JP7359063B2 - Generation method, generation program, and generation device - Google Patents

Description

The present invention relates to a generation method, a generation program, and a generation device.

BACKGROUND ART Conventionally, in order to protect privacy, there is an anonymization method that anonymizes and outputs personal data (PII: Personally Identifiable Information). For example, after processing personal data to generate anonymous data, a privacy test is conducted on the generated anonymous data, and only when it is determined that the anonymity of the original personal data is ensured, the generated anonymous data is There are anonymization methods that output anonymous data.

As a prior art, for example, when the number of data having a predetermined relationship is N or more among the data included in the first data group, there is a technique that outputs a plurality of data having a predetermined relationship.

Japanese Patent Application Publication No. 2014-016675

However, in the conventional technology, the usefulness of the output anonymous data may be impaired. For example, when a privacy test is carried out, only anonymous data generated based on a portion of a plurality of pieces of personal data may be output. As a result, a plurality of pieces of anonymous data that are output may become undesirable data in statistical processing. Specifically, a histogram showing the feature distribution of a plurality of pieces of personal data and a histogram showing the feature distribution of a plurality of anonymous data to be output may no longer be similar.

In one aspect, the invention aims to obtain useful anonymous data.

According to one embodiment, the degree of anonymity among the plurality of personal data is determined based on the result of anonymizing personal data included in the plurality of personal data using a first anonymization model that anonymizes information. Identifying one or more pieces of personal data that do not meet predetermined criteria, learning a second anonymization model that anonymizes information based on the identified one or more pieces of personal data, and learning the identified one or more pieces of personal data. , one or more anonymous data having a higher degree of anonymity than each of the one or more personal data is generated, and the one or more anonymous data generated by the learned second anonymization model. A generation method, a generation program, and a generation device are proposed for outputting new anonymous data obtained by anonymizing each anonymous data.

According to one aspect, useful anonymous data can be obtained.

FIG. 1 is an explanatory diagram (part 1) showing an example of the generation method according to the embodiment. FIG. 2 is an explanatory diagram (part 2) showing an example of the generation method according to the embodiment. FIG. 3 is an explanatory diagram showing an example of the data utilization system 300. FIG. 4 is a block diagram showing an example of the hardware configuration of the generation device 100. FIG. 5 is an explanatory diagram showing an example of the storage contents of the data management table 500. FIG. 6 is a block diagram showing an example of the functional configuration of the generation device 100. FIG. 7 is an explanatory diagram showing a first operation example of the generation device 100. FIG. 8 is an explanatory diagram showing a second operation example of the generation device 100. FIG. 9 is an explanatory diagram showing a third operation example of the generation device 100. FIG. 10 is an explanatory diagram showing an example of a membership inclusion attack. FIG. 11 is an explanatory diagram (part 1) showing a first example of the shape of a histogram to be compared. FIG. 12 is an explanatory diagram (part 2) showing a first example of the shape of a histogram to be compared. FIG. 13 is an explanatory diagram (part 3) showing a first example of the shape of a histogram to be compared. FIG. 14 is an explanatory diagram (part 4) showing a first example of the shape of a histogram to be compared. FIG. 15 is an explanatory diagram (part 1) showing a second example of the shape of the histogram to be compared. FIG. 16 is an explanatory diagram (part 2) showing a second example of the shape of the histogram to be compared. FIG. 17 is an explanatory diagram (part 3) showing a second example of the shape of the histogram to be compared. FIG. 18 is a flowchart illustrating an example of a preparation process procedure. FIG. 19 is a flowchart illustrating an example of a test processing procedure. FIG. 20 is a flowchart illustrating an example of a branch processing procedure. FIG. 21 is a flowchart illustrating an example of a reuse processing procedure.

DESCRIPTION OF EMBODIMENTS Below, embodiments of a generation method, a generation program, and a generation device according to the present invention will be described in detail with reference to the drawings.

(An example of the generation method according to the embodiment)
FIGS. 1 and 2 are explanatory diagrams showing an example of the generation method according to the embodiment. In FIG. 1, a generation device 100 is a computer that generates and outputs anonymous data based on personal data while ensuring the anonymity of the personal data.

Conventionally, when generating and outputting anonymous data by processing personal data, a privacy test is sometimes conducted to ensure the anonymity of the personal data. For example, anonymous data generated based on the personal data will be output only if it is determined through a privacy test that the anonymity of the personal data is ensured.

Specifically, we conduct a privacy test on personal data to establish a security standard called (k, γ) PD (Plausible Deniality), which establishes standards for the usefulness of anonymous data and the anonymity of personal data. There are gender indicators. Now, moving on to the explanation of FIG. 2, the flow of processing performed by the conventional (k, γ) PD will be explained.

In Figure 2, (k, γ) PD is an anonymous data y = M(d) by applying a probabilistic differential privacy algorithm M to personal data d randomly selected from a personal data group D. generate. (k, γ) PD performs a privacy test on the generated anonymous data y. Privacy tests may have usability requirements set.

(k, γ) PD is, for example, if there are k or more (k>1) other personal data d that includes the same attribute value as personal data d in personal data group D, the generated anonymous Data y is determined to be outputtable and added to the release data set. On the other hand, (k, γ) PD is, for example, if there are no more than k (k>1) other personal data d including the same attribute value as the personal data d in the personal data group D. The generated anonymous data y is determined to be impossible to output and is discarded.

Furthermore, in order to prevent attacks that estimate the parameter k, the (k, γ) PD may use a randomized parameter k+Lap (1/ε ⁰ ) instead of the parameter k. Lap(·) is a random number generation mechanism based on the Laplace distribution.

k is a parameter indicating how many pieces of other personal data d having the same attribute value as the personal data d is preferably present from the viewpoint of anonymity. k has a property that the larger the value, the more difficult it is to identify the individual corresponding to the personal data d.

γ is a parameter of the probabilistic differential privacy algorithm M. γ is a parameter that defines a noise value given stochastically to the personal data d. γ has a property that the smaller the value, the larger the noise value given to the personal data d. The smaller the noise value, the higher the risk that it will be identified from which personal data d anonymous data y was generated.

ε ⁰ is a parameter that defines a random noise value given to k. ε ⁰ has a property that the smaller the value, the stronger the resistance to membership inclusion attacks. An example of the membership inclusion attack will be specifically described later using FIG. 10.

Further, regarding (k, γ) PD, for example, reference can be made to the following non-patent document 1. In addition to (k, γ) PD, there is also a safety index called (k, δ) PD. Regarding (k, δ) PD, for example, the following non-patent document 2 can be referred to.

Non-Patent Document 1: Bindschaedler, Vincent, Reza Shokri, and Carl A. Gunter. “Plausible deniability for privacy-preserving data synthesis.” arXiv preprint arXiv:1708.07975 (2017).

Non-Patent Document 2: Bindschaedler, Vincent, and Reza Shokri. “Synthesizing plausible privacy-preserving location traces.” 2016 IEEE Symposium on Security and Privacy (SP). IEEE, 2016.

However, in the past, the usefulness of anonymous data may be compromised. For example, when a privacy test is carried out, only anonymous data generated based on a portion of a plurality of pieces of personal data may be output. As a result, a plurality of pieces of anonymous data that are output may become undesirable data in statistical processing. Specifically, a histogram showing the feature distribution of a plurality of pieces of personal data and a histogram showing the feature distribution of a plurality of anonymous data to be output may no longer be similar. The histogram will be specifically described later using FIGS. 11 to 17.

More specifically, in (k, γ) PD, it is difficult to adjust the parameters k, γ, ε ⁰ so as to balance the usefulness of anonymous data and the anonymity of personal data. Here, in (k, γ) PD, no matter how the parameters k, γ, ε ⁰ are adjusted, either the usefulness of anonymous data or the anonymity of personal data tends to be impaired.

In particular, in order to ensure the anonymity of personal data, if the value of the parameter k is increased, the number of personal data from which anonymous data that can be outputted will be generated will decrease, and the multiple anonymous data that will be output will be subjected to statistical processing. This results in unfavorable data. For example, a histogram showing the feature distribution of multiple pieces of personal data and a histogram showing the feature distribution of multiple output anonymous data will no longer be similar, and the multiple output anonymous data will become undesirable data in statistical processing. .

Furthermore, users may arbitrarily perform privacy tests in order to improve the usefulness of anonymous data by considering histograms. For example, a user repeatedly performs a privacy test on specific personal data until the parameter k+Lap (1/ε ⁰ ) happens to take a large value, and outputs anonymous data generated based on the specific personal data. Sometimes I try. In this case, the anonymity of personal data may be compromised.

Further, the anonymity of the personal data may also be impaired as a result of the histogram showing the feature distribution of a plurality of pieces of personal data and the histogram showing the feature distribution of a plurality of anonymous data to be output no longer similar. Since a relatively large amount of anonymous data is generated based on a relatively small amount of personal data, the risk of individuals being identified based on the anonymous data tends to be high.

Therefore, in this embodiment, a generation method that can improve the usefulness of output anonymous data will be described.

Returning to the explanation of FIG. 1, the generation device 100 stores a plurality of pieces of personal data in a DB (DataBase) 101. Personal data includes, for example, values that indicate some characteristic about an individual. The generation device 100 stores a first anonymization model 110. The first anonymization model 110 is a model that anonymizes information. Anonymization corresponds to processing. The first anonymization model 110 is, for example, a model that generates one or more anonymous data obtained by adding a random noise value to a value included in personal data. The first anonymization model 110 is, for example, a probabilistic differential privacy algorithm.

(1-1) The generation device 100 determines, based on the result of anonymizing the personal data included in the plurality of personal data using the first anonymization model 110, the degree of anonymity among the plurality of personal data is a predetermined standard. Identify one or more pieces of personal data that do not meet the requirements. The predetermined standard is, for example, a privacy test standard. In the following description, satisfying a predetermined standard may be expressed as "OK", and not satisfying a predetermined criterion may be expressed as "NG". One or more pieces of personal data whose degree of anonymity does not meet a predetermined standard is stored in the NG-DB 102, for example.

For example, the generation device 100 randomly selects personal data included in a plurality of pieces of personal data. For example, each time personal data is selected, the generation device 100 generates one or more pieces of anonymous data using the first anonymization model 110 based on the selected personal data. For example, the generation device 100 performs a privacy test based on one or more pieces of anonymous data, and determines whether the degree of anonymity of the personal data from which the one or more pieces of anonymous data was generated satisfies a predetermined standard. judge. For example, based on the determined result, the generation device 100 identifies one or more pieces of personal data whose degree of anonymity does not satisfy a predetermined standard from among the pieces of personal data.

(1-2) The generation device 100 learns the second anonymization model 120 based on the specified one or more pieces of personal data. The second anonymization model 120 is a model that anonymizes information. The second anonymization model 120 is a model that anonymizes information. The second anonymization model 120 is a model that generates one or more new anonymous data obtained by adding a random noise value to a value included in the anonymous data. The second anonymization model 120 is, for example, a probabilistic differential privacy algorithm. The second anonymization model 120 is, for example, the same algorithm as the first anonymization model 110. The generation device 100 learns the second anonymization model 120, for example, based on the variance and average regarding the values included in the specified one or more personal data.

(1-3) The generation device 100 generates one or more anonymous data having a higher degree of anonymity than each of the one or more personal data, based on the one or more identified personal data. One or more pieces of anonymous data are stored in the MA-DB 103, for example. MA means microaggregation. For example, the generation device 100 performs micro-aggregation and generates one or more anonymous data.

Specifically, the generation device 100 calculates statistical values regarding the values included in each of the one or more pieces of personal data that has been identified. Specifically, the statistical value is an average value, maximum value, minimum value, median value, mode, or the like. Specifically, the generation device 100 generates one or more anonymous data by replacing the value included in each of the identified one or more pieces of personal data with the calculated statistical value.

(1-4) The generation device 100 outputs new anonymous data obtained by anonymizing each of the one or more generated anonymous data using the learned second anonymization model 120. The output destination is, for example, the release DB 104. The generation device 100 generates and outputs new anonymous data using the second anonymization model 120, for example, based on each of the one or more anonymous data. At this time, the generation device 100 may also output anonymous data generated by the first anonymization model 110 based on personal data that satisfies a predetermined criterion among the plurality of personal data, for example. .

Thereby, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of anonymous data and the anonymity of personal data.

The generation device 100 can generate new anonymous data, for example, based on personal data whose degree of anonymity is determined not to satisfy a predetermined standard through a privacy test. For this reason, the generation device 100 can, for example, make a plurality of output anonymous data data preferable in statistical processing. Specifically, the generation device 100 can bring a histogram indicating the feature distribution of a plurality of pieces of personal data closer to a histogram indicating a feature distribution of a plurality of anonymous data to be output.

Further, the generation device 100 converts, for example, personal data whose degree of anonymity is determined to not satisfy a predetermined standard into anonymous data in a format with a higher degree of anonymity, and then uses the second anonymization model 120 to convert the personal data to anonymous data that has a higher degree of anonymity. , new anonymous data can be generated. Therefore, the generation device 100 can easily ensure the anonymity of personal data, for example.

For example, the generation device 100 can learn the second anonymization model 120 based on one or more pieces of personal data whose degree of anonymity does not satisfy a predetermined standard among a plurality of pieces of personal data. The generation device 100 can generate new anonymous data using the second anonymization model 120, for example. For this reason, the generation device 100 can, for example, make a plurality of output anonymous data data preferable in statistical processing. Specifically, the generation device 100 generates, for example, a histogram showing the feature distribution of personal data whose degree of anonymity does not meet a predetermined standard, and a feature distribution of new anonymous data generated by the second anonymization model 120. The histogram shown can be brought closer to the histogram shown.

The generation device 100 can generate and output anonymous data based on personal data that would otherwise be determined to be unacceptable. Therefore, the generation device 100 can prevent the user from arbitrarily conducting a privacy test in order to improve the usefulness of anonymous data, and can ensure the anonymity of personal data. can.

As described above, the generation device 100 has created a database of anonymous data that is compatible with the usefulness of anonymous data and the anonymity of personal data, and that is considered to cause no problem even if it is distributed externally and referenced by a third party. can be generated. Therefore, the generation device 100 can be used in the field of statistical analysis or machine learning.

Furthermore, the generation device 100 can improve the method of performing a privacy test. The generation device 100 can improve a method such as (k, γ) PD or (k, δ) PD, for example. The generation device 100 can improve methods for performing privacy tests other than (k, γ) PD and (k, δ) PD.

(Example of data utilization system 300)
Next, an example of a data utilization system 300 to which the generation device 100 shown in FIG. 1 is applied will be described using FIG. 3.

FIG. 3 is an explanatory diagram showing an example of the data utilization system 300. In FIG. 3, a data utilization system 300 includes a generation device 100, a data provider device 301, and a data usage device 302.

In the data utilization system 300, the generation device 100 and the data providing device 301 are connected via a wired or wireless network 310. The network 310 is, for example, a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, or the like. Furthermore, the generation device 100 and the data usage device 302 are connected via a wired or wireless network 310.

The generation device 100 collects personal data from the data provider device 301. The collected personal data is stored, for example, in a data management table 500 shown in FIG. 5 and described later. The generation device 100 generates a plurality of anonymous data based on the collected plurality of personal data and transmits the generated anonymous data to the data usage side device 302. A specific example of generating a plurality of anonymous data will be described later using, for example, FIGS. 7 to 9. The generation device 100 is, for example, a server or a PC (Personal Computer).

The data providing device 301 acquires personal data and transmits it to the generating device 100. The data providing device 301 acquires personal data based on the operator's operation input and transmits it to the generating device 100. The data provider device 301 acquires personal data from, for example, a tablet terminal, a smartphone, a wearable terminal, an IoT (Internet of Things) device, etc., and transmits it to the generation device 100. The data providing device 301 is, for example, a server or a PC.

The data usage device 302 receives a plurality of pieces of anonymous data from the generation device 100. The data utilization side device 302 implements a data utilization task based on a plurality of anonymous data. The data utilization task is, for example, a task such as statistical analysis or machine learning. The data usage side device 302 is, for example, a server or a PC.

Although a case has been described here in which the generation device 100 is a device different from the data providing device 301, the present invention is not limited to this. For example, the generation device 100 may be integrated with the data providing device 301 and may also operate as the data providing device 301.

Here, a case has been described in which the generation device 100 is a device different from the data usage side device 302, but the present invention is not limited to this. For example, the generation device 100 may be integrated with the data usage side device 302 and may also operate as the data usage side device 302.

Although the case where the data providing side device 301 is a server, a PC, or the like has been described here, the present invention is not limited to this. For example, the data providing device 301 may be a tablet terminal, a smartphone, a wearable terminal, an IoT device, or the like.

(Example of hardware configuration of generation device 100)
Next, an example of the hardware configuration of the generation device 100 will be described using FIG. 4.

FIG. 4 is a block diagram showing an example of the hardware configuration of the generation device 100. In FIG. 4, the generation device 100 includes a CPU (Central Processing Unit) 401, a memory 402, a network I/F (Interface) 403, a recording medium I/F 404, and a recording medium 405. Further, each component is connected to each other by a bus 400.

Here, the CPU 401 is in charge of overall control of the generation device 100. The memory 402 includes, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), a flash ROM, and the like. Specifically, for example, a flash ROM or ROM stores various programs, and a RAM is used as a work area for the CPU 401. The program stored in the memory 402 is loaded into the CPU 401 and causes the CPU 401 to execute the coded processing.

Network I/F 403 is connected to network 310 through a communication line, and connected to other computers via network 310. The network I/F 403 serves as an internal interface with the network 310, and controls data input/output from other computers. The network I/F 403 is, for example, a modem or a LAN adapter.

The recording medium I/F 404 controls reading/writing of data to/from the recording medium 405 under the control of the CPU 401 . The recording medium I/F 404 is, for example, a disk drive, an SSD (Solid State Drive), a USB (Universal Serial Bus) port, or the like. The recording medium 405 is a nonvolatile memory that stores data written under the control of the recording medium I/F 404. The recording medium 405 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 405 may be removable from the generation device 100.

In addition to the components described above, the generation device 100 may include, for example, a keyboard, a mouse, a display, a printer, a scanner, a microphone, a speaker, and the like. Furthermore, the generation device 100 may include a plurality of recording medium I/Fs 404 and recording media 405. Further, the generation device 100 does not need to have the recording medium I/F 404 or the recording medium 405.

(Stored contents of data management table 500)
Next, an example of the storage contents of the data management table 500 will be explained using FIG. 5. The data management table 500 is realized, for example, by a storage area such as the memory 402 or the recording medium 405 of the generation device 100 shown in FIG. 4.

FIG. 5 is an explanatory diagram showing an example of the storage contents of the data management table 500. As shown in FIG. 5, the data management table 500 has fields for name, gender, age, and height. In the data management table 500, personal data is stored as a record 500-a by setting information in each field for each individual. a is any integer.

A name for identifying an individual is set in the name field. In the gender field, the gender of the individual is set as the attribute value of the individual. In the age field, the age of the individual is set as the attribute value of the individual. In the height field, the height of the individual is set as the attribute value of the individual. The personal data does not need to include any one of the individual's name, gender, age, and height as an attribute value of the individual. The personal data may include attribute values other than the individual's name, gender, age, and height.

(Example of hardware configuration of data provider device 301)
The hardware configuration example of the data providing side device 301 is similar to the hardware configuration example of the generation device 100 shown in FIG. 4, and therefore a description thereof will be omitted.

(Example of hardware configuration of data usage side device 302)
The hardware configuration example of the data usage side device 302 is the same as the hardware configuration example of the generation device 100 shown in FIG. 4, and therefore a description thereof will be omitted.

(Functional configuration example of generation device 100)
Next, an example of the functional configuration of the generation device 100 will be described using FIG. 6.

FIG. 6 is a block diagram showing an example of the functional configuration of the generation device 100. The generation device 100 includes a storage unit 600, an acquisition unit 601, a first anonymization unit 602, a determination unit 603, an identification unit 604, a learning unit 605, a generation unit 606, and a second anonymization unit. 607 and an output section 608.

The storage unit 600 is realized, for example, by a storage area such as the memory 402 or the recording medium 405 shown in FIG. 4. In the following, a case will be described in which the storage unit 600 is included in the generation device 100, but the invention is not limited to this. For example, there may be a case where the storage unit 600 is included in a device different from the generation device 100, and the storage contents of the storage unit 600 can be referenced from the generation device 100.

The acquisition unit 601 to output unit 608 function as an example of a control unit. Specifically, the acquisition unit 601 to the output unit 608 execute the program by causing the CPU 401 to execute a program stored in a storage area such as the memory 402 or the recording medium 405 shown in FIG. This function is realized by The processing results of each functional unit are stored in a storage area such as the memory 402 or the recording medium 405 shown in FIG. 4, for example.

The storage unit 600 stores various information that is referenced or updated in the processing of each functional unit. The storage unit 600 stores a plurality of pieces of personal data. Personal data includes, for example, values that indicate some characteristic about an individual. The value is, for example, an attribute value. Personal data is acquired by the acquisition unit 601, for example. Storage unit 600 stores a plurality of anonymous data. The anonymous data is generated by, for example, the first anonymization unit 602 or the second anonymization unit 607.

The storage unit 600 stores the first anonymization model. The first anonymization model is a model that anonymizes information. Anonymization corresponds to processing. The first anonymization model is, for example, a model that generates one or more anonymous data obtained by adding a random noise value to a value included in personal data. The first anonymization model is, for example, a probabilistic differential privacy algorithm. The first anonymized model is generated by the generation unit 606, for example.

Storage unit 600 stores the second anonymization model. The second anonymization model is a model that anonymizes information. The second anonymization model is, for example, a model that generates one or more new anonymous data obtained by adding a random noise value to a value included in the anonymous data. The second anonymization model is, for example, a probabilistic differential privacy algorithm. The second anonymization model is, for example, the same algorithm as the first anonymization model.

The acquisition unit 601 acquires various information used in processing of each functional unit. The acquisition unit 601 stores the acquired various information in the storage unit 600 or outputs it to each functional unit. Further, the acquisition unit 601 may output various information stored in the storage unit 600 to each functional unit. The acquisition unit 601 acquires various information based on, for example, a user's operation input. The acquisition unit 601 may receive various information from a device different from the generation device 100, for example.

The acquisition unit 601 acquires a plurality of pieces of personal data. The acquisition unit 601 acquires, for example, a plurality of pieces of personal data by receiving them from the data provider device 301. The acquisition unit 601 acquires a plurality of pieces of personal data based on, for example, a user's operation input. The acquisition unit 601 may acquire the first anonymized model, for example.

The acquisition unit 601 may receive a start trigger that starts processing of any functional unit. The start trigger is, for example, a predetermined operation input by the user. The start trigger may be, for example, receiving predetermined information from another computer. The start trigger may be, for example, that any functional unit outputs predetermined information. The acquisition unit 601 receives, for example, the acquisition of a plurality of pieces of personal data as a start trigger for starting the processing of the first anonymization unit 602 to the second anonymization unit 607.

The first anonymization unit 602 anonymizes personal data included in a plurality of pieces of personal data using a first anonymization model, and generates one or more anonymous data. The first anonymization unit 602, for example, randomly selects personal data included in a plurality of pieces of personal data multiple times. For example, each time personal data is selected, the first anonymization unit 602 generates one or more pieces of anonymous data using a first anonymization model based on the selected personal data. Thereby, the first anonymization unit 602 can generate anonymous data and improve the anonymity of personal data.

The determination unit 603 determines whether the degree of anonymity of the personal data satisfies a predetermined standard based on the result of anonymizing the personal data included in the plurality of personal data using the first anonymization model. . The predetermined standard is, for example, a privacy test standard. For example, the determination unit 603 performs a privacy test based on one or more pieces of anonymous data, and determines whether the degree of anonymity of the selected personal data from which the one or more pieces of anonymous data were generated satisfies a predetermined standard. Determine whether or not.

Specifically, when the personal data included in the plurality of personal data is anonymized using the first anonymization model, the determination unit 603 determines whether the plurality of personal data includes the same or similar value as the personal data. Calculate the number of other personal data. Further, each piece of personal data may include multiple values. In this case, the determination unit 603 may specifically calculate the number of other pieces of personal data in which the value of a specific item is the same as or similar to the personal data targeted for anonymization.

Here, if the calculated number is less than or equal to a predetermined number, the determination unit 603 determines that the predetermined criterion is not satisfied. The predetermined number is, for example, a fixed value. The predetermined number may be a variable value, for example. The variable value is, for example, k+Lap(1/ε ⁰ ). On the other hand, if the calculated number is larger than the predetermined number, the determination unit 603 determines that the predetermined criterion is satisfied. Thereby, the determination unit 603 can determine whether the anonymity of the personal data is ensured.

Specifically, the determination unit 603 determines that when personal data included in a plurality of pieces of personal data is anonymized using the first anonymization model, the representative value of the added noise value is equal to or less than a predetermined threshold value. , it is determined that the predetermined criteria are not met. Specifically, the representative value is an average value, maximum value, minimum value, median value, mode, or the like. Thereby, the determination unit 603 can determine whether the anonymity of the personal data is ensured.

Specifically, the determination unit 603 may determine, with a predetermined probability, that a predetermined standard is not satisfied, regardless of the actual degree of anonymity of the selected personal data. The predetermined probability is set by the user, for example. Thereby, the determination unit 603 can increase the number of personal data that can be referenced by the learning unit 605, and can make it easier for the learning unit 605 to generate the second anonymized model.

The identification unit 604 identifies one or more pieces of personal data whose degree of anonymity does not satisfy a predetermined standard from among the plurality of pieces of personal data. The identification unit 604 identifies one or more pieces of personal data, for example, based on the determined result. Specifically, the identifying unit 604 identifies one or more pieces of personal data for which the determined result is NG. Thereby, the identification unit 604 can identify one or more pieces of personal data whose degree of anonymity does not meet a predetermined standard, which was the source of the anonymous data discarded by the privacy test.

The identifying unit 604 may divide the identified one or more pieces of personal data into one or more clusters. The identifying unit 604 divides the identified one or more pieces of personal data into one or more clusters, for example, based on the value included in each of the identified one or more pieces of personal data.

Specifically, the identifying unit 604 sorts the identified one or more pieces of personal data based on the magnitude relationship of the values included in each of the identified pieces of personal data. Specifically, the identifying unit 604 divides the one or more pieces of personal data into one or more clusters so that each k piece of personal data belongs to the same cluster from the top of the sorted one or more pieces of personal data. . k may be a variable value. Thereby, the specifying unit 604 can easily associate the histogram showing the feature distribution of one or more anonymous data generated by the generating unit 606 with the histogram showing the feature distribution of one or more personal data.

The learning unit 605 learns the second anonymization model based on the identified one or more pieces of personal data. For example, the learning unit 605 determines the range of noise values used in the second anonymization model based on the variance and average regarding the values included in each of the one or more pieces of personal data that has been identified, and Learn an anonymization model for . Thereby, the learning unit 605 can easily associate the histogram showing the feature distribution of one or more anonymous data generated by the second anonymization unit 607 with the histogram showing the feature distribution of a plurality of pieces of personal data.

The learning unit 605 learns, for each cluster, a second anonymization model corresponding to the cluster, based on the personal data divided into clusters. Thereby, the learning unit 605 can easily associate the histogram showing the feature distribution of one or more anonymous data generated by the second anonymization unit 607 with the histogram showing the feature distribution of a plurality of pieces of personal data.

The generation unit 606 generates one or more anonymous data having a higher degree of anonymity than each of the one or more personal data, based on the one or more identified personal data. For example, the generation unit 606 performs micro-aggregation and generates one or more anonymous data.

Specifically, the generation unit 606 calculates statistical values regarding the values included in each of the identified one or more pieces of personal data. Specifically, the statistical value is an average value, maximum value, minimum value, median value, mode, or the like. The generation unit 606 replaces the value included in each of the identified one or more pieces of personal data with the calculated statistical value, and generates one or more pieces of anonymous data. Thereby, the generation unit 606 can improve the anonymity of personal data.

The generation unit 606 generates, for each cluster, anonymous data corresponding to the cluster and having a higher degree of anonymity than each of the personal data divided into clusters, based on the personal data divided into clusters. Thereby, the generation unit 606 can generate anonymous data referenced by the second anonymization model for each cluster.

The second anonymization unit 607 anonymizes each of the one or more generated anonymous data using the learned second anonymization model, and generates new anonymous data. Thereby, the second anonymization unit 607 generates one or more new anonymous data so that the histogram showing the feature distribution of the generated one or more new anonymous data corresponds to the histogram showing the feature distribution of the plurality of personal data. Data can be generated.

For each cluster, the second anonymization unit 607 anonymizes the anonymous data corresponding to the generated cluster using the learned second anonymization model corresponding to the cluster, and generates new anonymous data. As a result, the second anonymization unit 607 adjusts the histograms indicating the feature distribution of the generated one or more new anonymous data to correspond to the histograms indicating the feature distribution of the plurality of personal data for each cluster. new anonymous data can be generated.

The output unit 608 outputs the processing results of any of the functional units. The output format is, for example, display on a display, printout to a printer, transmission to an external device via network I/F 403, or storage in a storage area such as memory 402 or recording medium 405. Thereby, the output unit 608 can notify the user of the processing results of any of the functional units, thereby improving the usability of the generation device 100.

The output unit 608 outputs the new anonymous data generated by the second anonymization unit 607. The output unit 608 further outputs the anonymous data generated by the first anonymization unit 602. The output unit 608 outputs, for example, the anonymous data generated by the first anonymization unit 602 and the new anonymous data generated by the second anonymization unit 607. This allows the output unit 608 to make useful anonymous data available.

(First operation example of generation device 100)
Next, a first operation example of the generation device 100 will be described using FIG. 7.

FIG. 7 is an explanatory diagram showing a first operation example of the generation device 100. In FIG. 7, (7-1) the generation device 100 obtains the personal data group 701 from the data management table 500 after deleting the name attribute value.

(7-2) The generation device 100 clusters the personal data group 701 based on the value included in each piece of personal data in the acquired personal data group 701. Clustering is performed on attributes that are likely to create a histogram. For example, attributes for which a histogram is likely to be created are specified in advance by the user. As the clustering, for example, clustering defined in K-anonymization processing is used.

In the example of FIG. 7, the generation device 100 divides a personal data group 701 into a cluster 702 that includes personal data whose gender value is "female" and a cluster 703 that includes personal data whose gender value is "male." do. Here, the gender value is treated as a quasi-identifier. Values other than gender are treated as sensitive attributes. The generation device 100 stores, in the DB 710, a cluster 702 that includes personal data whose gender value is "female." The generation device 100 stores, in the DB 720, a cluster 703 that includes personal data whose gender value is “male.”

In the following description, a case will be described in which the generation device 100 processes the DB 710. The case in which the generation device 100 processes the DB 720 is the same as the case in which the generation device 100 processes the DB 710, so a description thereof will be omitted.

(7-3) The generation device 100 performs noise addition and privacy test on the DB 710. The generation device 100 obtains a personal data group 711 stored in the DB 710, for example. For example, the generation device 100 randomly selects personal data included in the acquired personal data group 711 a predetermined number of times.

For example, each time personal data is selected, the generation device 100 generates one or more pieces of anonymous data using the generation model 730 based on the selected personal data. Generative model 730 is a probabilistic generative model. The generative model 730 is, for example, a generative model that has a differential privacy mechanism. The generative model 730 may be generated based on the personal data group 711, for example.

For example, the generation device 100 performs a privacy test based on the one or more generated anonymous data, and determines that the degree of anonymity of the personal data from which the one or more generated anonymous data was generated satisfies a predetermined standard. Determine whether or not. Here, the generation device 100 stores the generated one or more anonymous data in the release DB 740, for example, if the determined result is OK. OK means that the degree of anonymity of the personal data satisfies a predetermined standard and passes the privacy test. On the other hand, if the determined result is NG, the generation device 100 discards the one or more generated anonymous data and stores the personal data from which the one or more generated anonymous data was generated into the NG-DB 750. save. NG means that the degree of anonymity of the personal data does not meet a predetermined standard and does not pass the privacy test.

(7-4) The generation device 100 performs micro-aggregation on the NG-DB 750. The generation device 100 obtains the personal data group 751 stored in the NG-DB 750, for example. For example, the generation device 100 performs micro-aggregation on the acquired personal data group 751. Micro-aggregation is a method of replacing the values included in each personal data in the personal data group 751 with statistical values regarding the values included in each personal data in the personal data group 751. Specifically, the statistical value is an average value, maximum value, minimum value, median value, mode, or the like.

In the example of FIG. 7, the generation device 100 generates anonymous data by replacing the value included in each personal data of the personal data group 751 with the average value of the values included in each personal data of the personal data group 751. A group 761 is generated. The generation device 100 stores an anonymous data group 761 obtained from the personal data group 751 in the MA-DB 760, for example, by micro-aggregation.

Here, the generation device 100 generates anonymous data by replacing the value included in each personal data of the personal data group 751 with the average value of the values included in each personal data of the personal data group 751. Although the case has been described, it is not limited to this. In this case, the anonymous data may be mistakenly recognized as belonging to an individual whose personal data includes a value relatively close to the average value. Therefore, for example, by the generation device 100 replacing the value included in each personal data of the personal data group 751 with a value that is more than a certain distance from the value included in each personal data of the personal data group 751, There may be cases where anonymous data is generated.

(7-5) The generation device 100 learns the generation model 770 based on the NG-DB 750. The generation device 100 obtains the personal data group 751 stored in the NG-DB 750, for example. The generation device 100 uses, for example, each personal data of the acquired personal data group 751 as learning data to learn the generation model 770. Generative model 770 is a probabilistic generative model. The generative model 770 is, for example, a generative model that has a differential privacy mechanism. The generation device 100 learns the generation model 770, for example, based on the variance and average regarding the values included in each personal data of the acquired personal data group 751.

(7-6) The generation device 100 adds noise to the MA-DB 760. The generation device 100 obtains the anonymous data group 761 stored in the MA-DB 760, for example. For example, the generation device 100 randomly selects anonymous data included in the acquired anonymous data group 761 a predetermined number of times. The generation device 100 may select each piece of anonymous data from the acquired anonymous data group 761.

For example, each time anonymous data is selected, the generation device 100 generates one or more new pieces of anonymous data using the learned generation model 770 based on the selected anonymous data. The generation device 100 stores, for example, an anonymous data group 771 including the generated new anonymous data in the release DB 740. The generation device 100 may perform a privacy test when generating one or more new anonymous data.

In this way, when the generation device 100 processes the DB 710, the release DB 740 is obtained. On the other hand, when the generation device 100 processes the DB 720, it is assumed that the release DB 781 is obtained.

(7-7) The generation device 100 combines the release DB 740 obtained with the DB 710 as the processing target and the release DB 781 obtained with the DB 720 as the processing target, and generates the DB 780. Thereby, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of anonymous data and the anonymity of personal data.

The generation device 100 can generate new anonymous data, for example, based on personal data determined to be NG in a privacy test. For this reason, the generation device 100 can, for example, make a plurality of output anonymous data data preferable in statistical processing. Specifically, the generation device 100 can bring a histogram indicating the feature distribution of a plurality of pieces of personal data closer to a histogram indicating a feature distribution of a plurality of anonymous data to be output.

Further, the generation device 100 converts personal data whose degree of anonymity is determined to not meet a predetermined standard into anonymous data in a format with a higher degree of anonymity, and then uses the generation model 770 to generate new anonymous data. Data can be generated. Therefore, the generation device 100 can easily ensure the anonymity of personal data, for example.

For example, the generation device 100 may learn the generation model 770 based on one or more pieces of personal data determined to be NG among the plurality of pieces of personal data, and generate new anonymous data using the learned generation model 770. I can do it. For this reason, the generation device 100 can, for example, make a plurality of output anonymous data data preferable in statistical processing. Specifically, the generation device 100 can, for example, bring the histogram indicating the feature distribution of personal data determined to be NG closer to the histogram indicating the feature distribution of new anonymous data generated by the generation model 770. .

As described above, the generation device 100 has created an anonymous data DB 780 that is compatible with the usefulness of anonymous data and the anonymity of personal data, and that is considered to cause no problem even if it is distributed externally and referred to by a third party. can be generated. Therefore, the generation device 100 can be used in the field of statistical analysis or machine learning.

Although the case where the generation device 100 simply performs the privacy test in (7-3) has been described here, the present invention is not limited to this. For example, when the generation device 100 conducts a privacy test in (7-3), it has a certain probability of failing or failing, regardless of the degree of anonymity of the personal data that was the source of the one or more generated anonymous data. There may be a case where the operation is performed so as to determine that there is.

Thereby, the generation device 100 can avoid a situation where the anonymity of personal data may be lost due to the small number of personal data stored in the NG-DB 750. An example of the operation of the generation device 100 in this case corresponds to a second example of operation, which will be described later with reference to FIG.

Here, a case has been described in which the generation device 100 performs micro-aggregation on the entire personal data group 751 stored in the NG-DB 750 in (7-4), but the present invention is not limited to this. For example, the generation device 100 may perform micro-aggregation for each k pieces of personal data out of the personal data group 751 stored in the NG-DB 750 in (7-4). In this case, the generation device 100 learns the generation model 770 for each k piece of personal data.

Thereby, the generation device 100 can more easily bring the histogram showing the feature distribution of the personal data determined to be NG and the histogram showing the feature distribution of the new anonymous data generated by the generation model 770 closer to each other. . The operation example of the generation device 100 in this case corresponds to the third operation example described later using FIG. 9.

(Second operation example of generation device 100)
Next, a second operation example of the generation device 100 will be described using FIG. 8.

FIG. 8 is an explanatory diagram showing a second operation example of the generation device 100. In the second operation example, when the generation device 100 conducts a privacy test, it determines that one or more pieces of generated anonymous data are NG with a certain probability, regardless of the degree of anonymity of the personal data from which the generated anonymous data was generated. This corresponds to the case where it operates to make a judgment.

In FIG. 8, (8-1) the generation device 100 generates personal data whose gender value is "female" based on the data management table 500 by the same operation as (7-1) and (7-2). A group of personal data 801 including this information is stored in the DB 800.

In the following description, a case will be described in which the generation device 100 processes the DB 800. The case where the generation device 100 processes another DB that stores a group of personal data containing personal data whose gender value is "male" is the same as the case where the generation device 100 processes the DB 800. Therefore, the explanation will be omitted.

(8-2) The generation device 100 performs noise addition and privacy test on the DB 800. For example, the generation device 100 acquires a personal data group 801 stored in the DB 800. For example, the generation device 100 randomly selects personal data included in the acquired personal data group 801 a predetermined number of times.

For example, each time personal data is selected, the generation device 100 generates one or more pieces of anonymous data using the generation model 810 based on the selected personal data. Generative model 810 is a probabilistic generative model. The generative model 810 is, for example, a generative model that has a differential privacy mechanism. The generative model 810 may be generated based on the personal data group 801, for example.

For example, the generation device 100 performs a privacy test based on the one or more generated anonymous data, and determines that the degree of anonymity of the personal data from which the one or more generated anonymous data was generated satisfies a predetermined standard. Determine whether or not. At this time, the generation device 100 determines, with a certain probability, that the one or more generated anonymous data do not meet the predetermined criteria, regardless of the degree of anonymity of the personal data from which the generated one or more pieces of anonymous data were generated.

Here, the generation device 100 stores the generated one or more anonymous data in the release DB 820, for example, if the determined result is OK. On the other hand, if the determined result is NG, the generation device 100 discards the one or more generated anonymous data and stores the personal data from which the one or more generated anonymous data was generated in the NG-DB 830. save.

(8-3) The generation device 100 performs micro-aggregation on the NG-DB 830. For example, the generation device 100 acquires the personal data group 831 stored in the NG-DB 830. For example, the generation device 100 performs micro-aggregation on the acquired personal data group 831.

In the example of FIG. 8, the generation device 100 generates anonymous data by replacing the value included in each personal data of the personal data group 831 with the average value of the values included in each personal data of the personal data group 831. A group 841 is generated. The generation device 100 stores the anonymous data group 841 obtained from the personal data group 831 in the MA-DB 840, for example, by micro-aggregation.

Here, the generation device 100 generates anonymous data by replacing the value included in each personal data of the personal data group 831 with the average value of the values included in each personal data of the personal data group 831. Although the case has been described, it is not limited to this. In this case, the anonymous data may be mistakenly recognized as belonging to an individual whose personal data includes a value relatively close to the average value. Therefore, for example, by the generation device 100 replacing the value included in each personal data of the personal data group 831 with a value that is more than a certain distance from the value included in each personal data of the personal data group 831, There may be cases where anonymous data is generated.

(8-4) The generation device 100 learns the generative model 850 based on the NG-DB 830. For example, the generation device 100 acquires the personal data group 831 stored in the NG-DB 830. The generation device 100 uses, for example, each personal data of the acquired personal data group 831 as learning data to learn the generation model 850. Generative model 850 is a probabilistic generative model. The generative model 850 is, for example, a generative model that has a differential privacy mechanism. The generation device 100 learns the generation model 850, for example, based on the variance and average regarding the values included in each personal data of the acquired personal data group 831.

(8-5) The generation device 100 adds noise to the MA-DB 840. The generation device 100 obtains the anonymous data group 841 stored in the MA-DB 840, for example. For example, the generation device 100 randomly selects anonymous data included in the acquired anonymous data group 841 a predetermined number of times. The generation device 100 may select each piece of anonymous data from the acquired anonymous data group 841.

For example, each time anonymous data is selected, the generation device 100 generates one or more new pieces of anonymous data using the learned generation model 850 based on the selected anonymous data. For example, the generation device 100 selects any one anonymous data from the acquired anonymous data group 841, and generates new anonymous data into the anonymous data group using the learned generation model 850 based on the selected anonymous data. The same number of anonymous data as 841 may be generated. The generation device 100 stores, for example, an anonymous data group 851 including the generated new anonymous data in the release DB 820. The generation device 100 may perform a privacy test when generating one or more new anonymous data.

In this way, when the generation device 100 processes the DB 800, a release DB 820 is obtained. On the other hand, it is assumed that the release DB 861 is obtained when the generation device 100 processes another DB that stores a group of personal data that includes personal data whose gender value is "male."

(8-6) The generation device 100 combines the release DB 820 and the release DB 861 to generate the DB 860. Thereby, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of anonymous data and the anonymity of personal data.

When performing a privacy test, the generation device 100 can store personal data that could otherwise be determined to be OK in the NG-DB 830 with a certain probability. Therefore, the generation device 100 can avoid a situation where the anonymity of personal data may be lost due to statistical analysis because the number of personal data stored in the NG-DB 830 is small.

Further, the generation device 100 may set a predetermined threshold value for the number of personal data determined to be OK by the privacy test. The predetermined threshold value is set in advance by the user, for example. Then, while the number of personal data determined to be OK is below a predetermined threshold, the generation device 100 determines personal data that would normally be determined to be OK as NG with a certain probability, and generates the NG-DB830. Execute the operation of saving to . On the other hand, after the number of personal data determined to be OK becomes larger than a predetermined threshold, the generation device 100 determines, with a certain probability, personal data that would otherwise be determined to be OK as NG. -Stop the operation of saving to DB830. Thereby, the generation device 100 can reduce the bias between the number of personal data determined to be OK and the number of personal data determined to be NG, making it easier to improve the anonymity of the data. can.

Furthermore, after the number of personal data determined to be OK becomes larger than a predetermined threshold, the generation device 100 determines personal data that would normally be determined to be OK as NG, with a certain probability, and NG- An operation of saving the data in the DB 830 may be started. Thereby, the generation device 100 can reduce the bias between the number of personal data determined to be OK and the number of personal data determined to be NG, making it easier to improve the anonymity of the data. can.

Further, the generation device 100 may set a predetermined threshold value for the number of personal data to be stored in the NG-DB 830. The predetermined threshold value is set in advance by the user, for example. Then, while the number of personal data stored in the NG-DB 830 is below a predetermined threshold, the generation device 100 determines personal data that would otherwise be determined as OK with a certain probability, and rejects the personal data as NG. - Execute the operation of saving in the DB830. On the other hand, after the number of personal data stored in the NG-DB 830 becomes larger than a predetermined threshold, the generation device 100 determines, with a certain probability, personal data that would otherwise be determined to be OK as NG. , the operation of saving to NG-DB830 is stopped. Thereby, the generation device 100 can reduce the bias between the number of personal data determined to be OK and the number of personal data determined to be NG, making it easier to improve the anonymity of the data. can.

(Third operation example of generation device 100)
Next, a third operation example of the generation device 100 will be described using FIG. 9.

FIG. 9 is an explanatory diagram showing a third operation example of the generation device 100. The third operation example corresponds to a case where the generation device 100 performs micro-aggregation for each k piece of personal data among a plurality of pieces of personal data determined to be NG in the privacy test.

In FIG. 9, (9-1) the generation device 100 generates personal data whose gender value is "female" based on the data management table 500 by the same operation as (7-1) and (7-2). A group of personal data including this information is stored in the DB900.

In the following description, a case will be described in which the generation device 100 processes the DB 900. The case where the generation device 100 processes another DB that stores a group of personal data containing personal data whose gender value is "male" is the same as the case where the generation device 100 processes the DB 900. Therefore, the explanation will be omitted.

(9-2) The generation device 100 performs noise addition and privacy test on the DB 900. For example, the generation device 100 acquires a group of personal data stored in the DB 900. For example, the generation device 100 randomly selects personal data included in the acquired personal data group a predetermined number of times.

For example, each time personal data is selected, the generation device 100 generates one or more pieces of anonymous data using the generation model 910 based on the selected personal data. Generative model 910 is a probabilistic generative model. The generative model 910 is, for example, a generative model that has a differential privacy mechanism. The generative model 910 may be generated based on the acquired personal data group, for example.

For example, the generation device 100 performs a privacy test based on the one or more generated anonymous data, and determines that the degree of anonymity of the personal data from which the one or more generated anonymous data was generated satisfies a predetermined standard. Determine whether or not. Here, the generation device 100 stores the generated one or more anonymous data in the release DB 920, for example, if the determined result is OK. On the other hand, if the determined result is NG, the generation device 100 discards the one or more generated anonymous data and stores the personal data from which the one or more generated anonymous data was generated into the NG-DB 930. save.

(9-3) The generation device 100 performs clustering on the NG-DB 930. For example, the generation device 100 acquires the personal data group 940 stored in the NG-DB 930. The generation device 100 sorts the personal data group 940, for example, in descending order of the values included in each piece of personal data in the personal data group 940.

For example, the generation device 100 performs clustering on the sorted personal data group 940 by selecting k pieces of personal data from the top from the sorted personal data group 940 and dividing them into the same cluster. implement. For example, k may be a variable value. In other words, each cluster may contain a different number of personal data. In the example of FIG. 9, the generation device 100 divides the personal data group 940 into the same cluster with the personal data group 941, and divides the personal data group 942 into the same cluster.

(9-4) The generation device 100 performs micro-aggregation for each cluster. For example, the generation device 100 acquires a personal data group 941 divided into certain clusters. For example, the generation device 100 performs micro-aggregation on the acquired personal data group 941. In the example of FIG. 9, the generation device 100 generates anonymous data by replacing the value included in each personal data of the personal data group 941 with the average value of the values included in each personal data of the personal data group 941. A group 961 is generated.

For example, the generation device 100 obtains a personal data group 942 divided into certain clusters. For example, the generation device 100 performs micro-aggregation on the acquired personal data group 942. In the example of FIG. 9, the generation device 100 generates anonymous data by replacing the value included in each personal data of the personal data group 942 with the average value of the values included in each personal data of the personal data group 942. A group 962 is generated. For example, the generation device 100 generates an anonymous data group 960, which is a combination of an anonymous data group 961 obtained from a personal data group 941 and an anonymous data group 962 obtained from a personal data group 942, by micro-aggregation. Save to DB950.

(9-5) The generation device 100 learns generation models 971 and 972 for each cluster. The generative models 971 and 972 are probabilistic generative models. The generative models 971 and 972 are, for example, generative models that have a differential privacy mechanism.

For example, the generation device 100 acquires a personal data group 941 divided into certain clusters. The generation device 100 uses, for example, each personal data of the acquired personal data group 941 as learning data to learn the generation model 971. The generation device 100 learns the generation model 971, for example, based on the variance and average regarding the values included in each personal data of the acquired personal data group 941.

For example, the generation device 100 obtains a personal data group 942 divided into certain clusters. The generation device 100 uses, for example, each personal data of the acquired personal data group 942 as learning data to learn the generation model 972. The generation device 100 learns the generation model 972, for example, based on the variance and average regarding the values included in each personal data of the acquired personal data group 942.

(9-6) The generation device 100 adds noise to each cluster. The generation device 100 obtains, for example, an anonymous data group 961 divided into certain clusters. For example, the generation device 100 randomly selects anonymous data included in the acquired anonymous data group 961 a predetermined number of times. The generation device 100 may select each piece of anonymous data from the acquired anonymous data group 961.

For example, each time anonymous data is selected, the generation device 100 generates one or more new pieces of anonymous data using the learned generation model 971 based on the selected anonymous data. The generation device 100 stores, for example, an anonymous data group including the generated new anonymous data in the release DB 920. The generation device 100 may perform a privacy test when generating one or more new anonymous data.

The generation device 100 obtains, for example, an anonymous data group 962 divided into certain clusters. For example, the generation device 100 randomly selects anonymous data included in the acquired anonymous data group 962 a predetermined number of times. The generation device 100 may select each piece of anonymous data from the acquired anonymous data group 962.

For example, each time anonymous data is selected, the generation device 100 generates one or more new pieces of anonymous data using the learned generation model 972 based on the selected anonymous data. The generation device 100 stores, for example, an anonymous data group including the generated new anonymous data in the release DB 920. The generation device 100 may perform a privacy test when generating one or more new anonymous data.

In this way, when the generation device 100 processes the DB 900, a release DB 920 is obtained. On the other hand, it is assumed that the release DB 981 is obtained when the generation device 100 processes another DB that stores a group of personal data that includes personal data whose gender value is "male."

(9-7) The generation device 100 combines the release DB 920 and the release DB 981 to generate a DB 980. Thereby, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of anonymous data and the anonymity of personal data. Furthermore, the generation device 100 can make it easier to bring the histogram showing the feature distribution of personal data determined to be NG and the histogram showing the feature distribution of new anonymous data generated by the generation models 971 and 972 closer together. can.

In this way, the generation device 100 can improve the usefulness of output anonymous data for anonymized data generation algorithms including privacy tests such as (k, γ) PD, and improve the usefulness of anonymous data. , it is possible to achieve both anonymity of personal data.

(Effects due to generation device 100)
Next, the effects of the generation device 100 will be explained using FIGS. 10 to 17.

FIG. 10 is an explanatory diagram showing an example of a membership inclusion attack. The generation device 100 can prevent membership inclusion attacks according to operation examples 1 to 3.

A membership inclusion attack is an attack that is possible when it is assumed that one or more individuals who have the same attributes as the individual related to the personal data d collude with an attacker. For example, if the privacy test parameter k = 3, if an attacker knows two individuals who have the same attributes as the individual related to personal data d, he or she can estimate the remaining one person's personal data d. It is.

In the example of FIG. 10, Alice exists, and Becky, Chris, and Dazy, who have the same attributes as Alice, ``female'' and ``teenage,'' also exist. The personal data of each individual is stored in a data management table 500. Conventionally, based on the data management table 500, a release data set 1001 including data obtained by adding noise to the personal data of each individual is output.

Here, by knowing the background information of Alice, Becky, Chris, and Dazy and observing the release data set 1001, the attacker deduces that the release data set 1001 contains data based on Alice's personal data. It is possible. For example, if the attacker knows that Becky, Chris, and Dazy who have the same attributes as Alice, such as "female" and "teenage," exist, the attacker can obtain personal data about Alice that is close to the true value.

In contrast, the generation device 100 outputs a release data set 1002 that includes data obtained by adding noise to randomly selected personal data based on the data management table 500. Therefore, the generation device 100 can ensure the anonymity of each individual's personal data and prevent membership inclusion attacks.

The generation device 100 can generate and output anonymous data based on personal data that would otherwise be determined to be unacceptable. Therefore, the generation device 100 can prevent the user from arbitrarily conducting a privacy test in order to improve the usefulness of anonymous data, making it easier to prevent membership inclusion attacks. I can do it.

FIGS. 11 to 14 are explanatory diagrams showing first examples of the shapes of histograms to be compared. According to operation examples 1 to 3, the generation device 100 can bring the histogram showing the feature distribution of a plurality of pieces of personal data closer to the histogram showing the feature distribution of a plurality of anonymous data to be output, and generate useful anonymous data. can be obtained.

Here, as a comparison target with the generation device 100, a histogram showing the feature distribution of a plurality of anonymous data outputted by a conventional privacy test will be described. Table 1100 in FIG. 11 is based on personal data having any value from January to December when ε ⁰ is fixed at 100 and k is varied from 1 to 1000 in the conventional privacy test. Indicates the number of anonymous data output. Now, moving on to the explanation of FIG. 12, an example of a graph of the table 1100 will be explained.

A graph 1200 in FIG. 12 is an example of a graph of the table 1100. As shown in table 1100 and graph 1200, when k is increased to improve the anonymity of personal data, the number of anonymous data output becomes uneven. For example, when k=1000, anonymous data based on personal data having any value from January to September is no longer output compared to when k=1.

On the other hand, in conventional privacy tests, it is conceivable to reduce ε ⁰ to reduce bias. Table 1300 in FIG. 13 shows that in the conventional privacy test, when ε ⁰ is fixed at 0.1 and k is varied from 1 to 1000, personal data having any value from January to December is Indicates the number of anonymous data output based on. Now, moving on to the explanation of FIG. 14, an example of a graph of the table 1300 will be explained.

A graph 1400 in FIG. 14 is an example of a graph of the table 1300. As shown in the table 1300 and graph 1400, even if ε ⁰ is made small, the number of anonymous data output will be biased. For example, when k = 1000, the number of anonymous data based on personal data with values in November decreases by about 80% compared to the case with k = 1, whereas the number of anonymous data based on personal data with values in April decreases by about 80%. The number of anonymous data based on this will be reduced by about 50%.

On the other hand, the generation device 100 can generate and output new anonymous data based on personal data determined to be NG by the privacy test. Therefore, the generation device 100 can make it difficult for bias to occur in the number of output anonymous data, and generate a histogram showing the characteristic distribution of a plurality of pieces of personal data and a characteristic distribution of a plurality of pieces of anonymous data to be output. The histogram can be brought closer. The generation device 100 can then obtain useful anonymous data.

Further, the generation device 100 can generate and output anonymous data based on personal data that would otherwise be determined to be unacceptable. Therefore, the generation device 100 can prevent users from arbitrarily conducting a privacy test in order to improve the usefulness of anonymous data, and can improve the anonymity of personal data. can.

FIGS. 15 to 17 are explanatory diagrams showing second examples of the shapes of the histograms to be compared. According to operation examples 1 to 3, the generation device 100 can bring the histogram showing the feature distribution of a plurality of pieces of personal data closer to the histogram showing the feature distribution of a plurality of anonymous data to be output, and generate useful anonymous data. can be obtained.

Here, as a comparison target with the generation device 100, a histogram showing the feature distribution of a plurality of anonymous data outputted by a conventional privacy test will be described. A graph 1500 in FIG. 15 is an example of a graph of the number of personal data having any value from January to December. Next, the explanation will move on to FIG. 16.

Graphs 1601 to 1603 in FIG. 16 show that in a conventional privacy test, when k is fixed to the average value k1 and ε ⁰ is varied from 0.001 to 100, any value from January to December is This is an example of a graph of the number of anonymous data output based on personal data held. A graph 1601 in FIG. 16 corresponds to the case where ε ⁰ is set to 0.001. A graph 1602 in FIG. 16 corresponds to the case where ε ⁰ is set to 1. A graph 1603 in FIG. 16 corresponds to the case where ε ⁰ is set to 100.

As shown in graphs 1601 to 1603, if ε ⁰ is increased in order to improve the anonymity of personal data, the number of anonymous data output will be biased. For example, when ε ⁰ =100, anonymous data based on personal data having a value from January to April, June, or August is no longer output. Next, the explanation will move on to FIG. 17.

Graphs 1701 to 1703 in FIG. 17 show that in the conventional privacy test, when k is fixed at the lowest value k2 and ε ⁰ is varied from 0.001 to 100, any value from January to December is This is an example of a graph of the number of anonymous data output based on personal data held. A graph 1701 in FIG. 17 corresponds to the case where ε ⁰ is set to 0.001. A graph 1702 in FIG. 17 corresponds to the case where ε ⁰ is set to 1. A graph 1703 in FIG. 17 corresponds to the case where ε ⁰ is set to 100.

As shown in graphs 1701 to 1703, when ε ⁰ is increased, the value of k becomes easier to estimate based on the number of output anonymous data. For example, when ε ⁰ = 100, only the number of anonymous data based on personal data with values in April has decreased by about 50%; , k becomes easy to estimate.

On the other hand, the generation device 100 can generate and output new anonymous data based on personal data determined to be NG by the privacy test. Therefore, the generation device 100 can make it difficult for bias to occur in the number of output anonymous data, and generate a histogram showing the characteristic distribution of a plurality of pieces of personal data and a characteristic distribution of a plurality of pieces of anonymous data to be output. The histogram can be brought closer. The generation device 100 can then obtain useful anonymous data. Furthermore, the generation device 100 can make it difficult for privacy test parameters to be estimated.

In this way, it is difficult to adjust the parameters k, γ, ε ⁰ of the conventional privacy test so as to balance the usefulness of anonymous data and the anonymity of personal data. In contrast, the generation device 100 can balance the usefulness of anonymous data and the anonymity of personal data without appropriately adjusting the parameters k, γ, ε ⁰ of the privacy test. .

The generation device 100 balances the usefulness of anonymous data and the anonymity of personal data even if the number of personal data determined to be NG increases due to the parameters k, γ, ε ⁰ of the privacy test. can do. As a result, the generation device 100 can make the quantity and ratio of the histogram showing the feature distribution of the plurality of personal data similar to the histogram showing the feature distribution of the plurality of output anonymous data, and Data anonymity can be ensured.

(Preparation procedure)
Next, an example of a preparation process procedure executed by the generation device 100 will be described using FIG. 18. The preparation process is realized by, for example, the CPU 401 shown in FIG. 4, a storage area such as the memory 402 or the recording medium 405, and the network I/F 403.

FIG. 18 is a flowchart illustrating an example of a preparation process procedure. In FIG. 18, first, the generation device 100 acquires the attribute of the object that makes the usefulness of the histogram constant (step S1801). The target attributes are set in advance by the user, for example. For example, the user sets the priority of attributes that make the usefulness of the histogram constant in the order of gender and height.

Next, the generation device 100 acquires the storage contents of the DB (step S1802). Then, the generation device 100 divides the storage contents of the DB for any attribute according to the priority (step S1803). For example, the generation device 100 divides the storage contents of the DB according to the gender, female and male, according to the priority.

Next, the generation device 100 saves each of the divided storage contents as DBn (step S1804). The generation device 100 then determines whether there are any unprocessed attributes (step S1805).

Here, if there is an unprocessed attribute (step S1805: Yes), the generation device 100 returns to the process of step S1802. On the other hand, if there are no unprocessed attributes (step S1805: No), the generation device 100 ends the preparation process.

(Test processing procedure)
Next, an example of a test processing procedure executed by the generation device 100 will be described using FIG. 19. The test process is realized by, for example, the CPU 401 shown in FIG. 4, a storage area such as the memory 402 or the recording medium 405, and the network I/F 403.

FIG. 19 is a flowchart illustrating an example of a test processing procedure. In FIG. 19, the generation device 100 acquires safety standards (step S1901). The security criteria includes, for example, privacy test parameters k, γ, ε ⁰ .

Next, the generation device 100 acquires the storage contents of DBn (step S1902). Then, the generation device 100 generates a mechanism M for generating data based on the storage contents of DBn (step S1903).

Mechanism M is an algorithm that generates data with guaranteed differential privacy. For example, the generation device 100 calculates the average and variance of the values included in each record r _i of the storage contents of DBn, and generates the mechanism M based on the calculated average and variance and the safety standard.

Next, the generation device 100 extracts any unprocessed record r _i from the storage contents of DBn and sets it as input to mechanism M (step S1904). Then, the generation device 100 generates a predetermined number of data M(r _i ) obtained by adding noise to the record r _i using the mechanism M (step S1905).

Next, the generation device 100 performs k randomization processing (step S1906). The generation device 100 performs randomization processing on k using a mechanism M' regarding k, for example. At this time, the generation device 100 may generate a plurality of randomized k's. Then, the generation device 100 obtains the randomized k' (step S1907).

Next, the generation device 100 performs a privacy test on the record r _i and determines whether it is OK (step S1908). At this time, the generation device 100 may determine that the result is NG with a certain probability. Here, if the result is NG (step S1908: No), the generation device 100 moves to the process of step S1910. On the other hand, if it is OK (step S1908: Yes), the generation device 100 moves to the process of step S1909.

In step S1909, the generation device 100 stores the data M(r _i ) in the RL-DB as a release data set (step S1909). RL-DB is a release DB. The generation device 100 then proceeds to the process of step S1911.

In step S1910, the generation device 100 stores the record r _i in the NG-DB (step S1910). The generation device 100 then proceeds to the process of step S1911.

In step S1911, the generation device 100 determines whether a predetermined number of records r _i have been extracted (step S1911). Here, if the predetermined number of samples have not been extracted (step S1911: No), the generation device 100 returns to the process of step S1904. On the other hand, if the predetermined number of samples have been extracted (step S1911: Yes), the generation device 100 ends the test process.

(Branch processing procedure)
Next, an example of a branch processing procedure executed by the generation device 100 will be described using FIG. 20. The branching process is realized by, for example, the CPU 401 shown in FIG. 4, a storage area such as the memory 402 or the recording medium 405, and the network I/F 403.

FIG. 20 is a flowchart illustrating an example of a branch processing procedure. In FIG. 20, the generation device 100 acquires safety standards (step S2001). The security criteria includes, for example, privacy test parameters k, γ, ε ⁰ .

Next, the generation device 100 acquires the storage contents of the RL-DB (step S2002). Then, the generation device 100 obtains the number of records in the storage contents of the RL-DB (step S2003).

Next, the generation device 100 determines whether the number of records is greater than or equal to the upper limit (step S2004). Here, if the number of records is greater than or equal to the upper limit (step S2004: Yes), the generation device 100 moves to the process of step S2005. On the other hand, if the number of records is less than the upper limit (step S2004: No), the generation device 100 moves to the process of step S2007.

In step S2005, the generation device 100 changes the PTOP of the privacy test option (step S2005). Next, the generation device 100 executes the test process shown in FIG. 19 again (step S2006). The generation device 100 then ends the branching process.

In step S2007, the generation device 100 determines whether the number of records is less than or equal to the lower limit (step S2007). Here, if the number of records is less than or equal to the lower limit (step S2007: Yes), the generation device 100 moves to the process of step S2008. On the other hand, if the number of records is greater than the lower limit (step S2007: No), the generation device 100 moves to the process of step S2009.

In step S2008, the generation device 100 changes the optional MAOP of the micro-aggregation (step S2008). The generation device 100 then proceeds to the process of step S2009.

In step S2009, the generation device 100 executes reuse processing, which will be described later in FIG. 21 (step S2009). The generation device 100 then ends the branching process.

(Reuse processing procedure)
Next, an example of a reuse processing procedure executed by the generation device 100 will be described using FIG. 21. The reuse process is realized by, for example, the CPU 401 shown in FIG. 4, storage areas such as the memory 402 and the recording medium 405, and the network I/F 403.

FIG. 21 is a flowchart illustrating an example of a reuse processing procedure. In FIG. 21, the generation device 100 acquires safety standards (step S2101). The security criteria includes, for example, privacy test parameters k, γ, ε ⁰ .

Next, the generation device 100 acquires the storage contents of the NG-DB (step S2102). The generation device 100 then obtains the MAOP and executes micro-aggregation processing on the storage contents of the NG-DB (step S2103).

Next, the generation device 100 extracts the k pieces of data from the top among the stored contents of the NG-DB (step S2104). Then, the generation device 100 generates a mechanism M _i for generating data based on the k pieces of extracted data (step S2105).

Mechanism M _i is an algorithm that generates data with guaranteed differential privacy. For example, the generation device 100 calculates the average and variance of the values included in the k pieces of extracted data, and generates the mechanism M _i based on the calculated average and variance and the safety standard.

Next, the generation device 100 averages the k pieces of data and stores it in the MA-DB as the i-th processing target (step S2106). Then, the generation device 100 determines whether all data stored in the NG-DB has been extracted (step S2107). Here, if unextracted data remains (step S2107: No), the generation device 100 returns to the process of step S2104. On the other hand, if all data has been extracted (step S2107: Yes), the generation device 100 moves to the process of step S2108.

In step S2108, the generation device 100 extracts the i-th record m _i,k to be processed from the storage contents of the MA-DB (step S2108). Next, the generation device 100 converts the record m _i , _k using the mechanism M i to generate a record M _i (m _i,k ) (step S2109). The generation device 100 then stores the generated record M _i (m _i,k ) in the RL-DB (step S2110).

Next, the generation device 100 determines whether all records of the storage contents of the MA-DB have been extracted (step S2111). Here, if unextracted records remain (step S2111: No), the generation device 100 returns to the process of step S2108. On the other hand, if all records have been extracted (step S2111: Yes), the generation device 100 ends the reuse process.

Here, the generation device 100 may perform the processing by changing the order of some of the steps in each of the flowcharts in FIGS. 18 to 21. For example, the order of the processing in steps S1904 and 1905 and the processing in steps S1906 and 1907 can be changed. Furthermore, the generation device 100 may omit some of the steps in each of the flowcharts in FIGS. 18 to 21. For example, the processing in steps S1801 to S1805 can be omitted.

As explained above, according to the generation device 100, the degree of anonymity among the plurality of personal data is determined based on the result of anonymizing the personal data included in the plurality of personal data using the first anonymization model. One or more pieces of personal data that do not meet the criteria can be identified. According to the generation device 100, the second anonymization model can be learned based on one or more pieces of identified personal data. According to the generation device 100, it is possible to generate one or more anonymous data having a higher degree of anonymity than each of the one or more pieces of personal data, based on the one or more pieces of identified personal data. According to the generation device 100, it is possible to output new anonymous data obtained by anonymizing each of the one or more generated anonymous data using the learned second anonymization model. Thereby, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of anonymous data and the anonymity of personal data.

According to the generation device 100, based on the result of anonymizing personal data included in a plurality of pieces of personal data using the first anonymization model, it is determined whether the degree of anonymity of the personal data satisfies a predetermined standard. can be determined. According to the generation device 100, when determining whether the degree of anonymity of personal data included in a plurality of pieces of personal data satisfies a predetermined standard, it can be determined with a predetermined probability that the degree of anonymity of personal data does not satisfy the predetermined standard. can. According to the generation device 100, one or more pieces of personal data can be specified based on the determined result. As a result, the generation device 100 can avoid a situation where the anonymity of personal data may be lost due to statistical analysis due to a small number of personal data determined not to meet a predetermined standard. Can be done.

According to the generation device 100, when personal data included in a plurality of pieces of personal data is anonymized using the first anonymization model, among the plurality of pieces of personal data that includes a value that is the same as or similar to the personal data, A number of other personal data can be calculated. According to the generation device 100, if the calculated number is less than or equal to a predetermined number, it can be determined that the predetermined criterion is not satisfied. Thereby, the generation device 100 can determine whether the anonymity of personal data is ensured.

According to the generation device 100, a variable value can be adopted as the predetermined number. Thereby, the generation device 100 can easily prevent membership inclusion attacks.

According to the generation device 100, a model that generates one or more anonymous data obtained by adding a random noise value to a value included in personal data can be adopted as the first anonymization model. According to the generation device 100, when personal data included in a plurality of pieces of personal data is anonymized using the first anonymization model, if the representative value of the added noise value is equal to or less than a predetermined threshold, a predetermined It can be determined that the criteria are not met. Thereby, the generation device 100 can determine whether the anonymity of personal data is ensured.

According to the generation device 100, one or more pieces of identified personal data can be divided into one or more clusters. According to the generation device 100, the second anonymization model corresponding to the cluster can be learned for each cluster based on the personal data divided into clusters. According to the generation device 100, it is possible to generate, for each cluster, anonymous data corresponding to the cluster and having a higher degree of anonymity than each of the personal data divided into clusters, based on the personal data divided into clusters. According to the generation device 100, for each cluster, new anonymous data obtained by anonymizing the anonymous data corresponding to the generated cluster using the second anonymization model corresponding to the learned cluster can be output. can. Thereby, the generation device 100 makes it easier to make the histogram showing the feature distribution of one or more new anonymous data obtained by anonymization using the second anonymization model similar to the histogram showing the feature distribution of a plurality of pieces of personal data. be able to.

According to the generation device 100, it is possible to calculate statistical values regarding values included in each of the identified one or more pieces of personal data. According to the generation device 100, it is possible to generate one or more anonymous data by replacing the value included in each of the identified one or more pieces of personal data with the calculated statistical value. Thereby, the generation device 100 can improve the anonymity of personal data.

According to the generation device 100, it is further possible to output anonymous data obtained by anonymizing personal data whose degree of anonymity satisfies a predetermined standard among a plurality of personal data using the first anonymization model. Thereby, the generation device 100 can make useful anonymous data available to the user.

According to the generation device 100, a model that generates one or more new anonymous data obtained by adding a random noise value to a value included in the anonymous data can be adopted as the second anonymization model. . Thereby, the generation device 100 can employ the second anonymization model that can improve the anonymity of personal data.

According to the generation device 100, the range of noise values used in the second anonymization model is determined based on the variance and average regarding the values included in each of the identified one or more pieces of personal data, and the range of noise values used in the second anonymization model is determined. can learn anonymized models. Thereby, the generation device 100 makes it easier to make the histogram showing the feature distribution of one or more new anonymous data obtained by anonymization using the second anonymization model similar to the histogram showing the feature distribution of a plurality of pieces of personal data. be able to.

Note that the generation method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a PC or a workstation. The generation program described in this embodiment is recorded on a computer-readable recording medium, and executed by being read from the recording medium by the computer. The recording medium includes a hard disk, a flexible disk, a CD (Compact Disc)-ROM, an MO (Magneto Optical disc), a DVD (Digital Versatile Disc), and the like. Furthermore, the generation program described in this embodiment may be distributed via a network such as the Internet.

Regarding the embodiments described above, the following additional notes are further disclosed.

(Additional note 1) Based on the results of anonymizing personal data included in a plurality of personal data using the first anonymization model that anonymizes information, it is determined that among the plurality of personal data, the degree of anonymity meets a predetermined standard. Identify one or more pieces of personal data that do not meet the requirements,
learning a second anonymization model that anonymizes information based on the one or more identified personal data;
Based on the identified one or more pieces of personal data, generate one or more anonymous data having a higher degree of anonymity than each of the one or more pieces of personal data;
outputting new anonymous data obtained by anonymizing each of the one or more generated anonymous data using the learned second anonymization model;
A generation method characterized in that processing is performed by a computer.

(Additional note 2) Based on the result of anonymizing personal data included in the plurality of personal data using the first anonymization model, determine whether the degree of anonymity of the personal data satisfies the predetermined criteria. judge,
the computer executes the process;
The determining process is as follows:
In determining whether the degree of anonymity of the personal data satisfies the predetermined standard based on the result of anonymizing the personal data included in the plurality of personal data using the first anonymization model, Determining that the predetermined criterion is not met with a predetermined probability,
The identifying process is
The generation method according to appendix 1, characterized in that the one or more pieces of personal data are specified based on the determined result.

(Additional note 3) The above-mentioned determining process is
When the personal data included in the plurality of personal data is anonymized by the first anonymization model, other personal data among the plurality of personal data that includes the same or similar value as the personal data concerned. If the number of is less than or equal to a predetermined number, it is determined that the predetermined criterion is not satisfied.

(Supplementary note 4) The generation method according to supplementary note 3, wherein the predetermined number is a variable value.

(Additional Note 5) The first anonymization model is a model that generates one or more anonymous data obtained by adding a random noise value to the value included in the personal data,
The determining process is as follows:
When the personal data included in the plurality of personal data is anonymized by the first anonymization model, if the representative value of the added noise value is equal to or less than a predetermined threshold, the predetermined criterion is not satisfied. The generation method according to any one of appendices 2 to 4, characterized in that the generation method is determined as follows.

(Additional Note 6) Divide the identified one or more pieces of personal data into one or more clusters,
the computer executes the process;
The process to learn is
learning the second anonymization model corresponding to the cluster based on the personal data divided into the clusters for each cluster;
The process to generate the
For each cluster, based on the personal data divided into the clusters, generate anonymous data corresponding to the cluster, which has a higher degree of anonymity than each of the personal data divided into the clusters,
The output process is as follows:
For each cluster, new anonymous data obtained by anonymizing the anonymous data corresponding to the generated cluster by the second anonymization model corresponding to the learned cluster is output. The generation method described in any one of Supplementary Notes 1 to 5.

(Additional Note 7) Calculating statistical values regarding the values included in each of the one or more pieces of personal data identified;
the computer executes the process;
The process to generate the
Any one of appendices 1 to 6, characterized in that the value included in each of the identified one or more pieces of personal data is replaced with the calculated statistical value to generate one or more anonymous data. Generation method described in.

(Additional Note 8) The output process is
Furthermore, among the plurality of personal data, personal data whose degree of anonymity satisfies the predetermined standard is anonymized using the first anonymization model, and the obtained anonymous data is output. 7. The production method according to any one of 7.

(Additional Note 9) The second anonymization model is a model that generates one or more new anonymous data obtained by adding a random noise value to the value included in the anonymous data. The production method described in any one of Supplementary Notes 1 to 7.

(Additional Note 10) The process to be learned is
A noise value range to be used in the second anonymization model is determined based on the variance and average of the values included in each of the one or more pieces of personal data that has been identified, and the second anonymization model The generation method according to appendix 9, characterized in that the generation method learns.

(Additional note 11) Based on the results of anonymizing personal data included in a plurality of personal data using the first anonymization model that anonymizes information, it is determined that among the plurality of personal data, the degree of anonymity meets a predetermined standard. Identify one or more pieces of personal data that do not meet the requirements,
learning a second anonymization model that anonymizes information based on the one or more identified personal data;
Based on the identified one or more pieces of personal data, generate one or more anonymous data having a higher degree of anonymity than each of the one or more pieces of personal data;
outputting new anonymous data obtained by anonymizing each of the one or more generated anonymous data using the learned second anonymization model;
A generation program that causes a computer to perform processing.

(Additional note 12) Based on the results of anonymizing personal data included in a plurality of personal data using the first anonymization model that anonymizes information, it is determined that among the plurality of personal data, the degree of anonymity meets a predetermined standard. Identify one or more pieces of personal data that do not meet the requirements,
learning a second anonymization model that anonymizes information based on the one or more identified personal data;
Based on the identified one or more pieces of personal data, generate one or more anonymous data having a higher degree of anonymity than each of the one or more pieces of personal data;
outputting new anonymous data obtained by anonymizing each of the one or more generated anonymous data using the learned second anonymization model;
A generation device characterized by having a control section.

100 Generation device 102,750,830,930 NG-DB
103,760,840,950 MA-DB
104,740,781,820,861,920,981 Release DB
110 First anonymization model 120 Second anonymization model 300 Data utilization system 301 Data provider device 302 Data user device 310 Network 400 Bus 401 CPU
402 Memory 403 Network I/F
404 Recording medium I/F
405 recording medium 500 data management table 600 storage unit 601 acquisition unit 602 first anonymization unit 603 determination unit 604 identification unit 605 learning unit 606 generation unit 607 second anonymization unit 608 output unit 701, 711, 751, 801, 831,842,940-942 Personal data group 702,703 Cluster 710,720,780,800,860,900,980 DB
730,770,810,850,910,971,972 Generative model 761,771,841,851,960-962 Anonymous data group 1001,1002 Release data set 1100,1300 Table 1200,1400,1500,1601-1603,1701 ~1703 Graph

Claims (8)

Based on the results of anonymizing personal data included in a plurality of pieces of personal data using the first anonymization model that anonymizes information, one or more pieces of personal data whose degree of anonymity does not meet a predetermined standard are determined. identify the personal data of
learning a second anonymization model that anonymizes information based on the one or more identified personal data;
Based on the identified one or more pieces of personal data, generate one or more anonymous data having a higher degree of anonymity than each of the one or more pieces of personal data;
outputting new anonymous data obtained by anonymizing each of the one or more generated anonymous data using the learned second anonymization model;
A generation method characterized in that processing is performed by a computer. Determining whether the degree of anonymity of the personal data satisfies the predetermined criterion based on the result of anonymizing the personal data included in the plurality of personal data using the first anonymization model;
the computer executes the process;
The determining process is as follows:
In determining whether the degree of anonymity of the personal data satisfies the predetermined standard based on the result of anonymizing the personal data included in the plurality of personal data using the first anonymization model, Determining that the predetermined criterion is not met with a predetermined probability,
The identifying process is
2. The generation method according to claim 1, further comprising identifying the one or more pieces of personal data based on the determined result. The determining process is as follows:
When the personal data included in the plurality of personal data is anonymized by the first anonymization model, other personal data among the plurality of personal data that includes the same or similar value as the personal data concerned. 3. The generation method according to claim 2, further comprising determining that the predetermined criterion is not satisfied if the number of the predetermined criteria is less than or equal to a predetermined number. The first anonymization model is a model that generates one or more anonymous data obtained by adding a random noise value to a value included in the personal data,
The determining process is as follows:
When the personal data included in the plurality of personal data is anonymized by the first anonymization model, if the representative value of the added noise value is equal to or less than a predetermined threshold, the predetermined criterion is not satisfied. The generation method according to claim 2 or 3, characterized in that it is determined that: dividing the identified one or more pieces of personal data into one or more clusters;
the computer executes the process;
The process to learn is
learning the second anonymization model corresponding to the cluster based on the personal data divided into the clusters for each cluster;
The process to generate the
For each cluster, based on the personal data divided into the clusters, generate anonymous data corresponding to the cluster, which has a higher degree of anonymity than each of the personal data divided into the clusters,
The output process is as follows:
For each cluster, new anonymous data obtained by anonymizing the anonymous data corresponding to the generated cluster by the second anonymization model corresponding to the learned cluster is output. The production method according to any one of claims 1 to 4, wherein: calculating statistical values regarding the values included in each of the one or more pieces of personal data identified;
the computer executes the process;
The process to generate the
Any one of claims 1 to 5, characterized in that the value included in each of the identified one or more pieces of personal data is replaced with the calculated statistical value to generate one or more pieces of anonymous data. The generation method described in one. Based on the results of anonymizing personal data included in a plurality of pieces of personal data using the first anonymization model that anonymizes information, one or more pieces of personal data whose degree of anonymity does not meet a predetermined standard are determined. identify the personal data of
learning a second anonymization model that anonymizes information based on the one or more identified personal data;
Based on the identified one or more pieces of personal data, generate one or more anonymous data having a higher degree of anonymity than each of the one or more pieces of personal data;
outputting new anonymous data obtained by anonymizing each of the one or more generated anonymous data using the learned second anonymization model;
A generation program that causes a computer to perform processing. Based on the results of anonymizing personal data included in a plurality of pieces of personal data using the first anonymization model that anonymizes information, one or more pieces of personal data whose degree of anonymity does not meet a predetermined standard are determined. identify the personal data of
learning a second anonymization model that anonymizes information based on the one or more identified personal data;
Based on the identified one or more pieces of personal data, generate one or more anonymous data having a higher degree of anonymity than each of the one or more pieces of personal data;
outputting new anonymous data obtained by anonymizing each of the one or more generated anonymous data using the learned second anonymization model;
A generation device characterized by having a control section.

Images