JP6711519B2 - Evaluation device, evaluation method and program - Google Patents

Description

The present invention relates to an evaluation device for evaluating anonymized information, an evaluation method, and a program for realizing the same.

In recent years, due to the development of IT technology, personal information is very easily leaked. Therefore, the importance of protecting personal information is being emphasized, and it has been proposed that the personal information be processed to make it difficult to identify the individual. A k-anonymization process is known as one of such processing processes.

In the k-anonymization process, data is processed so that there are k or more data having the same attribute in the target data. For example, it is assumed that k=3 is set when personal data having items such as postal code, sex, age, and hobby exists. In this case, when the k anonymization process is executed, the lower digits of the postal code are deleted or the age is rounded up so that the number of individuals whose items all match is k=3 or more. Is being processed.

In relation to this, for example, in Patent Document 1, it is determined whether excessive information loss occurs when anonymization processing is performed on the database, and the information utility is calculated based on the determined determination result. It is disclosed to do.

In addition, Patent Document 2 discloses an information anonymization system that analyzes a risk level at which an individual is uniquely identified from anonymized data including personal information. The disclosed information anonymization system quantitatively analyzes the risk for each record that makes up the anonymized data, and calculates the risk level of the anonymized data according to a specific measure based on the risk of each analyzed record. Then, the calculated risk level is output.

JP, 2013-190838, A JP, 2005-176496, A

Here, as the value of k is set higher, the risk of leakage of personal information is reduced, but the usefulness when using personal information is reduced. On the other hand, the lower the value of k is set, the more useful the personal information is, but the higher the risk of leakage of the personal information.

In Patent Document 1, it is determined whether information is excessively lost with respect to anonymized individual anonymized data, and the usefulness of the anonymized personal information is calculated. No consideration is given to the point of preventing the leakage risk.

In Patent Document 2, a risk analyzer is used to analyze the risk of leakage of personal information, and the risk of personal information is solved by analyzing the risk level. However, if the risk of leakage is excessively prevented, the usefulness of information is lost. It does not take into consideration the possibility that it may occur.

Therefore, it is required to evaluate both information usefulness and leakage risk and set the value of k to an appropriate value.

An example of the object of the present invention is to provide an evaluation device, an evaluation method, and a program that can solve the above-mentioned problems and can evaluate the data subjected to the k-anonymization process.

In order to achieve the above object, an evaluation device according to one aspect of the present invention is an evaluation device that evaluates data including personal information acquired from a plurality of individuals as target data,
Possibility of grasping the existence of the individual from which the personal information is acquired from the target data, evaluating as a personal identification risk, a personal identification risk evaluation unit,
The possibility that the individual from whom the personal information is acquired is identified from the target data, is evaluated as an individual identification risk, and an individual identification risk evaluation unit,
A usefulness evaluation unit that evaluates usefulness when anonymization processing is performed on the target data,
It is characterized by having.

Further, in order to achieve the above object, an evaluation method according to one aspect of the present invention is an evaluation method in which data including personal information acquired from a plurality of individuals is evaluated as target data,
(A) evaluating the possibility that the existence of an individual who has acquired the personal information from the target data is known as a personal identification risk;
(B) evaluating the possibility that an individual from whom the personal information is acquired from the target data is identified as an individual identification risk;
(C) a step of evaluating the usefulness when the anonymization process is performed on the target data.

In order to achieve the above object, the program according to one aspect of the present invention is
A program for evaluating data including personal information obtained from a plurality of individuals as target data by a computer,
On the computer,
(A) evaluating the possibility that the existence of an individual who has acquired the personal information from the target data is known as a personal identification risk;
(B) evaluating the possibility that an individual from whom the personal information is acquired from the target data is identified as an individual identification risk;
(C) a step of evaluating the usefulness when anonymization processing is performed on the target data,
Is carried out.

As described above, according to the present invention, it is possible to evaluate the data subjected to the k-anonymization process.

FIG. 1 is a block diagram showing a schematic configuration of an evaluation device according to the first embodiment of the present invention. FIG. 2 is a block diagram specifically showing the evaluation device according to the present embodiment. FIG. 3 is a flowchart showing the operation of the evaluation device according to the embodiment of the present invention. FIG. 4 is a diagram showing an example of the evaluation of the personal identification risk obtained in the embodiment of the present invention. FIG. 5 is a diagram illustrating an example of the personal identification risk evaluation process performed in the embodiment of the present invention, and FIGS. 5A to 5C show a series of process flows. FIG. 6 is a diagram illustrating another example of the personal identification risk evaluation process performed in the embodiment of the present invention, and FIGS. 6A to 6D show a series of processes. FIG. 7 is a diagram illustrating another example of the personal identification risk evaluation process performed in the embodiment of the present invention, and FIGS. 7A to 7E show a series of processes. FIG. 8 is a diagram for explaining an individual identification risk evaluation process performed in the embodiment of the present invention, and shows an example of personal information. FIG. 9 is a diagram showing an example of evaluation of usefulness performed in the embodiment of the present invention. FIG. 10 is a block diagram showing an example of a computer that realizes the evaluation device according to the embodiment of the present invention.

(Embodiment)
Hereinafter, an evaluation device, an evaluation method, and a program according to an embodiment of the present invention will be described with reference to FIGS.

[Device configuration]
First, a schematic configuration of the evaluation device according to the present embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing a schematic configuration of an evaluation device according to the first embodiment of the present invention.

The evaluation apparatus 10 according to the present embodiment shown in FIG. 1 is an apparatus that evaluates data including personal information of a plurality of individuals as target data. As shown in FIG. 1, the evaluation device 10 in the present embodiment includes an individual identification risk evaluation unit 11, an individual identification risk evaluation unit 12, and a usefulness evaluation unit 13.

The personal identification risk evaluation unit 11 evaluates the possibility that the existence of the individual who acquired the personal information from the target data is recognized as the personal identification risk. The individual identification risk evaluation unit 12 evaluates, as an individual identification risk, the possibility that an individual from whom the personal information is acquired is identified from the target data. The usefulness evaluation unit 13 evaluates the usefulness when the anonymization process is performed on the target data.

Here, “identification” is defined as the fact that the information of each person is known. “Specific” is defined as knowing who the information is. “Identification” has a broader meaning than “identification”. If "identified", then naturally "identified". It can be said that k anonymization is a technique that makes “identification” difficult in order to prevent “identification”.

As described above, in the present embodiment, the data is evaluated based on three points of individual identification risk, individual identification risk, and usefulness. According to the present embodiment, it is possible to evaluate the data that has undergone k-anonymization processing.

Subsequently, the evaluation system 1 according to the present embodiment will be described more specifically with reference to FIG. FIG. 2 is a block diagram specifically showing the evaluation device according to the present embodiment.

As shown in FIG. 2, in the present embodiment, a database 20 that manages personal information and a terminal device 30 used by an evaluator are connected to the evaluation device 10 via a network or the like.

The database 20 stores personal information. Further, the database 20 may store anonymized personal information. The personal information has a quasi-identifier having a possibility of identifying an individual, such as an address, a name, a telephone number, an age and a nationality, and is composed of a plurality of quasi-identifiers. Further, the anonymization is performed, for example, by changing the content of the quasi-identifier so that when the value of the set level is A, there are A individuals who share the quasi-identifier.

In addition, as shown in FIG. 2, in the present embodiment, the evaluation device 10 includes a data acquisition unit in addition to the individual identification risk evaluation unit 11, the individual identification risk evaluation unit 12, and the usefulness evaluation unit 13 described above. 14 and a data output unit 15.

The data acquisition unit 14 acquires personal information or anonymized personal information from the database 20 as target data. The data output unit 15 indicates the individual identification risk obtained from the individual identification risk evaluation unit 11, the individual identification risk obtained from the individual identification risk evaluation unit 12, and the usefulness obtained from the usefulness evaluation unit 13, It is transmitted to the terminal device 30. As a result, each risk and usefulness of personal information is displayed on the screen of the terminal device 30.

In the present embodiment, the personal identification risk evaluation unit 11 calculates the number of records in which the values of the quasi-identifiers forming the personal information in the target data match, and from the calculated number, the anonymization of the target data is performed. The individual identification risk is evaluated by obtaining the number of people identified by k when the process is executed. That is, the individual identification risk evaluation unit 11 counts the number of records that can be identified from the quasi-identifiers, and calculates the number of identifiable records in someone's record as the individual identification risk.

In the present embodiment, the individual identification risk evaluation unit 12 determines the individual identification risk obtained by the individual identification risk evaluation unit 12 and the risk that an individual is identified from each quasi-identifier preset for each quasi-identifier. The individual identification risk is evaluated based on the indicated coefficient. That is, the individual identification risk evaluation unit 12 calculates the individual identification risk in consideration of how much the attacker uses the quasi-identifier with respect to the evaluation result of the risk of individual identification.

In this embodiment, the usefulness evaluation unit 13 evaluates the usefulness by using the number of records of the target data and the number of records of the target data when the anonymization process is performed on the target data. Specifically, the usefulness evaluation unit 13 compares the number of records before anonymization of the target data with the number of records after anonymization, and evaluates how many records have been deleted by the anonymization.

[Device operation]
Next, an example of the operation of the evaluation device 10 according to the present embodiment will be described with reference to FIG. FIG. 3 is a flowchart showing the operation of the evaluation device according to the embodiment of the present invention. Further, in the following description, FIGS. 1 and 2 will be referred to as appropriate. Further, in the present embodiment, the evaluation method is implemented by operating the evaluation device 10. Therefore, the description of the evaluation method according to the present embodiment will be replaced with the following description of the operation of the evaluation device 10.

As shown in FIG. 3, first, the data acquisition unit 14 acquires personal information as target data from the database 20 (step A1). Further, the data acquisition unit 14 inputs the acquired target data to the individual identification risk evaluation unit 11, the individual identification risk evaluation unit 12, and the usefulness evaluation unit 13.

Next, the personal identification risk evaluation unit 11 evaluates, as the personal identification risk, the possibility that the existence of the individual from which the personal information is acquired is grasped from the target data acquired in step A1 (step A2). The personal identification risk evaluation unit 11 also inputs the result to the data output unit 15.

Next, the individual identification risk evaluation unit 12 evaluates the possibility that the individual from which the personal information is acquired from the target data is identified as the individual identification risk (step A3). The individual identification risk evaluation unit 12 also inputs the result to the data output unit 15.

Next, the usefulness evaluation unit 13 evaluates the usefulness when the anonymization process is performed on the target data (step A4). The usefulness evaluation unit 13 also inputs the result to the data output unit 15.

Next, the data output unit 15 outputs the evaluation performed in steps A2 to A4 to the terminal measure 30 (step A5).

Subsequently, each of the above-described steps A2 to A4 will be described in more detail below.

[Step A2: Individual identification risk evaluation process]
First, the individual identification risk evaluation processing by the individual identification risk evaluation unit 11 will be described with reference to FIGS. 4 to 7. FIG. 4 is a diagram showing an example of the evaluation of the personal identification risk obtained in the embodiment of the present invention. FIG. 5 is a diagram illustrating an example of the personal identification risk evaluation process performed in the embodiment of the present invention, and FIGS. 5A to 5C show a series of process flows. FIG. 6 is a diagram illustrating another example of the personal identification risk evaluation process performed in the embodiment of the present invention, and FIGS. 6A to 6D show a series of processes. FIG. 7 is a diagram illustrating another example of the personal identification risk evaluation process performed in the embodiment of the present invention, and FIGS. 7A to 7E show a series of processes.

As shown in FIG. 4, in the present embodiment, the personal identification risk evaluation unit 11 determines that the data obtained by the k-anonymization process in the specific quasi-identifier portion of the table in which the personal information is recorded is the target data. Has become. That is, in FIG. 4, the first row is obtained by performing the k-anonymization process with k=10 on the data of “age” and “sex” of “post-anonymization table_pattern 1”. It indicates that the data after anonymization is the target data.

Further, the personal identification risk evaluation unit 11 calculates the number of records in which the value of the specific quasi-identifier in the target data matches, and from the calculated number, k when anonymization processing is performed on the target data. Find the number of people identified by a person. As shown in FIG. 4, this "number of people" is an evaluation of the personal identification risk.

Specifically, for example, in the target data, the specific quasi-identifier is a combination of single values. The “single value” is data having a single attribute, and is a quasi-identifier in which an individual such as age and sex has only a single value. In this case, as shown in FIG. 5, the personal identification risk evaluation unit 11 obtains the number of corresponding users (the number of records) from the target data (see FIG. 5A) for each combination of the identifiers Ql1 and Ql2. (See FIG. 5(b)). Next, the individual identification risk evaluation unit 11 obtains the number of users identified by k for each value of k (see FIG. 5C).

Further, for example, in the target data, it is assumed that the specific identifier is a set value. The “aggregate value” is data of complex attributes, and is a quasi-identifier in which an individual may have a plurality of values such as the type of illness and area (work place, place of residence). In this case, as shown in FIG. 6, the personal identification risk evaluation unit 11 specifies the combination of the corresponding identifiers “region” for each user from the target data (see FIG. 6A) (FIG. 6B. )reference). Next, the personal identification risk evaluation unit 11 obtains the number of corresponding users (the number of records) for each combination of the identifiers “region” (see FIG. 6C). Next, the individual identification risk evaluation unit 11 obtains the number of users identified by k for each value of k (see FIG. 6D).

Further, for example, in the target data, the specific identifier is a combination of a single value and a set value. In this case, as shown in FIG. 7, the personal identification risk evaluation unit 11 firstly sets the part of the set value of the target data (see FIG. 7A) and the part of the single value of the target data (see FIG. 7B). ))) and (see FIG. 7C). Next, the individual identification risk evaluation unit 11 obtains the number of corresponding users (the number of records) for each combination of the identifier qi1 and the identifier “region” (see FIG. 7C). Next, the individual identification risk evaluation unit 11 obtains the number of users identified by k for each value of k (see FIG. 7D).

[Step A3: Individual identification risk evaluation process]
Next, with reference to FIG. 8, the individual identification risk evaluation processing by the individual identification risk evaluation unit 12 will be described. FIG. 8 is a diagram for explaining an individual identification risk evaluation process performed in the embodiment of the present invention, and shows an example of personal information.

The individual identification risk evaluation unit 12 is based on the individual identification risk obtained by the individual identification risk evaluation unit 11 and a coefficient that is preset for each quasi-identifier and indicates a risk of identifying an individual from each quasi-identifier. , Assess personal identification risk. Specifically, the individual identification risk evaluation unit 12 calculates the individual identification risk f by, for example, the formula shown below.

(Equation 1)
f=(1/k)×r

In the above mathematical expression 1, k is the personal identification risk calculated by the personal identification risk evaluation unit 11. r is a coefficient indicating the risk of identifying an individual from each quasi-identifier. Hereinafter, r is referred to as “evaluation parameter”.

The evaluation parameter is appropriately set based on the content of the quasi-identifier, the value of the quasi-identifier, the usage destination of the target data, and the like. For example, assume that the personal information is as shown in FIG.

In the example of FIG. 8, the quasi-identifiers age, sex, medical treatment date, and injury/disease may be used in other external data as well, of which age and sex are different from injury/illness. It is highly likely that it exists in the data. Therefore, when the specific identifier in the target data is injury or illness, the possibility of identifying the individual is lower than in the case where the specific identifier is age or sex, and thus the value of the evaluation parameter r is set small.

Moreover, when the specific identifier in the target data data is injury or illness, heart disease is less likely to be present in another data than cold. Therefore, even when the specific identifier in the target data is injury or illness, the value of the evaluation parameter r is set to a large value when the number of cold records is relatively large, and when the number of cold records is relatively small, The value of the evaluation parameter r is set small.

Further, the individual identification risk evaluation unit 12 can also calculate the individual identification risk f by the formula shown in the following Expression 2.

(Equation 2)
f=k×R

In Expression 2, k is the individual identification risk calculated by the individual identification risk evaluation unit 11, as in Expression 1. R is the sharing rate. The sharing rate indicates the probability with which the attacker knows the target identifier as prior knowledge, and is set in the range of 0 or more and 1 or less. For example, when the identifier is only gender, it is easy to be known, so it is set to 0.9, and when it is only age, it is set to 0.7. Further, when the identifier is a combination of age and gender, it is somewhat difficult to be known, so it is set to 0.5, for example.

[Step A4: Usability Evaluation Processing]
Next, the utility evaluation processing by the utility evaluation unit 13 will be described with reference to FIG. FIG. 9 is a diagram showing an example of evaluation of usefulness performed in the embodiment of the present invention. In FIG. 9, the horizontal axis represents the value of k in the k anonymization process, and the vertical axis represents the record reduction rate before and after the k anonymization process.

As shown in FIG. 9, the usefulness evaluation unit 13 evaluates the usefulness by using the number of records of the target data and the number of records of the target data when k anonymization processing is performed on the target data. doing. Specifically, the usefulness evaluation unit 13 changes the value of k, calculates the ratio (decrease rate) of the number of records after k anonymization to the number of records before anonymization of the target data, and calculates the calculation result. Make a graph.

Thus, according to the graph shown in FIG. 9, the evaluator can visually understand how many records are deleted by the k-anonymization process. As a result, the evaluator can grasp the usefulness of the evaluation target data after the anonymization of k.

[Effects of Embodiment]
As described above, according to the present embodiment, it is possible to provide a tool for evaluating individual identification risk, individual identification risk, and usefulness, and it is possible to contribute to the formulation of guidelines that balance risk and usefulness. ..

[program]
The program in the present embodiment may be any program that causes a computer to execute steps A1 to A5 shown in FIG. The evaluation device 10 and the evaluation method according to the present embodiment can be realized by installing and executing this program on a computer. In this case, the CPU (Central Processing Unit) of the computer functions as an individual identification risk evaluation unit 11, an individual identification risk evaluation unit 12, a usefulness evaluation unit 13, a data acquisition unit 14, and a data output unit 15 to perform processing. ..

Further, the program according to the present embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the personal identification risk evaluation unit 11, the individual identification risk evaluation unit 12, the usefulness evaluation unit 13, the data acquisition unit 14, and the data output unit 15. good.

Here, a computer that realizes the evaluation device 10 by executing the program according to the present embodiment will be described with reference to FIG. 10. FIG. 10 is a block diagram showing an example of a computer that realizes the evaluation device according to the embodiment of the present invention.

As shown in FIG. 10, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader/writer 116, and a communication interface 117. These units are connected to each other via a bus 121 so as to be able to perform data communication with each other.

The CPU 111 expands the program (code) according to the present embodiment stored in the storage device 113 into the main memory 112, and executes these in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the program in the present embodiment is provided in a state of being stored in computer-readable recording medium 120. The program according to the present embodiment may be distributed on the Internet connected via the communication interface 117.

Further, as a specific example of the storage device 113, a semiconductor storage device such as a flash memory can be cited in addition to a hard disk drive. The input interface 114 mediates data transmission between the CPU 111 and an input device 118 such as a keyboard and a mouse. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

The data reader/writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads a program from the recording medium 120, and writes the processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.

As a specific example of the recording medium 120, a general-purpose semiconductor storage device such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), a magnetic storage medium such as a flexible disk, or a CD- An optical storage medium such as a ROM (Compact Disk Read Only Memory) can be used.

The evaluation device 10 according to the present embodiment can also be realized by using hardware corresponding to each unit instead of using a computer in which a program is installed. Further, the evaluation device 10 may be partially implemented by a program and the rest may be implemented by hardware.

As described above, according to the present invention, it is possible to evaluate the data subjected to the k-anonymization process. The present invention is useful in various fields in which anonymization of personal information is required.

10 Evaluation device 11 Individual identification risk evaluation part 12 Individual identification risk evaluation part 13 Utility evaluation part 14 Data acquisition part 15 Data output part 20 Database 30 Terminal device 110 Computer 111 CPU
112 Main Memory 113 Storage Device 114 Input Interface 115 Display Controller 116 Data Reader/Writer 117 Communication Interface 118 Input Equipment 119 Display Device 120 Recording Medium 121 Bus

Claims (9)

An evaluation device for evaluating data including personal information acquired from a plurality of individuals as target data,
The number of records in which the values of the quasi-identifiers forming the personal information match is calculated, and from the calculated number, the number of people identified by k when the anonymization process is performed on the target data is obtained . An individual identification risk evaluation unit that evaluates the calculated number of people as an individual identification risk,
The possibility that the individual from whom the personal information is acquired is identified from the target data, is evaluated as an individual identification risk, and an individual identification risk evaluation unit,
A usefulness evaluation unit that evaluates usefulness when anonymization processing is performed on the target data,
An evaluation device comprising: The individual identification risk evaluation unit evaluates the individual identification risk based on the individual identification risk and a coefficient that is preset for each of the quasi-identifiers and indicates a risk that an individual is identified from the quasi-identifier.
The evaluation device according to claim 1 . The usefulness evaluation unit evaluates the usefulness by using the number of records of the target data and the number of records of the target data when anonymization processing is performed on the target data,
The evaluation device according to claim 1 or 2 . An evaluation method in which a computer evaluates data including personal information acquired from a plurality of individuals as target data,
(A) The number of records in which the values of the quasi-identifiers that form the personal information match, and the number of records identified by k when the anonymization process is performed on the target data from the calculated number And evaluate the calculated number of people as a personal identification risk, and
(B) evaluating the possibility that an individual from whom the personal information is acquired from the target data is identified as an individual identification risk;
(C) a step of evaluating the usefulness when anonymization processing is performed on the target data, and
An evaluation method comprising: In the step (b), the individual identification risk is evaluated based on the individual identification risk and a coefficient that is preset for each of the quasi-identifiers and indicates a risk of identifying an individual from the quasi-identifier. ,
The evaluation method according to claim 4 . In the step (c), the usefulness is evaluated using the number of records of the target data and the number of records of the target data when anonymization processing is performed on the target data.
The evaluation method according to claim 4 or 5 . A program for evaluating data including personal information obtained from a plurality of individuals as target data by a computer,
On the computer,
(A) The number of records in which the values of the quasi-identifiers that form the personal information match, and the number of records identified by k when the anonymization process is performed on the target data from the calculated number And evaluate the calculated number of people as a personal identification risk, and
(B) evaluating the possibility that an individual from whom the personal information is acquired from the target data is identified as an individual identification risk;
(C) a step of evaluating the usefulness when anonymization processing is performed on the target data, and
A program that runs In the step (b), the individual identification risk is evaluated based on the individual identification risk and a coefficient that is preset for each of the quasi-identifiers and indicates a risk of identifying an individual from the quasi-identifier. ,
The program according to claim 7 . In the step (c), the usefulness is evaluated using the number of records of the target data and the number of records of the target data when anonymization processing is performed on the target data.
The program according to claim 7 .

Images