JP2008102827A - System and method for monitoring personal information file - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system which checks a personal information file by placing no burden on both a user and an administrator when the data are taken out via an e-mail or an external medium and prevents an information leakage caused by lost or stolen of the data or eavesdropping via a network, and which is capable of tracking the source of information taken out in the event of an information leak. <P>SOLUTION: A monitoring system includes the function of detecting an operation, such as a drag-and-drop operation, made for a user to take out a file, to check whether or not the file is a personal information file, to record that check result in a log, and to generate an encrypted file depending on the check result. A plain text file, a personal information check log of that file, an encrypted file generation log of that file, and a file taking-out log are stored in association with each other, thereby enabling an analysis of a leakage route of the file if the file is leaked. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to software and a monitoring system that enhance information security when an electronic file in a company is taken outside via mail or media.

  The Personal Information Protection Law was enacted and promulgated in May 2003 and entered into force in April 2005. Increasing awareness about the protection of people's personal information, companies are making various efforts to avoid the leakage of personal information of customers and employees. As a system that supports such efforts, for example, in Patent Document 1, it is determined whether or not a personal information file is targeted for text data that excludes character sections including inappropriate characters / character strings as personal information. A system for searching personal information files at high speed and with certainty is described.

  Further, as a prior art related to protection of personal information, for example, Patent Document 2 describes a system in which a personal information management server installs a personal information search program in each client and collects the results executed in each client on the server. Has been. By using the techniques disclosed in Patent Document 1 and Patent Document 2 described above, it is possible to search for personal information files distributed on PCs in a company, and to track and manage access to the files. It is possible to prevent unauthorized use of information.

  As another technique, there is a technique in which access authority to a file is set so that only authorized persons can view or copy the file. By combining the personal information search technology and the file access authority setting technology, it is possible to manage and restrict access to the personal information file.

As another technique, there is a technique for encrypting an electronic file, an electronic folder, or a hard disk. In recent years, there have been many accidents in which corporate information is leaked due to data leakage due to virus infection of PCs storing corporate information, or theft or loss. As a countermeasure, encryption of electronic files, electronic folders, or hard disks prevents loss of information, theft, and information leakage via the network due to virus infection. It also has an effect.
Japanese Patent No. 3705439 Patent 3743783

  Tracking and managing access to the personal information file disclosed in Patent Documents 1 and 2 described above has a deterrent effect against unauthorized use, but preventing data loss, theft, and information leakage via viruses The problem of not being possible arises.

  Moreover, when restricting the taking-out of a personal file using a file access restriction technique, it is necessary to set a restriction for each file, and there is a problem that it takes time and effort for management. In addition, if a file is updated after setting access restrictions to the file, the importance of the file may change, and it is necessary to change the access restriction to the file according to the importance. However, there is a problem that it takes time and effort.

  On the other hand, since it is not possible to search the encrypted file in the conventional method, it is possible to take out the encrypted file without searching for the personal information file, and information leakage When this happens, there is a problem that it is not possible to track taking out of the personal information file. In order to take out the file freely, a malicious user may appear to intentionally encrypt the file so that it cannot be checked whether it is a personal information file. For system administrators, to increase security On the contrary, there is a problem that it becomes impossible to check whether the file is a personal information file.

  The object of the present invention was created to solve such problems, and when taking out data via e-mail or external media, the personal information file is not burdened on both the user and the administrator. Provide a system that can check information taken out and prevent information leakage due to data loss, theft, eavesdropping via the network, etc., and even if information leaks, There is.

In order to solve the above problems, the present invention mainly adopts the following configuration.
A file conversion operation detection unit for detecting a conversion operation for taking out a plain text file by a user;
A file encryption unit that encrypts a plaintext file that is the target of the conversion operation;
In parallel with the encryption process, a personal information check unit that detects whether or not the plaintext file that is the detection target of the conversion operation is a personal information file,
When the file conversion operation detection unit detects the conversion operation, a unique ID corresponding to the plaintext file is assigned, and the file encryption program and the personal information check program are given the plaintext file with the assigned ID as an argument. Start
A personal information file monitoring system for generating and storing a log including a plaintext file name with an ID and a user name or login name.

In addition, a file conversion operation detection unit that detects a conversion operation for taking out a plain text file by a user,
A personal information check unit that detects whether or not the plaintext file that is the detection target of the conversion operation is a personal information file;
A file encryption unit that encrypts a plaintext file that is the detection target of the conversion operation according to a detection result in the personal information check unit,
When the file conversion operation detection unit detects the conversion operation, a unique ID corresponding to the plaintext file is assigned, and the file encryption program and the personal information check program are given the plaintext file with the assigned ID as an argument. In order,
A personal information file monitoring system for generating and storing a log including a plaintext file name with an ID and a user name or login name.

  In the personal information file monitoring system, when the file input to the file conversion operation detection unit is not a plain text file but an encrypted file, the file encryption unit decrypts the encrypted file. To return to a plaintext file, and the decrypted plaintext file is input to the personal information check unit.

  Further, in the personal information file monitoring system, the generation of the encrypted file and the storage of the plaintext file name with the ID, the user name or the login name, and the prevention of information leakage of the personal information file The information outflow route can be analyzed.

  The personal information file monitoring system further includes a mail control unit that transmits the file attached to an e-mail, and the mail control unit is assigned to the file name of the attached file when the e-mail is transmitted. ID is retrieved, the log generated when checking and encrypting the personal information file is searched, and if there is no ID corresponding to the retrieved ID, the mail transmission process is interrupted, and the mail is sent to the sender. It is configured to return it. Further, when there is an ID corresponding to the extracted ID, a mark indicating that the transmission is performed, for example, the transmission date and time of the mail is added to the log.

  The personal information file monitoring system further includes a download control unit that downloads the file, and the download control unit extracts an ID given to the file name of the file at the time of downloading, and checks and encrypts the personal information file. The log generated at the time of conversion is searched, and if there is no ID corresponding to the extracted ID, the download processing of the file corresponding to the ID is interrupted. Further, when there is an ID corresponding to the extracted ID, a download mark is added to the log with the download date and time as an example.

  By applying the personal information file monitoring system of the present invention, a file to be taken outside the company is checked whether it is a personal information file and becomes an encrypted file. Even if there is a file leak or wiretapping on the communication path, the file cannot be easily opened, resulting in a highly secure file in terms of information leakage.

  Since the administrator only has to monitor the files that are taken out without having to set the access authority for each user by controlling the use of the files detected in the personal information file check. File export can be controlled without the hassle of monitoring all files.

  The user only needs to perform a conventional file operation such as drag and drop, and can use it without having to learn a new operation.

  A personal information file monitoring system according to an embodiment of the present invention will be described below in detail with reference to the drawings. Here, the storage location of the personal information file may be a client PC or a server, and the monitoring system according to the present embodiment can be implemented as software that operates on the client PC and the server. In addition, this monitoring system can be implemented as software for converting a specified personal information file into an encrypted file. In a client PC, file attachment operation to mail, file writing / moving / copying operation to external media It may be realized as software that automatically operates by detecting the file, or may be realized as software that automatically operates by detecting a file attachment operation to a mail or a file download operation in the server.

  FIG. 1 is a block diagram showing the overall configuration of a personal information file monitoring system according to an embodiment of the present invention. FIG. 2 is a diagram showing the flow of processing of the file conversion operation detection program in the personal information file monitoring system according to the present embodiment. FIG. 3 is a diagram showing a flow of processing of the file encryption program in the personal information file monitoring system according to the present embodiment. FIG. 4 is a diagram showing a flow of processing of the personal information check program in the personal information file monitoring system according to the present embodiment. FIG. 5 is a diagram showing the flow of processing of the item attribute determination program in the personal information file monitoring system according to the present embodiment.

  In the drawing, 100 is a personal information file take-out monitoring function, 101 is a plaintext file, 102 is an encrypted file, 103 is an email to a related department, 110 is a log storage unit, 111 is a log / plaintext data database, and 112 is a use authority Check system, 120 is a file conversion operation detection unit, 130 is a file encryption unit, 140 is a personal information check unit, 180 is a file take-out operation monitoring function, 181 is a mail control unit, 182 is a download control unit, 190 is a check result process Respectively.

  In FIG. 1, when the plain text file 101 is input to the file conversion operation detection unit 120, the personal information file take-out monitoring function 100 encrypts the file in the file encryption unit 130 and outputs the encrypted file 102. At the same time as file encryption, the personal information check unit 140 checks whether the plain text file 101 is a personal information file. The check result processing unit 190 performs processing according to the check result and sends the mail 103 to the related department. Send. Simultaneously with the processing of the check result, the log storage unit 110 stores the user, file name, file attribute, time, and check result in the database 111 together with the plain text data as a log (see FIG. 15 to be dictated).

  The database 111 can be referred to from the use authority check system 112. The use authority check system 112 transmits the encrypted file 102 by e-mail in the file take-out operation monitoring function 180, or the download control unit 182 downloads it. And the log stored in the log storage unit 110 (see FIG. 15 dictated) can be associated with each other, and the usage status of the encrypted file 102 can be analyzed.

  In FIG. 1, the file encryption unit 130 and the personal information check unit 140 are configured to process in parallel. However, as illustrated in FIG. 14, the encrypted file 102 is generated according to the processing result of the check result processing unit 190. It is also possible to have a configuration in which processing is divided into whether to display an unencryptable message 1401 (if it is determined that the file is a personal information file, the file may be encrypted, It may be displayed, and it can be set so that it can be selected from various modes). Further, when the monitoring system according to the present embodiment is constructed on the server, in the configuration of FIG. 1, the business program is executed by operating the processing after the personal information check unit 140 in a time zone where the operation rate is low, such as at night. There is an advantage that it is possible to perform an operation that does not affect the operation of (for example, a financial deposit / withdrawal program that operates on a server other than the program that operates the monitoring system of the present embodiment).

  When a personal information file is detected, it is possible to call attention to the handling of the personal information file by performing an e-mail contact 103 to the related department, and the use department can prevent easy takeout There is. In the configuration of FIG. 14, since the encrypted file 102 is not generated in the case of a personal information file (display of an unencryptable message), the personal information file is combined with a system that prohibits copying or moving of the file. There is an effect that it becomes impossible to take out.

  In FIG. 1, since it is assumed that it operates on the server (not on the client PC), file export is configured to control via mail and download, but the client PC copies to external media. It is often taken out. When operating on a client PC, security can be enhanced by providing the file take-out monitoring function 180 with a function for controlling writing to an external medium.

  An encrypted file cannot be opened on a computer that does not have a decryption program corresponding to the encryption method (for example, computers within a company have a decryption program, but a computer outside the company has a decryption program). It is often used in the form of creating a file locked with a password on a self-decrypting encrypted file and taking out the file. In practice, the encrypted file 102 is desirably such a self-decryption type encrypted file.

  The input to the personal information file take-out monitoring function 100 is a plain text file 101. However, in a computer in which an encryption / decryption program for a file or folder is installed, the file may already be encrypted. In this case, the file encryption unit 130 performs a decryption process to return to plain text, and then sends plain text data to the personal information check unit 140 to perform a process for generating a self-decryption type encrypted file.

  When encryption is applied to the hard disk, it is processed as plain text data on the memory, so that the processing flow does not change. Many types of application software that automatically encrypts files placed in a specified area have a function to control file export, a function that prohibits copying files to external media, Functions that cannot be taken out unless converted into a self-decryption encryption file are provided.

  Therefore, by incorporating the monitoring system according to the present embodiment into the function of converting into a self-decryption type encrypted file, it becomes possible to add a function for managing the taking-out of personal information files. Application programs that scan for the presence of personal information are available on the market, but the problem of being unable to scan encrypted files can be solved, and access privileges to files can be set and set. The management effort can be saved.

  FIG. 2 is a diagram showing the flow of processing of the file conversion operation detection program 200 that implements the file conversion operation detection unit 120. When the file conversion operation detection program 200 is activated, it monitors the user's operation. When the user's end operation (operation of the “Exit” menu of the program) is detected in step 210, the file conversion operation detection program 200 ends. If the plain text file 101 is dragged and dropped on the encryption program icon, a unique number (ID) is assigned to the plain text file 101 in step 230, and the ID is added to the original file name. The plaintext file 201 with ID is changed to start the file encryption program 300 with the file name of the plaintext file 201 with ID as an argument, and the personal information check program 400 with the file name of the plaintext file 201 with ID as an argument at the same time. Of user operation Back to Nitaringu.

  Here, the meaning of assigning an ID to a plaintext file is that there may be a file with the same name in the file. Therefore, a unique ID is assigned to identify the file with the same name, and the file is specified. (The dictated FIG. 15 shows that an ID is given to a file). When the file encryption program 300 is a type that performs file encryption without leaving the original file, a copy of the plaintext file 201 with ID is taken and copied to either the file encryption program 300 or the personal information check program 400. The plaintext file name with ID 201 is passed as an argument.

  In step 230, the plaintext file 101 may be copied to generate the file 201 without changing the file name to which the ID is added, and the file name of the file 201 may be changed to a file name with an ID. By assigning an ID, it is possible to specify a file with an ID-added file name even if the files have the same name. Here, the file encryption program 300 and the personal information check program 400 are started from the drag-and-drop operation, but a menu for creating a file to be taken out is displayed when the mouse is right-clicked, and when it is selected, the file encryption is performed. The program 300 and the personal information check program 400 may be activated. Further, it may be realized that these programs are activated when an operation for writing to an external medium or an operation for attaching to an e-mail is performed.

  FIG. 3 is a diagram showing the flow of processing of the file encryption program 300 that implements the file encryption unit 130. When the file encryption program 300 is activated, a password input screen is displayed in step 310 and waits until the password is input by the user (see the encryption password shown in FIGS. 1 and 14). In step 320, the password is input. If it is determined, the process proceeds to step 330, the plain text file 201 is read, the encrypted file 102 is generated, and the process ends. Various encryption methods have been invented and put into practical use, but here the encryption method is not particular. In order to enable decryption even on a computer on which no decryption program is installed, the encrypted file 102 may be a self-decryption type encrypted file.

  The self-decryption file is generally in EXE format. If it is attached to an e-mail and transmitted, it may be determined as a dangerous file and deleted by the e-mail client on the receiving side, so that the EXE file may be included in another file format. As shown in FIG. 14, when the process of the file encryption unit 130 is performed after the processing of the personal information check unit 140, the file ID is included in the file together with the EXE file, or the personal information check unit 140 receives a check. By including a mark indicating that the file has been changed, the file can be traced even if the file name is changed, or it can be easily confirmed that the file has been checked for personal information. It becomes possible.

  FIG. 4 is a diagram showing the flow of processing of the personal information check program 400 that implements the personal information check unit 140. The target file is a CSV (Comma Separated Value) file separated by commas. The character string separated by commas is “item”, and the item name such as name, phone number, postal code, and gender is “item”. Attribute ".

  When the personal information check program 400 is activated, it activates an item attribute determination program 500 to determine an attribute for each item. In step 410, the determined result determines whether one of the item attributes is a name, and one of the item attributes is determined to be a phone number, a zip code, a gender or a date of birth, If negative, the process proceeds to step 470, where it is determined that the file is not a personal information file, and the process ends. If the determination is positive, the plaintext file 201 is opened in step 420, and one line is read in step 425 (a plurality of items may exist in one line). If it is the file end code 425, the process proceeds to step 460. Otherwise, the process proceeds to step 430.

  Details of the item attribute determination program in step 500 will be described later with reference to FIG. In the case of the present embodiment, the criteria for determining whether or not the file is a personal information file is that the name is an essential requirement, and any one attribute of the telephone number, the postal code, and the gender date of birth is an essential requirement. This criterion can be appropriately changed according to the specific method of the personal information file. The following description will be made assuming that the personal information file is an Excel file in CSV format, but it is naturally not limited to an Excel file. As an example of an Excel file, there are item attributes that represent the name, phone number, postal code, gender, and date of birth on the first line, and each person's full name is listed in the name column (vertical) for each line. Suppose a file in which a telephone number corresponding to each first name and last name is listed for each row in the column of.

  In step 430, one line is divided into items, and in step 435, it is determined whether or not all items have been checked. If not, the process is distributed according to the attribute determination result of the item (with items over). If the attribute of the item is a name, go to Step 600, if it is a telephone number, go to Step 700, if it is a postal code, go to Step 800, if it is gender, go to Step 900, if it is a date of birth, go to Step 1000. Then, a determination process is performed to determine whether the attribute is the same as the item attribute.

  When all the items are completed, the process proceeds to step 440, where it is determined whether the determination result includes a name and a telephone number, a postal code, a gender, or a date of birth. If negative, the process proceeds to step 445, where it is determined that the information is not personal information, the process returns to step 425, the next line is read, and the processing is continued.

  If it is determined in step 425 that the reading of the file has been completed, the process proceeds to step 460, the ratio determined as personal information is calculated, and if the ratio determined as personal information is 70% or more, the process proceeds to step 465. If it is determined that the file is a personal information file, if it is less than 70%, the process proceeds to step 470, where it is determined that the file is not a personal information file, and the process ends. Here, if 70% or more of the positive (Yes) and negative (No) in the determination in Step 440 is positive (Yes), this plaintext file is determined to be a personal information file.

  It is assumed that the file targeted by the personal information check program 400 is a CSV format file separated by commas, but in the case of a text file, it is also possible to target a character string separated by a space instead of a comma. It is. In addition, since a file or an image file with a password cannot be checked, pre-processing for determining that the determination is impossible is performed before starting the item attribute determination program 500. If the file cannot be determined, the check result processing program 1300 shown in FIG. 13 notifies the user department that the file cannot be determined.

  FIG. 5 is a diagram showing the flow of processing of the item attribute determination program 500. The item attribute determination method reads the first 10 lines of the file (all lines if less than 10 lines), determines the attribute for each item in each line, and the same item (in the above-described example of Excel) In the vertical first column), if there is an attribute with a ratio of 50% or more determined to be the same attribute (for example, name), the attribute of the item is determined.

  When the attribute determination program 500 is activated by the personal information check program 400, the plaintext file 201 is opened in step 510 and a line is read in step 515. In step 520, it is determined whether the file is the end or the 11th line. If the file is positive, the process proceeds to step 530. If the file is negative, the process proceeds to step 525. It is determined whether or not all items have been checked. If the determination in step 555 is positive, the process returns to step 515 to read the next line from the file.

  If the determination in step 555 is negative, the process proceeds to step 556, an item that has not been checked is taken out, and a name determination process 600 is performed. If the determination result in step 560 is positive (determined as a name), step Returning to 555, if it is negative (determined as not being a name), the telephone number determination process 700 is similarly performed. If the determination result is positive (determined as a telephone number) in step 565, the process returns to step 555. If it is negative (determined that it is not a telephone number), a zip code determination process 800 is performed. If the determination result is positive (determined as a zip code) in step 570, the process returns to step 555, and is negative (not a zip code). If the determination result is positive (determined as gender) in step 575, the gender determination process 900 is performed. Returning to 55, if it is negative (is determined not to be a sex) performs birth determination process 1000 returns to step 555.

  If it is determined to be positive in step 520, the process proceeds to step 530 to determine whether or not all items have been attributed. If the determination has been completed, the program ends. If the determination is not completed, the process proceeds to step 535 to calculate the ratio of the same attribute for the same item (read the first 10 lines of the file, the same attribute in the vertical column of each line of the same item, For example, a ratio of names is calculated). In step 540, it is determined whether the ratio is 50% or more. If the determination is positive, the process proceeds to step 550 to determine the attribute of the item, and the process returns to step 530. If the determination in step 540 is negative, the item attribute is determined to Other in step 545 and the process returns to step 530.

  As shown in FIG. 4 and FIG. 5, attributes are determined for all items in the first 10 rows (attribute determination is performed for each item as shown in FIG. 5), and the attributes of each item are determined. By determining whether or not the attribute is determined for each item later for all lines of the file (from the 11th line onward, for each line read without determining the attribute of each item (as in FIG. 5)) Since the determination process can be performed with fewer steps than the determination for all items, the time for checking and the CPU load can be reduced.

  Next, the processing flow of the determination program for determining each attribute of an item that is a file character string in the personal information file monitoring system according to the present embodiment will be described with reference to FIGS. FIG. 6 is a diagram showing a processing flow of a name determination program as an attribute of an item which is a file character string according to the present embodiment. FIG. 7 is a diagram illustrating a processing flow of a program for determining a telephone number as an attribute of an item which is a file character string according to the present embodiment. FIG. 8 is a diagram showing a processing flow of a determination program for a postal code as an attribute of an item which is a file character string according to the present embodiment. FIG. 9 is a diagram showing a processing flow of a sex determination program as an attribute of an item which is a file character string according to the present embodiment. FIG. 10 is a diagram showing a process flow of the date of birth determination program as an item attribute which is a file character string according to the present embodiment.

  FIG. 6 is a diagram showing the flow of processing of the name determination program 600. When the name determination program 600 is activated with the character string of the item as an argument, in step 610, the character string is divided by a space, and in step 615, it is determined whether there are three or more character strings. If the determination in step 615 is positive, the process proceeds to step 665, where it is determined that the name is not a name, and the process ends. If the determination in step 615 is negative, the process proceeds to step 620 to determine whether or not the first character string is one character. If the determination is positive, the process proceeds to step 665 to determine that the name is not a name and the process ends. The reason that it is not a full name in the case of a single letter is because the appearance frequency of a single letter last name is low, and here it is not the purpose of accurately judging whether it is a surname, but the probability that it is judged as a surname This is because the purpose is to detect a file having a high value.

  If the determination in step 620 is negative, the process proceeds to step 622 to determine whether the number of divided character strings is two. If it is positive, the process proceeds to step 623, the first character string is regarded as a surname, and the process proceeds to step 645. If the determination in step 622 is negative, there is one divided character string. In this case, the process proceeds to step 625 to determine whether the character code is half-width kana or full-width kana. If the determination in step 625 is positive. If the determination is negative, the process proceeds to step 640 to determine whether the character code is a Chinese character. If the determination at step 625 is negative, the process proceeds to step 640. If there is, the process proceeds to step 635 and the first two characters of the first character string are regarded as the last name, and the process proceeds to step 645. If it is determined to be negative in step 630, the process proceeds to step 665 and it is determined that the name is not the name. This is because the appearance frequency of two-letter surnames is high in the case of kanji and the appearance frequency of three-letter surnames is high in the case of kana.

  In step 645, the name candidate table 650 is searched using the character string set as the name candidate as a key. If the search hits in step 655, the process proceeds to step 660 to determine the name, and if the search does not hit, step 665 is executed. It is determined that it is not a full name and ends. Here, the name candidate table is created using name data having a large parameter such as a customer database. Here, it is assumed that three types of full-width kana, half-width kana, and kanji are prepared, and the top 200 items are owned as a table in descending order.

  FIG. 7 is a diagram showing the flow of processing of the telephone number determination program. When the telephone number determination program 700 is activated using the character string of the item as an argument, it checks whether it is a 10-digit or 11-digit number starting with 0 or a 7-digit number in step 710. Judgment criteria that the number of fixed-line numbers starting with the area code is 10 digits, the number of fixed-line numbers excluding the area code is 7 digits, and the number of digits of the mobile phone and PHS phone numbers is 11 digits I have to. If it is determined to be positive in step 710, it is determined to be a telephone number in step 720. If it is determined to be negative, it is determined in step 715 that it is not a telephone number, and the process ends.

  FIG. 8 is a diagram showing a flow of processing of the zip code determination program 800. When the zip code determination program 800 is started with an item character string as an argument, it starts with “〒” in step 810 and is composed of a 3-digit number, a hyphen, a 4-digit number, or an 〒 mark. Check if there are no 3 digits, hyphen, 4 digits. If it is determined to be positive in step 810, it is determined to be a zip code in step 820. If it is determined to be negative, it is determined to be not a zip code in step 815, and the process ends.

  FIG. 9 is a diagram showing a flow of processing of the sex determination program 900. When the gender determination program 900 is activated with the character string of the item as an argument, it checks in step 910 whether the character string is “male” or “female”. If it is determined to be positive in step 910, it is determined to be gender in step 920. If it is determined to be negative, it is determined in step 915 that it is not gender, and the process ends.

  FIG. 10 is a diagram showing the flow of processing of the determination program 1000 for the date of birth. When the birth date determination program 1000 is activated with the character string of the item as an argument, it checks in step 1010 whether the character string includes “year”, “month”, and “day”. If it is determined to be positive in step 1010, it is determined to be gender in step 1020. If it is determined to be negative, it is determined in step 1015 that it is not gender, and the process ends.

  As described above, as shown in FIGS. 4 to 10, the personal information file is determined by a simple method by determining whether or not it is a personal information file based on the percentage of information that is likely to be personal information. Can be detected.

  Next, a program for executing other components in the personal information file monitoring system according to the present embodiment will be described below with reference to FIGS. FIG. 11 is a diagram showing a processing flow of the mail control program for executing the mail control unit in the personal information file monitoring system according to the present embodiment. FIG. 12 is a diagram showing a processing flow of the download control program for executing the download control unit in the personal information file monitoring system according to the present embodiment. FIG. 13 is a diagram showing a processing flow of the check result processing program for executing the check result processing unit in the personal information file monitoring system according to the present embodiment.

  FIG. 11 is a diagram showing a flow of processing of the mail control program 1100 for executing the mail control unit 181 (see FIG. 1). When the mail control program 1100 is activated, it checks in step 1110 whether the attached file is encrypted with a predetermined encryption method (assuming that encrypted files other than the encrypted file 102 generated in FIG. 1 are not attached files). If the determination is negative, the mail is returned to the sender in step 1115 and the process is terminated. If the determination is positive, an e-mail is transmitted in step 1120, and an e-mail transmission log (for example, e-mail transmission date and time shown in FIG. 15) is converted into a file encryption log (not shown in FIG. File encryption date / time and user name) and store them in the database 111, and the process ends. Linking is performed by searching the database 111 for an ID corresponding to the ID included in the file name, and sending a flag or transmission date / time (shown in FIG. 15) to the log table 1500 shown in FIG. (See the date in the mail column).

  Whether the file is encrypted with a predetermined encryption method may be checked by checking the file encryption method. If the file includes a self-decryption file, the mark included in the file is the predetermined one. You may check if it is. Further, it may be determined whether or not the ID included in the file is searched from the database 111. As described above, the mail control unit 181 has a function of not transmitting a file to which an ID is not assigned (not embedded), and in addition, to identify whether the ID is given by the monitoring system or is not a camouflaged ID. , Even if it has an ID, whether a personal information check and encryption processing have been performed or not is detected with reference to a log (table of FIG. 15 as an example) to detect a match with an ID in the log, If they do not match, the file is not transmitted. Note that the function of the download control unit 182 to be described later has the same function as described above.

  FIG. 12 is a diagram showing the flow of processing of the download control program 1200 for executing the download control unit 182 (see FIG. 1). When the download control program 1200 is activated, it checks in step 1210 whether or not the file is encrypted with a predetermined encryption method (assuming that the file encrypted with a route different from the encryption route shown in FIG. 1 is not downloaded). If the determination is negative, a download disapproval message is displayed in step 1215, and the download process is interrupted and terminated. If the determination is positive, the download is started in step 1220, the download log is linked to the file encryption log in step 1225, stored in the database 111, and the process ends. In the case of downloading, it is possible to check whether or not the data is linked by a method similar to that of the mail control program 1100 and whether or not the data is encrypted by a predetermined encryption method.

  When retrieving a file from the server, it is possible to restrict file export by controlling the download. On the client PC, file export can be controlled by controlling the export operation to external media. It is possible to limit. Therefore, the client PC replaces the download process with an external medium write process.

  FIG. 13 is a diagram showing a flow of processing of the check result processing program 1300 for executing the check result processing unit 190 (see FIG. 1). When the check result processing program 1300 is activated, it receives the determination result of the personal information check program 400 in step 1310. If the determination result is a personal information file, the process proceeds to step 1320, and a predetermined department such as the information management department is notified by mail. If it is determined that the determination result cannot be determined, the process advances to step 1330 to notify the user department that has performed the file encryption process by e-mail, and the process ends.

  FIG. 15 shows a log table 1500 stored in the database 111 shown in FIG. The log storage unit 110 has a file name, an ID (the program automatically adds), a user name (login name) (a person who takes out the file), a file determined by the personal information check unit 140 by the personal information check program 400, The department to which the user belongs, the date and time (date and time of personal information check), the file size, and the check result are stored in the database 111. The contents of the log table 1500 are not limited to those shown in FIG. 15, but may include a file encryption log (encryption date and time) and an ID-added file name (a file name with an ID added).

  In the check result processing program 1300 (see FIG. 13), the department in charge and the department in charge are notified by e-mail according to the check result, but a flag indicating whether or not the relevant department has been notified may be stored. By storing not only the flag but also the ID of the notification mail, the contents of the mail can be referred to later when necessary. Further, the mail control program 1100 and the download control program 1200 search for an ID that matches the ID included in the file name, and write a flag indicating that the ID has been attached / downloaded to the mail. Also, the date and time at that time may be written.

  If the personal information check result is referred to and the personal information file is determined, attachment / downloading may be prohibited. Use of encrypted files by associating and saving logs of email transmission and download and logs (file encryption logs) when encryption processing is performed to safely take out files Can be displayed, and further, the usage of the encrypted personal information file can be searched, so that it is possible to expect a deterrent effect on easy handling of the personal information file.

In this way, when a file is encrypted, it is checked whether it is a personal information file, and files that are taken outside the company, such as attached to an e-mail, will be encrypted. Even in the case of eavesdropping on the road, the risk of information leakage can be reduced, and the security of information security can be increased. For administrators, it is possible to control file export without setting access privileges to the file.
As described above, the personal information file according to the embodiment of the present invention is characterized by having the following configuration and effects. In other words, the user detects an operation such as drag and drop for taking out the file, checks whether or not the file is a personal information file, logs it, and generates an encrypted file according to the check result. Provide functions. If an encryption application is installed on the computer and the file to be taken is encrypted in advance, check whether it is a personal information file after converting it back to plain text. Re-encryption because it is not possible).

  Requesting certainty for the personal information check, for example, if the number of files to be brought out increases due to an increase in the number of emails, the time and load for checking increase accordingly, which may hinder the flow of work. A function to easily check personal information is provided. In particular, when the business system is configured as a server type, a monitoring system configuration for protecting personal information is required so that the business server is not loaded. In order to reduce the load on the server, an encrypted file is generated after copying the file, and a function for checking personal information using a file copied at a time when the usage rate for work is low is provided. It is also possible to check the personal information file being taken out without affecting the business.

  As another method, a processing server is provided separately from the business server, the file to be taken is sent from the business server to the processing server, personal information is checked and an encrypted file is generated at the processing server, and the processing server is switched to the business server. A configuration in which the encrypted file is sent back is also conceivable.

  In the unlikely event that a file is leaked, a function that displays the log of the result of checking the generation of an encrypted file and personal information and the file export (email transmission log, file download log, etc.) is displayed. It is also possible to analyze the outflow path of the file.

  As described above, the outline of the present embodiment is that the user detects an operation such as drag and drop for taking out the file, checks whether or not the file is a personal information file, takes the log, and checks the result. A function to generate an encrypted file according to the file, a plain text file, a personal information check log of the file (user name, department, etc. in FIG. 15), and an encrypted file generation log of the file (when the file is encrypted) (Date and user name) and file takeout log (email, download date, etc.) are stored in association with each other so that the file outflow route can be analyzed when the file is outflowed. As an application field of this embodiment, in the security field for preventing leakage of corporate information and personal information, personal information is checked when an encrypted file is generated and stored in a file attached to an e-mail or external media By limiting the files to be encrypted to encrypted files, there is a possibility of use such as preventing information leakage. An encrypted file can be generated by a method operated by a user operation, a method used by being incorporated in a mail attachment function, a method incorporated and used by a function for writing to an external medium, or the like.

It is a block diagram which shows the whole structure in the monitoring system of the personal information file which concerns on embodiment of this invention. It is a figure which shows the flow of a process of the file conversion operation detection program in the personal information file monitoring system which concerns on this embodiment. It is a figure which shows the flow of a process of the file encryption program in the personal information file monitoring system which concerns on this embodiment.

It is the figure which showed the flow of the process of the file encryption program. (Example 1)
It is a figure which shows the flow of a process of the personal information check program in the personal information file monitoring system which concerns on this embodiment. It is a figure which shows the flow of a process of the item attribute determination program in the personal information file monitoring system which concerns on this embodiment. It is a figure which shows the processing flow of the name determination program as an attribute of the item which is a file character string regarding this embodiment. It is a figure which shows the processing flow of the determination program of the telephone number as an attribute of the item which is a file character string regarding this embodiment. It is a figure which shows the processing flow of the determination program of a zip code as an attribute of the item which is a file character string regarding this embodiment. It is a figure which shows the processing flow of the sex determination program as an attribute of the item which is a file character string regarding this embodiment. It is a figure which shows the processing flow of the determination program of a birth date as an attribute of the item which is a file character string regarding this embodiment. It is a figure which shows the processing flow of the mail control program which implements the mail control part in the personal information file monitoring system which concerns on this embodiment. It is a figure which shows the processing flow of the download control program which implements the download control part in the personal information file monitoring system which concerns on this embodiment. It is a figure which shows the processing flow of the check result processing program which implements the check result process part in the personal information file monitoring system which concerns on this embodiment. It is a figure which shows the other structural example of the personal information file taking-out monitoring function in the personal information file monitoring system which concerns on this embodiment. It is a figure which shows the content of the log table stored in the database in the personal information file monitoring system which concerns on this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Personal information file take-out monitoring function 101 Plain text file 102 Encrypted file 103 Mail to related department 110 Log storage part 111 Log / plain text data database 112 Usage authority check system 120 File conversion operation detection part 130 File encryption part 140 Personal information Check unit 180 File take-out operation monitoring function 181 Mail control unit 182 Download control unit 190 Check result processing unit

Claims (16)

A file conversion operation detection unit for detecting a conversion operation for taking out a plain text file by a user;
A file encryption unit that encrypts a plaintext file that is the target of the conversion operation;
In parallel with the encryption process, a personal information check unit that detects whether or not the plaintext file that is the detection target of the conversion operation is a personal information file,
When the file conversion operation detection unit detects the conversion operation, a unique ID corresponding to the plaintext file is assigned, and the file encryption program and the personal information check program are given the plaintext file with the assigned ID as an argument. Start
A personal information file monitoring system, wherein a log including a plaintext file name with an ID and a user name or login name is generated and stored. A file conversion operation detection unit for detecting a conversion operation for taking out a plain text file by a user;
A personal information check unit that detects whether or not the plaintext file that is the detection target of the conversion operation is a personal information file;
A file encryption unit that encrypts a plaintext file that is the detection target of the conversion operation according to a detection result in the personal information check unit,
When the file conversion operation detection unit detects the conversion operation, a unique ID corresponding to the plaintext file is assigned, and the file encryption program and the personal information check program are given the plaintext file with the assigned ID as an argument. In order,
A personal information file monitoring system, wherein a log including a plaintext file name with an ID and a user name or login name is generated and stored. In claim 1 or 2,
The personal information file monitoring system, wherein the log further includes a plain text file take-out date and a plain text file encryption date and time. In claim 1, 2 or 3,
When the file input to the file conversion operation detection unit is not a plaintext file but an encrypted file, the encrypted file is decrypted by the file encryption unit and returned to the plaintext file,
The personal information file monitoring system, wherein the plain text file subjected to the decryption process is input to the personal information check unit. In claim 1 or 2,
It is possible to prevent information leakage of the personal information file and analyze the information outflow route by generating the encrypted file and storing the plaintext file name with ID, the user name or the login name. A personal information file monitoring system. In claim 1 or 2,
The personal information check unit
It is determined whether or not attributes such as name, telephone number, postal code, gender, date of birth are included in items separated by a predetermined symbol from the beginning of the plaintext file to a predetermined part, and the same item If the ratio determined to be the same attribute for is greater than or equal to a predetermined value, determine the attribute of the item,
Determine whether the attribute of the item determined for each item of the plaintext file matches,
If the name and any other attributes are included, it is determined to be personal information,
A personal information file monitoring system, characterized in that a personal information file is determined when a ratio determined as the personal information when reading of the plaintext file is over a predetermined value. In claim 6,
In determining the attribute of the item, the ratio of the same item determined to be the same attribute is 50% or more,
The personal information file monitoring system is characterized in that the determination of the personal information file is a case where the ratio determined as personal information is 70% or more. In claim 6 or 7,
The determination of the name is as follows:
The character string in the item is divided by a space, and if the number of divided character strings is 3 or more, it is determined that the name is not a name, and if the first character string of the divided character string is one character, it is not a name. And
If the number of divided character strings is two, the first character string is regarded as the last name,
If the number of divided character strings is 1, if the character string code is half-width kana or full-width kana, the first 3 characters are considered as the last name, and if the character string is kanji, the first 2 characters are regarded as the last name.
A personal information file monitoring system, wherein a name candidate table is searched with the character string regarded as the last name, and when the corresponding surname is hit, it is determined to be a full name. In claim 1 or 2,
A mail control unit for sending the file attached to an email;
The mail control unit retrieves the ID given to the file name of the attached file when sending an e-mail, searches the log generated when the personal information file is checked and encrypted, and retrieves the log If there is no ID corresponding to the received ID, the mail transmission process is interrupted and the mail is returned to the transmission source. In claim 1 or 2,
A mail control unit for sending the file attached to an e-mail;
The mail control unit retrieves the ID given to the file name of the attached file when sending an e-mail, searches the log generated when the personal information file is checked and encrypted, and retrieves the ID If there is an ID corresponding to the received ID, a mark indicating that the mail was sent as an example is added to the log. In claim 1 or 2,
A download control unit for downloading the file;
The download control unit retrieves the ID given to the file name of the file at the time of download, searches the log generated when the personal information file is checked and encrypted, and corresponds to the retrieved ID A personal information file monitoring system, characterized in that the download processing of the file corresponding to the ID is interrupted if there is no ID. In claim 1 or 2,
A download control unit for downloading the file;
The download control unit retrieves the ID given to the file name of the file at the time of download, searches the log generated when the personal information file is checked and encrypted, and corresponds to the retrieved ID In the case where there is, a personal information file monitoring system, wherein a download mark is added to the log, taking a download date and time as an example. A file conversion operation detection unit that detects a conversion operation for taking out a plaintext file by a user, a file encryption unit that encrypts a plaintext file that is the detection target of the conversion operation, and a detection target of the conversion operation A monitoring method for monitoring a personal information file, comprising: a personal information check unit for detecting whether the plaintext file is a personal information file; and a mail control unit for transmitting the file attached to an e-mail.
Assigning a unique ID corresponding to a plain text file when the file conversion operation detection unit detects the conversion operation;
The file encryption program and the personal information check program are activated with the assigned ID plaintext file as an argument, and whether the plaintext file is a personal information file in parallel with the encryption processing for the plaintext file. Detecting step;
Generating and storing a log including the plaintext file name with the ID and a user name or login name;
The ID given to the file name of the attached file is extracted at the time of e-mail transmission, the log generated when the personal information file is checked and encrypted, and the ID corresponding to the extracted ID If there is no ID, the mail transmission process is interrupted, and if the corresponding ID exists, the mail transmission date and time is added to the log. A file conversion operation detection unit that detects a conversion operation for taking out a plaintext file by a user, a file encryption unit that encrypts a plaintext file that is the detection target of the conversion operation, and a detection target of the conversion operation A monitoring method for monitoring a personal information file, comprising: a personal information check unit for detecting whether the plaintext file is a personal information file; and a mail control unit for transmitting the file attached to an e-mail.
Assigning a unique ID corresponding to a plain text file when the file conversion operation detection unit detects the conversion operation;
Activating the personal information check program with the given plaintext file with ID as an argument, and detecting whether the plaintext file is a personal information file;
Activating the file encryption program with the assigned plaintext file with ID as an argument when it is detected as a personal information file, and performing encryption processing on the plaintext file;
Generating and storing a log including the plaintext file name with the ID and a user name or login name;
The ID given to the file name of the attached file is extracted at the time of e-mail transmission, the log generated when the personal information file is checked and encrypted, and the ID corresponding to the extracted ID If there is no ID, the mail transmission process is interrupted, and if the corresponding ID exists, the mail transmission date and time is added to the log. A file conversion operation detection unit that detects a conversion operation for taking out a plaintext file by a user, a file encryption unit that encrypts a plaintext file that is the detection target of the conversion operation, and a detection target of the conversion operation A monitoring method for monitoring a personal information file, comprising: a personal information check unit for detecting whether the plaintext file is a personal information file; and a download control unit for downloading the file,
Assigning a unique ID corresponding to a plain text file when the file conversion operation detection unit detects the conversion operation;
The file encryption program and the personal information check program are activated with the assigned ID plaintext file as an argument, and whether the plaintext file is a personal information file in parallel with the encryption processing for the plaintext file. Detecting step;
Generating and storing a log including the plaintext file name with the ID and a user name or login name;
When downloading, the ID given to the file name of the attached file is taken out, the log generated when the personal information file is checked and encrypted, and there is no ID corresponding to the taken out ID A method of monitoring a personal information file, comprising: a step of interrupting download processing and adding a download date and time to the log when a corresponding ID exists. A file conversion operation detection unit that detects a conversion operation for taking out a plaintext file by a user, a file encryption unit that encrypts a plaintext file that is the detection target of the conversion operation, and a detection target of the conversion operation A monitoring method for monitoring a personal information file, comprising: a personal information check unit for detecting whether the plaintext file is a personal information file; and a download control unit for downloading the file,
Assigning a unique ID corresponding to a plain text file when the file conversion operation detection unit detects the conversion operation;
Activating the personal information check program with the given plaintext file with ID as an argument, and detecting whether the plaintext file is a personal information file;
Activating the file encryption program with the assigned plaintext file with ID as an argument when it is detected as a personal information file, and performing encryption processing on the plaintext file;
Generating and storing a log including the plaintext file name with the ID and a user name or login name;
When downloading, the ID given to the file name of the attached file is taken out, the log generated when the personal information file is checked and encrypted, and there is no ID corresponding to the taken out ID A method for monitoring a personal information file, comprising: interrupting a download process and adding a download date and time to the log when a corresponding ID exists.

Images