JP7149905B2 - anonymization system - Google Patents

Description

The present invention relates to an anonymization system.

In recent years, advances in information and communication technology have made it possible to collect and analyze a vast amount of personal information in various fields.
For example, in Patent Document 1, the amount of power consumption in a house can be measured for each of a plurality of branching circuits, and the measurement results can be shared by an energy indicator installed in the house and a mobile information terminal such as a smartphone. A network service system is disclosed that has the capability of displaying In this system, when displaying the measurement results for each of the multiple circuits on an energy indicator or mobile information terminal, it is now possible to give arbitrary names to each of the multiple branching circuits so that the user can easily recognize them. However, the service provider (administrator) also manages the same data. In other words, data arbitrarily named by the user can be collected and analyzed by the service provider.

JP 2012-248040 A

By the way, when the service provider promotes the utilization of the collected data, if the collected data contains information that can identify an individual (for example, any name above), personal information protection It is necessary to perform anonymization processing from the viewpoint of However, the amount of data to be collected is enormous, and it has been impossible to anonymize the data appropriately by reading each one.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an anonymization system capable of efficiently and reliably anonymizing collected data.

The invention according to claim 1 is, for example, as shown in FIGS.
judgment means (judgment program 161) for judging whether or not the collected data contains information that can identify an individual;
Lists 151 and 152 that serve as criteria for judgment by the judging means;
a replacement means (replacement program 163) for replacing the information that can identify the individual with information that cannot identify the individual;
List addition means (list addition program 165) ,
The list includes a whitelist 151 containing candidates for information that cannot identify the individual, and a blacklist 152 containing candidates for information that can identify the individual,
The judging means compares the collected data with the information in the lists 151 and 152, and determines whether there is information that matches any of the candidates listed in the whitelist 151, and whether there is information listed in the blacklist 152. Determine if there is information that matches any of the candidates, and
When the collected data includes information that matches any of the candidates listed in the blacklist 152, the replacement means replaces the information with information that cannot identify the individual ,
If the information included in the collected data does not match any of the candidates listed in the whitelist 151 and the candidates listed in the blacklist 152, the list adding means adds the information to the collected data. The included information is additionally posted as a candidate for either the whitelist 151 or the blacklist 152 .

According to the first aspect of the invention, the judgment means for judging whether or not the collected data contains information that can identify an individual collates the collected data with the information in the lists 151 and 152. Then, it is determined whether there is information that matches any of the candidates listed in the whitelist 151 or information that matches any of the candidates listed in the blacklist 152. A determination can be made as to whether the information contained in the collected data matches a candidate for personally identifiable information on the blacklist 152 without looking at the information.
Furthermore, when it is determined by the determination means that there is information in the collected data that matches any of the candidates listed in the blacklist 152, the replacement means replaces the information with information that cannot identify an individual. , so it is possible to perform anonymization processing on each piece of collected data without looking through it.
Therefore, it is possible to efficiently and reliably perform anonymization processing of the collected data.
Also, if the information contained in the collected data does not match any of the candidates listed in the whitelist 151 and the candidates listed in the blacklist 152, the information included in the collected data is By adding means, it is possible to additionally list it as a candidate for either the white list 151 or the black list 152, so that the accuracy of judgment by subsequent judgment means can be improved.

The invention according to claim 2 is, for example, as shown in FIGS. 4 and 5, in the anonymization system according to claim 1,
If the information included in the collected data matches any of the candidates listed in the blacklist 152 and cannot be replaced by the replacement means, it matches any of the candidates listed in the blacklist 152. It is characterized by further comprising first deletion means (first deletion program 164) for deleting the information to be deleted.

According to the second aspect of the present invention, it is possible to match any of the candidates listed in the blacklist 152 and not be replaced by the replacement means without looking at each of the collected data. Since the information made available can be deleted by the first deletion means, the overall processing can be simplified, and the efficiency of the anonymization processing can be improved.

The invention according to claim 3 is, for example, as shown in FIGS. 4 to 6, in the anonymization system according to claim 1 or 2 ,
If the information included in the collected data does not match any of the candidates listed in the whitelist 151 and the candidates listed in the blacklist 152, delete the information included in the collected data. It is characterized by further comprising second deletion means (second deletion program 166).

According to the third aspect of the invention, when the information included in the collected data does not match any of the candidates listed in the whitelist 151 and the candidates listed in the blacklist 152, the collected Since the information contained in the data can be deleted by the second deletion means, the overall processing can be simplified and the efficiency of the anonymization processing can be improved.

The invention according to claim 4 is, for example, as shown in FIGS. 1, 4, and 5, in the anonymization system according to any one of claims 1 to 3 ,
further comprising a database 2 for storing the collected data;
The data stored in the database 2 includes data determined by the determination means that the information contained in the collected data matches any of the candidates listed in the white list 151, and It is characterized in that the included information is data that has been replaced by the information that cannot identify the individual by the replacing means.

According to the fourth aspect of the present invention, in the database 2, the information included in the collected data is judged by the judging means to match any of the candidates listed in the white list 151, and the collected data It is possible to store and store data in which the information contained in is replaced with information that cannot identify an individual by replacement means, so it is possible to collect and analyze a huge amount of data, and the collected data can be utilized Cheap.

The invention according to claim 5 is, for example, as shown in FIGS. 1 and 2, in the anonymization system according to any one of claims 1 to 4 ,
The data collection source is characterized by being a data collection network built to collect data from a plurality of users.

According to the fifth aspect of the invention, since the data collection source is a data collection network constructed to collect data from a plurality of users U (U1, U2, U3), a plurality of users U (U1 , U2, U3). This makes it possible to collect a huge amount of data.

The invention according to claim 6 is, for example, as shown in FIGS. 1 to 4, in the anonymization system according to claim 5 ,
The collected data includes information whose setting can be arbitrarily changed by the plurality of users U (U1, U2, U3), and the information whose setting can be arbitrarily changed is the object of judgment by the judging means. It is characterized by being

According to the sixth aspect of the invention, the collected data includes information whose settings can be arbitrarily changed by a plurality of users U (U1, U2, U3). is subject to the determination by the determination means, even information that has been arbitrarily changed by a plurality of users U (U1, U2, U3) is a candidate for information that can identify an individual listed in the blacklist 152. can be easily determined whether or not they match.

ADVANTAGE OF THE INVENTION According to this invention, the anonymization process of the collected data can be performed efficiently and reliably.

1 shows an overview of a data collection network including an anonymization system; FIG. FIG. 4 is a block diagram showing the configuration of network services connected to an anonymization system; It is a figure which shows an example of the measurement data in the power consumption of a house. It is a block diagram which shows the structure of an anonymization system. It is a flowchart which shows the flow of an anonymization process. It is a flowchart which shows the flow of an anonymization process.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the embodiments described below have various technically preferable limitations for carrying out the present invention, but the technical scope of the present invention is not limited to the following embodiments and illustrated examples. do not have.

FIG. 1 shows an outline of a data collection network, and reference numeral 1 denotes an arithmetic processing device that constitutes an anonymization system in this embodiment. Also, reference numeral 2 denotes a database that also constitutes an anonymization system, and these arithmetic processing unit 1 and database 2 are connected so as to be able to communicate with each other. In addition, the data collection network incorporates a large number of users U (U1, U2, U3) who consent to data collection. It is connected to communication devices (energy indicators 3a, 4a, 5a and personal digital assistants 3b, 4b, 5b, which will be described later) so that data communication is possible. In other words, the data collection network is the data collection source in the anonymization system.

A user U is a person who receives a service provided by a service provider. The data collection network is a network for data collection constructed by a service provider or a company entrusted by the service provider, and collects data including information on services from the user U. Collected data is stored in the database 2 and utilized by the service provider. That is, it can be used as big data.

Communication network N includes various communication line networks such as telephone lines, ISDN lines, optical fibers, mobile communication networks, communication satellite lines, CATV lines, and other dedicated lines, and Internet service providers ( That is, the Internet) and the like may be included. Also, various communication networks such as LAN (Local Area Network), WAN (Wide Area Network), WiFi (Wireless Fidelity), Bluetooth (registered trademark), NFC (Near Field Communication), etc. communication network. The form of connection may be wired, wireless, or a mixture of wired and wireless.

The anonymization system is incorporated into the data collection network and managed by the service provider or a contractor entrusted by the service provider (hereinafter, managed by the administrator). Then, when the collected data contains information that can identify an individual, the anonymization system anonymizes the information.

In the present embodiment, the service provided by the service provider is, as shown in FIGS. ) can be measured for each of a plurality of branching circuits, and the measurement results can be sent to the user U It is a network service that has a function that can be commonly displayed on the mobile information terminal 3b (4b, 5b) such as a smartphone used by . That is, each house 3 (4, 5) is provided with a measuring unit 3c (4c, 5c) for measuring power consumption for each of a plurality of circuits, and the data MD measured by the measuring unit 3c (4c, 5c) is , is stored in the measurement data storage unit. The measurement data storage unit is stored in a service arithmetic processing unit (referring to the home gateway device HGW or the center server 6 in FIG. 2) provided inside the house 3 (4, 5) or outside the house 3 (4, 5). have. When the measured data MD is stored in the measurement data storage unit, a data item name DIN is assigned to each measurement unit 3c (4c, 5c), and the data MD is stored for each data item name DIN. .
In this service, when displaying the measurement results for each of a plurality of circuits on the energy display device 3a (4a, 5a) or the mobile information terminal 3b (4b, 5b), a plurality of branching circuits are displayed so that the user U can easily recognize them. Any name can be given to each. In order to realize this, the energy display device 3a (4a, 5a) and the portable information terminal 3b (4b, 5b) are provided with a name assignment input unit (touch panel, various input buttons, etc.) not shown. When a name is input from the name assignment input unit, the control unit of the service processing unit executes control to change the data item name DIN to an arbitrary name. Namely, the name is arbitrarily given by the user U, and the service provider can handle it as one piece of information. In short, the service provider can collect and analyze data containing information (an arbitrary name given to each of a plurality of branching circuits) whose setting can be arbitrarily changed by the user U.
FIG. 3 is a diagram showing that the measurement results (data DM) for each of a plurality of circuits measured at each predetermined time in one house (for example, house 3) are displayed for each data item name DIN. is. In this embodiment, the user U can arbitrarily set the data item names DIN set as "whole use", "whole power sale", ..., "children's room", ... by input from the name assignment input section. be able to change. The service provider collects data thus named.

Any number of data may be collected from the user U by the data collection network, and the data collected from the user U shall include at least information whose settings can be arbitrarily changed by the user. Other information related to may be included.
Moreover, it is desirable that data including information to be anonymized by the anonymization system and data including information for specifying the user U (for example, account information) are handled separately.
Furthermore, even if the data contains information that should be anonymized by the anonymization system, if the information is necessary for organizing the data in the database 2, the information that should be anonymized by the anonymization system is It may be appropriately linked to the included data.

The arithmetic processing device 1 constituting the anonymization system of the present embodiment is a computer having a control unit 10, an input unit 11, a display unit 12, a communication unit 13, and a storage unit 14, as shown in FIG. be. For example, mobile phones (e.g., smart phones, feature phones), PDA (Personal Digital Assistant), desktop personal computers, laptop personal computers (notebook personal computers), palmtop personal computers, tablet personal computers, etc. .

The control unit 10 controls the entire arithmetic processing device 1 including the storage unit 14 and the like based on control programs 161 to 166 stored in the storage unit 14 . More specifically, the control unit 10 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), and a ROM (Read Only Memory), and configures an anonymization system based on the control by the control unit 10. Various means can be implemented to do so. That is, various control programs 161 to 166 stored in the storage unit 14 can be executed.

The input unit 11 is for inputting various instructions to the anonymization system. More specifically, data input keys for inputting characters, numerical values, etc., data selection keys, up/down/left/right movement keys, and various function keys are appropriately provided. Also, input devices such as a mouse and a keyboard are appropriately employed. The control section 10 can cause each section to perform a predetermined operation according to a signal input from the input section 11 .

The display unit 12 is a display device in the arithmetic processing device 1, and employs, for example, a liquid crystal display or an organic EL display panel. The display unit 12 in this embodiment displays a display screen on the display surface based on a display control signal from the control unit 10 .

The communication unit 13 receives a communication signal from the control unit 10 and sends the communication signal to the communication network N. Also, the communication unit 13 receives a communication signal from the communication network N and outputs this communication signal to the control unit 10 .
This communication unit 13 plays a role of connecting the anonymization system including the database 2 to the data collection network, and communicates with the communication devices used by the user U, that is, the energy indicators 3a, 4a, 5a and the mobile information terminals 3b, 4b, It functions as collecting means for collecting the data transmitted from 5b.
The timing of data collection (data transmission) may be based on a program incorporated in the energy indicators 3a, 4a, 5a and the mobile information terminals 3b, 4b, 5b, or may be based on the energy indicators 3a, 4a, 5a and A program for transmitting a signal instructing execution of data transmission to portable information terminals 3b, 4b, and 5b may be employed in arithmetic processing unit 1. FIG.

The storage unit 14 is composed of, for example, a large-capacity storage medium such as an HDD (Hard Disc Drive) or flash memory, and includes various data 151 and 152 necessary for the operation of each unit in the anonymization system and various control programs 161. ~166 is stored.
Various data necessary for the anonymization system include whitelist data 151 and blacklist data 152 . These data 151 and 152 are stored in the data storage section 15 within the storage section 14 .
Various control programs necessary for the anonymization system include a judgment program 161, a notification program 162, a replacement program 163, a first deletion program 164, a list addition program 165, and a second deletion program 166. These programs 161 to 166 are stored in the program storage section 16 within the storage section 14 .

The white list data 151 (white list 151) lists candidates for information that cannot identify an individual. It serves as a criterion for judging whether or not it is included. The whitelist data 151 in the present embodiment lists candidates for information that cannot identify individuals as the names of multiple circuits that can be arbitrarily changed by the user U in the network service described above. .
Candidates for non-personally identifiable information listed in the whitelist data 151 include, for example, "whole use", "whole power sale", "whole power purchase", "Western-style room", and "Japanese-style room". , "kitchen", "living room", "bathroom", "washroom", "dining room", "hall", "toilet", "storeroom", "Western-style TV", "Japanese-style TV", "Western-style air conditioner", " Japanese room air conditioner, dining room air conditioner, living room lighting, kitchen lighting, dining room lighting, kitchen refrigerator, IH stove, air conditioner, floor heating, toilet washing and heating "toilet seat", "toilet outlet", "charging", "discharging", "electric vehicle", "others", and the like. In other words, candidates are those that can be generalized as information. None of the candidates listed in the whitelist data 151 contain information that can identify an individual, and are easy to handle as big data.
It should be noted that candidates for information that cannot identify an individual listed in the whitelist data 151 are not limited to the above.

The blacklist data 152 (blacklist 152) contains information candidates that can identify an individual. It will be the criteria for judging whether or not The blacklist data 152 in the present embodiment lists candidates of information that can identify an individual as names of a plurality of circuits that can be arbitrarily changed by the user U in the network service described above.
Candidates for personally identifiable information listed in the blacklist data 152 include, for example, "Children's room", "Children's room", "2nd floor Western-style room", "2nd floor Japanese-style room", "3rd floor "Western-style room", "3rd floor Japanese-style room", "Bedroom", "Living room 1st and 2nd floor", "Children's room TV", "Bedroom TV", "Children's room air conditioner", "Bedroom air conditioner", "1st floor Western-style room""Name (e.g. Taro, Hanako, etc.)", "last name (e.g. Sato, Suzuki, etc.)", "designation (e.g. father, mother, papa, mama, etc.)", "north-side Western-style room", "south-side Japanese-style room", "play room", Examples include "dedicated equipment", "well", and the like. In addition, patterns such as "Taro's room" and "Papa's room", which are combined like "name + room" and "name + room", can also be used. That is, presence/absence of children, house level, orientation, user U's surname/first name, user U's name (name), items whose use is known, special items such as the above-mentioned well, etc. are candidates. All of the candidates listed in the blacklist data 152 contain information that can identify individuals and cannot be treated as big data.
It should be noted that the candidates for the personally identifiable information listed in the blacklist data 152 are not limited to the above.

The judgment program 161 is a program for judging whether the collected data contains information that can identify an individual.
More specifically, the determination program 161 is executed by the control unit 10, and thereby the collected data (information that can be arbitrarily changed in settings) and the list (white list data 151, black list data 152) to determine whether there is information that matches any of the candidates listed in the whitelist data, or whether there is information that matches any of the candidates listed in the blacklist.
That is, the determination program 161 functions as determination means in cooperation with the control section 10 .
It should be noted that, as a result of comparing arbitrarily changeable information included in the collected data with information in the lists (white list data 151, black list data 152) by the determination means, any information included in the collected data If it is determined that the configurable information matches any of the whitelisted candidates, the data is sent to database 2 for storage.

The notification program 162 checks the information in the list (white list data 151, black list data 152) against the arbitrarily settable information included in the collected data by the judgment means, and the information in the collected data is This is a program for notifying the administrator when the included information whose setting can be arbitrarily changed is listed neither in the whitelist data 151 nor in the blacklist data 152. - 特許庁
When the information terminal used by the administrator to manage the anonymization system is the arithmetic processing unit 1 itself, the notification program 162 is executed by the control unit 10, so that the notification can be displayed on the display unit 12. . If the arithmetic processing device 1 has an audio output unit, the notification sound may be emitted from the audio output unit.
The administrator routinely uses an information terminal (not shown) that is connected to the processing unit 1 via the communication network N so that data communication is possible, and the information terminal is set to the processing unit 1 in advance as a notification destination. If registered, notifications can be sent to the information terminal.
That is, the notification program 162 functions as notification means in cooperation with the control unit 10 .

The replacement program 163 compares the collected data with the information in the lists (white list data 151, black list data 152) by the judgment means, and as a result, the candidates listed in the black list data 152 are included in the collected data. If there is information (information that can be arbitrarily changed by the user U) that matches any of the above, the program replaces the information with information that cannot identify the individual.
More specifically, the replacement program 163 is executed by the control unit 10 to replace arbitrarily changeable information that can identify an individual with information that cannot identify an individual.
Specifically, for example, "child's room" and "child's room" are replaced with "Western-style room", "Japanese-style room", etc., because it is necessary to conceal the presence or absence of children. Even when indicating the use such as "bedroom" or "play room", it is replaced with "Western-style room" or "Japanese-style room". In the case of "second-floor western-style room" and "third-floor western-style room", it is not necessary to uselessly indicate the floor level of the house, so it is replaced with "western-style room" or "Japanese-style room". In the case of ``north-side Western-style room'' and ``south-side Japanese-style room'', it is not necessary to indicate the direction of the house unnecessarily, so it is replaced with ``Western-style room'' or ``Japanese-style room''. In the case of a combination pattern such as "name + room" or "name + room", it is necessary to conceal the "name" and "name", so it is replaced with "Western-style room" or "Japanese-style room". Special cases like "well" are replaced with "other". In the case of "name" only or "designation" only, it is necessary to keep the "name" and "designation" confidential, and it is also unknown whether it is a room or not, so it is treated as non-replaceable information.
In other words, such a replacement program 163 functions as replacement means in cooperation with the control section 10 . Then, the data in which the arbitrarily changeable information that can identify the individual is replaced with the information that cannot identify the individual is transmitted to the database 2 and stored.

The first deletion program 164 compares arbitrarily changeable information contained in the collected data with information in the list (white list data 151, black list data 152) by the judgment means, and as a result, the collected data If the arbitrarily configurable information included in the blacklist data 152 matches any of the candidates listed in the blacklist data 152 and cannot be replaced by the replacement means, the arbitrarily settable change included in the collected data A program for deleting possible information.
More specifically, the first deletion program 164 is executed by the control unit 10, whereby the arbitrarily changeable information included in the collected data is identified as one of the candidates listed in the blacklist data 152. Delete information that matches and cannot be replaced by the replacement means. Specifically, as described above, if only the "name" or only the "designation" is treated as non-replaceable information, such information is deleted.
That is, the first deletion program 164 functions as first deletion means in cooperation with the control section 10 .

The list addition program 165 compares arbitrarily configurable information included in the collected data with information in the lists (white list data 151 and black list data 152) by means of determination means. and the candidate listed in the blacklist data 152, the arbitrarily changeable information is added as a candidate for either the whitelist data 151 or the blacklist data 152. This is a program for posting (see FIG. 6).
More specifically, the list addition program 165 is executed by the control unit 10, whereby the candidates listed in the whitelist data 151 and the candidates listed in the blacklist data 152 are displayed on the display unit 12 of the processing unit 1. A screen is displayed that allows the administrator to select whether or not the arbitrarily configurable information that does not match any of the above needs to be anonymized. If the administrator determines that the information requires anonymization, the list addition program 165 proceeds to the next screen, which will be described later. On the other hand, if the information does not require anonymization, the list addition program 165 adds the information to the whitelist data 151 as a candidate for information that cannot identify an individual.
In addition, when the administrator determines that anonymization is required, the list addition program 165 provides a screen for the administrator to select whether or not the information requiring anonymization can be generalized. point to the screen). If the administrator determines that the information can be generalized, the list addition program 165 adds the information to the blacklist data 152 as a candidate for personally identifiable information.
Note that such a list addition program 165 is executed by the control unit 10 after the notification means by the notification program 162 operates.
That is, the list addition program 165 functions as list addition means in cooperation with the control unit 10 .

The second deletion program 166 deletes the data when the arbitrarily changeable information contained in the collected data does not match any of the candidates listed in the whitelist data 151 and the candidates listed in the blacklist data 152. , is a program for deleting the arbitrarily changeable information (see FIG. 6).
In more detail, the second deletion program 166 is executed by the control unit 10, thereby arbitrarily setting a candidate that does not match any of the candidates listed in the whitelist data 151 and the candidates listed in the blacklist data 152. Delete mutable information.
The second deletion program 166 in this embodiment is executed by the control unit 10 after the list addition means is operated by the list addition program 165, and the information judged to require anonymization by the administrator is further publicized by the administrator. delete the information if it is determined that it is not possible to
That is, the second deletion program 166 functions as second deletion means in cooperation with the control section 10 .

However, the configuration of the second deletion program 166 is not limited to the above. , arbitrarily changeable information that does not match any of the candidates listed in the whitelist data 151 and the candidates listed in the blacklist data 152 may be deleted (that is, from step S1 or S2 described later, You may proceed directly to step S12.). The notification by the notification program 162 in this case is not only a notification to the effect that the arbitrarily changeable information contained in the collected data was not listed in either the whitelist data 151 or the blacklist data 152. , the content of notifying that the information has been deleted by the second deletion program 166 may be added.

The anonymization system is configured as described above, and the flow of anonymization processing by the anonymization system will be described next.

First, as shown in FIG. 5, arbitrarily changeable information contained in the collected data is listed in either the whitelist data 151 or the blacklist data 152 by the judgment means (judgment program 161). It is determined whether or not it matches the candidate (step S1).

If the arbitrarily changeable information included in the collected data is neither listed in the whitelist data 151 nor the blacklist data 152, the information is managed by notification means (notification program 162). (step S2).

If the arbitrarily changeable information included in the collected data matches a candidate listed in either the whitelist data 151 or the blacklist data 152, the determination means (determination program 161) selects the whitelist It is determined whether the candidate listed in the data 151 matches the candidate listed in the blacklist data 152 (step S3).

In step S3, the judgment means judges that the arbitrarily changeable information included in the collected data matches the candidate listed in the whitelist data 151 (that is, the information cannot identify an individual). When judged, it transfers to step S7.

In step S3, the judgment means judges that the arbitrarily changeable information contained in the collected data matches the candidate listed in the blacklist data 152 (that is, it is information that can identify an individual). If so, it is determined whether to replace or delete the information (step S4).

The determination in step S4 is whether or not the arbitrarily changeable information contained in the collected data can be replaced with information that cannot identify an individual by the replacement means (replacement program 163). It is used as a judgment criterion, and if it cannot be replaced, it is deleted by the first deletion means (first deletion program 164) (step S5).
On the other hand, if it is determined in step S4 that the arbitrarily changeable information contained in the collected data can be replaced by the replacement means, the individual is replaced by the replacement means without being deleted by the first deletion means. Replace with unidentifiable information (step S6).

In step S6, when the arbitrarily changeable information contained in the collected data is replaced with information that cannot identify an individual by the replacement means, the information is transmitted to the database 2 and stored. (step S7).
Furthermore, in step S3, even if it is determined by the determining means that the arbitrarily changeable information included in the collected data matches the candidates listed in the whitelist data 151, the information is transferred to the database 2. is transmitted and stored (step S7).

Further, in step S2, the arbitrarily changeable information contained in the collected data is neither listed in the whitelist data 151 nor the blacklist data 152, and a notification to that effect is managed by the notification means. 6, the administrator determines whether or not the arbitrarily changeable information contained in the collected data requires anonymization (step S8). That is, the list addition means (list addition program 165) displays on the display unit 12 of the arithmetic processing device 1 a screen allowing the administrator to select whether or not to require anonymization.
The administrator uses the input unit 11 to select whether or not anonymization is necessary on the selection screen displayed on the display unit 12, and reflects his/her own selection in the system.

If the administrator chooses not to require anonymization, arbitrarily configurable information that does not match any of the candidates listed in the whitelist data 151 and the candidates listed in the blacklist data 152 is listed. The individual is added to the white list data 151 as a candidate for unidentifiable information by adding means (step S9).

On the other hand, when the administrator selects that anonymization is required, the information requiring anonymization can be generalized on the display unit 12 of the processing unit 1 by the list addition means (list addition program 165). A screen is displayed to prompt the administrator to select whether or not (step S10).
The administrator uses the input unit 11 to select whether or not to allow generalization on the selection screen displayed on the display unit 12, and reflects his/her own selection in the system.

If the administrator selects that generalization is possible, the above information selected to require anonymization is added to the blacklist data 152 as a candidate for personally identifiable information by list addition means. (Step S11).
On the other hand, if the administrator selects that generalization is not possible, the second deletion means (second deletion program 166) deletes the information selected to require anonymization (step S12).

Anonymization processing by the anonymization system is performed as described above. With such a flow, the anonymization process can be performed without human intervention except for steps S and S.

As described above, after the notification is made by the notification means, the candidates listed in the whitelist data 151 and the candidates listed in the blacklist data 152 are deleted by the second deletion means (second deletion program 166). When deleting arbitrarily changeable information that does not match any of the above, steps S8 to S12 are omitted.

According to the present embodiment, the judgment means (judgment program 161) for judging whether or not the collected data contains information that can identify an individual, compares the collected data with the information in the lists 151 and 152. to determine whether there is information that matches any of the candidates listed in the whitelist 151, or whether there is information that matches any of the candidates listed in the blacklist 152. Therefore, one of the collected data Whether or not arbitrarily configurable information included in the collected data matches candidates for personally identifiable information listed in the blacklist 152 without looking at one judgment can be made.
Further, when the collected data is judged by the judging means (judging program 161) to contain information that matches any of the candidates listed in the blacklist 152, the replacing means (replacement program 163) Since information is replaced with information that cannot identify an individual, anonymization processing can be performed on each piece of collected data without looking through it.
Therefore, it is possible to efficiently and reliably perform anonymization processing of the collected data.

In addition, each of the collected data is matched with one of the candidates listed in the blacklist 152 and made unreplaceable by the replacement means (replacement program 163) without human eyes. Since the information can be deleted by the first deletion means (first deletion program 164), the overall processing can be simplified, and the efficiency of the anonymization processing can be improved.

Also, if the information contained in the collected data does not match any of the candidates listed in the whitelist 151 and the candidates listed in the blacklist 152, the information included in the collected data is Since the addition means (list addition program 165) can additionally list it as a candidate for either the white list 151 or the black list 152, it is possible to improve the accuracy of judgment by subsequent judgment means (judgment program 161).

In addition, if the information contained in the collected data does not match any of the candidates listed in the whitelist 151 and the candidates listed in the blacklist 152, the information included in the collected data is Since it can be deleted by the second deletion means (second deletion program 166), it is possible to simplify the overall processing and improve the efficiency of the anonymization processing.

In addition, for the database 2, the information included in the collected data is determined by the determination means (determination program 161) to match any of the candidates listed in the white list 151, and the data included in the collected data. Data in which the information is replaced with information that cannot identify an individual by the replacement means (replacement program 163) can be stored, so that a huge amount of data can be collected and analyzed, and the collected data can be utilized. It's easy to do.

In addition, since the data collection source is a data collection network constructed to collect data from a plurality of users U (U1, U2, U3), data is collected from a plurality of users U (U1, U2, U3). can do. This makes it possible to collect a huge amount of data.

In addition, the collected data includes information whose settings can be arbitrarily changed by a plurality of users U (U1, U2, U3). Therefore, whether or not information whose settings have been arbitrarily changed by a plurality of users U (U1, U2, U3) matches candidates for information that can identify an individual listed in the blacklist 152. It is possible to easily judge whether or not.

In this embodiment, the service provided by the service provider is a network service related to power consumption in the houses 3, 4, and 5 where each user U resides. any service of
In the present embodiment, the data collected by the collecting means is data containing information whose settings can be arbitrarily changed by the user U. may be data containing In that case, the data containing information whose settings cannot be arbitrarily changed by the user U shall contain information that can identify an individual.

1 Arithmetic processing unit 2 Database 3 House 3a Energy indicator 3b Personal digital assistant 4 House 4a Energy indicator 4b Personal digital assistant 5 House 5a Energy indicator 5b Personal digital assistant 10 Control unit 11 Input unit 12 Display unit 13 Communication unit 14 Storage Part 15 Data storage part 151 White list data 152 Black list data 16 Program storage part 161 Judgment program 162 Notification program 163 Replacement program 164 First deletion program 165 List addition program 166 Second deletion program U (U1, U2, U3) User N communication network

Claims (6)

a collection means connected to an external data collection source and collecting data from the data collection source;
means for determining whether or not the collected data includes information that can identify an individual;
a list that serves as criteria for determination by the determination means;
a replacement means for replacing the personally identifiable information with non-personally identifiable information;
a list addition means, and
The list includes a whitelist containing candidates for information that cannot identify the individual and a blacklist containing candidates for information that can identify the individual,
The determination means compares the collected data with the information in the list, and finds information that matches any of the candidates listed in the whitelist, or matches any of the candidates listed in the blacklist. determine if there is information to
If the collected data includes information that matches any of the candidates listed in the blacklist, the replacement means replaces the information with information that cannot identify the individual ,
If the information included in the collected data does not match any of the candidates listed in the whitelist and the candidates listed in the blacklist, the list addition means adds information included in the collected data. An anonymization system characterized by additionally listing the obtained information as a candidate for either the whitelist or the blacklist . In the anonymization system according to claim 1,
If the information contained in the collected data matches any one of the blacklisted candidates and cannot be replaced by the replacement means, said matching with any one of said blacklisted candidates An anonymization system, further comprising a first deletion means for deleting information. In the anonymization system according to claim 1 or 2,
If the information included in the collected data does not match any of the candidates listed in the whitelist and the candidates listed in the blacklist, delete the information included in the collected data. An anonymization system characterized by further comprising two deletion means . In the anonymization system according to any one of claims 1 to 3,
further comprising a database for storing the collected data ;
The data stored in the database includes data whose information included in the collected data is determined by the determination means to match any of the candidates listed on the white list, and data included in the collected data. an anonymization system, wherein said information is data replaced by said replacing means with information that cannot identify said individual . In the anonymization system according to any one of claims 1 to 4,
The anonymization system , wherein the data collection source is a data collection network built to collect data from a plurality of users . In the anonymization system according to claim 5 ,
The collected data includes information whose settings can be arbitrarily changed by the plurality of users, and the information whose settings can be arbitrarily changed is subject to judgment by the judging means. anonymization system.

Images