JP6748612B2 - Anonymity evaluation device, anonymity evaluation method, and program - Google Patents

Description

The present invention relates to a technique for evaluating anonymity of anonymized trajectory data obtained by anonymizing trajectory data.

Non-Patent Document 1 proposes an attack that identifies an individual by learning a movement history between meshes on a map using a Markov chain model, and a method of evaluating anonymity based on the attack result.

Shokri R, Theodorakopoulos G, Boudec JYL, Hubaux JP, “Quantifying location privacy,” In: Proceedings of the 2011 IEEE Symposium on Security and Privacy (S&P′11), 2011, pp. 247-262.

The locus data of a certain moving body may be acquired by a plurality of businesses. For example, when carrying a car equipped with a GPS function and moving in a vehicle equipped with a car navigation system, both the smartphone application company that uses the location information and the company that operates the car navigation system acquire the trajectory data of the individual. it can. Therefore, the holder of trajectory data may become an attacker with strong background knowledge. However, there is no method to evaluate the anonymity of the mobile body in consideration of this possibility.

The present invention has been made in view of the above circumstances, and an object thereof is to evaluate the anonymity of trajectory data of a moving body with respect to an attacker who has trajectory data as background knowledge.

The anonymity evaluation apparatus sets a plurality of arbitrary times d _i (n _i ). of mobiles S _i included in a set SET _d of a plurality of mobiles. Discrete position d _i (n _i ) at time. A plurality of arbitrary times a _i (r _i ). of the moving body S _i estimated from the trajectory data d _i representing co. Discrete estimated position a _i (r _i ) at time. Obtain background knowledge data a _i representing co. Further, the anonymity evaluation apparatus conceals the trajectory data d _j of the moving body S _j included in the set SET _sd of the plurality of moving bodies and obtains a plurality of arbitrary times sd _j (sn _{j of} the moving body S _j obtained by concealing the trajectory data d _j of the moving body S _j. ). Discrete concealment positions sd _j (sn _j ). A plurality of arbitrary times a _i (r _i ) of the moving body S _j estimated from the anonymized trajectory data sd _j representing the co. Discrete estimated concealment positions sa _j (r _i ) at time. co and any time _a i plurality of mobile _{S i (r i).} Discrete estimated position a _i (r _i ) at time. An anonymity evaluation value indicating a degree that the moving body S _j that minimizes the distance between co and the moving body S _i is obtained.

This makes it possible to evaluate the anonymity of the trajectory data of the moving body with respect to an attacker who has the trajectory data as background knowledge.

FIG. 1 is a block diagram illustrating the functional configuration of the anonymity evaluation apparatus of the embodiment. FIG. 2A is a block diagram illustrating the functional configuration of the data generation unit. FIG. 2B is a block diagram illustrating the functional configuration of the data comparison unit. FIG. 3 is a flowchart illustrating the anonymity evaluation method of the embodiment. FIG. 4 is a flowchart illustrating the processing of the data generation unit. FIG. 5 is a flowchart illustrating the processing of the data comparison unit. FIG. 6 is a diagram for explaining the linear interpolation of the embodiment. FIG. 7 is a diagram for explaining the linear interpolation of the embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
<Definition>
First, terms used in the embodiment will be defined.
≪Mobile object≫
The moving body means something that moves. Examples of moving objects include humans, parts of the body such as human fingers, non-human animals, vehicles such as automobiles, remote-controlled or autonomous moving objects such as drones and robots, virtual spaces and game spaces. For example, a virtual moving object. A set of a plurality of mobile predetermined and elements represented with the SET _d, a mobile belonging to the set SET _d is expressed as _{S i} ∈SET _d. The total number of mobile units S _i belonging to the set SET _d is represented by Nd. However, Nd is an integer of 2 or more. i is an index for identifying the mobile unit S _i . For convenience of explanation, it is assumed that i=1,..., Nd (i is an integer). However, any value may be i as long as it can identify the moving body S _i . Similarly, a set of a plurality of mobile predetermined and elements represented with the _{SET sd,} mobile belonging to the set _{SET sd} expressed as _{S j} ∈SET _sd. SET _sd =SET _d may or may not be SET _sd =SET _d . However, the set SET _sd includes at least a part of moving bodies belonging to SET _d , and SET _sd ∩SET _d is not an empty set. The total number of moving objects S _j belonging to the set SET _sd is denoted by Nsd. j is an index for identifying the moving body S _j . For convenience of explanation, it is assumed that j=1,..., Nsd (j is an integer). However, any value may be j as long as the moving object S _j can be identified.

≪Track data≫
The trajectory data is time-series data that represents discrete positions (positional information) at a plurality of arbitrary times. Examples of discrete positions are coordinates consisting of a combination of latitude and longitude, either latitude or longitude, a combination of latitude and longitude and altitude, coordinates on screen, coordinates in virtual space, predetermined reference points. Relative position to. The trajectory data may be actual measurement data by GPS or the like, simulation data, or data obtained in a virtual space or a game space. d _i is an arbitrary time _d i multiple mobile _{S i (n i).} Discrete position d _i (n _i ) at time. Represents locus data representing co. For example, the trajectory data _{d i,} for a plurality of _{n i} times _d i _(n i). time and position d _i (n _i ). It is time-series data associated with co. | _{D i} |, the discrete positions _d i included in the locus data _{d i (n} i). represents the total number of co (that is, the total number of times d _i (n _i ).time). However, |d _i | is an integer of 2 or more, for example, an integer of 3 or more. n _i is the time d _i (n _i ). It is an index corresponding to time. For example, a time _d i _(n i) corresponding to a small _{n i.} The time is as old as time. In this case, the position d _i (n _i ). co represents the n _i- th position of the moving body S _i . For convenience of explanation, it is assumed that n _i =1,..., |d _i | (n _i is an integer). However, at time d _i (n _i ). any value as long identify time may be an n _i.

≪Original data≫
The original data D is a set whose elements are the trajectory data d _i of the moving body S _i εSET _d included in the set SET _d . For example, when i=1,..., Nd, D={d ₁ ,..., D _Nd }. The total number of locus data d _i included in the original data D is Nd. i=1,..., Nd and the position d _i (n _i ). co is the latitude d _i (n _i ). lat and longitude d _i (n _i ). When the coordinate is a combination with lon, the original data D is as follows, for example.

≪Anonymous trajectory data≫
The anonymity trajectory data sd _j includes a plurality of arbitrary times sd _j (sn _j ).s of the moving body S _j εSET _sd . Discrete concealment positions sd _j (sn _j ). represents co. For example, concealing locus data sd _j, a plurality of sn _i for time _sd j _(sn j). time and position sd _j (sn _j ). It is time-series data associated with co. Concealed locus data sd _j is the locus data _{d j} mobile _{S j} ∈SET _sd those obtained by concealed. For example, concealing locus data sd _j is obtained by change or add or delete position at some time included in the locus data d _j, the position of a new time in the locus data d _j is there. Concealed locus data sd _j is may be one that concealed the trajectory data d _j included in the original data D, be one obtained by concealing the locus data d _j is not included in the original data D Good. |sd _j | is a discrete concealment position sd _j (sn _j ).s contained in the concealment trajectory data sd _j . represents the total number of co (that is, the total number of times sd _j (sn _j ).time). However, |sd _j | is an integer of 2 or more, for example, an integer of 3 or more. sn _j is the time sd _j (sn _j ). It is an index corresponding to time. For example, the time _sd j _(sn j) corresponding to the small sn _j. The time is as old as time. In this case, the concealment positions sd _j (sn _j ). co represents the sn _j- th concealed position of the mobile S _j . For convenience of explanation, it is assumed that sn _j =1,..., |sd _j | (sn _j is an integer). However, at times sd _j (sn _j ). Any value may be sn _j as long as the time can be identified.

≪Confidential data≫
The concealment data SD means a set having the concealment trajectory data sd _j of the moving body S _j εSET _sd included in the set SET _sd as an element. The total number of the confidential trajectory data sd _j included in the confidential data SD is Nsd. For example, when j=1,..., Nsd, SD={sd ₁ ,..., sd _Nsd }.

≪Background knowledge data≫
Background knowledge data _{a i} is an arbitrary time _a i plurality of mobile _{S i (r i).} Discrete estimated position a _i (r _i ) at time. represents co. For example, background knowledge data _{a i} is the time for a plurality of _{r i a i (r i)} . time and the estimated position a _i (r _i ). It is time-series data associated with co. The background knowledge data a _i is estimated from the trajectory data d _i . | _{A i} |, the discrete estimated position included in background knowledge data _{a i a i (r i)} . It represents the total number of co (that is, the total number of times a _i (r _i ).time). However, |a _i | is an integer of 2 or more, for example, an integer of 3 or more. r _i is the time a _i (r _i ). It is an index corresponding to time. For example, the time _a i _(r i) corresponding to the small _{r i.} The time is as old as time. In this case, the estimated position a _i (r _i ). co represents the r _i- th concealed position of the mobile S _i . For convenience of explanation, it is assumed that r _i =1,..., |a _i | (r _i is an integer). However, at time a _i (r _i ). Any value can be used as r _i as long as it can identify the time.

≪Background knowledge≫
The background knowledge A is a set having the background knowledge data a _i for the moving body S _i εSET _d included in the set SET _d as an element. The total number of background knowledge data a _i included in the background knowledge A is Nd. For example, when i=1,..., Nd, A={a ₁ ,..., A _Nd }.

<Structure>
As illustrated in FIG. 1, the anonymity evaluation apparatus 1 of the present embodiment includes a data generation unit 11, a data comparison unit 12, a data storage unit 13, a constant storage unit 14, and a control unit 15, and the control unit 15 includes Each process is executed under control. As illustrated in FIG. 2A, the data generation unit 11 includes, for example, a range selection unit 111, a time selection unit 112, a linear interpolation unit 113, a control unit 114, and a generation unit 115. As illustrated in FIG. 2B, the data comparison unit 12 includes, for example, the substitution unit 121, the section search unit 122, the linear interpolation unit 123, the distance calculation unit 124, the average distance calculation unit 125, the minimum determination unit 126, and the evaluation value generation unit. It has 127 and the control part 128.

<Process>
Next, the processing of this embodiment will be described.
In this embodiment, the anonymity of the anonymized data SD is evaluated. The general procedure of processing is as follows.
1. Construct the background knowledge A of the attacker from the original data D.
2. Anonymity is evaluated by executing an attack (re-identification) on the anonymized data SD using the background knowledge A.

The details of the processing will be described below.
<<Pretreatment>>
As preprocessing, the original data D and the concealment data SD are stored in the data storage unit 13 of the anonymity evaluation apparatus 1, and the constant value storage unit 14 stores a positive parameter f representing the amount of background knowledge of the attacker. .. In the example described here, D={d ₁ ,..., D _Nd }, SD={sd ₁ ,..., sd _Nsd }, and d _i (where i=1,..., Nd) is For n _i =1,..., |d _i |, a plurality of arbitrary times d _i (n _i ). time and the latitude d _i (n _i ). lat and the longitude d _i (n _i ). lon is associated with time-series data, and the concealed trajectory data sd _j (where j=1,..., Nsd) is a plurality of arbitrary random numbers for sn _j =1,..., |sd _j | Time sd _j (sn _j ). time and the latitude sd _i (sn _i ). lat and longitude sd _i (sn _i ). lon is time-series data associated with.

<<Overall processing>>
As illustrated in FIG. 3, first, the data generation unit 11 (FIG. 1) of the anonymity evaluation apparatus 1 uses the original data D={d ₁ ,..., D _Nd } to obtain the background knowledge A={a ₁ , , A _Nd } is constructed (step S11). Then, the data comparison unit 12 is concealed data _SD = with background knowledge _{A {sd 1, ..., sd} Nsd} running attacks on performing the data comparison process for evaluating the anonymity (step S12).

<<Data Generation Process (Step S11)>>
The data generation unit 11 uses the original data D={d ₁ ,..., D _Nd } of the data storage unit 13 and the parameter f of the constant storage unit 14, and for i=1,..., Na, the moving body S _i ∈SET. _d arbitrary times d _i (n _i ). Latitude d _i (n _i ) at time. lat and longitude d _i (n _i ). lon ( "discrete positions _d i _(n i) .co" considerably) used, any time _a i plurality of mobile _{S i (r i).} Latitude a _i (r _i ) at time. lat and longitude a _i (r _i ). The background knowledge data a _i representing lon (corresponding to “discrete estimated position a _i (r _i ).co”) is estimated, and background knowledge A={a ₁ ,..., A _Nd } is obtained and output.

Here, it is unknown at what time the actual attacker possesses the data. In particular, it is rare that an attacker who has acquired the position data of the moving body S _{i by} means different from the original data D possesses the data at exactly the same time as the original data D. In order to perform the evaluation in consideration of such a situation, a plurality of arbitrary times a _i (r _i ). At least a part of the time (where r _i =1,..., |a _i |) is a plurality of arbitrary times d _i (n _i ). It is desirable that the time is other than time (however, n _i =1,..., |d _i |). More preferably, at any arbitrary time a _i (r _i ). time is a plurality of arbitrary times d _i (n _i ). It is desirable that the time is other than time. For a similar reason, a plurality of arbitrary times a _i (r _i ). time is a plurality of arbitrary times d _i (n _i ). It is desirable that the time is randomly selected from the minimum value and the maximum value randomly selected from the time.

Specific example of data generation process:
A specific example of the data generation process (step S11) will be described with reference to FIG.
First, the control unit 114 of the data generation unit 11 (FIG. 2A) sets i=1 (step S1141). Next, the control unit 114 sets r _i =1 (step S1142).

The range selection unit 111 refers to the locus data d _i of the original data D and randomly generates and outputs an integer z belonging to the closed interval [1, |d _i |−1] (step S111).

The time selection unit 112 receives the integer z as an input, refers to the trajectory data d _i of the original data D, and closes the closed section [d _i (z). time, d _i (z+1). time] is randomly selected, and the time is selected as a _i (r _i ). Substitute for time and output. That is, a _i (r _i ). time is a plurality of arbitrary times d _i (n _i ). It is a time randomly selected from the minimum value (d _i (z).time) and the maximum value (d _i (z+1).time) randomly selected from the time (step S112).

同様に、線形補間部１１３は、軌跡データｄ_ｉのｄ_ｉ（ｚ）．ｌｏｎ，ｄ_ｉ（ｚ＋１）．ｌｏｎ、ｄ_ｉ（ｚ）．ｔｉｍｅ，ｄ_ｉ（ｚ＋１）．ｔｉｍｅ、および時刻選択部１１２から出力されたａ_ｉ（ｒ_ｉ）．ｔｉｍｅを入力とし、以下のような線形補間によって、時刻ａ_ｉ（ｒ_ｉ）．ｔｉｍｅでの経度ａ_ｉ（ｒ_ｉ）．ｌｏｎ（「推定位置ａ_ｉ（ｒ_ｉ）．ｃｏ」を構成）を得て出力する。

このような線形補間により、任意の時刻ａ_ｉ（ｒ_ｉ）．ｔｉｍｅでの緯度ａ_ｉ（ｒ_ｉ）．ｌａｔおよび経度ａ_ｉ（ｒ_ｉ）．ｌｏｎ（推定位置ａ_ｉ（ｒ_ｉ）．ｃｏ）が推定される（ステップＳ１１３）。 Linear interpolation unit 113, the locus data _{d i d i} (z). lat,d _i (z+1). lat, d _i (z). time, d _i (z+1). time, and a _i (r _i ). output from the time selection unit 112. time as an input, and time a _i (r _i ). Latitude a _i (r _i ) at time. lat (constructing “estimated position a _i (r _i ).co”) is obtained and output (see FIG. 6).

Similarly, the linear interpolation unit 113, the locus data _{d i d i} (z). lon,d _i (z+1). lon, d _i (z). time, d _i (z+1). time, and a _i (r _i ). output from the time selection unit 112. time as an input, and time a _i (r _i ). Longitude a _i (r _i ) at time. lon (constructing “estimated position a _i (r _i ).co”) is obtained and output.

By such linear interpolation, at any time a _i (r _i ). Latitude a _i (r _i ) at time. lat and longitude a _i (r _i ). lon (estimated position a _i (r _i ).co) is estimated (step S113).

Next, the control unit 114 determines whether r _i =H(f,i). However, H(f,i) is an integer function value corresponding to the parameters f and i. For example, H(f,i) is an integer function value of f×|d _i |. An example of a H (f, i) is f × | a _{d i} | floor function value _{floor (f × | | d i} ). H (f, i) is the discrete estimated position _a i included in the background knowledge data _{a i (r} i). The total number of cos is |a _i |. If r _i =H(f,i) is not satisfied, the control unit 114 increments r _i by 1 (r _i +1 is set as a new r _i ) (step S1144) and returns the process to step S111. On the other hand, if r _i =H(f,i), the process proceeds to step S1145 (step S1143).

In step S1145, the control unit 114 determines whether i=Nd. If i=Nd is not satisfied, the control unit 114 increments i by 1 (i+1 is a new i) (step S1146) and returns the process to step S1142. If i=Nd, the generation unit 115 determines that any time a _i (r _i ). r _i =1,..., |a _i | time and latitude a _i (r _i ). lat and latitude a _i (r _i ). lon is used as background knowledge data a _i, and background knowledge A={a ₁ ,..., A _Nd } is obtained and output (step S115).

<<Data comparison processing (step S12)>>
In the data comparison process, the background knowledge A is used to execute an attack on the anonymity data SD to evaluate anonymity. That is, in the data comparison process, a plurality of arbitrary times a _i (r _i ). of the moving body S _j estimated from the anonymized trajectory data sd _j . Discrete estimated concealment positions sa _j (r _i ) at time. co and any time _a i plurality of mobile _{S i (r i).} Discrete estimated position a _i (r _i ) at time. The moving object S _j that minimizes the distance between co and co is re-identified as the moving object S _i . However, the concealed trajectory data sd _j is obtained by concealing the trajectory data d _j of the moving body S _j included in the set SET _sd of the plurality of moving bodies, and the plurality of arbitrary moving body S _j. At time sd _j (sn _j ). Discrete concealment positions sd _j (sn _j ). represents co. In other words, this attack, background knowledge data a _i and the distance between the concealed trajectory data sd _j measured for all mobile S _j included in the set SET _sd, mobile S _j whose distance among the small Are identified as mobiles S _i . At this time, from the anonymity trajectory data sd _j to the background knowledge data a _{i at} a plurality of arbitrary times a _i (r _i ). Discrete estimated concealment positions sa _j (r _i ) at time. co is estimated, a plurality of arbitrary time _a i of the background knowledge data _{a i (r} i). Discrete estimated position a _i (r _i ) at time. The distance from co is evaluated. The average distance and the corresponding value are used for the evaluation of this distance. That the re-identification is successful (i.e., that the moving body S _j that are identified as mobile S _i is a true mobile S _i) moving an attacker from concealing data SD using the background knowledge A This means that the body S _i could be identified. Therefore, by using the anonymity evaluation value that represents the degree to which the moving body S _j is the moving body S _i , it is possible to evaluate the anonymity of the moving body with respect to an attacker who has the trajectory data as the background knowledge A.

It is rare that the time corresponding to the data is completely the same between the background knowledge A acquired by the actual attacker and the anonymized data SD. In order to perform the evaluation in consideration of such a situation, a plurality of arbitrary times a _i (r _i ). At least a part of the time (where r _i =1,..., |a _i |) is a plurality of arbitrary times sd _j (sn _j ). It is desirable that the time is other than time (however, sd _j =1,..., |sd _j |). More preferably, at any arbitrary time a _i (r _i ). time is a plurality of arbitrary times sd _j (sn _j ). It is desirable that the time is other than time.

Specific example of data generation process:
A specific example of the data comparison process (step S12) will be described with reference to FIG.
First, the control unit 128 of the data comparison unit 12 (FIG. 2B) sets i=1 and Score=0 (step S1281). Next, the control unit 128 sets j=1 (step S1282). Further, the control unit 128 sets r _i =1 (step S1283).

The substituting unit 121 includes the time a _i (r _i ).h included in the background knowledge data a _i of the input background knowledge A. time to time sa _i (r _i ). Substitute for time and output (step S121).

The section search unit 122 refers to the anonymity trajectory data sd _j of the anonymity data SD, and acquires the time points sd _j (1). time,..., Sd _j (|sd _j |). From the time intervals of adjacent times in the time, the times sa _i (r _i ). The time interval including time is searched, and the times at both ends are searched as sd _j (m). time and sd _j (m+1). Output as time. That is, sd _j (m). time≦sa _i (r _i ). time≦sd _j (m+1). satisfy time (see FIG. 7).

同様に、線形補間部１２３は、区間探索部１２２から出力されたｓｄ_ｊ（ｍ）．ｔｉｍｅ，ｓｄ_ｊ（ｍ＋１）．ｔｉｍｅ、これらを用いて秘匿化軌跡データｓｄ_ｊから抽出した軌跡データｄ_ｉのｓｄ_ｊ（ｍ）．ｌｏｎ，ｓｄ_ｊ（ｍ＋１）．ｌｏｎ、および代入部１２１から出力された時刻ｓａ_ｉ（ｒ_ｉ）．ｔｉｍｅを入力とし、以下のような線形補間によって、時刻ｓａ_ｉ（ｒ_ｉ）．ｔｉｍｅでの経度ｓａ_ｊ（ｒ_ｉ）．ｌｏｎ（「推定秘匿化位置ｓａ_ｊ（ｒ_ｉ）．ｃｏ」を構成）を得て出力する。

このような線形補間により、移動体Ｓ_ｊの複数の任意の時刻ａ_ｉ（ｒ_ｉ）．ｔｉｍｅでの緯度ｓａ_ｉ（ｒ_ｉ）．ｌａｔおよび経度ｓａ_ｉ（ｒ_ｉ）．ｌｏｎ（推定秘匿化位置ｓａ_ｉ（ｒ_ｉ）．ｃｏ）が推定される（ステップＳ１２３）。 The linear interpolation unit 123 outputs the sd _j (m). time, sd _j (m+1). time, sd _j (m). of the trajectory data d _i extracted from the anonymized trajectory data sd _j using these. lat, sd _j (m+1). lat, and the time sa _i (r _i ) output from the substitution unit 121. time as an input and time sa _i (r _i ). Latitude sa _j (r _i ) at time. lat (constructing the “estimated concealment position sa _j (r _i ).co”) is obtained and output (see FIG. 7).

Similarly, the linear interpolation unit 123 outputs the sd _j (m). time, sd _j (m+1). time, sd _j (m). of the trajectory data d _i extracted from the anonymized trajectory data sd _j using these. lon, sd _j (m+1). lon, and the time sa _i (r _i ) output from the substitution unit 121. time as an input and time sa _i (r _i ). Longitude sa _j (r _i ) at time. lon (constructing the “estimated concealment position sa _j (r _i ).co”) is obtained and output.

Such by linear interpolation, the mobile _{S j} of the plurality of arbitrary time _a i _(r i). Latitude sa _i (r _i ) at time. lat and longitude sa _i (r _i ). lon (estimated concealment position sa _i (r _i ).co) is estimated (step S123).

The distance calculation unit 124, the time _a i including background knowledge data _{a i (r} i). Latitude a _i (r _i ) at time. lat and longitude a _i (r _i ). lon, the time sa _i (r _i ) output from the linear interpolation unit 123. Latitude sa _j (r _i ) at time. lat and longitude sa _j (r _i ). lon is input. The distance calculation unit 124 uses these to calculate the coordinates (a _i (r _i ).lat, a _i (r _i ).lon) and the coordinates (sa _j (r _i ).lat,sa _j (r _i ).lon. ) To L _geo (a _i (r _i ), sa _j (r _i )) are calculated and output (step S124).

Next, the control unit 128 determines whether r _i =|a _i |. If r _i =|a _i | is not true, the control unit 128 increments r _i by 1 (r _i +1 is set as a new r _i ) (step S1286) and returns the process to step S121. On the other hand, if r _i =|a _i |, the process proceeds to step S125 (step S1285).

In step S125, the average distance calculation unit 125 inputs the distance L _geo (a _i (r _i ), sa _j (r _i )) for r _i =1,..., |a _i | L(a _i , sa _j ) is obtained and output as follows (step S125).

Next, the control unit 128 determines whether j=Nsd. If j=Nsd is not satisfied, the control unit 128 increments j by 1 (j+1 is a new j) (step S1288) and returns the process to step S1283. On the other hand, if j=Nsd, the process proceeds to step S126 (step S1287).

In step S126, the minimum determination unit 126, j = 1, ..., to identify the smallest of the average distance _{L (a} i, sa _j) for NSD, minimum average distance _L (a i, _sa j) Is output as j _min (step S126).

The evaluation value generation unit 127 receives j _min and i as inputs, and determines whether the moving body S _jmin corresponding to j _min is the moving body S i corresponding to _i . For example, the evaluation value generation unit 127 determines whether j _min =i. If the moving body S _jmin is the moving body S _i , the evaluation value generation unit 127 _{updates the} value obtained by adding 1 to the Score to a new Score, and otherwise maintains the Score (step S1271).

Next, the control unit 128 determines whether i=Nd. If not i=Nd, the control unit 128 increments i by 1 (i+1 is a new i) (step S1280), and returns the process to step S1282. On the other hand, if i=Nd, the process proceeds to step S1272 (step S1289).

In step S1272, the evaluation value generating unit 127, and calculates and outputs anonymity evaluation value e = Score / _{N D.} The anonymity evaluation value e represents the ratio of successful attacks described above. The higher the anonymity evaluation value e, the lower the anonymity, and conversely, the lower the anonymity evaluation value e, the higher the anonymity. By using the anonymity evaluation value e, it is possible to evaluate the anonymity of the moving body with respect to the attacker who has the trajectory data as background knowledge.

[Other modifications]
The present invention is not limited to the above embodiment. For example, in the above embodiment, each process is executed using the original data D and the concealed data SD stored in the data storage unit 13 and the parameter f stored in the constant storage unit 14. However, at least part of the original data D, the confidential data SD, and the parameter f may be input to the anonymity evaluation device 1. In this case, the anonymity evaluation apparatus 1 performs each process using the original data D, the anonymized data SD, and the parameter f that are input from the outside or read from the data storage unit 13 or the constant storage unit 14. Execute. In such a configuration, the anonymity evaluation device 1 does not have to have at least one of the data storage unit 13 and the constant storage unit 14.

In the above embodiments, the mobile _{S i} of a plurality of arbitrary time _a i _(r i). Discrete estimated position a _i (r _i ) at time. co is, any time _d i multiple mobile _{S i (n i).} Discrete position d _i (n _i ) at time. Obtained by linear interpolation of co. However, the background knowledge data a _i may be estimated from the trajectory data d _i by another method. For example, the background knowledge data a _i may be estimated from the trajectory data d _i by an AR model or a machine-learned model.

Also, in the above embodiments, the mobile _{S j} of the plurality of arbitrary time _sa i _(r i). Discrete estimated concealment positions sa _j (r _i ) at time. co, the mobile _{S j} of the plurality of arbitrary time _sd j _(sn j). Discrete concealment positions sd _j (sn _j ). Obtained by linear interpolation of co. However, according to other methods, the concealment positions sd _j (sn _j ). from the estimated concealment position sa _j (r _i ). You may estimate co.

In the above embodiment, the e = Score / _{N D} and anonymity evaluation value. However, the anonymity evaluation value may be another value that represents the degree to which the moving body S _j that minimizes the average distance L(a _i , sa _j ) is the moving body S _i . For example, the monotonically increasing function value of e may be the anonymity evaluation value, or the monotonically decreasing function value of e may be the anonymity evaluation value. Further, instead of the average distance L(a _i , sa _j ), the average value of the distance L _geo (a _i (r _i ), sa _j (r _i )) for r _i =1,..., |a _i | , The median value of the distance L _geo (a _i (r _i ), sa _j (r _i )) for r _i =1,..., |a _i |, or the function value of the median value is L(a _i , sa _j ) may be used.

Further, in the above embodiment, although the total number of background knowledge data a _i included in the background knowledge A was Nd, the total number of background knowledge data a _i included in the background knowledge A may be less than Nd .. The background knowledge data a _i may be generated only for a part of the mobile body S _i belonging to the set SET _d .

The various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the device that executes the process or the need. Needless to say, other changes can be made without departing from the spirit of the present invention.

The device is, for example, a general-purpose or special-purpose computer provided with a processor (hardware processor) such as a CPU (central processing unit) and a memory such as a RAM (random-access memory) and a ROM (read-only memory). It is configured by executing the program. This computer may be provided with one processor and memory, or may be provided with a plurality of processors and memory. This program may be installed in a computer or may be recorded in a ROM or the like in advance. Further, some or all of the processing units are configured by using an electronic circuit that realizes a processing function without using a program, rather than an electronic circuit that realizes a functional configuration by reading a program like a CPU. May be. The electronic circuit that constitutes one device may include a plurality of CPUs.

When the above configuration is realized by a computer, the processing contents of the functions that the device should have are described by a program. By executing this program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded in a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium are a magnetic recording device, an optical disc, a magneto-optical recording medium, a semiconductor memory and the like.

The distribution of this program is performed by, for example, selling, transferring, or lending a portable recording medium such as a DVD or a CD-ROM in which the program is recorded. Further, the program may be stored in a storage device of a server computer and transferred from the server computer to another computer via a network to distribute the program.

A computer that executes such a program first stores, for example, the program recorded in a portable recording medium or the program transferred from the server computer in its own storage device. When executing the process, this computer reads the program stored in its own storage device and executes the process according to the read program. As another execution form of this program, the computer may directly read the program from the portable recording medium and execute processing according to the program, and further, each time the program is transferred from the server computer to this computer. The processing according to the received program may be sequentially executed. The above-described processing may be executed by a so-called ASP (Application Service Provider) type service that does not transfer the program from the server computer to this computer but realizes the processing function only by executing the execution instruction and the result acquisition. Good.

The processing functions of the present apparatus may not be realized by executing a predetermined program on a computer, but at least a part of these processing functions may be realized by hardware.

1 Anonymity Evaluation Device 11 Data Generation Unit 12 Data Comparison Unit

Claims (8)

An anonymity evaluation device for evaluating anonymity of anonymized trajectory data,
A plurality of arbitrary times d _i (n _i ) of mobiles S _i included in a set SET _d of a plurality of mobiles. Discrete position d _i (n _i ) at time. A plurality of arbitrary times a _i (r _i ). of the moving body S _i estimated from the trajectory data d _i representing co. Discrete estimated position a _i (r _i ) at time. a data generation unit for obtaining background knowledge data a _i representing co,
A plurality of arbitrary time _sd j of the plurality mobile included in the set _{SET sd} moving body of _{S j} of the trajectory data _{d j} the movable body _{S j} obtained by concealing _(sn j). Discrete concealment positions sd _j (sn _j ). .., a plurality of the arbitrary times a _i (r _i ). of the moving body S _j estimated from the concealed trajectory data sd _j representing co. Discrete estimated concealment positions sa _j (r _i ) at time. co, a plurality of said arbitrary time _a i of the moving body _{S i (r i).} Discrete estimated position a _i (r _i ) at time. and a data comparison unit that obtains an anonymity evaluation value that represents a degree to which the moving body S _j is the moving body S _i that minimizes the distance between co and
Anonymity evaluation device having. The anonymity evaluation apparatus according to claim 1, wherein
A plurality of the arbitrary times a _i (r _i ). At least a part of the time is a plurality of arbitrary times d _i (n _i ). Anonymity evaluation device that is a time other than time. The anonymity evaluation apparatus according to claim 1 or 2, wherein
A plurality of the arbitrary times a _i (r _i ). At least part of the time is a plurality of arbitrary times sd _j (sn _j ). Anonymity evaluation device that is a time other than time. The anonymity evaluation device according to any one of claims 1 to 3,
All said arbitrary times a _i (r _i ). time is a plurality of arbitrary times d _i (n _i ). Times other than time, and a plurality of the arbitrary times sd _j (sn _j ). Anonymity evaluation device that is a time other than time. The anonymity evaluation apparatus according to any one of claims 1 to 4,
A plurality of the arbitrary times a _i (r _i ). time is a plurality of arbitrary times d _i (n _i ). An anonymity evaluation device that is a time randomly selected from a minimum value and a maximum value randomly selected from time. The anonymity evaluation apparatus according to any one of claims 1 to 5,
A plurality of the arbitrary times a _i (r _i ) of the mobile body S _i . Discrete estimated position a _i (r _i ) at time. co, a plurality of said arbitrary time _d i of said mobile _{S i (n i).} Discrete position d _i (n _i ) at time. obtained by linear interpolation of co,
A plurality of said arbitrary time _sa i of the moving body _{S j (r} i). Discrete estimated concealment positions sa _j (r _i ) at time. co, the mobile _{S j} of the plurality of arbitrary time _sd j _(sn j). Discrete concealment positions sd _j (sn _j ). Anonymity evaluation device obtained by linear interpolation of co. An anonymity evaluation method of an anonymity evaluation device for evaluating anonymity of anonymity trajectory data,
The data generation unit of the anonymity evaluation apparatus uses a plurality of arbitrary times d _i (n _i ). of mobile units S _i included in a set SET _d of multiple mobile units. Discrete position d _i (n _i ) at time. A plurality of arbitrary times a _i (r _i ). of the moving body S _i estimated from the trajectory data d _i representing co. Discrete estimated position a _i (r _i ) at time. a data generation step of obtaining background knowledge data a _i representing co,
The data comparison unit of the anonymity evaluation apparatus conceals the trajectory data d _j of the mobile body S _j included in the set SET _sd of the plurality of mobile bodies, and obtains a plurality of arbitrary times of the mobile body S _j. sd _j (sn _j ). Discrete concealment positions sd _j (sn _j ). .., a plurality of the arbitrary times a _i (r _i ). of the moving body S _j estimated from the concealed trajectory data sd _j representing co. Discrete estimated concealment positions sa _j (r _i ) at time. co, a plurality of said arbitrary time _a i of the moving body _{S i (r i).} Discrete estimated position a _i (r _i ) at time. and a data comparing step of obtaining an anonymity evaluation value indicating a degree to which the moving body S _j is the moving body S _i that minimizes the distance between co and
Anonymity evaluation method having. A program for causing a computer to function as the anonymity evaluation apparatus according to claim 1.

Images