 38 combines the original character strings in the order of the contractor's surname and the contractor's name from the top (for example, "Yamada Taro" is input to the hash function to obtain a hash value, and a record corresponding to the hash value is identified. Then, the replacement character string recorded in the record may be determined as the replacement character string of the contractor surname. If the hash value is "123", the replacement string of the contractor surname will be "Kuriyama".

  Further, the replacement character string determination unit 38 inputs a character string (for example, “Taro Yamada”) obtained by combining the original character string in the order of the contractor name and the contractor surname from the top (for example, “Taro Yamada”) into a hash function to obtain a hash value. Identifies the record that corresponds to the value. Then, the replacement character string recorded in the record may be determined as the replacement character string of the contractor surname. If the hash value is "422", the replacement string of the contractor name will be "plain".

  According to the configuration of the first modification, the combinations of replacement character strings of a plurality of information items to be masked become more diversified, and it becomes more difficult to estimate the original character string from the replacement character strings. For example, in the conversion dictionary of FIG. 3, when the replacement string of the contractor surname is "Kuriyama", the replacement string of the contractor's name is not always "high order", but is "hiraji" or "photon" It may be. In addition, it can be made more difficult to grasp the original character string corresponding to the replacement character string by looking at the conversion dictionary.

  A second modified example of the first embodiment will be described. In the above embodiment, the replacement character string determination unit 38 combines the original character strings of a plurality of information items to be replaced to obtain a hash value. As a modification, after the original character strings of the information items are combined, a hash value may be acquired after performing a predetermined character string operation or bit operation. In addition, after a predetermined character string operation or bit operation is performed on the original character string of each information item, the character string after the operation / operation may be combined to obtain a hash value. In addition, after obtaining the hash value for each original character string of each information item, the individual hash values may be combined by a predetermined operation, and the replacement string may be determined based on the combined value.

  A third modified example of the first embodiment will be described. In the above embodiment, the replacement string recorded at the line position corresponding to the hash value is determined as the replacement string used for masking. As a modification, the replacement character string determination unit 38 converts a replacement character string of a plurality of information items associated with a hash value obtained from a character string obtained by combining original character strings of a plurality of information items into a conversion dictionary storage unit. The conversion dictionary held in 32 may be referred to and identified. That is, a record of a conversion dictionary in which a hash value obtained from a combined character string is recorded may be identified, and a replacement character string recorded in the record may be determined as a character string to be used for masking. For example, when referring to the conversion dictionary of FIG. 3 and the hash value of “Yamada Taro” obtained by combining the original character strings is “123”, the replacement character string of “Subscriber surname” is determined as “Kuriyama”. , And the replacement string of “contractor name” may be determined to be “high order”.

  A fourth modified example of the first embodiment will be described. The conversion dictionary held by the conversion dictionary holding unit 32 may directly associate the original character string and the replacement character string. FIG. 4 shows a conversion dictionary of the modification. In the conversion dictionary of the same figure, the original character strings of the plurality of information items "contractor surname" and "contractor name" (data of "original contractor surname" and "original contractor name" in the figure) Is associated with the replacement character string (data of “replacement contractor surname” and “replacement contractor name” in the figure). In this case, the replacement character string determination unit 38 may search the conversion dictionary using a combination of original character strings of a plurality of information items as a key. In the example of FIG. 4, when the combination of the original contractor surname and the original contractor name is “Yamada” and “Taro”, the replacement character string determination unit 38 “Kuriyama” as a combination of the replacement contractor surname and the replacement contractor name. Determine "high order".

Second Embodiment
In the second embodiment, a data masking technique will be described in which the relationship between original character strings of a plurality of information items to be replaced is maintained even between replacement character strings of the plurality of information items. The configuration of the information processing system 100 of the second embodiment is the same as that of the first embodiment (FIG. 1), and the functional blocks of the data masking device 14 of the second embodiment are also the same as that of the first embodiment (FIG. 2). . Hereinafter, the description overlapping with the first embodiment will be omitted, and different points will be mainly described.

  In a plurality of information items to be masked in the second embodiment, original character strings having contents related to each other are recorded. For example, in a plurality of information items, a first information item in which an original character string in which an object or thing is described in a first mode is set, and an original in which the same object or thing is described in a second mode different from the first mode It contains the second information item in which the character string is set. In other words, character strings in which the same object or thing is described in different appearances are respectively set to the plurality of information items. For example, if the first information item is a "contractor kanji surname" in which the kanji notation of the contractor's surname is set, the second information item is a "contractor kana surname" in which the Kana notation of the contractor's surname is set. Is the case.

  A plurality of information items in which original character strings having mutually related contents are recorded, that is, a plurality of information items effective for masking in the second embodiment, can be considered various other than kanji surnames and kana surnames. For example, a person's name and gender, an ID (for example, a prefecture code) and information specified by the ID (for example, a prefecture name), a prefecture name and a municipality name, a surname and an e-mail address If there is a rule to set roman letters).

  The conversion dictionary holding unit 32 holds a conversion dictionary indicating a plurality of information items recorded in the original document 16 and indicating replacement character strings of a plurality of information items related to each other. FIG. 5 shows an example of the conversion dictionary held in the conversion dictionary holding unit 32 of the second embodiment. Between the replacement character strings of the plurality of information items defined by the conversion dictionary, the relationship between the original character strings of the plurality of information items recorded in the original document 16 is maintained. That is, in the conversion dictionary of FIG. 5, the hash value is associated with the replacement character string of the information items "contractor kanji surname" and "contractor kana surname", and the same record is registered in "contractor kana surname" of a certain record. The phonetic alphabet of "Subscriber Kanji surname" is set.

  FIG. 6 also shows an example of the conversion dictionary held in the conversion dictionary holding unit 32 of the second embodiment. The relationships among the original character strings of the plurality of information items recorded in the original document 16 are maintained among the replacement character strings of the plurality of information items defined by the conversion dictionary. That is, character strings matching each other are set for the prefecture code, the prefecture name, and the city name in the same record.

  Returning to FIG. 2, the replacement target information holding unit 30 holds identification information of a plurality of mutually related information items as the information items to be replaced. The original character string acquisition unit 36 refers to the replacement target information holding unit 30 and acquires an original character string set for each of a plurality of mutually related information items.

  The replacement character string determination unit 38 is specified based on at least one original character string of a plurality of information items related to each other among the plurality of candidates for the replacement character string recorded in the conversion dictionary of the conversion dictionary storage unit 32. A candidate recorded at a position in the dictionary is determined as a replacement string of a plurality of information items. The replacement character string determination unit 38 determines a candidate recorded at a position in the dictionary specified based on a combination of original character strings of a plurality of information items related to each other as a replacement character string of a plurality of information items. Good. Further, a value obtained by converting a combination of original character strings of a plurality of mutually related information items by a predetermined one-way function is acquired, and a candidate held at a position specified based on the value is determined as a substituted character string. May be

  The replacement character string determination unit 38 according to the embodiment combines original character strings of a plurality of information items acquired by the original character string acquisition unit 36, inputs the combined character string into a predetermined hash function, and acquires a hash value. Do. For example, when a plurality of information items to be replaced are "contractor kanji surname" and "contractor kana surname", the original character strings of "contractor kanji surname" original characters of "Yamada" and "contractor kana surname" Gets the hash value of the string "Yamada Yamada" that combines the column "Yamada".

  Similar to the first embodiment, the replacement character string determination unit 38 determines a replacement character string recorded at a line position of the conversion dictionary corresponding to the acquired hash value as a replacement character string used for masking. For example, if the hash value of "Yamada Yamada" is "500", the replacement character string recorded on the 500th line of the conversion dictionary is determined as the character string to be used for masking. As a modification, as in the third modification of the first embodiment, the replacement character string determination unit 38 identifies a record of the conversion dictionary in which the acquired hash value is recorded, and the replacement character string recorded in the record. May be determined as a string to be used for masking. For example, referring to the conversion dictionary of FIG. 5 and when the hash value of "Yamada Yamada" is "123", the replacement character string of "contractor kanji surname" is determined as "Kuriyama", and is "contractor Kana" The replacement string of the surname may be determined as "Kuriyama".

  The character string conversion unit 40 substitutes the original character strings of the plurality of information items to be substituted recorded in the original document 16 with the replacement character strings of the plurality of information items defined by the conversion dictionary held by the conversion dictionary holding unit 32. Replace to Specifically, the character string conversion unit 40 replaces original character strings of a plurality of information items related to each other with replacement character strings of the respective information items determined by the replacement character string determination unit 38.

  The operation of the data masking device 14 of the second embodiment is similar to the operation of the data masking device 14 of the first embodiment. The replacement character string determination unit 38 determines replacement character strings of the plurality of information items defined by the conversion dictionary of the conversion dictionary holding unit 32 according to the combination of the original character strings of the plurality of information items related to each other. The character string conversion unit 40 generates the converted document 18 by replacing original character strings of a plurality of information items related to each other with replacement character strings of the plurality of information items defined by the conversion dictionary of the conversion dictionary storage unit 32. .

  According to the data masking device 14 of the second embodiment, with respect to a plurality of mutually related information items recorded in the original document 16 and the converted document 18, the relationship between the original character strings of the information items is maintained even among the replacement character strings. can do. As a result, it is possible to generate a converted document 18 that is highly effective in terms of using as test data or the like. For example, in the case of the conversion dictionary of FIG. 5, the replacement string of the kanji surname matches the replacement string of the kana surname. Further, in the case of the conversion dictionary shown in FIG. 6, the replacement codes of the prefecture code and the name of the prefecture and the name of the city are matched.

  Therefore, while the kanji surname is "Kuriyama", the kana surname is "there was" or that the municipality name is "Yokohama City Nishi Ward" while the prefecture name of the address is "Tokyo". The user of the converted document 18 can be prevented from feeling discomfort. In addition, it is possible to avoid that it becomes difficult to determine, for example, a search result with the prefecture name as a key as a result of a test using the converted document 18. That is, it is possible to generate the converted document 18 that does not make the user of the converted document 18 feel unnaturalness in the relationship between character strings of a plurality of information items, and it is possible to enhance the usefulness of the data after masking.

  Further, according to the data masking device 14 of the second embodiment, a specific original character string of a plurality of information items related to one another can be uniquely converted into a specific replacement character string, and the uniqueness of conversion can be secured. Further, since only the correspondence between the hash value and the replacement character string is recorded in the conversion dictionary, it is difficult to grasp the original character string corresponding to the replacement character string only by looking at the conversion dictionary, and data masking safety I can improve the nature.

  The present invention has been described above based on the second embodiment. It will be understood by those skilled in the art that this embodiment is an exemplification, and that various modifications can be made to the combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

  The second to fourth modifications of the first embodiment are also useful as modifications of the second embodiment. For example, the conversion dictionary held by the conversion dictionary holding unit 32 may directly associate the original character string and the replacement character string. FIG. 7 shows a conversion dictionary of the modification. The replacement character string determination unit 38 may search the conversion dictionary using a combination of original character strings of a plurality of information items as a key. In the example of FIG. 7, when the combination of the original contractor kanji surname and the original contractor kana surname is "Yamada" or "Yayama", the replacement character string determination unit 38 combines the replacement contractor kanji surname and the replacement contractor kana surname. As "Kuriyama" "Kuriyama" is decided.

Third Embodiment
The data masking device 14 of the third embodiment comprises both the features of the first embodiment and the features of the second embodiment. The configuration of the information processing system 100 of the third embodiment is the same as that of the first embodiment and the second embodiment (FIG. 1), and the functional blocks of the data masking device 14 of the second embodiment are also the first embodiment, the second embodiment. It is the same as the embodiment (FIG. 2). Hereinafter, descriptions overlapping with the first embodiment and the second embodiment will be omitted, and different points will be mainly described.

  FIG. 8 shows an example of the conversion dictionary held in the conversion dictionary holding unit 32 of the third embodiment. Each record of the conversion dictionary of the third embodiment includes a first item group and a second item for a first item group including a plurality of information items related to each other and a second item group including a plurality of information items related to each other Record the correspondence between the replacement string of each group and the hash value. The first item group is a combination of a contractor kanji surname and a contractor kana surname in the example of FIG. 8, and the second item group is a combination of a contractor kanji name and a contractor kana name in the example of FIG. It is desirable that there is no related surname between the first and second item groups. For example, it can be said that there is no direct relationship between surnames and first names.

  Returning to FIG. 2, the replacement target information holding unit 30 identifies the identification information of the plurality of information items included in the first item group and the identification of the plurality of information items included in the second item group as the information items to be replaced. Hold information The original character string acquisition unit 36 refers to the replacement target information holding unit 30, and the original character string set for each of the plurality of information items included in the first item group and the plurality of information items included in the second item group Get the original character string set for each.

  The replacement character string determination unit 38 selects at least one original character string of the first item group and at least one of the second item group among the plurality of replacement character string candidates recorded in the conversion dictionary of the conversion dictionary storage unit 32. A candidate recorded at a position in the dictionary specified based on a combination of two original character strings is determined as a replacement character string. The replacement character string determination unit 38 is a character combining all original character strings of a plurality of information items included in the first item group and a plurality of original character strings of a plurality of information items included in the second item group. Columns may be used to determine replacement strings.

  The replacement character string determination unit 38 according to the embodiment combines all of the original character strings of the plurality of information items acquired by the original character string acquisition unit 36, inputs the combined character string into a predetermined hash function, and transmits the hash value. To get For example, the original character string "Yamada" of the contractor kanji surname of the first item group, the original character string "Yayama" of the contractor kana surname, the original character string "Taro" of the contractor kanji name of the second item group and the contractor The hash value of "Yamada Yamada Taro Taro" combining the original character string "Taro" of Kana name is acquired.

  Similar to the first embodiment, the replacement character string determination unit 38 determines a replacement character string recorded at a line position of the conversion dictionary corresponding to the acquired hash value as a replacement character string used for masking. For example, if the hash value of "Yamada or still Taro Taro" is "500", the replacement character string recorded on the 500th line of the conversion dictionary is determined as the character string to be used for masking. As a modification, as in the third modification of the first embodiment, the replacement character string determination unit 38 identifies a record of the conversion dictionary in which the acquired hash value is recorded, and the replacement character string recorded in the record. May be determined as a string to be used for masking. For example, if the conversion dictionary in FIG. 8 is referred to and the hash value of "Yamada Yamada Taro" is "123", the replacement character string of the contractor kanji surname is determined as "Kuriyama" and the contractor kana surname The replacement string of may be determined as "Kuriyama". At the same time, the replacement character string of the contractor kanji name may be determined as "high order", and the replacement character string of the contractor kana name may be determined as "Koji". Other configurations and operations are similar to those of the first embodiment and the second embodiment.

  According to the data masking device 14 of the third embodiment, the effects of the first embodiment and the effects of the second embodiment can be compatible. That is, it is difficult to infer the original original character string from the substitute character string, and the relationship between the original character strings of a plurality of information items related to each other can be maintained even between the masked replacement character strings. This makes it possible to enhance the usefulness of the data after masking in both information leakage prevention and data utilization.

  The present invention has been described above based on the third embodiment. It will be understood by those skilled in the art that this embodiment is an exemplification, and that various modifications can be made to the combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there. The modification of the first embodiment and the modification of the second embodiment are also useful in the third embodiment. For example, in the conversion dictionary of FIG. 8, the original character string may be directly associated with the replacement character string instead of the hash value.

  It is also understood by those skilled in the art that the functions to be performed by the respective constituent features described in the claims are realized by a single member of each constituent shown in the embodiment and the modification or a combination thereof.

  14 data masking device 30 replacement target information storage unit 32 conversion dictionary storage unit 34 original document acquisition unit 36 original character string acquisition unit 38 replacement character string determination unit 40 character string conversion unit 42 conversion document output unit

Claims (3)

A replacement character string determination unit that determines replacement character strings of the plurality of information items based on a combination of original character strings of a plurality of information items recorded in the original data;
A character string replacement unit that replaces original character strings of the plurality of information items recorded in the original data with a replacement character string determined by the replacement character string determination unit;
A candidate character string holding unit that holds, at different positions, a plurality of candidates that can be the replacement character string;
Equipped with
The replacement character string determination unit determines, as the replacement character string, a candidate held at a position specified based on a combination of original character strings of the plurality of information items.
The plurality of information items include a first item and a second item,
The replacement character string determination unit determines, as the first item, a candidate held at a position specified based on a character string obtained by combining the original character string of the first item and the original character string of the second item in a first mode. And the original character string of the first item and the original character string of the second item are determined based on the character string obtained by combining in a second mode different from the first mode. A data masking apparatus characterized in that the determined candidate is determined as a replacement string of the second item. Determining a replacement character string of the plurality of information items based on a combination of the original character strings of the plurality of information items recorded in the original data;
Replacing the original character string of the plurality of information items recorded in the original data with the replacement character string determined in the determining step;
Holding, at different positions, a plurality of candidates for the replacement character string;
Equipped with
The determining step determines a candidate held at a position specified based on a combination of original character strings of the plurality of information items as the replacement character string.
The plurality of information items include a first item and a second item,
In the determining, the candidate held at the position specified based on the character string obtained by combining the original character string of the first item and the original character string of the second item in the first aspect is replaced with the first item It is determined as a character string, and is held at a position specified based on a character string obtained by combining the original character string of the first item and the original character string of the second item in a second mode different from the first mode. A data masking method characterized in that the data masking device executes determining a candidate as a replacement string of the second item. A function of determining a replacement character string of the plurality of information items based on a combination of the original character strings of the plurality of information items recorded in the original data;
A function of replacing original character strings of the plurality of information items recorded in the original data with replacement character strings determined in the determining step;
A function of holding a plurality of candidates that can be the replacement character string at different positions;
Equipped with
The function to determine determines a candidate held at a position specified based on a combination of original character strings of the plurality of information items as the replacement character string.
The plurality of information items include a first item and a second item,
The function to determine determines a candidate held at a position specified based on a character string obtained by combining the original character string of the first item and the original character string of the second item in the first mode with the first item replacement It is determined as a character string, and is held at a position specified based on a character string obtained by combining the original character string of the first item and the original character string of the second item in a second mode different from the first mode. A computer program for causing a data masking device to determine a candidate as a replacement string of the second item.

Images