JP6270756B2 - Anonymized data providing device, anonymized data providing method, and anonymized data providing program - Google Patents

Description

  The present invention relates to an anonymized data providing device, an anonymized data providing method, and an anonymized data providing program.

  In recent years, the handling of personal information has become a problem due to the problem of information leakage and the enactment of the Personal Information Protection Law. Personal information is collected not only by public institutions but also by various companies. For example, a consumer who purchases a product or service (hereinafter sometimes referred to as “individual”) may register as a member when purchasing the product or service. At the time of membership registration, data such as an individual's name, age, gender, address, and e-mail address are usually registered (stored) in a company system in a state in which the data is associated with an individual ID assigned to the individual. . That is, the company system stores “personal information data”. Here, the “personal information data” includes, for example, a name, age, sex, address, e-mail address, and personal ID. Furthermore, every time an individual whose personal information data is already registered purchases a product or service, the company system stores information related to the purchased product or service in association with the ID of the individual. As a result, the company can use the collected personal information data for corporate activities.

  On the other hand, for example, a second company other than the first company that collected personal information data may desire to use the personal information data. That is, there is a possibility that the data collection entity and the data utilization entity are different. However, from the viewpoint of personal information protection, personal information data itself cannot be provided without obtaining personal permission. Therefore, it is considered that personal information data is converted into data in a state where an individual cannot be specified (hereinafter, sometimes referred to as “anonymized data”) and anonymized data is used.

  In addition, the Personal Information Protection Law, which is scheduled to be revised in the future, makes it possible to distribute personal information that has undergone a certain level of de-identification processing with the permission of the user. The

JP 2014-153944 A

  However, when the data collection entity and the data utilization entity are different, anonymization patterns such as attributes and attribute values may be different between the data collection entity and the data utilization entity. For example, the data collection side anonymizes each data from 60 to 99 years old as the attribute value “old man”, and the data use side anonymizes each data from 65 years old to 80 as the attribute value “old man” Garage. In this case, if the data use side purchases anonymized data having the attribute value “old man”, the analysis using the anonymized data becomes inaccurate because it is different from the anonymized data assumed by itself. . As a result, the distribution of anonymized data is hindered.

  The disclosed technique has been made in view of the above, and an object thereof is to provide an anonymized data providing device, an anonymized data providing method, and an anonymized data providing program that can improve the distribution of anonymized data. And

  The anonymized data providing device disclosed in the present application is configured such that, for each anonymized data in which personal information data related to an attribute in which at least one attribute value related to personal information is set is anonymized according to an abstract pattern, the attribute value and the attribute value A counting unit that counts the number of appearances of each combination in which the attribute value is associated with the abstract pattern rewritten in the anonymization. When the anonymized data providing apparatus accepts a search term for searching for desired anonymized data, the search target is determined according to the number of appearances of the abstract pattern of the search target including the search term as the attribute value or the attribute. A display control unit for controlling the display of the abstraction pattern.

  According to one embodiment, the distribution of anonymized data can be improved.

FIG. 1 is a diagram illustrating an example of the overall configuration of a system according to the first embodiment. FIG. 2 is a functional block diagram showing a functional configuration of the anonymization distribution apparatus. FIG. 3 is a diagram illustrating an example of anonymized data. FIG. 4 is a diagram illustrating an example of a rewrite result stored in the attribute accumulation DB. FIG. 5 is a diagram illustrating an example of totalization of rewrite results stored in the attribute totalization DB. FIG. 6 is a diagram illustrating an example of a value generalization hierarchy. FIG. 7 is a diagram illustrating an example of the attribute generalization hierarchy. FIG. 8 is a diagram for explaining an example of generating a value generalization hierarchy. FIG. 9 is a diagram illustrating an example of setting the level value. FIG. 10 is a diagram illustrating an example of calculating the evaluation index. FIG. 11 is a diagram for explaining a calculation example of the DIS. FIG. 12 is a diagram illustrating an example of a search result. FIG. 13 is a diagram for explaining an example of a search result. FIG. 14 is a flowchart showing a flow of score evaluation generation processing. FIG. 15 is a diagram for explaining data transition of score evaluation. FIG. 16 is a flowchart showing the flow of search processing. FIG. 17 is a diagram illustrating a hardware configuration example.

  Embodiments of the anonymized data providing device, the anonymized data providing method, and the anonymized data providing program disclosed in the present application will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

[overall structure]
FIG. 1 is a diagram illustrating an example of the overall configuration of a system according to the first embodiment. This system has an anonymization distribution device 10 and is an anonymization of personal information data provided by a company or the like for distribution to society. The anonymization distribution device 10 is an example of an anonymized data providing device.

  Specifically, the anonymization distribution device 10 performs anonymization processing, statistical processing, search processing, and the like to distribute anonymized data. For example, in the anonymization process, the anonymization distribution device 10 uses personal information data including data such as the name, age, sex, address, and email address of an individual registered when using various services, Accept from personal users. And the anonymization distribution apparatus 10 anonymizes personal information data using a predetermined application. At this time, the anonymization distribution apparatus 10 determines an attribute rewrite pattern by user designation or the like.

  Further, in the statistical processing, the anonymization distribution device 10 collects statistical information as a result of rewriting the attribute value in the anonymization processing, executes attribute redefinition using the statistical information, and generates a meta attribute for each attribute. To do. For example, the anonymization distribution apparatus 10 aggregates information such as the attribute value “21 years old” being rewritten to “20s”. Here, the anonymization distribution device 10 generates a so-called value generalization hierarchy, an attribute generalization hierarchy, and the like that are used in the anonymization process.

  In the search process, the anonymized distribution device 10 expands the search term input by the searcher who searches for anonymized data that has been anonymized into the concept of the meta attribute, and corresponds from the search index of the anonymized data. Search for anonymized data and respond to the searcher.

  Here, the anonymization distribution device 10 holds anonymized data that each of the data processor 1a of the company A, the data processor 2 of the company B, and the data processor 3 of the company C anonymized. In other words, the anonymization distribution device 10 holds anonymized data that has been anonymized with an abstraction pattern uniquely determined by each company. For example, the anonymized distribution apparatus 10 is anonymized with the attribute value “21” anonymized as an abstract pattern “20s” and the attribute value “21” as an abstract pattern “20-22 years old”. Keep anonymized data. That is, the anonymization distribution apparatus 10 holds a plurality of anonymized data having different abstraction patterns even though the attribute before anonymization is the same attribute.

  In such a state, when the data searcher 1b of company A inputs the attribute value “20's” as a search term, the anonymized distribution device 10 searches for anonymized data corresponding to the abstract pattern “20's”. To do. Specifically, the anonymization distribution device 10 searches for the abstract pattern “20's” in which the attribute value is rewritten, and the data searcher 1b searches for “20's” before the attribute value is rewritten. Therefore, there is a gap between the two. Since this deviation occurs, it is possible that the anonymized data obtained as a search result is not the data desired by the data searcher 1b and corresponding to “20's” before rewriting the attribute value.

  Therefore, the anonymization distribution apparatus 10 has an attribute value and an attribute value anonymous for each anonymized data in which personal information data related to an attribute for which at least one attribute value related to personal information is set is anonymized according to an abstract pattern. The number of occurrences of each combination in association with the abstract pattern rewritten in the conversion is counted. When the anonymization distribution apparatus 10 receives a search word for searching for desired anonymized data, the anonymization distribution device 10 extracts the search target abstraction according to the number of appearances of the search target abstract pattern including the search word as an attribute value or attribute. Control the display of the activation pattern. As a result, the anonymization distribution device 10 selects the data that includes the search term that the searcher searches for and that the searcher is likely to desire from the anonymized data that cannot determine the original personal information. Because it provides, the distribution of anonymized data can be improved

[Function configuration]
FIG. 2 is a functional block diagram showing a functional configuration of the anonymization distribution apparatus. As shown in FIG. 2, the anonymization distribution device 10 includes an anonymization information DB 11, an attribute accumulation DB 12, an attribute aggregation DB 13, a score DB 14, an anonymization processing unit 15, an attribute acquisition unit 16, a score generation unit 17, and a search unit 18. Have.

  The anonymization information DB 11, the attribute accumulation DB 12, the attribute aggregation DB 13, and the score DB 14 are stored in a storage device such as a memory or a hard disk, for example. The DBs mentioned here are examples, and may include a DB that stores history, a DB that stores calculation processes, and the like. Further, the anonymization processing unit 15, the attribute acquisition unit 16, the score generation unit 17, and the search unit 18 are an example of an electronic circuit such as a processor or an example of a process executed by the processor.

  The anonymization information DB 11 is a database that stores anonymization data. Specifically, the anonymization information DB 11 stores anonymization data for several generations generated by each user in association with each user or company that provides personal information or an engineer of the company. For example, the anonymization information DB 11 stores two generations, that is, the previous anonymization data and the anonymization data generated this time for one user.

  FIG. 3 is a diagram illustrating an example of anonymized data. The anonymization information DB 11 stores anonymization data shown in FIG. As shown in FIG. 3, in the anonymized data, a plurality of abstract patterns are associated with “existence number” corresponding to each abstract pattern. The value of “existence number” indicates how many anonymization data groups corresponding to the associated abstraction pattern are included, and is a so-called number of appearances. The “anonymized data group” includes a plurality of anonymized data obtained by abstracting personal information data based on a plurality of “abstraction patterns” of item values.

  In addition, in the “k-anonymity determination table” shown in FIG. 3, “◯” that is the item value of “k-anonymity” indicates that the item value of “existence number” is 10 or more. The value “Δ” indicates that the item value of “existence number” is less than 10. Here, “k—anonymity clear reference value” is set to “10”.

  For example, as shown in FIG. 3, the value of the number of existence of the abstract pattern “20s”, that is, the k value is “30”, and the k value of the abstract pattern “20s, male” is “21”. The k value of the abstract pattern “20s, female” is “9”.

  That is, when the identification information of personal information data is A, the number of data corresponding to 17 years old is 50, the number of data corresponding to 18 years old is 18, the number of data corresponding to 16 years old is 16 people, The number of data corresponding to 15 years old or younger is 10. As described above, the abstract pattern is defined by a plurality of attributes, and the number of data corresponding to the attributes is the existence number.

  The attribute accumulation DB 12 is a database that stores the result of rewriting the attribute value in the anonymization process for each anonymized data. Specifically, the attribute accumulation DB 12 stores a correspondence relationship between an attribute value before anonymization and an attribute value after anonymization.

  FIG. 4 is a diagram illustrating an example of a rewrite result stored in the attribute accumulation DB 12. As shown in FIG. 4, the attribute accumulation DB 12 stores “attribute, attribute value, rewrite result, date and time” in association with each other. The “attribute” stored here indicates an attribute designated as an anonymization target. The “attribute value” is a value before rewriting set in the attribute. The “rewrite result” indicates a word (attribute value) in which the attribute value is rewritten during anonymization. “Date and time” is the date and time when rewriting was performed, that is, the date and time when anonymization was performed.

  Referring to an example of FIG. 4, the attribute value “21 years old” set in the attribute “age” is rewritten to “20s” on the date “December 1” to be anonymized. Similarly, the attribute value “53 years old” set for the attribute “age” is rewritten to “50s” on the date “December 1” to indicate that it is anonymized.

  The attribute tabulation DB 13 is a database that stores the tabulation of results obtained by rewriting attribute values in the anonymization process for each anonymized data. Specifically, the attribute aggregation DB 13 stores the number of appearances of combinations of attributes, attribute values before rewriting, and attribute values after rewriting.

  FIG. 5 is a diagram illustrating a totalization example of rewrite results stored in the attribute totalization DB 13. As illustrated in FIG. 5, the attribute aggregation DB 13 stores “attributes, attribute values, rewriting results, number of appearances” in association with each other. The “attribute” stored here indicates an attribute designated as an anonymization target. The “attribute value” is a value before rewriting set in the attribute. “Rewrite result” indicates a word whose attribute value has been rewritten upon anonymization. “Number of appearances” is the total number of appearances of combinations of attributes, attribute values, and rewrite results that appear in anonymized data stored in the anonymized information DB 11.

  Referring to an example of FIG. 5, “20” combinations of the attribute “age”, the attribute value “21 years old”, and the rewriting result “20s” have appeared, in other words, 20 companies out of the providers of anonymized data. The attribute value “21 years old” is abstracted into “20s”. The combination of the attribute “age”, the attribute value “21 years old”, and the rewriting result “20-22 years old” has appeared “1”, and one of the providers of anonymized data sets the attribute value “21 years old” to “ It shows that it was abstracted to "20-22 years old".

  The score DB 14 is a database that stores information used when evaluating anonymized data. Specifically, the score DB 14 includes a value generalization hierarchy that identifies a candidate group when rewriting one attribute value to another value, and an attribute generalization that identifies a distance from the original information when abstracting the entire attribute Remember the hierarchy.

  FIG. 6 is a diagram illustrating an example of a value generalization hierarchy. As shown in FIG. 6, the value generalization hierarchy manages “attributes, rewriting results, levels, ranks, number of appearances” in association with each other. The “attribute” stored here indicates an attribute designated as an anonymization target. “Rewrite result” indicates a word whose attribute value has been rewritten upon anonymization.

  The “level” is information indicating the hierarchy of the abstract pattern specified based on the attribute value before rewrite, the rewrite result (abstract pattern), the abstract pattern, and the like. Specifically, the attribute value “8 years old, 9 years old” before rewriting is level 1, the attribute value after rewriting (abstract pattern) “10s, 20s” is level 2, and the attribute values after rewriting are included. Level 3 or the like is set for another abstraction pattern “Minor, Adult” or the like.

  “Rank” is a priority of a plurality of rewrite results at the same level, and a higher rank is set as the number of appearances increases. “Number of appearances” is the cumulative number of rewrite results that appear in the anonymized data. In the example of FIG. 6, the data of the attribute “age” and the rewriting result “8 years old” belongs to the level “1”, the priority is “1st”, and the number of appearances is “25” times. Indicates.

  FIG. 7 is a diagram illustrating an example of the attribute generalization hierarchy. As shown in FIG. 7, the attribute generalization hierarchy manages “attributes, levels, and attribute values” in association with each other. The “attribute” stored here indicates an attribute designated as an anonymization target. “Level” indicates a hierarchy in which attributes are classified from the inclusion relation of attribute values. The “attribute value” is an attribute value classified from an inclusion relationship or the like among attribute values belonging to the same attribute.

  The example of FIG. 7 is an example in which the attribute “age” is classified into three layers. In level 1 (hierarchy 1), attribute values “8, 9, 10,... 99 years” are classified. In level 2 (hierarchy 2), “0's, 10's, 20's ... “” Is classified, and level 3 (hierarchy 3) indicates that “underage, adult, under 18 years old, etc.” is classified.

  The anonymization processing unit 15 is a processing unit that converts personal information data into anonymized data using a predetermined application. Specifically, the anonymization processing unit 15 uses the application specified by the engineer to anonymize the personal information data received from the engineer such as the data processor with the abstract pattern specified by the engineer. The anonymized data after anonymization is stored in the anonymized information DB 11. The engineer can designate an attribute included in the abstract pattern with reference to the dictionary DB or the like.

  The attribute acquisition unit 16 is a processing unit that collects information regarding an abstraction pattern designated by an engineer at the time of anonymization. Specifically, the attribute acquisition unit 16 acquires information indicating how each engineer of each company abstracted the attribute value from each engineer and stores the information in the attribute accumulation DB 12. For example, the attribute acquisition unit 16 acquires the attribute “age”, the attribute value “21 years old”, the rewrite result “20s”, the date “12/1”, and the like, and stores them in the attribute accumulation DB 12.

  The score generation unit 17 includes a first hierarchy generation unit 17a and a second hierarchy generation unit 17b, and is a processing unit that generates a value generalization hierarchy and an attribute generalization hierarchy.

  The first hierarchy generation unit 17a specifies the hierarchical relationship of each abstract pattern based on the number of attribute values associated with each abstract pattern included in each anonymization data and the inclusion relationship of each abstract pattern. Generate a value generalization hierarchy.

  FIG. 8 is a diagram for explaining an example of generating a value generalization hierarchy. Here, as an example, “21 years old, Tokyo”, “53 years old, Aomori”, “45 years old, Kagoshima”, “24 years old, Kanagawa”, “17 years old, Nagano” and the like are attribute values of “age, region”. Is anonymized with the attribute “age” and the attribute “region”, the anonymized data “age, number of people” is “10s, 30”, “20s, 21”, “30s, 17”, An example in which “40s, 19” and “50s, 16” are generated will be described. Similarly, an example in which “Tohoku, 12”, “Kanto, 25”, “Tokai, 21”, “Kansai, 29”, “China, 16” is generated as the anonymized data “region, number of people” will be described.

  Further, at the time of such anonymization, the attribute storage DB 12 stores “age, attribute value, rewrite result, date / time” as “age, 21 years old, 20s, 12/1”, “region, Tokyo, Kanto, 12 / It is assumed that “1” and the like are accumulated.

  In this case, the first hierarchy generation unit 17a refers to the attribute accumulation DB 12 and counts the number of appearances of the combination of “attribute, attribute value, rewrite result”. Specifically, the first layer generation unit 17a determines that “age, 21 years old, 20s” is detected as two “age, 21 years old, 20s” as “attribute, attribute value, rewrite result”. The number of occurrences of is 2. In this way, the first layer generation unit 17a sets “age, attribute value, rewrite result, number of appearances” as “age, 21 years old, 20s, 20” or “age, 21 years old, 18 years old or older, 2”. Are generated and stored in the attribute tabulation DB 13.

  Subsequently, the first hierarchy generation unit 17a generates a superordinate concept and a subordinate concept from the number of appearances for each “attribute value + rewrite result”. Specifically, the first hierarchy generation unit 17a aggregates the upper and lower positions, with attribute value = lower concept and rewrite result = higher concept. For example, when there are a plurality of attributes as a subordinate concept of the rewrite result “20's”, the first layer generation unit 17a adds a value obtained by adding 1 to the level set in the subordinate concept to the level of the rewrite result “20's”. Set to.

  In this way, the first hierarchy generation unit 17a generates the value generalization hierarchy based on the number of appearances of the rewrite result. However, if the hierarchy cannot be fixed, such as when the same content is duplicated, the one with the larger number of appearances is given priority. To do. In addition, the first hierarchy generation unit 17a gives priority to the one having a larger number of appearances in the level. As a result, the first hierarchy generation unit 17a generates a value generalization hierarchy including “attribute, rewrite result, level, rank, number of appearances” and stores it in the score DB.

  Here, the setting of the level indicating the hierarchical relationship will be specifically described. FIG. 9 is a diagram illustrating an example of setting the level value. The values associated with each level shown in FIG. 9 are attribute values after rewriting at each level. Level 1 corresponds to an attribute with one rewrite result. For example, data that is anonymized while the attribute “18 years old” before rewriting is “18 years old” and data that is anonymized while the attributes “19 years old” before rewriting are “19 years old” are applicable.

  Next, level 2 corresponds to anonymized data obtained by abstracting attribute values before rewriting corresponding to level 1. For example, data anonymized by rewriting the attribute “21” before rewriting to “20s” and data anonymized by rewriting the attribute “21” before rewriting to “20-22 years old” are applicable. In these data, since the attribute value before rewriting corresponds to level 1, level 2 obtained by adding one from level 1 is set.

  Next, level 3 corresponds to anonymized data obtained by abstracting attribute values before rewriting corresponding to level 2. For example, data anonymized by rewriting the attribute “20's” before rewriting to “Youth” and data anonymized by rewriting the attribute “20's” before rewriting to “20 years or older” are applicable. Since the attribute value before rewriting corresponds to level 2 in these data, level 3 obtained by adding one from level 2 is set.

  Here, the upper and lower relations of the attribute values after rewriting at each level are set higher as the number of appearances increases. That is, the anonymized data in which the attribute value “21 years old” is rewritten to “20s” has a larger number of appearances than the anonymized data in which the attribute value “21 years old” is rewritten to “20-22 years old”. The attribute value “20's” after rewriting has a higher priority. Thus, each level is determined by the attribute value after rewriting, that is, the inclusion relation and the number of appearances of the abstract pattern, and the value generalization hierarchy is a hierarchical structure focusing on the attribute value (abstraction pattern) after rewriting. It is.

  Returning to FIG. 2, the second hierarchy generation unit 17b extracts each abstract pattern associated with the attribute, classifies the attribute into a plurality of hierarchy relations using the inclusion relation of each abstract pattern, and generalizes the attribute. A processing unit that generates a hierarchy. Specifically, the second hierarchy generation unit 17b classifies the attribute that is the target of the anonymized data by grouping with the attribute value “abstraction pattern” after rewriting that is divided into levels. And the 2nd hierarchy production | generation part 17b stores a classification result in score DB14 as an attribute generalization hierarchy.

  For example, it is assumed that the first hierarchical generation unit 17a specifies the hierarchical relationship of rewritten attribute values (abstracted patterns) as shown in FIG. 9 in the anonymized data for the attribute “age”. In this case, the second hierarchy generation unit 17b groups attribute values belonging to level 1, groups attribute values belonging to level 2, and groups attribute values belonging to level 3.

  Then, the second hierarchy generation unit 17b includes “attribute (age), level 1, attribute values belonging to level 1”, “attribute (age), attribute values belonging to level 2, level 2”, “attribute (age) ), Level 3 and attribute values belonging to level 3 ”. That is, the second hierarchy generation unit 17b classifies the attribute (age) by level. And the 2nd hierarchy production | generation part 17b stores this matching in score DB14 as an attribute generalization hierarchy. As described above, the attribute generalization hierarchy is a hierarchical structure that focuses on the attribute that is the target of the anonymized data.

  The search unit 18 includes an evaluation unit 18a and a display control unit 18b, and is a processing unit that searches corresponding anonymized data using a search term input by the data user and provides it to the data user.

  The evaluation unit 18a is a processing unit that receives a search term from a data user and generates an evaluation index for anonymized data. Specifically, the evaluation unit 18a generates an evaluation index such as NCP (Normalized Certainty Penalty) for measuring a change in the number of categories and DIS that is the sum of the change ratios of the attribute generalization hierarchy and the value generalization hierarchy. Then, for the anonymized data including the search word as an attribute or an abstract pattern, an index is calculated as to whether or not it is similar to the anonymized data desired by the data user.

  Note that NCP is an index of how much the level is different, so “100%” is the same when it is completely the same, and “0%” when it is completely different. On the other hand, DIS is an index indicating whether or not the variations of options are similar, and is “0%” when exactly the same, or “100%” when completely different.

  An example of generating an evaluation index will be described with reference to FIG. FIG. 10 is a diagram illustrating an example of calculating the evaluation index. Here, the information A is anonymized data possessed by the data user, the information B is anonymized data searched by a search word, and the meta attribute is an attribute generalization hierarchy. The number of meta attribute sections is the number of attribute values.

  For example, the evaluation unit 18a calculates the degree of change in the number of sections between the anonymized data held by the data user and the searched anonymized data, using Expression (1). In this example, the evaluation unit 18a sets “NCP = 5/6 = 0.83” as “NCP = (number of sections of anonymized data retrieved / number of sections of anonymized data held by data user)”. calculate. Therefore, the evaluation unit 18a calculates the NCP value as 83%.

  As another example, the evaluation unit 18a calculates the degree of change in the number of sections between the anonymized data held by the data user and the attribute generalization hierarchy (meta attribute) using Expression (2). In this example, since information A includes level 2 and level 3, level 2 and level 3 are also targeted in the meta attribute. Specifically, the evaluation unit 18a determines that “NCP = (number of sections of anonymized data held by data user / (number of sections of meta attribute level 2 + number of sections of meta attribute level 3))”. NCP = (6 / (7 + 6)) = 0.46 ”is calculated. Therefore, the evaluation unit 18a calculates the NCP value as 46%.

  In addition, although the example in which the data user holds the anonymized data has been described here, the present invention is not limited to this, and the NCP value is calculated even when the data user does not hold the anonymized data. can do.

  Specifically, the evaluation unit 18a calculates the degree of change in the number of sections between the searched anonymized data and the attribute generalization hierarchy (meta attribute) using Expression (2). In this example, since the information B indicating the searched anonymized data includes the level 1 and the level 3, the level 1 and the level 3 are also targeted in the meta attribute. Specifically, the evaluation unit 18a sets “NCP = (number of sections of retrieved anonymized data / (number of sections of meta attribute level 1 + number of sections of meta attribute level 3))” as “NCP = (5 /(89+6))=0.05 ”Therefore, the evaluation unit 18a calculates the NCP value as 5%.

  Moreover, the evaluation unit 18a calculates DIS, which is the sum of the change ratios of the attribute generalization hierarchy and the value generalization hierarchy, using Expression (3). “A” in Expression (3) is the sum of the attributes to be multiplied, and may be ignored in the case of one attribute. “B” is the total distortion of attribute values included in one attribute, and “c” is “height in value generalized attribute before anonymization process—value generalization hierarchy after anonymization process” "D" is the height of the attribute generalization hierarchy. “E” is the number of attributes × the number of attribute values.

  FIG. 11 is a diagram for explaining a calculation example of the DIS. Assuming that the information A is anonymized data possessed by the data user, and the value generalization hierarchy (VGH) and the attribute generalization hierarchy (DVH) shown in FIG. 11 are generated, a DIS calculation example of the information A explain.

  As illustrated in FIG. 11, the evaluation unit 18 a has “1 (attribute) × 6 × 7” for the denominator because the number of divisions is “6, 7, 89” for one attribute whose calculation target is the attribute (age). X89 "is calculated. In addition, the evaluation unit 18a, for the numerator, “(Minor-most detailed information (1)) / Minor level in information A”, “(20s-most detailed information (1)) / in information A”. “20's level”, “(30's-most detailed information (1)) / 30's level in information A”, “(40's—most detailed information (1)) / 40's level in information A” "," (50's-most detailed information (1)) / level of 50's in information A "," (60's-most detailed information (1)) / level of 60's in information A " . Specifically, the evaluation unit 18a calculates DIS = 0.00102 by performing the calculation shown in FIG. 11 using the above denominator and numerator.

  The display control unit 18b is a processing unit that acquires the evaluation index and the searched anonymized data from the evaluation unit 18a, and provides the search result rearranged according to the evaluation index to the data user. In addition, when the display control unit 18b receives a sort instruction from the user on the search result screen, the display control unit 18b provides the data user with a screen on which the search result is sorted.

  FIG. 12 is a diagram illustrating an example of a search result. The display control unit 18b generates and provides the search result screen 20 using the information acquired from the evaluation unit 18a. This FIG. 12 is an example in the case where the data user does not hold the anonymized data, and in this case, the display control unit 18b has k-anonymity satisfying a threshold value among the searched anonymized data. Display anonymized data.

  As shown in FIG. 12, the search result screen 20 has a search field 20a, a search result 20b, a purchase button 20c, a refinement search button 20d, and a rearrangement button 20e. The search column 20a is a column in which a data user inputs a search term. The search result 20b is information on the searched anonymized data, and is sorted by DIS, NCP, number of appearances, and the like. In this search result, “public company” that is the name of the company that publishes the anonymized data, “attribute” that indicates the attribute of the anonymized data, “attribute value” included in the attribute, the data user selects the anonymized data “Select button”, “DIS score”, “NCP score”, “number of appearances”, “k-anonymity of anonymized data”, “number of users” included in anonymized data, and the like are displayed. Here, the DIS score and the NCP score are evaluation values using the value generalization hierarchy and the attribute generalization hierarchy of the anonymized data of the search result.

  The purchase button 20c is a button for making a transition to a purchase process for anonymized data selected in the search result. The search refinement button 20d is a button for making a transition to a process of narrowing down the searched anonymized data. The rearrangement button 20e is provided for each of the DIS score, the NIS score, and the number of appearances, and is a button for rearranging the values in ascending order or descending order.

  In this manner, the display control unit 18b can display information scores such as DIS and NCP from information exceeding the l-anonymity level criterion, and can display the information difference level. Thereby, the data user can determine whether the information is near or far. In addition, since a sort reference value can be created, a data user can add a function of selecting information close to his / her necessity and narrowing down to information close to that.

  FIG. 13 is a diagram for explaining an example of a search result. FIG. 13 is an example in the case where the data user holds anonymized data. In this case, the display control unit 18b uses the anonymized data held by the data user as a reference point, and k-anonymous. Anonymized data with the same amount of information as the property satisfies the threshold is displayed.

  The difference between the search screen 21 shown in FIG. 13 and FIG. 12 is that it has anonymized data information 21b held by itself (data user). The information 21b includes “public company”, “attribute”, “attribute value”, “DIS score”, “NCP score”, “number of appearances”, “k-anonymity”, and “number of users”. Since the evaluation indexes such as DIS and NCP of the anonymized data information 21b are comparisons between the same anonymized data, DIS score = 0% and NCP score = 100%.

[Flow of score evaluation generation]
FIG. 14 is a flowchart showing a flow of score evaluation generation processing. As shown in FIG. 14, the first hierarchy generation unit 17a acquires the attribute value (S101), and generates a record of the attribute value and the combination after rewriting from the attribute accumulation DB 12 (S102).

  Subsequently, the first layer generation unit 17a determines whether the result of the same word (attribute value and the combination after rewriting) exists in the current aggregation period (S103), and when the result does not exist (S104: No) Then, level 1 is set to the rewritten word of the combination (S105). Thereafter, the first hierarchy generation unit 17a adds the number of appearances to the attribute count DB 13 for the combination (S106).

  On the other hand, when there is a result (S104: Yes), the first layer generation unit 17a sets a level already set for the same word in the rewritten word in the combination (S107), and executes S106 To do.

  Thereafter, the first hierarchy generation unit 17a acquires the rewritten word (attribute value, abstraction pattern) (S108), acquires the subordinate concept of the rewritten word during the current aggregation period (S109), and subordinate concept It is determined whether there are two or more (S110).

  And the 1st hierarchy production | generation part 17a sets the word after rewriting to the same level, when there is one subordinate concept (S110: No) (S111). And the 1st hierarchy production | generation part 17a adds the appearance count of the word after rewriting to attribute totalization DB13 (S112).

  In addition, when there are two or more subordinate concepts (S110: Yes), the first hierarchy generation unit 17a sets a level obtained by adding +1 to the maximum value of the subordinate concept level in the rewritten word (S113), and S112. Execute.

  Thereafter, when there is a next attribute value (S114: Yes), the first layer generation unit 17a acquires the next attribute value (S115), and repeats the steps from S102 onward.

  On the other hand, when there is no next attribute value (S114: No), the first hierarchy generation unit 17a acquires the average value of the level and the total number of appearances and registers them in the value generalization hierarchy (S116). The first hierarchy generation unit 17a registers the rank specified by the number of appearances in the value generalization hierarchy (S117).

  Here, a specific example of level setting will be described. FIG. 15 is a diagram for explaining data transition of score evaluation. As illustrated in FIG. 15, the first hierarchy generation unit 17 a selects the rewriting result “20s” from the attribute totaling DB 13 for the attribute “age”, and temporarily sets “level” to the rewriting result “20s” as the score intermediate data. 1 ”is set.

  After that, the first hierarchy generation unit 17a detects from the information of the other rewrite results and the subordinate concept that there is another attribute value rewritten to the target rewrite result “20's” in the anonymization process. At the same time, it is specified that the lower conceptual level of the other attribute value is 1. As a result, the first layer generation unit 17a sets the level value of the target rewrite result “20's” to “level of lower concept (level 1) + 1 = 2”. In this way, the first hierarchy generation unit 17a sets a level for specifying a hierarchy for the rewrite result “attribute value”.

[Search process flow]
FIG. 16 is a flowchart showing the flow of search processing. As illustrated in FIG. 16, when the evaluation unit 18a acquires a search word (S201), the evaluation unit 18a acquires a group including the search word from an information group that satisfies the anonymization condition (k> 1, etc.) (S202).

  Subsequently, when there is no information to be compared (S203: No), the evaluation unit 18a acquires a meta attribute of the corresponding level from the attribute generalization hierarchy (S204). On the other hand, when there is information to be compared (S203: Yes), the evaluation unit 18a acquires information to be compared (own anonymized data) (S205).

  Thereafter, the evaluation unit 18a obtains the level and score from the value generalization attribute for each information (S206), and calculates DIS, NCP, and the like as the change level of the anonymized information (anonymized data) (S207). ). Then, the display control unit 18b determines the display order based on DIS, NCP, the number of appearances, and the like (S208), and displays the search results on the display, the user terminal, etc. in the determined order (S209).

[effect]
As described above, the anonymization distribution device 10 creates the value generalization hierarchy creation logic created when the anonymization process is performed, and the hierarchy logic for searching information in the same form, and uses both in the same format. By being able to describe, it can be used for both anonymization processing and information retrieval. Further, the anonymization distribution device 10 accumulates the rewrite result generated when creating the anonymized information, thereby using the information for the information search and the result information used for the information search for the generation of the anonymized information. Available.

  In addition, since the anonymized distribution device 10 searches for the input of very little information with or without the concept of the attribute information and provides it as a usable search result, there are many results displayed. It is possible to present detailed information. Moreover, the anonymization distribution device 10 can determine information that can be used or cannot be used in advance by registering the attribute of the information held by the information user, and the accuracy of the result output is increased. .

  In addition, since the anonymization distribution apparatus 10 is structurally easy to add a functional element such as attribute priority registration, it is possible to collect anonymized information by a simple operation. In addition, high connectivity with a large amount of data means that it is relatively safe and has the same meaning as being included in a useful concept, which greatly impairs the setting of useless attribute values and safety. It leads to eliminating the result.

  Further, even if the meanings of the attributes are the same, the search cannot be performed without knowing the concept, but the anonymization distribution device 10 compares the information itself with the concept, so it does not need to know the word. The result can be displayed. Moreover, the anonymization distribution device 10 can provide an index based on the evaluation criteria for connectivity to the anonymization engine at the time of data creation, and can use an attribute useful for anonymization processing as much as possible. It becomes possible. As a result, the processing accuracy of anonymized information increases. For example, information that is not used even if anonymization is performed is eliminated as much as possible, and an effect of promoting distribution can be expected.

  Although the embodiments of the present invention have been described so far, the present invention may be implemented in various different forms other than the embodiments described above.

[Evaluation index]
In the above-described embodiment, the example in which the display control is executed by the value of DIS or NCP has been described. However, the present invention is not limited to this. The anonymization distribution apparatus 10 can also perform display control using only the number of appearances without using the value of DIS or NCP. For example, the anonymization distribution apparatus 10 can preferentially display a search result satisfying k-anonymization that has a large number of appearances. In addition to DIS and NCP, the Hamming distance between the anonymized data of the user and the searched anonymized data can be used.

[feedback]
The anonymization distribution device 10 can also feed back the search result. Specifically, the anonymization distribution device 10 determines the number of appearances of an abstract pattern searched for by a user searching for desired anonymized data, or an abstract pattern selected by the user from the searched abstract patterns. The number of appearances can be increased by a predetermined value.

  For example, when the anonymization data provided by the company C is actually purchased, the anonymization distribution device 10 sets the appearance number of attribute values (words after rewriting) included in the anonymization data of the company C to a predetermined value (for example, 10) can be increased. Note that the increase condition can be set arbitrarily, for example, when anonymized data provided by company C is searched or when details of anonymized data provided by company C are viewed. In addition, the number of predetermined values can be changed by purchase, detailed display, search, and the like. For example, the number of predetermined values can be increased in descending order of purchase, detailed display, search, and the like.

[system]
Further, each configuration of the illustrated apparatus does not necessarily need to be physically configured as illustrated. That is, it can be configured to be distributed or integrated in arbitrary units. Further, all or any part of each processing function performed in each device is realized by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or hardware by wired logic. Can be realized as

  In addition, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually can be performed. All or a part can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

  Furthermore, various processing functions performed in each device are performed on a CPU (Central Processing Unit) (or a microcomputer such as an MPU (Micro Processing Unit), MCU (Micro Controller Unit), etc.) in whole or in part. You may make it perform. Various processing functions may be executed entirely or arbitrarily on a program that is analyzed and executed by a CPU (or a microcomputer such as an MPU or MCU) or hardware based on wired logic. .

  The anonymization distribution device 10 can be realized by the following hardware configuration, for example. FIG. 17 is a diagram illustrating a hardware configuration example. As illustrated in FIG. 17, the anonymization distribution device 100 includes a processor 101, a memory 102, and an IF 103.

  Examples of the processor 101 include a central processing unit (CPU), a digital signal processor (DSP), and a field programmable gate array (FPGA). Further, examples of the memory 102 include a RAM (Random Access Memory) such as an SDRAM (Synchronous Dynamic Random Access Memory), a ROM (Read Only Memory), a flash memory, and the like.

  Various processing functions performed in the anonymization distribution device 10 may be realized by executing a program stored in various memories such as a nonvolatile storage medium by a processor included in the control device. That is, a program corresponding to each process executed by the anonymization processing unit 15, attribute acquisition unit 16, score generation unit 17, and search unit 18 may be recorded in the memory 102, and each program may be executed by the processor 101.

10 Anonymized distribution device 11 Anonymized information DB
12 attribute storage DB
13 Attribute aggregation DB
14 Score DB
DESCRIPTION OF SYMBOLS 15 Anonymization processing part 16 Attribute acquisition part 17 Score production | generation part 17a 1st hierarchy production | generation part 17b 2nd hierarchy production | generation part 18 Search part 18a Evaluation part 18b Display control part

Claims (7)

For each anonymized data in which personal information data related to attributes for which at least one attribute value related to personal information is set is anonymized according to an abstract pattern, the attribute value and the attribute value are rewritten in the anonymization A counting unit that counts the number of occurrences of each combination associated with an abstraction pattern;
When a search term for searching for desired anonymized data is received, the search target abstract pattern is displayed according to the number of appearances of the search target abstract pattern including the search term as the attribute value or the attribute. An anonymized data providing apparatus comprising: a display control unit for controlling. Based on the number of attribute values associated with each abstraction pattern included in each anonymization data and the inclusion relation of each abstraction pattern, a specifying unit that identifies the hierarchical relation of each abstraction pattern,
A calculation unit that calculates the anonymization evaluation index for the search target abstraction pattern using the number of appearances of the search target abstraction pattern or the hierarchical relationship;
The anonymized data providing apparatus according to claim 1, wherein the display control unit controls display of the abstract pattern to be searched according to the evaluation index. The calculation unit includes, as the anonymization evaluation index, the number of sections of the anonymized data held by a user who searches for the desired anonymized data, the classification of the anonymized data including the abstraction pattern to be searched Calculate the evaluation value divided by the number,
The anonymized data providing apparatus according to claim 2, wherein the display control unit preferentially displays the search target abstract pattern having a large evaluation value. The specifying unit extracts each abstraction pattern associated with the attribute, classifies the attribute into a plurality of hierarchical relationships using an inclusion relationship of each abstraction pattern,
The calculation unit, as the evaluation index for anonymization, divides the number of abstract patterns to be searched by the number of abstract patterns possessed by the attribute associated with the hierarchy of abstract patterns to be searched Calculate the evaluation value,
The anonymized data providing apparatus according to claim 2, wherein the display control unit preferentially displays the search target abstract pattern having a large evaluation value.   The counting unit includes the number of appearances of the abstraction pattern searched by a user who searches for the desired anonymized data, or the number of appearances of the abstraction pattern selected by the user among the searched abstraction patterns. The anonymized data providing apparatus according to claim 1, wherein a predetermined value is increased. Computer
For each anonymized data in which personal information data related to attributes for which at least one attribute value related to personal information is set is anonymized according to an abstract pattern, the attribute value and the attribute value are rewritten in the anonymization Count the number of occurrences of each combination associated with an abstraction pattern,
When a search term for searching for desired anonymized data is received, the search target abstract pattern is displayed according to the number of appearances of the search target abstract pattern including the search term as the attribute value or the attribute. The anonymization data provision method characterized by including the process to control. On the computer,
For each anonymized data in which personal information data related to attributes for which at least one attribute value related to personal information is set is anonymized according to an abstract pattern, the attribute value and the attribute value are rewritten in the anonymization Count the number of occurrences of each combination associated with an abstraction pattern,
When a search term for searching for desired anonymized data is received, the search target abstract pattern is displayed according to the number of appearances of the search target abstract pattern including the search term as the attribute value or the attribute. An anonymized data providing program characterized by including a process for controlling.

Images