JP6078437B2 - Personal information anonymization system - Google Patents

Description

  The present invention relates to a personal information anonymization system that anonymizes personal information.

  With the development of cloud computing and distributed processing technology, it has become possible to analyze and utilize a large amount of data accumulated by companies and organizations so far in a realistic time. On the other hand, in many cases, these data include information that can identify an individual such as a name and an address, and information about an individual that cannot necessarily identify an individual such as age, occupation, and educational background. Such information is called personal information. Utilization of personal information must be done with consideration for privacy protection in order to prevent privacy infringement.

  This privacy protection cannot be realized simply by deleting personal information defined by the Personal Information Protection Law. For example, even if information that can identify an individual such as an identification number is deleted from personal information, an individual may be identified by combining attributes such as age, nationality, and occupation that cannot be identified by itself. . Such attributes that can be identified by combining them are called quasi-identifiers. As a technique for preventing an individual from being identified by a combination of quasi-identifiers, there is k anonymization. k anonymization is a technique for obscure attribute values so that a combination of quasi-identifiers of personal information appears in a document over a predetermined anonymization threshold value k. For example, in k-anonymization, a combination of attribute values “31 years old, Japanese, system engineer” is obscured as “30s, Japanese, IT”.

  In k anonymization that is an anonymization technique of personal information, a data structure called a generalized hierarchy is used to obscure the attribute value of the quasi-identifier of personal information. This generalized hierarchy can be generated according to the appearance frequency of the attribute value of the quasi-identifier of personal information using the technique shown in Patent Document 1. By performing k anonymization using the generalized hierarchy obtained in this way, it is possible to suppress the loss of accuracy of information.

The generalized hierarchy is composed of tree-structured nodes with the root at the top, and is divided into several layers. Such a layer constituting the generalized hierarchy is called a layer.
When the personal information, the quasi-identifier of the personal information, and the combination of the layers of the generalized hierarchy of the quasi-identifier are determined, the personal information can be anonymized according to the combination. This combination of the layers of the generalized hierarchy of quasi-identifiers is called an anonymization plan. When a generalized hierarchy of personal information and its quasi-identifier is given and a k-anonymization threshold is determined, there are generally a plurality of anonymization plans that can satisfy this k-anonymization threshold. Therefore, it is necessary to select an optimal anonymization plan from among them. Regarding the selection of the anonymization plan, the method shown in Non-Patent Document 1 is known. In this method, the anonymization plan is selected based on the proximity to the designated k anonymization threshold, the low layer of the generalized hierarchy, and the like.

  Since the quality of the anonymized data obtained by k anonymization depends on the generalization hierarchy and the anonymization plan, it is necessary to be able to grasp the influence by the editing of the generalization hierarchy. There is a loss information amount as an index representing the quality of the anonymized data. Several techniques for calculating the loss information amount have been proposed, but a technique for calculating the loss information amount as information entropy based on the appearance frequency of the attribute value is also proposed in Patent Document 1. This technology has the feature that the amount of information can be evaluated in accordance with personal information to be anonymized.

International publication WO2011 / 145401 pamphlet

Hitachi Consulting Co., Ltd .: 2009 Ministry of Economy, Trade and Industry Information Grand Voyage Project (Development, improvement and verification of common infrastructure technology) Development, completion and verification of personal information protection / analysis infrastructure External specification of personal information anonymization platform p . 53 (March 2010)

The generalized hierarchy obtained by using the technique shown in Patent Document 1 can suppress the loss of information accuracy, but is not always suitable for analysis purposes. For example, if the attribute values of the quasi-identifiers of nationalities “French (France)” and “China (China)” are generalized to the attribute value “French China (France and China)” in the next higher layer, Generalization is not appropriate when the analysis using anonymized data places importance on the global regional division of the country represented by nationality.
On the other hand, if the user does not use the technique shown in Patent Document 1 and creates a generalized hierarchy by one's own hand, how much information will be lost if anonymization is not performed once using the generalized hierarchy Therefore, anonymized data suitable for analysis purposes is not always obtained.

  An object of the present invention is to provide a personal information anonymization system capable of editing a generalized hierarchy in order to obtain anonymized data suitable for analysis purposes.

In order to solve the above problems, the personal information anonymization system of the present invention is:
Based on the anonymization target data including a combination of attribute values of a plurality of quasi-identifiers to be anonymized, for each quasi-identifier, the attribute value included in the anonymization target data and the appearance frequency of the attribute value A lowermost layer including a plurality of nodes, and a layer including one or more nodes having an attribute value having the same or higher degree of anonymization as compared to the lower layer and an appearance frequency of the attribute value. A generalized hierarchy creating means for creating a generalized hierarchy of a tree structure,
In response to the designation of the quasi-identifier by the user, a generalized hierarchy presentation means for presenting the generalized hierarchy of the designated quasi-identifier to the user;
Generalized hierarchy editing in which the generalized hierarchy presented by the generalized hierarchy presenting means is updated while maintaining a tree structure in accordance with an editing instruction by the user, and the updated generalized hierarchy is re-presented to the user. Means,
In response to designation of the generalized hierarchy layer of each semi-identifier by the user, the attribute value of each semi-identifier included in the anonymization target data belongs to the general hierarchy layer of the designated semi-identifier Anonymization means for creating anonymized data replaced with attribute values of
It is characterized by providing.

Preferably, the personal information anonymization system of the present invention is
A loss index calculating means for determining an information loss index of each layer of the generalized hierarchy;
The generalized hierarchy presenting means and the generalized hierarchy editing means present the information loss index of each layer included in the generalized hierarchy obtained by the loss index calculating means to the user;
It is characterized by that.

Preferably, the personal information anonymization system of the present invention is
The anonymization means modifies the anonymization data so that an appearance frequency of a combination of attribute values of each quasi-identifier included in the anonymization data satisfies a k anonymization threshold specified by a user. The personal information anonymization system according to claim 1 or 2.

Preferably, the personal information anonymization system of the present invention is
The editing in the generalized hierarchy editing means includes a node name change, a node movement, a layer addition, and a layer deletion.

  According to the present invention, the generalized hierarchy can be edited in order to obtain anonymized data suitable for analysis purposes.

It is a figure which shows an example of a structure of the personal information anonymization system which concerns on embodiment of this invention. It is a figure which shows an example of the generalization hierarchy edit screen. It is a figure which shows an example of the screen of an anonymization object data taking-in dialog. It is a figure which shows an example of the screen of an anonymization execution dialog. It is a figure which shows an example of the item which can be selected by the context menu displayed on a generalization hierarchy editor. It is a figure which shows an example of "a node name change." It is a figure which shows the 1st example of "node movement." It is a figure which shows the 2nd example of "node movement." It is a figure which shows the 3rd example of "node movement." It is a figure which shows an example of a structure of the anonymization object data. It is a figure which shows an example of a structure of management data. It is a figure which shows an example of a structure of generalized hierarchy data. It is a figure which shows an example of a structure of semi-identifier tuple frequency data. It is a figure which shows an example of the flow of the frequency table calculation process after anonymization in the frequency table calculation part after anonymization. It is a figure which shows an example of a generalization hierarchy. FIG. 15A shows an example of a generalized hierarchy of the quasi-identifier “age”. FIG. 15B shows an example of a generalized hierarchy of the quasi-identifier “nationality”. FIG. 15C is a diagram showing an example of a generalized hierarchy of the quasi-identifier “major”. It is a figure which shows an example of the tuple frequency table after anonymization. It is a figure which shows an example of the flow of the loss index calculation process in a loss index calculation part. It is a figure which shows an example of the frequency table for every semi-identifier. FIG. 18A shows an example of a frequency table of the quasi-identifier “age”. FIG. 18B shows an example of a frequency table of the quasi-identifier “nationality”. FIG. 18C shows an example of a frequency table of the quasi-identifier “major”. It is a figure which shows an example of the frequency table after anonymization for every semi-identifier. FIG. 18A shows an example of a frequency table after anonymization of the quasi-identifier “age”. FIG. 18B shows an example of a frequency table after anonymization of the quasi-identifier “nationality”. FIG. 18C shows an example of an anonymized frequency table of the semi-identifier “major”. It is a figure which shows an example of the flow of a generalization hierarchy preparation process. It is a figure which shows an example of the flow of a generalization hierarchy presentation process. It is a figure which shows an example of the flow of a generalization hierarchy edit process. It is a figure which shows an example of the flow of the generalization hierarchy preservation | save process in a generalization hierarchy preservation | save part. It is a figure which shows an example of the flow of the anonymization process in the anonymization process part.

Hereinafter, a personal information anonymization system according to an embodiment of the present invention will be described with reference to the accompanying drawings. However, it should be noted that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention.
In all the drawings for explaining the embodiments, common constituent elements are denoted by the same reference numerals, and repeated explanation is omitted.

(overall structure)
FIG. 1 shows an example of the configuration of a personal information anonymization system 100 according to an embodiment of the present invention.
The personal information anonymization system 100 is connected to a network 180 such as the Internet. The network 180 is connected to a generalized hierarchy editing accepting device 170. The personal information anonymization system 100 and the generalized hierarchy editing accepting device 170 can communicate with each other via the network 180.
The generalized hierarchy editing reception apparatus 170 provides a user with a user interface for editing the generalized hierarchy. The generalized hierarchy edit accepting apparatus 170 is realized by a personal computer, for example. For example, the generalized hierarchy editing reception apparatus 170 may implement a user interface as a Web page displayed on a Web browser, or use SWT (Standard Widget TOOLkit), which is a Java (registered trademark) graphical user interface component. The user interface may be realized as a window of the client server application.

The personal information anonymization system 100 includes an anonymization device 101 and a personal information management device 150.
The anonymization device 101 is an application server or the like, and includes a CPU (Central Processing Unit), a main memory composed of RAM (Random Access Memory) and the like, and a storage device composed of a hard disk and the like.
The storage device of the anonymization device 101 stores an anonymization program.
The CPU of the anonymization device 101 reads the anonymization program from the storage device into the main memory and executes it, so that the user interface unit 110, the generalized hierarchy creation unit 111, the generalized hierarchy presentation unit 112, and the generalized hierarchy The functions of the editing unit 113, the post-anonymization frequency table calculation unit 114, the loss index calculation unit 115, the generalized hierarchy storage unit 116, and the anonymization processing unit 117 are realized. The temporary storage unit 120 is a storage area provided in the main memory or the storage device of the anonymization device 101.
The personal information management device 150 is realized as a storage on a database product. As a method for realizing the personal information management apparatus 150, a relational database, a key-value type distributed database, or the like can be considered. The personal information management device 150 manages anonymization target data 151, management data 152, generalized hierarchy data 153, semi-identifier tuple frequency data 154, and anonymization data 155.
The anonymization device 101 and the personal information management device 150 may be realized by the same computer or may be realized by separate computers.

As will be described later, the user interface unit 110 displays the generalized hierarchy editing screen 200 shown in FIG. When the generalized hierarchy editing accepting apparatus 170 transmits various information input on the generalized hierarchy editing screen 200 to the anonymization apparatus 101, the user interface unit 110 receives the information and passes it to other units.
Generalization hierarchy creation part 111 will acquire a data file, if information, such as a name of anonymization object data, a data file location where anonymization object data is stored, k anonymization threshold, and attribute information, is received. Then, the generalized hierarchy creating unit 111 creates anonymization target data, generalized hierarchy data, and quasi-identifier tuple frequency data from the data file, and anonymization target data 151, management data 152, and general data are stored in the personal information management device 150. Write hierarchical data 153 and semi-identifier tuple frequency data 154.
When the generalized hierarchy presentation unit 112 receives the designation of the semi-identifier by the user using the generalized hierarchy editing accepting apparatus 200, the generalized hierarchy presenting unit 112 reads the generalized hierarchy data 153 of the designated semi-identifier from the personal information management apparatus 150, and has a tree structure. And is stored in the temporary storage unit 120. Then, the generalized hierarchy presentation unit 112 displays the generalized hierarchy and the like stored in the temporary storage unit 120 on the generalized hierarchy editing screen of the generalized hierarchy editing accepting apparatus 170. “Displaying the generalized hierarchy etc. on the generalized hierarchy editing screen of the generalized hierarchy editing accepting apparatus 170” means “presenting the generalized hierarchy of the specified quasi-identifier to the user” in the present invention. It is an example.
The generalized hierarchy editing unit 113 updates the generalized hierarchy presented by the generalized hierarchy presenting unit 112 while maintaining the tree structure in response to an editing instruction from the user.

The post-anonymization frequency table calculation unit 114 calculates the appearance frequency of the combination of quasi-identifiers when the attribute value of the quasi-identifier of the anonymization target data is anonymized, and the combination of quasi-identifiers after anonymization and the appearance frequency thereof An anonymized tuple frequency table including
The loss index calculation unit 115 calculates the amount of information before and after anonymization based on the post-anonymization tuple frequency table output by the post-anonymization frequency table calculation unit 114, and how much information accuracy is obtained from the data before anonymization. An information loss rate, which is an information loss index indicating whether or not an error has occurred, is calculated.

The generalized hierarchy storage unit 116 writes the generalized hierarchy stored in the temporary storage unit 120 as the generalized hierarchy data 153 of the personal information management device 150 according to the user's saving operation.
The anonymization processing unit 117 obtains anonymized data from the anonymization target data in response to the anonymization request by the user. Then, the anonymization processing unit 117 corrects the anonymization data so as to satisfy the k anonymization threshold specified by the user, and writes the data as anonymization data 155 of the personal information management device 150.
The generalized hierarchy creating unit 111 is an example of the general hierarchy creating unit of the present invention, the generalized hierarchy presenting unit 112 is an example of the generalized hierarchy presenting unit of the present invention, and the generalized hierarchy editing unit 113 is the present invention. The anonymization processing unit 117 is an example of the anonymization unit of the present invention, and the post-anonymization frequency table calculation unit 114 is an example of the post-anonymization frequency table calculation unit of the present invention. is there.

(Generalized hierarchy editing reception device)
The generalized hierarchy editing accepting apparatus 170 displays the generalized hierarchy editing screen 200 shown in FIG. 2 on the display.
Generalized hierarchy editing screen 200 includes menu bar 210, anonymization setting display area 250, loss index evaluation area 260, and generalized hierarchy editor 270.
In the menu bar 210, “data” and “generalized hierarchy” are displayed as items. When the “data-capture” menu 220 is selected by an operation such as left-clicking the menu bar 210 with a mouse, an anonymization target data capture dialog 221 shown in FIG. 3 is opened on the display. As will be described later, a data name and a data file path are designated on the anonymization target data import dialog 221, a k anonymization threshold is set, and anonymization target data attributes and quasi-identifier information are selected. it can.
When the “data-anonymization” menu 230 is selected by an operation such as left-clicking the menu bar 210 with the mouse, an anonymization execution dialog 231 shown in FIG. 4 is opened on the display.
Further, the generalized hierarchy can be saved in the generalized hierarchy data 153 of the information management apparatus 150 by selecting the “general hierarchy-save” menu 240 by an operation such as left-clicking the menu bar 210 with a mouse. .

  The anonymization setting display area 250 displays the data name set on the anonymization target data import dialog 221, the k anonymization threshold, the list of attributes of the anonymization target data, and the list of quasi-identifiers of the anonymization target data. To do. In FIG. 2, the list of attributes and the list of quasi-identifiers are displayed in separate areas, but they may be highlighted by a method such as displaying only the attributes corresponding to the quasi-identifiers in bold in the same area. Further, a button for adding or deleting a quasi-identifier may be provided between the attribute area and the quasi-identifier area.

The loss index evaluation area 260 displays the layers of the generalized hierarchy selected on the anonymization execution dialog 231 for all quasi-identifiers, and indicates the information loss rate when anonymization is executed using those layers. indicate.
When the layer of the quasi-identifier generalized hierarchy is selected on the anonymization execution dialog 231, the post-anonymization frequency table calculation unit 114 calculates a post-anonymization tuple frequency table according to the selected layer, and this anonymous The information loss rate is obtained based on the tuple frequency table after conversion. The information loss rate is calculated by a method defined in Equations 1 to 9 described later.

  The generalized hierarchy editor 270 displays the generalized hierarchy for each quasi-identifier, and the attribute value of the quasi-identifier or the generalized (anonymized) attribute value and its appearance frequency, and the information loss rate (IL: Information Loss rate) is displayed. Here, the appearance frequency means, for example, the number of times that the attribute value of the quasi-identifier appears in the anonymization target data. Also, the generalized hierarchy editor 270 updates the display of the generalized hierarchy and the information loss rate in accordance with editing operations such as node movement, node name change, layer addition and deletion by the user.

The generalization hierarchy is an attribute value of the quasi-identifier included in the data to be anonymized and an attribute having the same or higher degree of anonymization than the lowermost layer including a plurality of nodes having the appearance frequency and the lower layer A layer including one or more nodes having a value and its frequency of appearance.
For example, the generalized hierarchy editor 270 in FIG. 2 displays a generalized hierarchy of a quasi-identifier “nationality” for certain personal information. The upper row of each box represents the attribute value of the quasi-identifier “nationality” or the generalized (anonymized) attribute value, and the lower row represents the appearance frequency thereof.
The generalized hierarchy is composed of two or more arbitrary layers L ₀ ,..., L _J−1 , and each layer has one or more arbitrary nodes. Furthermore, there is a parent-child relationship between adjacent layers. That, j = 0, ..., with respect to J-2, _{L j} is _{L j + 1} of the child _{layers, L j + 1} is the parent layer of the _{L j.} Further, the nodes belonging to each layer have at most one parent node in the upper layer and 0 or more arbitrary child nodes in the lower layer. The node does not have a parent node when the layer to which the node belongs is the uppermost layer L _J−1 , that is, the root layer. The node has no child node when the layer to which the node belongs is the lowest layer L ₀ , that is, the leaf layer. A node included in the root layer is referred to as a root node, and a node included in the leaf layer is referred to as a leaf node.

In the example displayed in the generalized hierarchy editor 270 in FIG. 2, the fifth layer is the root layer, and the attribute value of the root node is “French, Chinese, English, German, US, and Japanese”. The 0th layer is a leaf layer, and the attribute values of leaf nodes are “French”, “Medium”, “English”, “Germany”, “US”, and “Japan”. The 0th layer includes a node having each attribute value before anonymization. For example, “day” is included from the 0th layer to the 4th layer, but “day” of the 0th layer is a leaf node, and “day” from the 1st layer to the 4th layer is a leaf node. Absent.
Hereinafter, an upper layer node connected to a node (parent node) of a certain layer is referred to as an ancestor node. The fifth layer, “French, Chinese, English, and US”, the fourth layer, “French, Chinese, English, and US”, and the third layer, “French, Chinese, English, and German,” It is a node. A node in a lower layer connected to a node (parent node) of a certain layer is called a descendant node. For example, “French Chinese” and “English” in the first layer and “French”, “Central”, and “English” in the 0th layer are descendant nodes of the parent node “French Chinese in English” in the second layer. Also, the node “day” of the 0th to third layers is a descendant node of the parent node “day” of the fourth layer.

(Edit in generalized hierarchy editor)
The context menu can be opened by an operation such as right-clicking on the generalized hierarchy editor 270 with the mouse. In the context menu, operations such as “change node name”, “move node”, “add layer (upper)”, “add layer (lower)”, and “delete layer” can be performed.
FIG. 5 shows an example of items that can be selected from the context menu displayed on the generalized hierarchy editor 270. The items that can be selected depend on the layer, but also depend on whether the user right-clicked on a node or another right-click area (hereinafter referred to as a non-node).
In FIG. 5, N is the layer number of the root layer and takes an integer value of 1 or more. When the total number of layers in the generalized hierarchy is 2 (N = 1), the first layer is the root layer. In this case, when performing an operation on the root node, the AND in the case of the layer “1” and the layer “N” in FIG. 5 is applied. For example, when a node is selected in the first hierarchy, “node movement” is ○ in the case of layer “1”, but “node movement” is × in layer “N”. “Move node” cannot be selected. When the total number of layers in the generalized hierarchy is 3 (N = 2), the first layer is not a root layer. In this case, when an operation is performed on the first layer, the case of the layer “1” in FIG. 5 is applied. When the total number of layers in the generalized hierarchy is 3 (N = 2), the second layer is the root layer. In this case, when performing an operation on the root node, the case of the layer “N” in FIG. 5 is applied.
For example, according to FIG. 5, when the total number of layers in the generalized hierarchy is two or more, “node name change” and “node movement” can be selected when right-clicking on a node on the first layer. On the other hand, when right-clicking on a non-node of the first layer (where there is no node, that is, a blank area), “add layer (above)”, “add layer (below)”, and “delete layer” can be selected.

FIG. 6 shows an example of “change node name”. In the example of FIG. 6, the second layer of rice is changed to the United States.
When performing a “change node name” operation, a context menu is displayed when a node displayed in the generalized hierarchy editor 270 is first right-clicked with the mouse. Next, “Change Node Name” displayed on the context menu is selected by left-clicking with the mouse. As a result, the node name of the selected node can be directly input on the generalized hierarchy editor 270, and the changed node name is input using a keyboard or the like. Note that after the node name is changed, a node that is recommended to be renamed, such as an ancestor node or a descendant node (excluding a leaf node) of the node whose node name has been changed, may be highlighted. As a highlighting method, for example, a method of displaying the node name in red or displaying it with a thick line is conceivable. As an example of emphasis display, FIG. 6 shows an example in which the border of the box of the node whose name is recommended is bolded.
In “change node name”, the hierarchical structure between nodes does not change before and after editing, so the information loss rate does not change.

When performing the “move node” operation, a context menu is displayed when the node displayed in the generalized hierarchy editor 270 is first right-clicked with the mouse. Next, “move node” displayed on the context menu is selected by left-clicking with the mouse. Then, left-click the destination parent node with the mouse.
The node movement is performed while maintaining the hierarchical structure including the descendant nodes of the movement target node. At this time, since the generalized hierarchy is a hierarchy that obfuscates the attribute values of the original data, it is necessary to have all the attribute values before anonymization in layer 0. For this reason, “node movement” is divided into the following three types depending on the hierarchy of the movement source and the movement destination.
(1) When the hierarchy is increased by movement: The descendant nodes of the moving node are moved together, and the node at the end of the moving node is extended to the 0th layer. FIG. 7 shows an example in which the node “medium” in the first layer is moved to a layer (second layer) below “day” in the third layer.
(2) When the hierarchy does not change due to movement: The node to be moved is moved together with the descendant nodes. FIG. 8 shows an example in which the node “medium” of the first layer is moved to a layer (first layer) below “day” of the second layer.
(3) When the hierarchy is lowered by the movement: The moving node is moved together with the descendant nodes. However, if it moves as it is, the node at the end of the moving node will be located below the 0th layer, so the hierarchy will be increased by the amount that protrudes from the 0th layer before the movement, and the lowest layer will be changed again. 0 layers are assumed. Further, the leaf nodes not included in the descendant nodes of the moving node are extended to the new 0th layer. FIG. 9 shows an example in which the node “French and German” in the first layer is moved to a layer (0th layer) below “English” in the first layer.
Note that, after a node is moved, a node that is recommended to be renamed may be highlighted. As an example of highlighting, FIGS. 7 to 9 show examples in which the box line of a node whose name is recommended is thickened.

Further, as shown in FIG. 5, the node of the 0th layer, that is, the leaf node can also be moved. For example, in the generalized hierarchy illustrated in the generalized hierarchy editor 270 of FIG. 2, the node “middle” is moved under the node “day” of the first layer or higher, and the destination parent node is set to “Asia”. An operation such as renaming can be considered. When a leaf node is moved by this operation, descendant nodes extend to the 0th layer of the moved leaf node, and leaf nodes having the same attribute value are created.
However, in “node movement”, a leaf node cannot be designated as a parent node. This is because a leaf node represents a raw attribute value before being anonymized, and it is unlikely that a leaf node has another raw attribute value as a descendant.
A node cannot be moved under its descendant nodes. This is because when such movement is possible, the parent-child relationship of the nodes circulates. This is the same as the Windows (registered trademark) Explorer cannot be used to move a folder under the subfolder.
In the “node movement”, the information loss rate is recalculated after the node movement is completed, and the recalculated information loss rate is displayed on the generalized hierarchy editor 270.

When performing “add layer (above)”, “add layer (below)”, or “delete layer” operation, first the non-node of the layer displayed in the generalized hierarchy editor 270 (where there is no node, ie, a blank area) Right-click with the mouse to display the context menu. Next, one of “add layer (top)”, “add layer (bottom)” and “delete layer” displayed on the context menu is selected by left-clicking with the mouse.
In “Add layer (upper)”, a new layer is created on the selected layer. As the new layer node, the node of the selected layer appears as it is. In the parent-child relationship between the nodes in the selected layer and the new layer, the nodes having the same name become the parent-child. The parent-child relationship between the node of the new layer and its parent layer inherits the parent-child relationship of the selected layer and its parent layer before adding the layer.
However, a new layer cannot be created above the root layer.
In “add layer (upper)”, the information loss rate in the added layer is the same as that of the selected layer.

In “Add layer (lower)”, a new layer is created under the selected layer. As the node of the new layer, the node that was in the child layer of the selected layer appears as it is. In the parent-child relationship between the child layer of the new layer and the node in the new layer, the nodes having the same name become the parent-child. The parent-child relationship between the node of the new layer and its parent layer inherits the parent-child relationship of the selected layer and its child layer before adding the layer.
However, a new layer cannot be created under the leaf layer.
In “add layer (lower)”, the information loss rate in the added layer is the same as that of the child layer of the selected layer before adding the layer.

In “delete layer”, the selected layer is deleted. The descendant relationship between the layer immediately below the layer to be deleted and the layer above is the parent-child relationship in the generalized hierarchy after the layer is deleted.
However, the root layer and leaf layer cannot be deleted.
In the “delete layer”, since the descendant relationship between the leaf layer and other layers does not change before and after editing, the information loss rate does not change.

(Data to be anonymized)
The anonymization target data 151 takes a tabular form as shown in FIG. The record of the anonymization target data 151 includes a key that is an identifier of the record and several columns that are attributes of the record. Here, the column “KEY” is an identifier, and there are columns such as age, nationality, major, and commuting time. In this embodiment, among these columns, age, nationality, and major are used as quasi-identifiers.

(Management data)
As shown in FIG. 11, the management data 152 includes a data name, a k anonymization threshold value, column information, and generalized hierarchy information.
The data name is the name of the data to be anonymized.
The k anonymization threshold is a threshold for anonymizing the anonymization target data 151 represented by the data name.
The column information is attribute information that the anonymization target data 151 has. The column information is a list of attribute information having a name and a type of the attribute and having a flag indicating whether it is a quasi-identifier (True if it is a quasi-identifier, False if not a quasi-identifier).
The generalized hierarchy information is a list of information including a quasi-identifier name indicating the name of the quasi-identifier and a generalized hierarchy name for the quasi-identifier. Here, the generalized hierarchy name corresponds to the table name in the generalized hierarchy data 153 of the personal information management apparatus 150. The data of the generalized hierarchy is written as a table in the generalized hierarchy data 153. The generalized hierarchy name is the name of the table, and is, for example, a combination of a data name and a quasi-identifier name with a certain delimiter. Also, data of generalized hierarchies with different quasi-identifiers can be stored in the same table. Also in this case, the generalized hierarchy name corresponds to the table name, and a common generalized hierarchy name is assigned to the data of the generalized hierarchy stored in the same table. The generalized hierarchy name in this case can be, for example, a combination of a fixed suffix after the data name.
The generalized hierarchy associated with the data name of the management data 152 can be edited on the generalized hierarchy editor 270 of FIG.

(Generalized hierarchy data)
As shown in FIG. 12, the generalized hierarchical data 153 includes a quasi-identifier name, an object ID, a value, and a frequency. The generalized hierarchy data 153 is a table using a semi-identifier name and an object ID as keys.
The object ID is an attribute value of the generalized hierarchy or an identifier of the parent-child relationship, the identifier of the attribute value is in the format of NXXX, and the identifier of the parent-child relationship is in the format of PNYYY. Here, the value of the attribute value identifier “NXXX” is the attribute value specified by the identifier “NXXX”. The value for the object ID “PNYYY” is the object ID of the parent node of the node “NYYY”.
The frequency indicates the appearance frequency of the attribute value. The appearance frequency exists only for the object ID “NXXX”, and the appearance frequency for the object ID “PNYYY” is blank.
For example, the first line of FIG. 12 corresponds to the leftmost node of the leaf layer in the generalized hierarchy example shown in the generalized hierarchy editor 270 of FIG. 2, and the node “N001” of the quasi-identifier “nationality”. Indicates that it has the attribute value “French” and the appearance frequency is “5”. Similarly, the second line of FIG. 12 corresponds to the leftmost node of the first layer in the generalized hierarchy example shown in the generalized hierarchy editor 270 of FIG. 2, and the node “N002” of the quasi-identifier “nationality”. Represents an attribute value “French in China” and its appearance frequency is “10”. The third line in FIG. 12 indicates that the parent of the node “French” of the object ID “N001” is the node “French center” of the object ID “N002”.

(Quasi-identifier tuple frequency data)
As shown in FIG. 13, the quasi-identifier tuple frequency data 154 includes a combination of quasi-identifier values of anonymization target data and a frequency. The frequency indicates the number of times that the combination of the quasi-identifier values appears in the anonymization target data. The quasi-identifier tuple frequency data 154 is calculated in advance based on the anonymization target data 151.
The data format of the quasi-identifier tuple frequency data 154 is a post-anonymization tuple frequency table that expresses the frequency for the combination of quasi-identifier values of anonymized data obtained by anonymizing the anonymization target data using a generalized hierarchy. Also used.

Next, the post-anonymization frequency table calculation unit 114 and the loss index calculation unit 115 will be described. The processing of both these units is executed after the generalized hierarchy creation processing of FIG.
(Anonymized frequency table calculation process)
FIG. 14 shows an exemplary flow of the post-anonymization frequency table calculation process in the post-anonymization frequency table calculation unit 114.
The post-anonymization frequency table calculation unit 114 reads the generalized hierarchy data 153 in FIG. 12 and the quasi-identifier tuple frequency data 154 in FIG. 13 from the personal information management device 150 to the main memory (S101). Then, the post-anonymization frequency table calculation unit 114 repeats the following processing one by one for all data included in the read quasi-identifier tuple frequency data 154, and calculates the post-anonymization tuple frequency table 300 shown in FIG. (S102).
Specifically, the post-anonymization frequency table calculation unit 114 acquires the key of the current record from the quasi-identifier tuple frequency data 154 (S103). This key is a combination of attribute values of leaf nodes in the generalized hierarchy constituted by the read generalized hierarchy data 153. For example, (27, day, geophysics) in FIG.
Next, the post-anonymization frequency table calculation unit 114 creates a new key by replacing the attribute value included in this key with the attribute value of the specified quasi-identifier layer (S104). The designation of each quasi-identifier layer can be performed on the anonymization execution dialog 231 in FIG. In addition, during the execution of the generalized hierarchy presentation process and the generalized hierarchy edit process, which will be described later, for the quasi-identifier whose generalized hierarchy is displayed on the generalized hierarchy editor 270, the layer designation is automatically performed from the leaf layer to the root layer. It is updated with. For example, when the above-mentioned key (27, day, geophysics) is replaced with each attribute value of the first layer by using the example of the generalized hierarchy shown in FIG. The replaced key is (20s, date, science).
Next, the post-anonymization frequency table calculation unit 114 confirms whether there is an entry of a key corresponding to the post-anonymization tuple frequency table 300 for the replaced key (S105), and if there is no entry (S106: Yes) ), An entry is created with a frequency value of 0 (S107). Subsequently, the post-anonymization frequency table calculation unit 114 obtains an entry in the post-anonymization tuple frequency table 300 for the replaced key, and prepares a quasi for the key of the current record corresponding to the key replaced with the frequency value. The frequency value of the identifier tuple frequency data 154 is added to update the entry in the anonymized tuple frequency table 300 (S108). This is repeated for all data included in the semi-identifier tuple frequency data 154 (S102).
The anonymized frequency table calculation unit 114 uses, for example, the quasi-identifier tuple frequency data 154 in FIG. 13 and the generalized hierarchy in FIG. 15 to specify all layers of the generalized hierarchy of age / nationality and major in the first layer. At this time, the anonymized tuple frequency table 300 shown in FIG. 16 is output.

(Loss index calculation part)
FIG. 17 shows an example of the flow of loss index calculation processing in the loss index calculation unit 115.
The inputs of the loss index calculation unit 115 are the quasi-identifier tuple frequency data 154 and the post-anonymization tuple frequency table 300 obtained by the post-anonymization frequency table calculation unit 114.
The loss index calculation unit 115 first calculates the frequency tables F1,..., FN for each quasi-identifier by counting the quasi-identifier tuple frequency data 154 for each quasi-identifier and obtaining the appearance frequency of the attribute values of all quasi-identifiers. Create (S201). Here, the frequency table for each quasi-identifier indicates the correspondence between the attribute value of the quasi-identifier and the appearance frequency when the anonymization target data 151 and a single quasi-identifier are determined. For example, a frequency table for each quasi-identifier as shown in FIG. 18 is obtained from the quasi-identifier tuple frequency data 154 in FIG.
Next, the loss index calculation unit 115 obtains post-anonymization frequency tables G1,..., GN for each semi-identifier from the post-anonymization tuple frequency table 300 for the layer specified for each semi-identifier (S202). The designation of each quasi-identifier layer can be performed on the anonymization execution dialog 231 in FIG. In addition, during the execution of the generalized hierarchy presentation process and the generalized hierarchy edit process, which will be described later, for the quasi-identifier whose generalized hierarchy is displayed on the generalized hierarchy editor 270, the layer designation is automatically performed from the leaf layer to the root layer. It is updated with. Here, the post-anonymization frequency table for each quasi-identifier indicates a correspondence relationship between the anonymization attribute value of the quasi-identifier and the appearance frequency when anonymization data and a single quasi-identifier are determined. This appearance frequency is obtained by counting the frequency for a specific quasi-identifier from the anonymized tuple frequency table 300. For example, when the quasi-identifier tuple frequency data 154 in FIG. 13 and the generalized hierarchy in FIG. 15 are used and the first layer is designated in all generalized hierarchies, the frequency table after anonymization for each quasi-identifier as in FIG. can get.
Next, the loss index calculation unit 115 obtains the amount of information before anonymization from the frequency tables F1,... FN for each quasi-identifier and the total number of records R of the anonymization target data. Here, the amount of information before anonymization corresponds to the amount of information when leaf layers are designated for all quasi-identifiers in the anonymization execution dialog 231 and the like. Formulas for calculating the amount of information before anonymization are as shown in the following equations 1 to 4. In the following formulas, the base of the logarithmic function log is assumed to be 2. However, if it is unified in the system, it may be any positive number exceeding 1 such as 10 or the number of Napier.

  Next, the loss index calculation unit 115 obtains an anonymized information amount from the anonymized frequency table G1,..., GN for each quasi-identifier and the total number of records R of the anonymization target data (S204). Here, the amount of information after anonymization is the amount of information when anonymized in the layer designated for each quasi-identifier. The designation of each quasi-identifier layer can be performed in the anonymization execution dialog 231 or the like. In addition, during the execution of the generalized hierarchy presentation process and the generalized hierarchy edit process, which will be described later, for the quasi-identifier whose generalized hierarchy is displayed on the generalized hierarchy editor 270, the layer designation is automatically performed from the leaf layer to the root layer. It is updated with. The formula for calculating the amount of information after anonymization is as shown in the following equations 5 to 8.

例えば、図２の一般化階層編集画面２００の損失指標評価エリア２６０に表示されている情報損失率（１２．９１％）は、準識別子「年齢」、「国籍」、および「専攻」について全て第１レイヤが指定されて匿名化された場合の値である。 Finally, the loss index calculation unit 115 obtains an information loss rate according to Equation 9 from the information amount before anonymization and the information amount after anonymization obtained so far (S205). The information loss rate is an example of the information loss index of the present invention.

For example, the information loss rate (12.91%) displayed in the loss index evaluation area 260 of the generalized hierarchy editing screen 200 of FIG. 2 is the same for all of the semi-identifiers “age”, “nationality”, and “major”. This is a value when one layer is designated and anonymized.

(Generalized hierarchy creation process)
FIG. 20 shows an example of the flow of the generalized hierarchy creation process.
When the user selects the “data-capture” menu 220 on the generalized hierarchy editing screen 200 displayed on the generalized hierarchy editing accepting apparatus 170 (S301), the anonymization target data import dialog shown in FIG. 221 opens (S302). The user inputs a data name, a data file path, a k anonymization threshold value, and column information on the anonymization target data capture dialog 221. As the column information, the name and type of each column constituting the anonymization target data created based on the data file to be imported are specified, and the column to be used as a quasi-identifier is specified from each column. When the user inputs a data name, a data file path, k anonymization threshold value, and column information and presses the import button, the generalized hierarchy editing accepting device 170 reads the data file from the specified path, An anonymization target data capture request including the data name, data file, k anonymization threshold, and column information is transmitted to the anonymization device 101 (S303).
When the anonymization apparatus 101 receives an anonymization target data import request including a data name, a data file, a k anonymization threshold, and column information (S304), the generalized hierarchy creating unit 111 is anonymous from the received data file. Anonymization target data including a combination of attribute values of a plurality of quasi-identifiers to be converted is created, and the created anonymization target data is written as anonymization target data 151 of personal information management device 150 (S305).
Next, based on the anonymization target data 151 and the quasi-identifier specified by the column information, the generalized hierarchy creating unit 111 determines the attribute value included in the anonymization target data 151 and its appearance frequency for each quasi-identifier. A tree structure including a lowermost layer including a plurality of nodes, and a layer including one or more nodes having an attribute value having the same or higher degree of anonymization and its appearance frequency as compared to the lower layer Is created and written as generalized hierarchy data 153 of the personal information management device 150 (S306). The automatic generation of the generalized hierarchy here uses a technique as shown in Patent Document 1.

Then, the generalized hierarchy creating unit 111 obtains quasi-identifier tuple frequency data based on the anonymization target data 151 and writes the quasi-identifier tuple frequency data 154 of the personal information management device 150 (S307). Further, the generalized hierarchy creating unit 111 writes the management data 152 of the personal information management device 150 based on the received data name, k anonymization threshold, and column information (S308). Here, for example, the table name of the writing destination when the generalized hierarchy data 153 of the personal information management apparatus 150 is written is specified as the generalized hierarchy name, but it is not limited to this.
When these series of processes are completed, the generalized hierarchy creating unit 111 notifies the generalized hierarchy editing accepting apparatus 170 of the completion of the generalized hierarchy creating process (S309). Upon receiving the notification, the generalized hierarchy editing accepting apparatus 170 closes the anonymization target data import dialog 221 (S310).

(Generalized hierarchy presentation process)
FIG. 21 shows an example of the flow of the generalized hierarchy presentation process.
In the anonymization setting display area 250 of the generalized hierarchy editing screen 200 in FIG. 2, a list of data names, anonymization threshold values, anonymization target data attributes, and anonymization targets set in the anonymization target data capture dialog 221. A list of data quasi-identifiers is displayed. When the user selects a quasi-identifier name in the anonymization setting display area 250 (S401), the generalized hierarchy editing accepting apparatus 170 transmits a generalized hierarchy read request including the quasi-identifier name to the anonymization apparatus 101 (S402). ).
When the anonymization apparatus 101 receives the generalized hierarchy read request (S403), the generalized hierarchy presentation unit 112 reads the generalized hierarchy from the generalized hierarchy data 153 of the personal information management apparatus 150, and the tree-structured data structure And is written in the temporary storage unit 120 (S404).
Next, the generalized hierarchy presentation unit 112 aggregates the quasi-identifier tuple frequency data 154 for each quasi-identifier, and obtains the appearance frequency of attribute values for all the quasi-identifiers (S405). Note that step S405 is the same processing as step S201, and the appearance frequency of the attribute value of each quasi-identifier corresponds to the appearance frequency of the leaf node in the generalized hierarchy.
In step S405, the generalized hierarchy presenting unit 112 determines the generalized hierarchy of the selected semi-identifier included in the generalized hierarchy read request (the generalized hierarchy of the semi-identifier displayed in the generalized hierarchy editor 270). The appearance frequency of the attribute value of the upper node of the leaf node is obtained using the obtained appearance frequency of the leaf node (S406). For example, for the generalized hierarchy displayed in the generalized hierarchy editor 270 of the generalized hierarchy editing screen 200 of FIG. 2, the frequency 10 of the first layer node “French China” is the 0th layer node “French”. And the frequency 25 of the second layer node “French Central English” is equal to the frequency 10 of the first layer node “French Central English” and the frequency “English”. ”Is added to the frequency 15.

Next, the loss index calculation unit 115 obtains the information loss rate IL of each layer of the generalized hierarchy displayed on the generalized hierarchy editor 270 of the generalized hierarchy editing screen 200 (S407). Here, the generalized hierarchy editor 270 displays the generalized hierarchy of the selected quasi-identifier included in the generalized hierarchy read request. The loss index calculation unit 115 selects a quasi-identifier other than the selected quasi-identifier by fixing it to the layer designated in the anonymization execution dialog 231 (that is, the layer displayed in the loss index evaluation area 260). The information loss rate of each layer is obtained while changing the quasi-identifier layer. For example, in the case displayed in the generalized hierarchy editor 270 of FIG. 2, the information loss rate when the age and major are fixed to the first layer is obtained while changing the nationality layer. For this purpose, the quasi-identifier tuple frequency data 154 and the anonymized tuple frequency table 300 are given to the loss index calculation unit 115 as inputs. Here, for the selected quasi-identifier, the anonymized tuple frequency table 300 is obtained and used for all layers of the generalized hierarchy. For other quasi-identifiers, the anonymized tuple frequency table 300 obtained for the layer displayed in the loss index evaluation area 260 is used.
Then, the generalized hierarchy presentation unit 112 transmits the generalized hierarchy including the appearance frequency of each node held in the temporary storage unit 120 and the information loss rate of each layer to the generalized hierarchy editing reception apparatus 170 (S408). ). The generalized hierarchy editing reception apparatus 170 displays the received generalized hierarchy and the information loss rate of each layer on the generalized hierarchy editor 270 (S409).

(Generalized hierarchy editing process)
FIG. 22 shows an example of the flow of generalized hierarchy editing processing.
As described above, on the generalized hierarchy editor 270 of the generalized hierarchy editing screen 200, “node name change”, “node movement”, “layer addition (upper)”, “layer addition (lower)”, and “layer deletion”. Etc. can be performed.
When the general hierarchy editing accepting apparatus 170 accepts an editing operation such as node movement, the generalized hierarchy editing accepting apparatus 170 transmits an editing request including designation of the corresponding editing operation to the anonymization apparatus 101 (S501).
When the anonymization apparatus 101 receives the editing request (S502), the generalized hierarchy editing unit 113 performs the editing operation specified by the editing request on the data structure of the generalized hierarchy stored in the temporary storage unit 120. The generalized hierarchy of the temporary storage unit 120 is updated (S503).
Subsequently, the generalized hierarchy editing unit 113 and the like perform the same processing as steps S405 to S407 described above, and the appearance of each node of the generalized hierarchy displayed on the generalized hierarchy editor 270 of the generalized hierarchy editing screen 200. The generalized hierarchy editor of the generalized hierarchy editing screen 200 on the generalized hierarchy editing accepting apparatus 170 is obtained by recalculating the frequency and the information loss rate IL of each layer, and further performing the same processing as steps S408 and S409 described above. The generalized hierarchy is displayed in 270.
Specifically, the generalized hierarchy editing unit 113 aggregates the quasi-identifier tuple frequency data 154 for each quasi-identifier, and determines the appearance frequency of attribute values (the appearance frequency of leaf nodes in the generalized hierarchy) for all quasi-identifiers. Obtained (same as S504 and S405). Then, for the generalized hierarchy of the quasi-identifier displayed in the generalized hierarchy editor 270, the generalized hierarchy editing unit 113 uses the appearance frequency of the leaf node obtained in step S504 to determine the attribute value of the node above the leaf node. Is found (same as S505 and S406).
Next, the loss index calculation unit 115 obtains the information loss rate IL of each layer of the generalized hierarchy displayed on the generalized hierarchy editor 270 of the generalized hierarchy editing screen 200 (same as S506 and S407).
Then, the generalized hierarchy editing unit 113 transmits the generalized hierarchy including the appearance frequency of each node held in the temporary storage unit 120 and the information loss rate of each layer to the generalized hierarchy editing accepting apparatus 170 (S507). , Same as S408). The generalized hierarchy editing accepting apparatus 170 displays the received generalized hierarchy and the information loss rate of each layer on the generalized hierarchy editor 270 (same as S508 and S409).

(Generalized hierarchy saving process)
FIG. 23 shows an example of the flow of generalized hierarchy storage processing in the generalized hierarchy storage unit 116.
When the “generalized hierarchy-save” menu 240 is selected on the generalized hierarchy editing screen 200 displayed on the generalized hierarchy editing accepting apparatus 170, the generalized hierarchy edit accepting apparatus 170 displays on the generalized hierarchy editor 270. A storage request for storing the generalized hierarchy of the quasi-identifier that has been sent is transmitted to the anonymization device 101 (S601).
When the anonymization apparatus 101 receives the save request (S602), the generalized hierarchy storage unit 116 obtains the generalized hierarchy data 153 having the structure of FIG. 12 from the generalized hierarchy of the tree structure stored in the temporary storage unit 120. Created and written in the generalized hierarchical data 153 of the personal information management device 150 (S603).

(Anonymization process)
FIG. 24 shows an example of the flow of anonymization processing in the anonymization processing unit 117.
When the “generalized hierarchy-save” menu 240 is selected on the generalized hierarchy edit screen 200 displayed on the generalized hierarchy edit accepting apparatus 170 (S701), the anonymization execution dialog 231 of FIG. 4 is opened (S702). ). In the anonymization execution dialog 231, the layer of the generalized hierarchy of the quasi-identifier can be input. The user refers to the loss index evaluation area 260 to evaluate the information loss rate, and designates the layer determined to be most appropriate on the anonymization execution dialog 231. When the user inputs the layer of the generalized hierarchy of each quasi-identifier on the anonymization execution dialog 231 and presses the anonymization execution button (S703), the generalized hierarchy editing reception apparatus 170 causes the generalized hierarchy of each quasi-identifier. The anonymization request including the layer is transmitted to the anonymization device 101 (S704).
When the anonymization device 101 receives the anonymization request (S705), the anonymization processing unit 117 includes the generalized hierarchy of each semi-identifier in which the attribute value of each semi-identifier included in the anonymization target data is included in the anonymization request. Anonymized data replaced with the attribute value of the node belonging to the layer is created (S706).
Next, the anonymization processing unit 117 calculates the appearance frequency of the combination of attribute values of each quasi-identifier included in the anonymized data (S707). The anonymization processing unit 117 deletes a record whose calculated appearance frequency is less than the k anonymization threshold from the anonymized data, so that the appearance frequency of the combination of attribute values of each quasi-identifier included in the anonymized data is determined by the user. The anonymization data is corrected so as to satisfy the k anonymization threshold specified by (S708). Then, the anonymization processing unit 117 writes the anonymization data 155 that includes the combination of the attribute values of each quasi-identifier after anonymization and the appearance frequency thereof and satisfies the k anonymization threshold to the personal information management device 150 (S709). . The configuration of the anonymization data 155 is the same as the anonymized tuple frequency table 300.
When these series of processes are completed, the anonymization processing unit 117 notifies the completion of the anonymization process to the generalized hierarchy reception editing apparatus 170 (S710).
When the personal information included in the data file is anonymized, first, the attribute value of the quasi-identifier before anonymization corresponding to the attribute value of the quasi-identifier included in the anonymized data 155 is obtained from the generalized hierarchy data 153. Then, the attribute value of the quasi-identifier before anonymization included in the data file is replaced with the attribute value of the quasi-identifier after anonymization.

  As described above, according to the present invention, the generalized hierarchy can be edited interactively while confirming the amount of loss information, starting from the template of the generalized hierarchy based on the anonymization target data. . This allows the user to know the optimal anonymization plan while editing the generalized hierarchy. By using the generalized hierarchy edited in this way, the anonymization plan that the user wants to anonymize the data to be anonymized is implemented, so that the generalized hierarchy and anonymized data suitable for analysis use can be Can be efficiently obtained in a form that is easy to convince.

DESCRIPTION OF SYMBOLS 100 ... Personal information anonymization system, 101 ... Anonymization apparatus, 110 ... User interface part, 111 ... Generalization hierarchy preparation part, 112 ... Generalization hierarchy presentation part, 113 ... Generalization hierarchy editing part, 114 ... Frequency after anonymization Table calculation unit 115 ... Loss index calculation unit 116 ... Generalized hierarchy storage unit 117 117 Anonymization processing unit 120 ... Temporary storage unit 150 ... Personal information management device 151 ... Anonymization target data 152 ... Management data 153 ... Generalized hierarchy data, 154 ... Semi-identifier tuple frequency data, 155 ... Anonymized data, 170 ... Generalized hierarchy edit accepting device, 180 ... Network, 200 ... Generalized hierarchy edit screen, 210 ... Menu bar, 220 ... “Data-acquisition” menu, 221... Anonymization object data import dialog, 230... “Data-anonymization” menu, 2 1 ... anonymous Run dialog, 240 ... "General hierarchical - Save" menu, 250 ... anonymous setting display area, 260 ... loss index evaluation area, 270 ... generalization hierarchy editor, tuple frequency table after 300 ... anonymous

Claims (4)

Based on the anonymization target data including a combination of attribute values of a plurality of quasi-identifiers to be anonymized, for each quasi-identifier, the attribute value included in the anonymization target data and the appearance frequency of the attribute value A lowermost layer including a plurality of nodes, and a layer including one or more nodes having an attribute value having the same or higher degree of anonymization as compared to the lower layer and an appearance frequency of the attribute value. A generalized hierarchy creating means for creating a generalized hierarchy of a tree structure,
In response to the designation of the quasi-identifier by the user, a generalized hierarchy presentation means for presenting the generalized hierarchy of the designated quasi-identifier to the user;
Generalized hierarchy editing in which the generalized hierarchy presented by the generalized hierarchy presenting means is updated while maintaining a tree structure in accordance with an editing instruction by the user, and the updated generalized hierarchy is re-presented to the user. Means,
In response to designation of the generalized hierarchy layer of each semi-identifier by the user, the attribute value of each semi-identifier included in the anonymization target data belongs to the general hierarchy layer of the designated semi-identifier Anonymization means for creating anonymized data replaced with attribute values of
A personal information anonymization system comprising: A loss index calculating means for determining an information loss index of each layer of the generalized hierarchy;
The generalized hierarchy presenting means and the generalized hierarchy editing means present the information loss index of each layer included in the generalized hierarchy obtained by the loss index calculating means to the user;
The personal information anonymization system according to claim 1.   The anonymization means modifies the anonymization data so that an appearance frequency of a combination of attribute values of each quasi-identifier included in the anonymization data satisfies a k anonymization threshold specified by a user. The personal information anonymization system according to claim 1 or 2.   4. The editing according to claim 1, wherein the editing in the generalized hierarchy editing means includes a node name change, a node movement, a layer addition, and a layer deletion. Personal information anonymization system.

Images