JP7788354B2 - Information processing device, information processing method, and information processing program - Google Patents

Description

The present invention relates to an information processing device, an information processing method, and an information processing program.

In recent years, there has been research into anonymizing personal information, such as data from users of online services, to prevent the identification of specific individuals, and then using this information for data analysis by third parties. For example, Patent Document 1 proposes technology for protecting personal information using differential privacy.

International Publication No. 2018/116366

However, even if information about users who use the services of one organization (e.g., a company or a local government) is useful for improving the services provided by other organizations, there is still room for improvement in terms of the provision of personal information, as this could, for example, undermine fair competition between organizations.

This application has been made in light of the above, and aims to provide an information processing device, information processing method, and information processing program that can more appropriately provide personal information.

The information processing device according to the present application includes a provision request receiving unit, a determination unit, an anonymization unit, and a providing unit. The provision request receiving unit receives a request to provide data. The determination unit determines whether the provision candidate data, which is data specified in the provision request received by the provision request receiving unit, is data linked to an organization that has a predetermined relationship with the requester of the provision request. When the determination unit determines that the provision candidate data is data linked to an organization that has a predetermined relationship with the requester, the anonymization unit anonymizes the provision candidate data to generate anonymously processed data. The providing unit provides data in response to the provision request based on the anonymously processed data generated by the anonymization unit.

According to one aspect of the embodiment, personal information can be provided more appropriately.

FIG. 1 is a diagram illustrating an example of information processing according to an embodiment. FIG. 2 is a diagram illustrating an example of a configuration of an information providing system according to the embodiment. FIG. 3 is a diagram illustrating an example of the configuration of the information processing apparatus according to the embodiment. FIG. 4 is a diagram illustrating an example of an organization information table stored in the organization information storage unit of the information processing apparatus according to the embodiment. FIG. 5 is a diagram illustrating an example of a service log table stored in the service log storage unit of the information processing apparatus according to the embodiment. FIG. 6 is a flowchart illustrating an example of information processing executed by the processing unit of the information processing device. FIG. 7 is a flowchart showing an example of anonymization processing executed by the processing unit of the information processing device. FIG. 8 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of the information processing apparatus according to the embodiment.

Below, detailed explanations will be given of the information processing device, information processing method, and information processing program (hereinafter referred to as "embodiments") according to the present application, with reference to the drawings. Note that the information processing device, information processing method, and information processing program according to the present application are not limited to these embodiments. Furthermore, the embodiments can be combined as appropriate to the extent that the processing content is not contradictory. Furthermore, the same components in the following embodiments will be assigned the same reference numerals, and redundant explanations will be omitted.

[1. An example of information processing]
First, an example of information processing according to the embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram illustrating an example of information processing according to the embodiment.

The information processing device 1 shown in Figure 1 collects data on multiple users U from each of multiple organizations (e.g., companies, local governments, etc.) and anonymizes the collected data on multiple users U so that the data on individual users U cannot be identified.

The information processing device 1 then generates target data for use from the anonymized data and provides the target data for use. This target data for use is data that is to be used by data users, and can be used for data analysis, for example.

1, each of the servers 3 ₁ to 3 _m provides an online service to a user U of the terminal device 2 (steps S1 ₁ to S1 _m ), where m is an integer equal to or greater than 2. Each of the servers 3 ₁ to 3 _m is, for example, a server that provides an online service provided by a different organization.

If the organization is a business, the online services provided by the organization may be, for example, online services such as shopping sites, news sites, auction sites, flea market sites, weather forecast sites, and finance (stock price) sites. Furthermore, the online services provided by a business may also be, for example, online services such as search sites, map sites, travel sites, restaurant introduction sites, blog sites, and SNS sites.

If the organization is a local government, the online services provided by the organization are administrative services, such as electronic applications, electronic bidding, electronic tax returns, electronic tax payments, reservations for public facilities, book lending reservations, and the provision of various information related to administrative services.

Each of the servers 3 ₁ to 3 _m inquires of the user U about whether or not the personal information can be used, and receives a response from the user U about whether or not the personal information can be used (steps S2 ₁ to S2 _m ). The personal information is user information including, for example, the user U's usage history of the online services provided by each of the servers 3 ₁ to 3 _m , the user U's attribute information, and the like.

The inquiry regarding whether or not personal information can be used is an inquiry as to whether to deny use of the personal information or to conditionally approve use of the personal information, and the conditional approval includes at least one of the conditions of use for each user U and the conditions of use for each data. Each of the conditions of use for each user U and the conditions of use for each data is indicated by the level of protection of personal information when the data is used, and is determined by each user U.

For example, each usage condition is selected by the user U from a plurality of protection levels AL ₁ , AL ₂ , ..., AL _n . Of the protection levels AL ₁ , AL ₂ , ..., AL _n , protection level AL ₁ provides the lowest level of protection for personal information, protection level AL ₂ provides the next lowest level of protection for personal information after protection level AL ₁ , and protection level AL _n provides the highest level of protection for personal information. Hereinafter, the protection level selected by the user U from protection levels AL ₁ , AL ₂ , ..., AL _n may be referred to as selected protection level SAL. Furthermore, when referring to each of the protection levels AL ₁ , AL ₂ , ..., AL _n without distinguishing them individually, they may be referred to as protection level AL.

If user U, who conditionally consents to the use of his or her personal information, does not select the above-mentioned conditions of use, the information processing device 1 can also determine the conditions of use based on information about user U. For example, the information processing device 1 can determine the conditions of use using a protection level determination model that inputs information about user U and outputs a score for each protection level.

In this case, the information processing device 1 inputs user U, who does not select any usage conditions, into the protection level determination model, and determines the protection level with the highest score among the scores for each protection level output from the protection level determination model as the protection level for user U, who does not select any usage conditions.

The information processing device 1 can generate a protection level determination model through machine learning, for example, using a dataset including information about user U and the protection level selected by user U as learning data.

The protection level determination model may be, for example, a learning model generated by a Gradient Boosting Decision Tree (GBDT) or a learning model generated by deep learning using a deep neural network (DNN), but is not limited to these examples and may also be a learning model generated by other machine learning methods.

Each of the servers 3 ₁ to 3 _m transmits information to the information processing device 1 (steps S3 ₁ to S3 _m ). The information transmitted from each of the servers 3 ₁ to 3 _m includes service log data of the online service and information indicating whether the service log data of the online service is available for use. Note that the information transmitted from each of the servers 3 ₁ to 3 _m may include provider organization information indicating the organization that provides the online service, authorized organization information indicating the organization that is authorized to use the service log data, etc.

The service log data of the online service is usage log data of the online service provided by each of the servers _3-1 to 3- _m , and includes, for example, information on the usage history of the online service by the user U and registration information of the user U. Hereinafter, the service log data of the online service may be referred to as service log data or service log. The service log data is an example of provided data.

The registration information of the user U includes, for example, attribute information and protection level information of the user U. The protection level information includes information indicating a selected protection level SAL, which is a protection level selected by the user U from a plurality of protection levels AL ₁ , AL ₂ , ..., AL _n .

The service log data included in the information transmitted from servers 3 ₁ to 3 _m to information processing device 1 does not include data for which user U has refused to use his/her personal information. In other words, each of servers 3 ₁ to 3 _m includes data of multiple users U who use online services, for which user U has conditionally permitted to use their personal information, but does not include data for which user U has refused to use their personal information. The data for which user U has refused to use their personal information is data for which use has been refused on a user U-by-user U basis or on a data-by-data basis.

In addition, the information indicating whether the service log data can be used includes either denial information that denies the use of the service log data or permission information that permits the use of the service log data. The information indicating whether the service log data can be used is, for example, information set by the organization that provides the online service.

The information processing device 1 receives the information transmitted from each of the servers 3 ₁ to 3 _m , and stores the received information from each of the servers 3 ₁ to 3 _m in association with the corresponding organization (step S4). Hereinafter, when each of the servers 3 ₁ to 3 _m is referred to without distinction, it may be referred to as server 3, and when each of the steps S3 ₁ to S3 _m is referred to without distinction, it may be referred to as step S3.

In step S4, the information processing device 1 associates the service log data sent from each server 3 with an organization among multiple organizations that satisfies the association conditions, and stores the associated data. An organization that satisfies the association conditions is, for example, an organization that provides online services or an organization that provided the service log data.

For example, if the server 3 ₁ is a server managed by an organization that provides online services, the information processing device 1 associates the service log data sent from the server 3 ₁ with the organization that manages the server 3 ₁ .

Furthermore, for example, when server 3 _m is a server that provides online services for an organization different from the organization that manages server 3 _m , the information processing device 1 links the service log data transmitted from server 3 _m to the organization to which the online services are provided by server 3 _m .

If the information transmitted from the server 3 in step S3 includes providing organization information indicating an organization that provides online services, the information processing device 1 can determine that the organization indicated in the providing organization information is an organization that satisfies the linking conditions.

An organization that satisfies the linking conditions may also be an organization for which the score output from the relevance estimation model satisfies a preset condition. The relevance estimation model is, for example, a learning model that takes service log data as input and outputs a score indicating the relevance of each organization with the source of the service log data request.

The relevance estimation model is generated by using service log data that has been determined in advance to be relevant to each organization as the correct answer data for each organization and having the model learn the characteristics of the correct answer data for each organization. The relevance estimation model is a learning model common to multiple organizations, but it may also be a learning model for each organization.

The information processing device 1 inputs the service log data into the relevance estimation model, and identifies organizations whose scores satisfy predetermined conditions among the scores for each organization output from the relevance estimation model as organizations whose scores output from the relevance estimation model satisfy the preset conditions. The score that satisfies the predetermined conditions is, for example, the highest score, but it may also be, for example, a score above a threshold. If there are multiple organizations with scores above the threshold, the information processing device 1 can link the service log data to multiple organizations.

The relevance estimation model may be, for example, a learning model generated by GBDT or a learning model generated by deep learning using a deep neural network, but is not limited to these examples and may also be a learning model generated by other machine learning methods.

For example, the relevance estimation model may be generated using machine learning with other learning algorithms, such as regression methods such as linear regression, multiple regression, or logistic regression, or learning algorithms such as support vector machines.

For example, the information processing device 1 can store service log data that has been disabled without linking it to an organization. The information processing device 1 can determine whether the service log data has been disabled based on information indicating whether the service log data is available, which is included in the information sent from the server 3.

Next, the information processing device 1 accepts a query from the requester device 4 as a request to provide data (step S5). The query from the requester device 4 includes, for example, data identification information for identifying the data to be used or the data to be processed, and organization identification information such as the organization ID (identifier) of the requesting organization. The requesting organization is, for example, the organization to which the operator operating the requester device 4 belongs, or the organization that has requested an analysis from the organization to which the operator belongs.

Data identification information includes target organization information and processing target information. Target organization information includes the organization ID of the target organization, which is the organization that owns the data to be used. For example, if the data that the requesting organization wants to analyze is service log data for an online service provided by organization B, the organization ID of the target organization is the organization ID of organization B.

The processing target information includes data type information indicating the type of processing target data, which is the data to be processed, and processing content information indicating the processing content of the processing target data. Data type information includes, for example, information indicating the location of the user U who used the online service, information indicating the type of usage history of the online service by the user, information indicating the type of attributes of the user, and information indicating the type of input information and output information of the learning model.

The information indicating the user's location is, for example, information indicating the location detected by a location detection unit (not shown) provided in the terminal device 2, and is information transmitted from the terminal device 2 to the server 3 when the user uses an online service.

The online service usage history includes the date and time of use of the online service and the content of use of the online service. For example, if the online service is a shopping site service, the content of use of the online service includes the content viewed by the user of the transaction target, the content purchased by the user of the transaction target, the content rated by the user of the transaction target, and the content added to favorites by the user of the transaction target.

For example, if the online service is a government service, the usage content of the online service may include the content of electronic applications submitted by users, the content of electronic bidding submitted by users, the content of electronic tax returns submitted by users, the content of public facility reservations submitted by users, the content of book lending reservations submitted by users, and the viewing of various information by users.

User U's attributes are at least one of demographic attributes and psychographic attributes. Demographic attributes are demographic attributes, such as age, gender, occupation, place of residence, annual income, and family composition. Psychographic attributes are psychological attributes, such as lifestyle, values, and interests.

The processing content information includes, for example, information indicating the type of statistical calculation, such as average, sum, or variance, or the type of calculation to generate parameters for a learning model. The processing content specified by the processing target information includes, for example, calculation of the average annual income of men in their twenties in Kyoto Prefecture, the average variance of people who like motorcycles, or the total number of users U who have made electronic tax payments, or generation of a learning model that takes information indicating the location and attributes of user U as input and outputs a score indicating the likelihood of user U using online services.

Next, the information processing device 1 determines whether the candidate data to be provided, which is data identified by the query received in step S5, is data linked to a specific related organization (step S6). A specific related organization is an organization that has a predetermined relationship with the requester of the provision request. The requester of the provision request is the organization whose organization ID is indicated by the organization identification information included in the query.

For example, if the target organization indicated by the organization ID included in the target organization information is an organization that is in a predetermined competitive relationship with the requester of the provision request, the information processing device 1 determines that the data to be provided is data of a specific related organization. For example, the information processing device 1 has a relationship table that includes, for each organization, information indicating organizations that are in a predetermined competitive relationship, and uses this relationship table to determine whether the data to be provided is data of a specific related organization.

If the information transmitted from the server 3 in step S3 includes permitted organization information indicating an organization that is permitted to use the service log data, the information processing device 1 can also determine that the organization indicated in the permitted organization information is an organization in a predetermined competitive relationship.

The information processing device 1 can also use information about competing organizations as correct answer data and use a related organization estimation model that has learned the characteristics of the correct answer data for competing organizations to estimate whether an organization is in a competitive relationship. The related organization estimation model is a learning model for each organization that has requested the provision request. In this case, the information processing device 1 inputs information about each organization into the related organization estimation model for the organization that has requested the provision request, and determines that an organization whose score output from the related organization estimation model is equal to or greater than a threshold is a competing organization.

In the above example, a specifically related organization is described as an organization that is in a predetermined competitive relationship with the requester of the provision request, but this example is not limited to this. For example, the information processing device 1 can also determine that an organization that is not in a predetermined competitive relationship with the requester of the provision request is a specifically related organization.

For example, the information processing device 1 has a relationship table that contains, for each organization, information indicating organizations that are not in a predetermined competitive relationship, and uses this relationship table to determine specific related organizations.

In addition, the information processing device 1 can, for example, use information about non-competitive organizations as correct data and determine specific related organizations using a related organization estimation model that has learned the characteristics of the correct data about non-competitive organizations.

Next, if the information processing device 1 determines that the candidate data to be provided is data linked to a specific related organization, it identifies the type of data linked to the specific related organization and corresponding to the query received in step S5 (step S7).

As described above, the query received in step S5 includes processing target information, and the information processing device 1 identifies the type of target data, which is data corresponding to the query, based on the data type information included in the processing target information. For example, if the data type information is information indicating the annual income of men in their twenties living in Kyoto Prefecture, the information processing device 1 identifies the annual income of men in their twenties living in Kyoto Prefecture as the type of target data.

Furthermore, when the data type information includes information indicating the types of input information and output information of the learning model, the information processing device 1 identifies the types of input information and output information of the learning model as the types of target data. The input information is, for example, information indicating the location and attributes of user U, and the output information is, for example, information indicating the content of user U's use of online services, but these examples are not limited to these.

In addition, in the processing of step S7, the information processing device 1 can also accept data specification so that the number of target data or the number of users U who are the source of the target data is greater than or equal to a threshold. For example, the information processing device 1 can send to the requester device 4 a list of attributes for which the number of target data or the number of users U who are the source of the target data is greater than or equal to a threshold, thereby allowing the operator to select an attribute from the list of attributes.

Next, the information processing device 1 anonymizes the data linked to the specific related organization and of the type identified in step S7 (step S8).

For example, suppose the specific related organization is organization B, and the type identified in step S7 is a specific attribute of user U. In this case, the information processing device 1 performs anonymization on data of the specific attribute from the service log data of organization B. For example, if the type identified in step S7 is the annual income of men in their twenties living in Kyoto Prefecture, the information processing device 1 performs anonymization on the annual incomes of multiple users U who are men in their twenties living in Kyoto Prefecture, using the data as the specific attribute. Hereinafter, data linked to the specific related organization and of the type identified in step S7 will be referred to as data to be anonymized. The data to be anonymized includes multiple pieces of data of the type identified in step S7, and can also be considered a group of data to be anonymized.

In step S8, the information processing device 1 first classifies each piece of data included in the data to be anonymized into groups according to the usage conditions set by the user U. The data included in the data to be anonymized is data whose use has been permitted by the user U.

For example, assume that the usage conditions set by a user U are indicated by a protection level selected by the user U from a plurality of protection levels AL ₁ , AL ₂ , ..., AL _n . In this case, the information processing device 1 classifies data included in the data to be anonymized into a plurality of groups G ₁ , G ₂ , ..., G _n corresponding to the plurality of protection levels AL ₁ , AL ₂ , ..., AL _n .

For example, data for which usage conditions indicated by protection level AL ₁ are set is classified into group G ₁ , data for which usage conditions indicated by protection level AL ₂ are set is classified into group G ₂ , and data for which usage conditions indicated by protection level AL _n are set is classified into group G _n . Hereinafter, when each of the multiple groups G ₁ , G ₂ , ..., G _n is referred to without being individually distinguished, they may be referred to as group G.

The information processing device 1 classifies each piece of data included in the data to be anonymized into a group G according to the conditions of use set by the user U, and then generates, for each group G, noise-added data by adding noise appropriate to the group G to the data (e.g., statistical quantities such as average, sum, and variance) of calculations based on a user data group including multiple pieces of data classified into the same group G, or a noise-added data group by adding noise appropriate to the group G to the user data group.

The information processing device 1 generates noise-added data or a group of noise-added data using anonymization processing based on differential privacy or k-anonymization. First, we will explain anonymization processing based on differential privacy, and then we will explain anonymization processing based on k-anonymization.

The information processing device 1 calculates the calculation result data for each group G from the user data set for each group G based on the processing content indicated in the processing content information included in the query. The processing content indicated in the processing content information includes, for example, statistical calculations such as average, sum, and variance for specific data, and generation of learning model parameters.

For example, suppose the processing content indicated by the processing content information is the average annual income of user U. In this case, the information processing device 1 calculates data indicating the average annual income of user U for each group G as the calculation result data for each group G.

Also, assume that the processing content indicated by the processing content information is the age distribution of users U. In this case, the information processing device 1 calculates data indicating the distribution or variance of the ages of users U for each group G as data of the calculation results for each group G.

Also, assume that the processing content indicated by the processing content information is the generation of parameters for a learning model. In this case, the information processing device 1 calculates, for each group G, data indicating the average value of multiple gradients resulting from training data samples when optimizing the learning model using stochastic gradient descent.

In addition to the processing content indicated by the processing content information, the information processing device 1 also calculates, as calculation result data, data indicating the number (total) of users U for each group G and data indicating the variance for each group G subject to statistical processing. Hereinafter, the number of users U may be referred to as the number of users.

Then, the information processing device 1 generates noise-added data for each group G by adding noise according to the group G to the data of the calculation results for each group G. For example, it is assumed that data included in the data to be anonymized is classified into a plurality of groups G ₁ , G ₂ , ..., G _n corresponding to a plurality of protection levels AL ₁ , AL ₂ , ..., AL _n .

In this case, the information processing device 1 adds noise of increasing noise level to the data resulting from the calculation in the order of groups G ₁ , G ₂ , ..., G _n . In this way, the noise-added data is generated for each group G, with the noise added to a higher level for groups G according to usage conditions with a higher data protection level AL.

Noise may be, for example, fixed noise, Gaussian noise, or Laplace noise. If the noise added to the calculation result data is fixed noise, the information processing device 1 increases the value of the fixed noise as the noise level increases.

Furthermore, when the noise added to the calculation result data is Gaussian noise, the information processing device 1 can increase the noise level by increasing the absolute value of the average value of the noise or by increasing the standard deviation of the noise.Furthermore, when the noise added to the calculation result data is Laplace noise, the information processing device 1 can increase the noise level by increasing the absolute value of the average value of the noise or by increasing the standard deviation of the noise.

In this way, in the anonymization process using differential privacy, the information processing device 1 generates noise-added data for each group G by adding noise appropriate to the group G to the data resulting from the calculation for each group G.

Next, we will explain anonymization using k-anonymization in the information processing device 1. K-anonymization is a technology that makes it difficult to identify an individual by reducing the probability of identifying the individual to 1 in k or less. For example, noise is added to the data to be anonymized so that there are k or more users U with the same combination of quasi-identifiers included in the data of user U.

A combination of quasi-identifiers is a combination of attribute items such as age, gender, date of birth, and place of residence (or location). The information processing device 1 performs anonymization by, for example, performing suppression processing to add noise by converting a certain attribute item into an asterisk (*) or by performing generalization processing to add noise by raising the hierarchy of the attribute item. For example, if the attribute item is place of residence (or location), generalization processing would change "Chiyoda-ku, Tokyo" to "Tokyo."

The information processing device 1 can also add noise using top coding, which groups values above a certain threshold into one category, or bottom coding, which groups values below a certain threshold into one category. Top coding is a process in which, for example, if the attribute item is age, values such as "80 years old," "81 years old," and "92 years old" are reclassified as "80 years old or older." Bottom coding is a process in which, for example, if the attribute item is age, values such as "0 years old," "1 year old," and "3 years old" are reclassified as "under 3 years old."

The information processing device 1 generates noise-added data groups for each group G, with noise added at higher levels for user data groups in the group G according to usage conditions with higher data protection levels AL. For example, the information processing device 1 increases the addition amount, which is the amount of data to be added as noise, or increases the change amount, which is the amount of data to be changed as noise, for groups G with higher data protection levels AL.

In the generalization process, the information processing device 1 can increase the noise level, for example, by increasing the generalization level. The generalization level is higher at the second hierarchical level than at the first hierarchical level, and higher at the third hierarchical level than at the second hierarchical level.

In addition, the information processing device 1 can increase the noise level by, for example, increasing the number of attribute items that are converted to asterisks "*" during suppression processing. Furthermore, the information processing device 1 can increase the noise level by decreasing the threshold when grouping values above a certain threshold into one category. Furthermore, the information processing device 1 can increase the noise level by increasing the threshold when grouping values below a certain threshold into one category.

For example, suppose that each user U is classified into a group G according to a selected protection level SAL, which is a protection level selected by the user U from among protection levels AL ₁ to AL _n . In this case, the information processing device 1 adds noise at a higher noise level to groups G with higher data protection levels AL.

The information processing device 1 can also perform a dummy addition process to add dummy data to the user data group for each group G, the number or content of which corresponds to the usage conditions for which the data protection level AL is high. The dummy data may, for example, be the same as the data contained in the user data group for each group G, or may be data obtained by processing the data contained in the user data group. The dummy data may also be data generated randomly or according to predetermined rules.

For example, the higher the data protection level AL, the more dummy data the information processing device 1 can add, or use data that has been highly modified from data included in the user data group as dummy data.

The information processing device 1 can also add dummy data to the user data group so that the overall trend of each group G does not change. For example, the information processing device 1 adds dummy data to the user data group so that the results of calculations based on the user data group (e.g., statistical quantities such as averages, sums, and variances) before and after adding the dummy data are within a threshold range, so that the overall trend of each group G does not change.

The information processing device 1 can also add noise to a group of user data using a different noise addition method for each protection level AL. Noise addition methods include, for example, suppression processing, generalization processing, and dummy addition processing, and suppression processing also includes noise addition methods such as conversion to asterisks (*), top coating, and bottom coating. Note that the noise addition methods are not limited to the examples described above.

In this way, in the anonymization process using k-anonymization, the information processing device 1 generates a noise-added data group for each group G by adding noise appropriate to the group G to the user data group for each group G.

Next, the information processing device 1 generates data to be used based on the noise-added data for each group G or the group of noise-added data for each group G generated by anonymization in step S8 (step S9).

First, we will explain the case where noise-added data for each group G is generated by anonymization in step S8. In this case, the information processing device 1 generates the data to be used by weighting and adding the noise-added data for each group G. The weighting may be a weight corresponding to the value obtained by adding noise to the number of users included in the user data group for each group G, or a weight corresponding to the value obtained by dividing the value obtained by adding noise to the number of users included in the user data group for each group G by the value obtained by adding noise to the variance for each group G.

For example, let _Ms1 , _Ms2 , ..., _Msn be the calculation results for groups _G1 , _G2 , ..., _Gn , let _Mn1 , _Mn2 , ..., _Mnn be the noises for groups _G1 , _G2 , ..., _Gn , and let _k1 , _k2 , ..., _kn be the weights for groups _G1 , G2, ..., _{Gn .}

In this case, the information processing device 1 can calculate the value Da expressed by the following formula (1) as the value of the use target data.
Da=k ₁ (Ms ₁ +Mn ₁ )+k ₂ (Ms ₂ +Mn ₂ )+...
+k _n・(Ms _n +Mn _n ) ... (1)

Here, the numbers of noise-added users in groups _G1 , _G2 , ..., _Gn are denoted as _Ng1 , _Ng2 , ..., _Ngn , and the total number of noise-added users _Ng1 , _Ng2 , ..., _Ngn is denoted as Nt. The numbers of noise-added users _Ng1 , _Ng2 , ..., _Ngn are the numbers of users included in the user data group of groups _G1 , _G2 , ..., _Gn with noise added according to group G, and are generated by the same noise addition process as for the noise-added data described above.

In this case, the weights _k1 , _k2 , ..., _kn are expressed as the number of users _Ng1 /Nt, _Ng2 /Nt, ..., _Ngn /Nt, i.e., _k1 = _Ng1 /Nt, _k2 = _Ng2 /Nt, ..., _kn = _Ngn /Nt.

In this way, the information processing device 1 can generate the data to be used by weighting and adding the noise-added data for each group G using weights based on the number of users included in the user data set for each group G.

Furthermore, assume that the noise-added variances of groups G ₁ , G ₂ , ..., G _n are σ ₁ ² , σ ₂ ² , ..., σ _n ^2. The noise-added variances σ ₁ ² , σ ₂ ² , ..., σ _n ² are data of noise-added calculation results in which noise according to the group G is added to the variance of values indicated by data included in the user data group for each group G. For example, if the statistical processing target is the annual income of user U, the noise-added variances σ ₁ ² , σ ₂ ² , ..., σ _n ² are variances in which noise according to the group G is added to the variance of the annual income of user U for each group G.

The weights k ₁ , k ₂ , ..., k _n may be expressed as values corresponding to the values obtained by dividing each of the numbers of noise-added users Ng ₁ , Ng ₂ , ..., Ng _n by the corresponding variances of noise-added variances σ ₁ ² , σ ₂ ² , ..., σ _n ² for each group G. In this case, the weights k ₁ , k ₂ , ..., k _n are expressed, for example, as k ₁ = Ng ₁ / Nt · σ ₁ ² , k ₂ = Ng ₂ / Nt · σ ₂ ² , ..., k _n = Ng _n / Nt · σ _n ² .

In this way, the information processing device 1 can generate data to be used by weighting and adding the noise-added data for each group G using weights according to the value obtained by dividing the number of noise-added users for each group G by the noise-added variance for each group G.

When the average value of the above-mentioned multiple gradients is used as the calculation result for each group G, the information processing device 1 calculates, as the data to be used, the parameters of the learning model determined by machine learning using the data of the calculation results with noise.

Furthermore, the information processing device 1 can also perform weighted addition of the noise-added data for each group G using the number of users in each group _G to which noise is not added, instead of the number of noise-added users Ng _{1 ,} Ng 2 , ..., Ng n. Furthermore, the information processing device 1 can also perform weighted addition of the noise-added data for each group G using the number of users in each group G to which noise is not added and the variance. Note that the variance may be the square root of σ ₁ ² , σ ₂ ² , ..., σ _n ² .

The information processing device 1 can selectively use a first weighted average method that uses a weight according to the number of noise-added users, and a second weighted average method that uses a weight according to the value obtained by dividing the number of noise-added users by the noise-added variance.

The information processing device 1 compares the variations in the data contained in the user data groups between groups G, and based on the comparison results, selects one of the first and second weighted averaging methods. Then, the information processing device 1 weights and adds the noise-added data for each group G using the selected weighted averaging method.

For example, the information processing device 1 calculates the variability of data included in a user data group for each group G, and selects the first weighted average method when the trend similarity, which is the degree of similarity in the trends of data variability between groups G, is high, and selects the second weighted average method when the trend similarity is low.

For example, the information processing device 1 determines that the trend similarity is high when the variance of the variances for each group G or the standard deviation of the variances for each group G is less than a threshold value, and determines that the trend similarity is low when the variance of the variances for each group G or the standard deviation of the variances for each group G is equal to or greater than a threshold value.

The information processing device 1 can also determine that the trend similarity is high when the variance of the standard deviations for each group G or the standard deviation of the standard deviations for each group G is less than a threshold value, and determine that the trend similarity is low when the variance of the standard deviations for each group G or the standard deviation of the standard deviations for each group G is equal to or greater than a threshold value. Note that the information processing device 1 only needs to select a weighted average method based on the results of comparing the variations for each group G, and is not limited to the above-mentioned example.

Next, we will explain how to generate data to be used when a noise-added data group for each group G is generated as an anonymously processed data group in step S8.

The information processing device 1 calculates data on the results of calculations (e.g., statistical quantities such as average, sum, and variance) based on the anonymously processed data group based on the processing content indicated in the processing content information. The processing content indicated in the processing content information includes information indicating the type of statistical calculation, such as average, sum, and variance, and the type of calculation used to generate parameters for the learning model.

For example, suppose the processing content specified by the processing target information is the average annual income of user U. In this case, the information processing device 1 calculates, as the data of the calculation result based on the anonymized processed data group, data indicating user U's average annual income included in the anonymized processed data group as the data to be used.

Also, assume that the processing content identified by the processing target information is the variance of the age of user U. In this case, the information processing device 1 calculates, as the data of the calculation result based on the anonymized processed data group, data indicating the variance of the age of user U included in the anonymized processed data group as the data to be used.

Also, assume that the processing content identified by the processing target information is the parameters of a learning model generated using the data to be anonymized as learning data. In this case, the information processing device 1 calculates, as the data to be used, the parameters of the learning model determined by machine learning using the average value of multiple gradients resulting from training data samples obtained from the anonymized data group when optimizing the model using, for example, stochastic gradient descent.

Next, the information processing device 1 provides the provided information to the operator by transmitting the target usage data generated in step S9 to the requester device 4 as provided information (step S10).

In this way, the information processing device 1 classifies data permitted for use by user U into groups G according to the usage conditions set by user U, and generates, for each group G, noise-added data by adding noise according to group G to data resulting from calculations based on user data groups containing multiple data classified into the same group G, or noise-added data groups by adding noise according to group G to user data groups. The information processing device 1 then generates data to be used using the noise-added data or noise-added data groups for each group G. By adding noise according to the usage conditions set by user U, the information processing device 1 can thereby use the data of users U who have permitted use of their personal information depending on the protection level, making it possible to utilize more personal information.

The information processing device 1 also accepts a request to provide data and determines whether the candidate data to be provided, which is data specified in the request, is data linked to a specific related organization that is an organization that has a predetermined relationship with the requester of the request. If the information processing device 1 determines that the candidate data to be provided is data linked to an organization that has a predetermined relationship with the requester, it anonymizes the candidate data to generate anonymized data, and provides data in response to the request based on the generated anonymized data. This enables the information processing device 1 to provide personal information more appropriately.

The following provides a detailed description of the configuration of the information provision system that includes the information processing device 1, terminal device 2, server 3, and requester device 4 that perform this processing.

2. Configuration of the information provision system
Fig. 2 is a diagram showing an example of the configuration of an information providing system according to an embodiment. As shown in Fig. 2, the information providing system 100 according to an embodiment includes an information processing device 1, a plurality of terminal devices 2, a plurality of servers 3 ₁ to 3 _m , and a requester device 4. n is, for example, an integer equal to or greater than 3.

The information processing device 1, the multiple terminal devices 2, the multiple servers 3 ₁ to 3 _m , and the requester device 4 are connected to each other via a network N so as to be able to communicate with each other via wired or wireless communication. Note that the information providing system 100 shown in FIG. 2 may include multiple information processing devices 1 and multiple requester devices 4.

The terminal device 2 may be, for example, a desktop PC (Personal Computer), a notebook PC, a tablet terminal, a smartphone, a mobile phone, or a PDA (Personal Digital Assistant). Note that the terminal device 2 is not limited to the above examples and may be, for example, a smart watch or a wearable device.

Each of the servers 3 ₁ to 3 _m provides online services to the user U of the terminal device 2. The servers 3 ₁ to 3 _m are, for example, servers that provide online services provided by different organizations, but may also be servers that provide some online services provided by the same organization.

If the organization is a business, the online services provided by the organization may be, for example, online services such as shopping sites, news sites, auction sites, flea market sites, weather forecast sites, and finance (stock price) sites. Furthermore, the online services provided by a business may also be, for example, online services such as search sites, map sites, travel sites, restaurant introduction sites, blog sites, and SNS sites.

If the organization is a local government, the online services provided by the organization are administrative services, such as electronic applications, electronic bidding, electronic tax returns, electronic tax payments, reservations for public facilities, book lending reservations, and the provision of various information related to administrative services.

The requester device 4 is, for example, a desktop PC or laptop PC, but may also be a tablet terminal, smartphone, mobile phone, or PDA. The operator who operates the requester device 4 operates the requester device 4 to obtain target data, etc., obtained by calculation from data in the service logs of the organization to which the operator belongs or an organization that has requested the operator's organization to analyze it.

3. Configuration of information processing device 1
3 is a diagram showing an example of the configuration of the information processing device 1 according to the embodiment. As shown in FIG. 3, the information processing device 1 includes a communication unit 10, a storage unit 11, and a processing unit 12.

3.1. Communication Unit 10
The communication unit 10 is realized by, for example, a NIC. The communication unit 10 is connected to a network N via a wired or wireless connection and transmits and receives information to and from various other devices. For example, the communication unit 10 transmits and receives information to and from the terminal device 2 via the network N.

[3.2. Storage unit 11]
The storage unit 11 is realized by, for example, a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 11 has an organization information storage unit 20 and a service log storage unit 21.

[3.2.1. Organizational information storage unit 20]
The organization information storage unit 20 stores an organization information table including information on each organization such as a company, a local government, etc. Fig. 4 is a diagram showing an example of the organization information table stored in the organization information storage unit 20 of the information processing device 1 according to the embodiment.

In the example shown in Figure 4, the organization information table stored in the organization information storage unit 20 includes information for the items "Organization ID," "Organization Name," and "Related Organization ID." "Organization ID" is an identifier that identifies an organization. "Organization Name" is information that indicates the name of the organization. "Related Organization ID" is the organization ID of an organization that has a predetermined relationship with the organization indicated by the "Organization ID."

In the example shown in Figure 4, the organization with organization ID "O1" has the organization name "Organization A," and the organization with which it has a predetermined relationship is Organization B with organization ID "O1." The organization with organization ID "O2" has the organization name "Organization B," and the organization with which it has a predetermined relationship is Organization C with organization ID "O3." Furthermore, the organization with organization ID "O1" has the organization name "Organization C," and the organizations with which it has a predetermined relationship are Organizations A and B with organization IDs "O1, O2."

The organization information table stored in the organization information storage unit 20 may include a "related organization estimation model" instead of an "organization ID." The "related organization estimation model" is information about the related organization estimation model, such as information about the parameters of the related organization estimation model.

3.2.2. Service Log Storage Unit 21
The service log storage unit 21 stores a service log information table including information such as service log data of online services provided by an organization. Fig. 5 is a diagram showing an example of the service log table stored in the service log storage unit 21 of the information processing device 1 according to the embodiment.

In the example shown in Figure 5, the service log table stored in the service log storage unit 21 includes information on items such as "Organization ID," "Service Log," and "Terms of Use Information." "Organization ID" is an identifier that identifies the organization. "Service Log" is information that indicates the service log data of the online service provided by the organization.

The "usage conditions information" is information indicating the usage conditions selected by each user U who conditionally permits the use of the data corresponding to that user U from among the multiple data included in the service log data. The information indicating the usage conditions is indicated by, for example, a protection level selected by the user U from protection levels _AL1 , _AL2 , ..., _ALn , and is associated with, for example, a user ID included in the service log data.

In the example shown in Figure 5, the organization with organization ID "O1" has service log data "DA1" and usage condition information "RA1", the organization with organization ID "O2" has service log data "DA2" and usage condition information "RA2", and the organization with organization ID "O3" has service log data "DA3" and usage condition information "RA3".

Note that in the example shown in Figure 5, the service log data is represented by abstract symbols such as "DA1" to "DA3," but the service log data is, for example, data in a file format that includes data for each user U.

In the example shown in Figure 5, the usage condition information is expressed using abstract symbols such as "RA1" to "RA3," but the usage condition information is, for example, data in a file format that includes information for each user U, including the user ID and selected protection level SAL of each user U. Note that the usage condition information may also be included in a "service log." For example, information on the protection level AL may be included as part of the user U data included in the service log data.

3.3. Processing Unit 12
The processing unit 12 is a controller, and is realized by a processor such as a CPU or an MPU, which uses RAM as a work area to execute various programs (examples of information provision programs) stored in a storage device (e.g., the storage unit 11) inside the information processing device 1. The processing unit 12 may also be partially or entirely realized by an integrated circuit such as an ASIC or FPGA.

As shown in FIG. 3, the processing unit 12 has a reception unit 30, a linking unit 31, a determination unit 32, an anonymization unit 33, and a provision unit 34, and realizes or executes the information processing functions and actions described below. Note that the internal configuration of the processing unit 12 is not limited to the configuration shown in FIG. 3, and may be any other configuration that performs the information processing described below.

3.3.1. Reception unit 30
The receiving unit 30 receives various data and queries. The receiving unit 30 includes a data receiving unit 40 and a provision request receiving unit 41.

3.3.1.1. Data Receiving Unit 40
The data receiving unit 40 receives data transmitted from various devices and stores the received data in the storage unit 11 .

For example, the data acceptance unit 40 accepts service log data uploaded from each server 3 to the information processing device 1 and stores the accepted data in the storage unit 11. The data acceptance unit 40 also accepts data uploaded from an information providing device (not shown) and stores the accepted data in the storage unit 11.

[3.3.1.2. Provision request receiving unit 41]
The provision request receiving unit 41 receives a data provision request. For example, the provision request receiving unit 41 receives a query transmitted from the requester device 4 as a data provision request.

A query from the requester device 4 includes, for example, data identification information for identifying the data to be used or the data to be processed, and organization identification information such as the organization ID of the requesting organization. The requesting organization is, for example, the organization to which the operator operating the requester device 4 belongs, or the organization that has requested an analysis from the organization to which the operator belongs.

Data identification information includes target organization information and processing target information. Target organization information includes the organization ID of the target organization, which is the organization that owns the data to be used. For example, if the data that the requesting organization wants to analyze is service log data for an online service provided by organization B, the organization ID of the target organization is the organization ID of organization B.

The processing target information includes data type information indicating the type of processing target data, which is the data to be processed, and processing content information indicating the processing content of the processing target data. Data type information includes, for example, information indicating the location of the user U who used the online service, information indicating the type of usage history of the online service by the user, information indicating the type of attributes of the user, and information indicating the type of input information and output information of the learning model.

The information indicating the user's location is, for example, information indicating the location detected by a location detection unit (not shown) provided in the terminal device 2, and is information transmitted from the terminal device 2 to the server 3 when the user uses an online service.

The online service usage history includes the date and time of use of the online service and the content of use of the online service. For example, if the online service is a shopping site service, the content of use of the online service includes the content viewed by the user of the transaction target, the content purchased by the user of the transaction target, the content rated by the user of the transaction target, and the content added to favorites by the user of the transaction target.

For example, if the online service is a government service, the usage content of the online service may include the content of electronic applications submitted by users, the content of electronic bidding submitted by users, the content of electronic tax returns submitted by users, the content of public facility reservations submitted by users, the content of book lending reservations submitted by users, and the viewing of various information by users.

User U's attributes are at least one of demographic attributes and psychographic attributes. Demographic attributes are demographic attributes, such as age, gender, occupation, place of residence, annual income, and family composition. Psychographic attributes are psychological attributes, such as lifestyle, values, and interests.

The processing content information includes, for example, information indicating the type of statistical calculation, such as average, sum, or variance, or the type of calculation to generate parameters for a learning model. The processing content specified by the processing target information includes, for example, calculation of the average annual income of men in their twenties in Kyoto Prefecture, the average variance of people who like motorcycles, or the total number of users U who have made electronic tax payments, or generation of a learning model that takes information indicating the location and attributes of user U as input and outputs a score indicating the likelihood of user U using online services.

3.3.2. Linking unit 31
The linking unit 31 links the provided data received by the data receiving unit 40 to an organization among a plurality of organizations that satisfies the linking conditions. The provided data includes, for example, service log data, that is, data on the usage log of online services.

An organization that satisfies the linking condition is, for example, an organization that provides an online service or an organization that provided the service log data. For example, if the server ₃₁ is a server of an organization managed by an organization that provides an online service, the linking unit 31 links the service log data transmitted from the server ₃₁ to the organization that manages the server ₃₁ .

Furthermore, for example, when server 3 _m is a server that provides online services for an organization different from the organization that manages server 3 _m , the linking unit 31 links the service log data transmitted from server 3 _m to the organization to which the online service is provided by server 3 _m .

When the information sent from the server 3 includes provider organization information indicating an organization that provides online services, the linking unit 31 can determine that the organization indicated in the provider organization information is an organization that satisfies the linking conditions.

An organization that satisfies the linking conditions may also be an organization for which the score output from the relevance estimation model satisfies a preset condition. The relevance estimation model is, for example, a learning model that takes service log data as input and outputs a score indicating the relevance of each organization with the source of the service log data request.

The relevance estimation model is generated by using service log data that has been determined in advance to be relevant to each organization as the correct answer data for each organization and having the model learn the characteristics of the correct answer data for each organization. The relevance estimation model is a learning model common to multiple organizations, but it may also be a learning model for each organization.

The linking unit 31 inputs the service log data into the relevance estimation model, and identifies organizations whose scores satisfy predetermined conditions among the scores for each organization output from the relevance estimation model as organizations whose scores output from the relevance estimation model satisfy the preset conditions. A score that satisfies the predetermined conditions is, for example, the highest score, but may also be, for example, a score above a threshold. If there are multiple organizations with scores above the threshold, the linking unit 31 can link the service log data to multiple organizations.

The relevance estimation model may be, for example, a learning model generated by GBDT or a learning model generated by deep learning using a deep neural network, but is not limited to these examples and may also be a learning model generated by other machine learning methods.

For example, the relevance estimation model may be generated using machine learning with other learning algorithms, such as regression methods such as linear regression, multiple regression, or logistic regression, or learning algorithms such as support vector machines.

The linking unit 31 can, for example, store service log data that has been made unavailable without linking it to an organization. The linking unit 31 can determine whether the service log data has been made unavailable based on information indicating whether the service log data is available, which is included in the information sent from the server 3.

[3.3.3. Judgment unit 32]
The determination unit 32 determines whether the candidate data to be provided, which is data specified by a query that is a provision request accepted by the provision request acceptance unit 41, is data linked to a specific related organization. The specific related organization is an organization that has a predetermined relationship with the requester of the provision request. The requester of the provision request is the organization indicated by the organization ID indicated in the organization identification information included in the query.

The determination unit 32 determines that the candidate data to be provided is data of a specific related organization, for example, when the target organization indicated by the organization ID included in the target organization information is an organization that is in a predetermined competitive relationship with the requester of the provision request. The determination unit 32 has, for example, a relationship table that includes information indicating organizations in a predetermined competitive relationship for each organization, and uses this relationship table to determine whether the candidate data to be provided is data of a specific related organization.

If the information sent from the server 3 includes permitted organization information indicating an organization that is permitted to use the service log data, the determination unit 32 can also determine that the organization indicated in the permitted organization information is an organization in a predetermined competitive relationship.

The determination unit 32 can also use information about competing organizations as correct answer data and use a related organization estimation model that has learned the characteristics of the correct answer data for competing organizations to estimate whether an organization is in a competitive relationship. The related organization estimation model is a learning model for each organization that has requested the provision request. In this case, the determination unit 32 inputs information about each organization into the related organization estimation model of the organization that has requested the provision request, and determines that an organization whose score output from the related organization estimation model is equal to or greater than a threshold is a competing organization.

In the above example, a specific related organization is an organization that is in a predetermined competitive relationship with the requester of the provision request, but this is not limited to this example. For example, the determination unit 32 can also determine an organization that is not in a predetermined competitive relationship with the requester of the provision request as a specific related organization.

For example, the determination unit 32 has a relationship table that contains, for each organization, information indicating organizations that are not in a predetermined competitive relationship, and uses this relationship table to determine specific related organizations.

Furthermore, the determination unit 32 can determine specific related organizations, for example, by using information about non-competitive organizations as correct answer data and using a related organization estimation model that has learned the characteristics of the correct answer data for non-competitive organizations.

If the determination unit 32 determines that the candidate data to be provided is data linked to a specific related organization, it identifies the type of data that is linked to the specific related organization and corresponds to the query received by the provision request receiving unit 41.

As described above, the query received by the provision request receiving unit 41 includes processing target information, and the determination unit 32 identifies the type of target data, which is data corresponding to the query, based on the data type information included in the processing target information. For example, if the data type information is information indicating the annual income of men in their twenties living in Kyoto Prefecture, the determination unit 32 identifies the annual income of men in their twenties living in Kyoto Prefecture as the type of target data.

Furthermore, when the data type information includes information indicating the types of input information and output information of the learning model, the determination unit 32 identifies the types of input information and output information of the learning model as the types of target data. The input information is, for example, information indicating the location and attributes of user U, and the output information is, for example, information indicating the content of user U's use of online services, but these examples are not limited to these.

The determination unit 32 can also accept data designation such that the number of target data or the number of users U that are the source of the target data is greater than or equal to a threshold. For example, the determination unit 32 can send a list of attributes for which the number of target data or the number of users U that are the source of the target data is greater than or equal to a threshold to the requester device 4, thereby allowing the operator to select an attribute from the list of attributes.

[3.3.4. Anonymous processing department 33]
The anonymization unit 33 performs anonymization on the candidate data to generate anonymously processed data when the determination unit 32 determines that the candidate data to be provided is data linked to a specific related organization. The anonymization unit 33 includes a classification unit 50 and a noise addition processing unit 51.

[3.3.4.1. Classification section 50]
The classification unit 50 classifies each piece of data included in the data to be anonymized into a group G according to the usage conditions set by the user U. Each piece of data included in the data to be anonymized is data whose use has been permitted by the user U.

For example, assume that the usage conditions set by the user U are indicated by a protection level selected by the user U from a plurality of protection levels AL ₁ , AL ₂ , ..., AL _n . In this case, the classification unit 50 classifies the data included in the data to be anonymized into a plurality of groups G ₁ , G ₂ , ..., G _n corresponding to the plurality of protection levels AL ₁ , AL ₂ , ..., AL _n .

For example, data for which usage conditions are set as indicated by protection level AL ₁ is classified into group G ₁ , data for which usage conditions are set as indicated by protection level AL ₂ is classified into group G ₂ , and data for which usage conditions are set as indicated by protection level AL _n is classified into group G _n .

[3.3.4.2. Noise Addition Processing Unit 51]
The noise addition processing unit 51 generates noise-added data or a noise-added data group for each group G based on a user data group for each group G including a plurality of data classified into the same group G by the classification unit 50 .

Noise-added data is data obtained by adding noise appropriate to the group G to data of calculation results (e.g., statistical quantities such as averages, sums, and variances) based on a user data group including multiple pieces of data classified into the same group G by the classification unit 50. Noise-added data groups are data groups obtained by adding noise appropriate to the group G to a user data group including multiple pieces of data classified into the same group G by the classification unit 50.

The noise addition processing unit 51 generates noise-added data or a group of noise-added data using anonymization processing based on differential privacy or k-anonymization. For example, if the information transmitted from the server 3 includes noise addition type information indicating the type of noise addition, the noise addition processing unit 51 can perform the anonymization processing indicated by the noise addition type information, either differential privacy anonymization processing or k-anonymization anonymization processing.

Furthermore, for example, if the query received by the provision request receiving unit 41 includes noise addition type information indicating the noise addition type, the noise addition processing unit 51 can perform anonymization indicated by the noise addition type information, either anonymization using differential privacy or anonymization using k-anonymization.

First, we will explain anonymization using differential privacy. The noise addition processing unit 51 calculates calculation result data for each group G from the user data set for each group G based on the processing content indicated in the processing content information included in the query received by the provision request receiving unit 41. The processing content indicated in the processing content information includes, for example, statistical calculations such as average, sum, and variance for specific data, and generation of learning model parameters.

For example, suppose the processing content indicated by the processing content information is the average annual income of user U. In this case, the noise addition processing unit 51 calculates data indicating the average annual income of user U for each group G as the calculation result data for each group G.

Also, assume that the processing content indicated by the processing content information is the age distribution of users U. In this case, the noise addition processing unit 51 calculates data indicating the distribution or variance of the ages of users U for each group G as data of the calculation results for each group G.

Also, assume that the processing content indicated by the processing content information is the generation of parameters for a learning model. In this case, the noise addition processing unit 51 calculates, for each group G, data indicating the average value of multiple gradients resulting from training data samples when optimizing the learning model using stochastic gradient descent.

In addition to the processing content indicated by the processing content information, the noise addition processing unit 51 also calculates, as calculation result data, data indicating the number (total) of users U for each group G and data indicating the variance for each group G subject to statistical processing. Hereinafter, the number of users U may be referred to as the number of users.

Then, the noise addition processing unit 51 generates noise-added data for each group G by adding noise according to the group G to the data of the calculation results for each group G. For example, it is assumed that data included in the data to be anonymized is classified into a plurality of groups G ₁ , G ₂ , ..., G _n corresponding to a plurality of protection levels AL ₁ , AL ₂ , ..., AL _n .

In this case, the noise addition processing unit 51 adds noise of increasing noise level to the data resulting from the calculation in the order of groups G ₁ , G ₂ , ..., G _n . In this way, noise-added data is generated for each group G, with noise of higher noise level added to groups G according to usage conditions with higher data protection levels AL.

Noise can be, for example, fixed noise, Gaussian noise, or Laplace noise. When the noise added to the calculation result data is fixed noise, the noise addition processing unit 51 increases the value of the fixed noise as the noise level increases.

Furthermore, when the noise added to the calculation result data is Gaussian noise, the noise addition processing unit 51 can increase the noise level by increasing the absolute value of the average value of the noise or by increasing the standard deviation of the noise.Furthermore, when the noise added to the calculation result data is Laplace noise, the noise addition processing unit 51 can increase the noise level by increasing the absolute value of the average value of the noise or by increasing the standard deviation of the noise.

In this way, in the anonymization process using differential privacy, the noise addition processing unit 51 generates noise-added data for each group G by adding noise appropriate to the group G to the data resulting from the calculation for each group G.

Next, we will explain anonymization using k-anonymization. The noise addition processing unit 51 performs anonymization by, for example, performing suppression processing to add noise by converting certain attribute items into asterisks (*) or by performing generalization processing to add noise by raising the hierarchy of attribute items.

The noise addition processing unit 51 can also add noise using top coding, which groups values above a certain threshold into one category, or bottom coding, which groups values below a certain threshold into one category.

The noise addition processing unit 51 generates a noise-added data group for each group G, with noise added at a higher noise level for user data groups in group G according to usage conditions with a higher data protection level AL. For example, the noise addition processing unit 51 increases the addition amount, which is the amount of data to be added as noise, or increases the change amount, which is the amount of data to be changed as noise, for groups G with a higher data protection level AL.

In the generalization process, the noise addition processing unit 51 can increase the noise level, for example, by increasing the generalization level. The generalization level is higher for the layer two levels above than for the layer one level above, and higher for the layer three levels above than for the layer two levels above.

Furthermore, the noise addition processing unit 51 can increase the noise level by, for example, increasing the number of attribute items converted to asterisks "*" during suppression processing. Furthermore, the noise addition processing unit 51 can increase the noise level by decreasing the threshold when grouping values above a certain threshold into one category. Furthermore, the noise addition processing unit 51 can increase the noise level by increasing the threshold when grouping values below a certain threshold into one category.

For example, suppose that each user U is classified into a group G according to a selected protection level SAL, which is a protection level selected by the user U from among protection levels AL ₁ to AL _n . In this case, the noise addition processing unit 51 adds noise at a higher noise level to groups G having higher data protection levels AL.

The noise addition processing unit 51 can also perform dummy addition processing to add dummy data to the user data group for each group G, the number or content of which depends on the usage conditions for which the data protection level AL is high. The dummy data may, for example, be the same as the data contained in the user data group for each group G, or may be data obtained by processing the data contained in the user data group. The dummy data may also be data generated randomly or according to predetermined rules.

For example, the higher the data protection level AL, the more dummy data the noise addition processing unit 51 can add, or use data that has been highly processed compared to the data included in the user data group as dummy data.

The noise addition processing unit 51 can also add dummy data to the user data group so that the overall trend of each group G does not change. For example, the noise addition processing unit 51 adds dummy data to the user data group so that the calculation results (e.g., statistical quantities such as average, sum, and variance) based on the user data group before and after adding the dummy data are within a threshold range, so that the overall trend of each group G does not change.

The noise addition processing unit 51 can also add noise to the user data group using a different noise addition method for each protection level AL. Noise addition methods include, for example, suppression processing, generalization processing, and dummy addition processing, and suppression processing also includes noise addition methods such as conversion to asterisks (*), top coating, and bottom coating. Note that the noise addition methods are not limited to the examples described above.

In this way, the noise addition processing unit 51 generates a noise-added data group for each group G by adding noise appropriate to the group G to the user data group for each group G during the anonymization process using k-anonymization.

[3.3.5. Providing Department 34]
The providing unit 34 provides data in response to the provision request accepted by the provision request accepting unit 41 as data to be analyzed, based on the anonymized data or a group of anonymized data generated by the anonymization unit 33.

The providing unit 34 includes a target data generating unit 60 that generates target data for use based on the anonymized processed data or a group of anonymized processed data generated by the anonymization unit 33, and a providing processing unit 61 that provides the target data for use generated by the target data generating unit 60.

3.3.5.1. Use target data generation unit 60
The target data generation unit 60 generates target data for use using the anonymously processed data or a group of anonymously processed data generated by the anonymization unit 33. The anonymously processed data is noise-added data or a group of noise-added data for each group G, as described above.

The target data generation unit 60 includes a comparison unit 70, a selection unit 71, a weighted average calculation unit 72, and a calculation processing unit 73.

3.3.5.1.1. Comparison unit 70
The comparison unit 70 compares the variations in the data included in the user data groups between groups G. For example, the comparison unit 70 calculates the variations in the data included in the user data groups for each group G, and calculates a trend similarity, which is the similarity in the trends of the data variations between groups G.

The trend similarity is, for example, a value expressed as the variance of the variances for each group G or the standard deviation of the variances for each group G, but is not limited to such examples. For example, the trend similarity may be a value expressed as the variance of the standard deviations for each group G or the standard deviation of the standard deviations for each group G.

3.3.5.1.2. Selection unit 71
The selection unit 71 selects one weighted averaging method from among the plurality of weighted averaging methods based on the comparison result by the comparison unit 70. The plurality of weighted averaging methods include a first weighted averaging method and a second weighted averaging method.

The first weighted average method is a weighted average method using a weight according to the number of noise-added users for each group G, and the second weighted average method is a weighted average method using a weight according to the value obtained by dividing the number of noise-added users by the noise-added variance for each group G.

For example, the selection unit 71 selects the first weighted average method when the trend similarity is high, and selects the second weighted average method when the trend similarity is low. For example, the selection unit 71 determines that the trend similarity is high when the variance of the variances for each group G or the standard deviation of the variances for each group G is less than a threshold, and determines that the trend similarity is low when the variance of the variances for each group G or the standard deviation of the variances for each group G is equal to or greater than a threshold.

The selection unit 71 can also determine that the trend similarity is high when the variance of the standard deviations for each group G or the standard deviation of the standard deviations for each group G is less than a threshold, and determine that the trend similarity is low when the variance of the standard deviations for each group G or the standard deviation of the standard deviations for each group G is equal to or greater than a threshold. Note that the selection unit 71 only needs to select a weighted average method based on the results of comparing the variations for each group G, and is not limited to the above-mentioned example.

[3.3.5.1.3. Weighted average calculation unit 72]
The weighted average calculation unit 72 generates data to be used based on the anonymously processed data when the anonymously processed data generated by the anonymization unit 33 is noise-added data for each group G. For example, the weighted average calculation unit 72 can generate data to be used by calculating the above formula (1).

The weighted average calculation unit 72 generates the data to be used by weighting and adding the noise-added data for each group G. The weighting may be a weight corresponding to the value obtained by adding noise to the number of users included in the user data group for each group G, or a weight corresponding to the value obtained by dividing the value obtained by adding noise to the number of users included in the user data group for each group G by the value obtained by adding noise to the variance for each group G.

For example, when the selection unit 71 selects the first weighted average method, the weighted average calculation unit 72 generates the data to be used by weighting and adding the noise-added data for each group G using a weight corresponding to the value obtained by adding noise to the number of users included in the user data group for each group G (number of users with noise).

Furthermore, when the selection unit 71 selects the second weighted average method, the weighted average calculation unit 72 generates the data to be used by weighting and adding the noise-added data for each group G using a weight corresponding to the value obtained by dividing the number of noise-added users for each group G by the noise-added variance for each group G.

When the average value of the above-mentioned multiple gradients is used as the calculation result for each group G, the weighted average calculation unit 72 calculates the parameters of the learning model determined by machine learning using the data of the calculation results with noise as the data to be used.

Furthermore, the weighted average calculation unit 72 can perform weighted addition of the noise-added data for each group G using the number of users in each group G to which noise is not added, instead of the number of users with noise. Furthermore, the weighted average calculation unit 72 can perform weighted addition of the noise-added data for each group G using the number of users in each group G to which noise is not added and the variance. Note that the variance may be the square root of σ ₁ ² , σ ₂ ² , ..., σ _n ² .

[3.3.5.1.4. Processing unit 73]
When the anonymization unit 33 generates a noise-added data group for each group G, that is, an anonymized processed data group, the calculation processing unit 73 generates data to be used.

The calculation processing unit 73 calculates data of calculation results (e.g., statistical quantities such as average, sum, and variance) based on the anonymously processed data group based on the processing content indicated in the processing content information. The processing content indicated in the processing content information includes information indicating the statistical calculation type such as average, sum, and variance, and the calculation type for generating learning model parameters.

For example, suppose the processing content specified by the processing target information is the average annual income of user U. In this case, the calculation processing unit 73 calculates, as the data of the calculation result based on the anonymized processed data group, data indicating user U's average annual income included in the anonymized processed data group as the data to be used.

Also, assume that the processing content identified by the processing target information is the variance of the age of user U. In this case, the calculation processing unit 73 calculates, as the data of the calculation result based on the anonymously processed data group, data indicating the variance of the age of user U included in the anonymously processed data group as the data to be used.

Also, the processing content identified by the processing target information is assumed to be the parameters of a learning model generated using the data to be anonymized as learning data. In this case, the calculation processing unit 73 calculates, as the data to be used, the parameters of the learning model determined by machine learning using the average value of multiple gradients resulting from training data samples obtained from the anonymized data group when optimizing the model using, for example, stochastic gradient descent.

3.3.5.2. Provision Processing Unit 61
The providing processing unit 61 provides, for example, data in response to a providing request accepted by the providing request accepting unit 41 .

For example, the provision processing unit 61 provides the provision information to the operator by transmitting the use target data generated by the use target data generation unit 60 to the requester device 4 as data in response to the provision request. This allows the provision processing unit 61 to provide personal information more appropriately.

4. Processing Procedure
Next, the procedure of information processing executed by the processing unit 12 of the information processing device 1 according to the embodiment will be described with reference to Fig. 6. Fig. 6 is a flowchart showing an example of information processing executed by the processing unit 12 of the information processing device 1.

As shown in FIG. 6, the processing unit 12 of the information processing device 1 determines whether there is upload data (step S20). For example, the processing unit 12 determines that there is upload data when service log data is sent from the server 3 to the information processing device 1 and received by the communication unit 10.

If the processing unit 12 determines that there is uploaded data (Step S20: Yes), it links the service log data, which is the uploaded data, to the organization (Step S21). Then, the processing unit 12 stores the service log data, which is the uploaded data linked to the organization, in the memory unit 11 (Step S22).

When the processing of step S22 is completed, or when it is determined that there is no uploaded data (step S20: No), the processing unit 12 determines whether there is a request to provide data (step S23). For example, the processing unit 12 determines that there is a request to provide data when a query is sent from the requester device 4 to the information processing device 1 and received by the communication unit 10.

If the processing unit 12 determines that there is a request to provide data (step S23: Yes), it determines whether the candidate data to be provided, which is the data identified by the query, is data linked to a specific related organization (step S24).

If the processing unit 12 determines that the candidate data to be provided is data linked to a specific related organization (step S24: Yes), it performs anonymization processing (step S25). The anonymization processing is the processing of steps S30 and S31 shown in Figure 7, and will be described in detail later.

Next, the processing unit 12 generates data to be used based on the anonymized processed data including noise-added data for each group G generated in the anonymization process of step S25 or a group of anonymized processed data including a group of noise-added data for each group G (step S26). The processing unit 12 then provides the data to be used generated in step S26 to the provider that has issued the provision request (step S27).

When the processing of step S27 is completed, when it is determined that there is no request to provide data (step S23: No), or when it is determined that the candidate data to be provided is not data linked to a specific related organization (step S24: No), the processing unit 12 determines whether the time to end has arrived (step S28). The processing unit 12 determines that the time to end has arrived, for example, when the power of the information processing device 1 is turned off, or when it is determined that an end operation has been performed by operating an operation unit (not shown) of the information processing device 1.

If the processing unit 12 determines that the end timing has not yet arrived (step S28: No), it proceeds to step S20. If the processing unit 12 determines that the end timing has arrived (step S28: Yes), it terminates the processing shown in FIG. 6.

Figure 7 is a flowchart showing an example of anonymization processing performed by the processing unit 12 of the information processing device 1. As shown in Figure 7, the processing unit 12 classifies each piece of data included in the candidate data to be provided into group G according to the usage conditions set by the user (step S30).

Next, the processing unit 12 generates noise-added data or a noise-added data group for each group G by adding noise corresponding to the group G to the data of the calculation result based on the user data group or the user data group (step S31), and then ends the processing shown in FIG. 7.

5. Modifications
In the above example, the data to be anonymized is service log data, but the data to be anonymized is not limited to service log data and may be, for example, data collected offline.

Furthermore, in the above example, an example was described in which noise was added according to the protection level indicated in the terms of use set by user U, but this is not limited to such an example. For example, when protection level information indicating the protection level of service log data is sent from server 3 to information processing device 1, the anonymization unit 33 can set the protection level indicated in the protection level information to the lowest protection level.

For example, suppose the protection levels of the data included in the service log data are protection levels AL ₁ , AL ₂ , ..., AL _n . In this case, if the protection level indicated by the protection level information is protection level AL ₂ , the anonymization unit 33 changes the protection level AL ₁ set by the user U as a condition of use to protection level AL _2. Also, if the protection level indicated by the protection level information is protection level AL _n , the anonymization unit 33 changes the protection level AL set by the user U as a condition of use to protection level AL _n .

The protection level information may also be information indicating a value p for raising the protection level AL. In this case, if the protection levels AL ₁ , AL ₂ , ..., AL _n are included as the protection levels of the data included in the service log data, the anonymization unit 33 changes the protection levels AL ₁ , AL ₂ , ..., AL _n to protection levels AL _1+p , AL _2+p , ..., AL _n+p , and performs the anonymization process.

6. Hardware Configuration
The information processing device 1 or the terminal device 2 according to the above-described embodiment is realized by, for example, a computer 80 configured as shown in Fig. 8. The following description will be given taking the information processing device 1 as an example. Fig. 8 is a hardware configuration diagram showing an example of a computer 80 that realizes the functions of the information processing device 1 according to the embodiment. The computer 80 has a CPU 81, a RAM 82, a ROM (Read Only Memory) 83, an HDD (Hard Disk Drive) 84, a communication interface (I/F) 85, an input/output interface (I/F) 86, and a media interface (I/F) 87.

The CPU 81 operates based on programs stored in the ROM 83 or HDD 84 and controls each component. The ROM 83 stores a boot program executed by the CPU 81 when the computer 80 starts up, as well as programs that depend on the computer 80's hardware.

The HDD 84 stores programs executed by the CPU 81 and data used by such programs. The communication interface 85 receives data from other devices via the network N (see Figure 2) and sends it to the CPU 81, and transmits data generated by the CPU 81 to other devices via the network N.

The CPU 81 controls output devices such as displays and printers, and input devices such as keyboards and mice, via the input/output interface 86. The CPU 81 acquires data from the input devices via the input/output interface 86. The CPU 81 also outputs data generated via the input/output interface 86 to the output devices.

The media interface 87 reads programs or data stored on the recording medium 88 and provides them to the CPU 81 via the RAM 82. The CPU 81 loads the programs from the recording medium 88 onto the RAM 82 via the media interface 87 and executes the loaded programs. The recording medium 88 may be, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase Change Rewritable Disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory.

For example, when the computer 80 functions as the information processing device 1 according to the embodiment, the CPU 81 of the computer 80 executes programs loaded onto the RAM 82 to realize the functions of the processing unit 12. In addition, the HDD 84 stores data in the storage unit 11. The CPU 81 of the computer 80 reads and executes these programs from the recording medium 88, but as another example, these programs may be obtained from another device via the network N.

[7. Other]
Furthermore, among the processes described in the above embodiments, some of the processes described as being performed automatically can also be performed manually. Alternatively, all or some of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown in the drawings.

Furthermore, the components of each device shown in the figure are functional concepts and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

For example, the information processing device 1 described above may be implemented using multiple server computers, and depending on the function, the configuration can be flexibly changed, such as by calling an external platform using an API or network computing.

Furthermore, for example, part or all of the memory unit 11 shown in FIG. 3 may not be held by each device, but may be held by a storage server or the like. In this case, each device obtains various information by accessing the storage server.

8. Effects
As described above, the information processing device 1 according to the embodiment includes a provision request receiving unit 41, a determination unit 32, an anonymization unit 33, and a providing unit 34. The provision request receiving unit 41 receives a data provision request. The determination unit 32 determines whether the provision candidate data, which is data identified in the provision request received by the provision request receiving unit 41, is data linked to an organization having a predetermined relationship with the requester of the provision request. When the determination unit 32 determines that the provision candidate data is data linked to an organization having a predetermined relationship with the requester, the anonymization unit 33 anonymizes the provision candidate data to generate anonymously processed data. The providing unit 34 provides data in response to the provision request based on the anonymously processed data generated by the anonymization unit 33. This allows the information processing device 1 to more appropriately provide personal information.

The anonymization unit 33 also performs k-anonymization on the candidate data to be provided to generate anonymously processed data. This allows the information processing device 1 to provide personal information more appropriately.

In addition, the anonymization unit 33 performs anonymization using differential privacy on the candidate data to generate anonymized data. This allows the information processing device 1 to provide personal information more appropriately.

The information processing device 1 also includes a data receiving unit 40 and a linking unit 31. The data receiving unit 40 receives provided data, which is data used to provide data in response to a provision request. The linking unit 31 links the provided data received by the data receiving unit 40 to an organization among multiple organizations that satisfies the linking conditions. This enables the information processing device 1 to provide personal information more appropriately.

The provided data is also online service usage log data. This allows the information processing device 1 to more appropriately provide online service usage log data.

In addition, the linking unit 31 determines that the organization that provided the provided data accepted by the data accepting unit 40 is an organization that satisfies the linking conditions. This allows the information processing device 1 to provide personal information more appropriately.

In addition, the linking unit 31 determines that organizations that provide online services are organizations that satisfy the linking conditions. This allows the information processing device 1 to provide personal information more appropriately.

The linking unit 31 also has a relevance estimation model that inputs data received by the data receiving unit 40 and outputs a score indicating the relevance of each organization with the requester, and determines organizations that satisfy the linking conditions based on the score output from the relevance estimation model. This allows the information processing device 1 to provide personal information more appropriately.

The anonymization unit 33 also includes a classification unit 50 and a noise addition processing unit 51. The classification unit 50 classifies data included in the candidate provision data and whose use has been permitted by the user U into a group G according to the usage conditions set by the user U. The noise addition processing unit 51 generates noise-added data for each group G by adding noise according to the group G to data resulting from calculations based on a user data group including multiple pieces of data classified into the same group G by the classification unit 50, or a noise-added data group by adding noise according to the group G to a user data group. In this way, by adding noise according to the usage conditions set by the user U, the information processing device 1 can use the data of users U who have permitted the use of their personal information depending on the protection level, making it possible to utilize more personal information.

In addition, the noise addition processing unit 51 generates noise-added data or noise-added data groups with higher noise levels added to groups G according to usage conditions with higher data protection levels. This allows the information processing device 1 to make more personal information usable.

The providing unit 34 also includes a usage target data generating unit 60 that generates usage target data using the noise-added data or noise-added data group for each group G generated by the noise addition processing unit 51. This allows the information processing device 1 to more appropriately add noise in accordance with the usage conditions set by the user U.

The target data generation unit 60 also generates target data for use by weighting the noise-added data for each group G generated by the noise addition processing unit 51, using a weight based on the value obtained by adding noise to the number of users U included in the user data group for each group G. This allows the information processing device 1 to more appropriately add noise according to the usage conditions set by the user U.

The target data generation unit 60 also generates, as target data for use, data obtained by weighting the noise-added data for each group G generated by the noise addition processing unit 51 using a weight corresponding to the value obtained by dividing the number of users U included in the user data set for each group G by the value obtained by adding noise to the variance for each group G of the data used to calculate the calculation results. This allows the information processing device 1 to more appropriately add noise according to the usage conditions set by the user U.

The usage target data generation unit 60 also includes a comparison unit 70, a selection unit 71, and a weighted average calculation unit 72. The comparison unit 70 compares the variability of the data included in the user data groups between groups G. Based on the comparison results by the comparison unit 70, the selection unit 71 selects, as the weighted averaging method, one of two methods: one using a weight according to the number of users U included in the user data group for each group G, or one using a weight according to a value obtained by dividing a value obtained by adding noise to the number of users U included in the user data group for each group G by a value obtained by adding noise to the variance for each group G of the data used to calculate the calculation results. The weighted average calculation unit 72 calculates a weighted average of the calculation result data for each group G calculated by the noise addition processing unit 51 using the weighted averaging method selected by the selection unit 71. This allows the information processing device 1 to more appropriately add noise according to the usage conditions set by the user U.

The above describes in detail the embodiments of the present application based on the drawings, but this is merely an example, and the present invention can be implemented in other forms that incorporate various modifications and improvements based on the knowledge of those skilled in the art, including the aspects described in the Disclosure of the Invention section.

Furthermore, the "parts" (sections, modules, units) mentioned above can be read as "means" or "circuits." For example, a providing unit can be read as a providing means or a providing circuit.

REFERENCE SIGNS LIST 1 information processing device 2 terminal device 3, 3 ₁ to 3 _m server 4 requester device 10 communication unit 11 memory unit 12 processing unit 20 organization information memory unit 21 service log memory unit 30 reception unit 31 linking unit 32 determination unit 33 anonymization unit 34 provision unit 40 data reception unit 41 provision request reception unit 50 classification unit 51 noise addition processing unit 60 use target data generation unit 61 provision processing unit 70 comparison unit 71 selection unit 72 weighted average calculation unit 73 calculation processing unit 100 information provision system

Claims (16)

a data receiving unit that receives provision data that is data used to provide data in response to a provision request;
a linking unit that links the provided data accepted by the data accepting unit to an organization that satisfies a linking condition among a plurality of organizations;
a provision request receiving unit that receives a data provision request;
a determination unit that determines whether or not the provision candidate data, which is the data specified in the provision request accepted by the provision request acceptance unit, is data linked to an organization that has a predetermined relationship with a requester of the provision request;
an anonymization unit that generates anonymously processed data by anonymizing the candidate data to be provided when the determination unit determines that the candidate data to be provided is data linked to an organization that has a predetermined relationship with the request source;
a providing unit that provides data in response to the provision request based on the anonymized data generated by the anonymization unit ,
The linking unit is
a relevance estimation model that receives data received by the data receiving unit as input and outputs a score indicating a relevance between each organization and the requester, and determines an organization that satisfies the linking condition based on the score output from the relevance estimation model;
1. An information processing device comprising: a provision request receiving unit that receives a data provision request;
a determination unit that determines whether or not the provision candidate data, which is the data specified in the provision request accepted by the provision request acceptance unit, is data linked to an organization that has a predetermined relationship with a requester of the provision request;
an anonymization unit that generates anonymously processed data by anonymizing the candidate data to be provided when the determination unit determines that the candidate data to be provided is data linked to an organization that has a predetermined relationship with the request source;
a providing unit that provides data in response to the provision request based on the anonymized data generated by the anonymization unit ,
The anonymization unit includes:
a classification unit that classifies data included in the provision candidate data and whose use is permitted by a user into groups according to usage conditions set by the user;
a noise addition processing unit that generates noise-added data for each group by adding noise according to the group to data resulting from an operation based on a user data group including a plurality of data classified into the same group by the classification unit,
The providing unit
a usage target data generation unit that generates, as usage target data, data obtained by weighting average of the noise-added data for each of the groups generated by the noise addition processing unit using a weight based on a value obtained by adding noise to the number of users included in the user data group for each of the groups;
1. An information processing device comprising: a data receiving unit that receives provided data, which is data used to provide data in response to the provision request;
The information processing apparatus according to claim 2 , further comprising: a linking unit that links the provided data accepted by the data accepting unit to an organization that satisfies a linking condition among a plurality of organizations. The provided data is
The information processing device according to claim 1 or 3 , wherein the data is a usage log data of an online service. The linking unit is
The information processing apparatus according to claim 1 or 3 , wherein an organization that provided the provided data accepted by the data accepting unit is determined to be an organization that satisfies the linking condition. The linking unit is
The information processing device according to claim 4 , wherein the organization providing the online service is determined to be an organization that satisfies the linking condition. The anonymization unit includes:
a classification unit that classifies data included in the provision candidate data and whose use is permitted by a user into groups according to usage conditions set by the user;
the information processing device according to claim 1, further comprising: a noise addition processing unit that generates, for each group, noise-added data by adding noise according to the group to data of a calculation result based on a user data group including a plurality of data classified into the same group by the classification unit, or a noise-added data group by adding noise according to the group to a user data group. The noise addition processing unit
The information processing apparatus according to claim 7 , wherein the information processing apparatus generates noise-added data or a noise-added data group to which a higher noise level is added for a group according to the usage conditions with a higher data protection level. The providing unit
The information processing apparatus according to claim 7 , further comprising a utilization target data generation unit that generates utilization target data using the noise-added data for each group or the noise-added data group generated by the noise addition processing unit. The usage target data generation unit
The information processing device according to claim 9, characterized in that data obtained by weighting average of the noise-added data for each of the groups generated by the noise addition processing unit using a weight based on a value obtained by adding noise to the number of users included in the user data group for each of the groups is generated as the data to be used. The usage target data generation unit
11. The information processing device according to claim 2 or 10, characterized in that the noise-added data for each of the groups generated by the noise addition processing unit is weighted-averaged using a weight corresponding to a value obtained by dividing a value obtained by adding noise to the number of users included in the user data group for each of the groups by a value obtained by adding noise to the variance for each of the groups of data used to calculate the calculation result. The usage target data generation unit
a comparison unit that compares the variations in data included in the user data groups between the groups;
a selection unit that selects, based on a comparison result by the comparison unit, one of a method using a weight according to a value obtained by adding noise to the number of users included in the user data group for each group, and a method using a weight according to a value obtained by dividing the value obtained by adding noise to the number of users included in the user data group for each group by a value obtained by adding noise to the variance for each group of data used to calculate the calculation result; and
12. The information processing device according to claim 11, further comprising: a weighted average calculation unit that calculates a weighted average of the data of the calculation results for each group calculated by the noise addition processing unit using the weighted average method selected by the selection unit. 1. A computer-implemented information processing method, comprising:
a data receiving step of receiving provision data, which is data used to provide data in response to a provision request;
a linking step of linking the provided data received in the data receiving step to an organization among a plurality of organizations that satisfies a linking condition;
a provision request receiving step of receiving a data provision request;
a determination step of determining whether or not the provision candidate data, which is data specified in the provision request accepted by the provision request accepting step, is data linked to an organization having a predetermined relationship with the requester of the provision request;
an anonymization process for generating anonymously processed data by anonymizing the candidate data to be provided when it is determined by the determination process that the candidate data to be provided is data linked to an organization having a predetermined relationship with the request source;
a providing step of providing data in response to the provision request based on the anonymized processed data generated by the anonymization step ,
The linking step includes:
The method includes a relevance estimation model that receives the data received in the data receiving step as an input and outputs a score indicating the relevance of each organization with the requester, and determines an organization that satisfies the linking condition based on the score output from the relevance estimation model.
An information processing method comprising: 1. A computer-implemented information processing method, comprising:
a provision request receiving step of receiving a data provision request;
a determination step of determining whether or not the provision candidate data, which is data specified in the provision request accepted by the provision request accepting step, is data linked to an organization having a predetermined relationship with the requester of the provision request;
an anonymization process for generating anonymously processed data by anonymizing the candidate data to be provided when it is determined by the determination process that the candidate data to be provided is data linked to an organization having a predetermined relationship with the request source;
a providing step of providing data in response to the provision request based on the anonymized processed data generated by the anonymization step,
The anonymization process includes:
a classification step of classifying data included in the candidate data to be provided and for which use is permitted by a user into groups according to use conditions set by the user;
a noise addition processing step of generating noise-added data for each group by adding noise according to the group to data resulting from an operation based on a user data group including a plurality of data classified into the same group by the classification step,
The providing step includes:
a use target data generating step of generating, as use target data, data obtained by weighting average of the noise-added data for each of the groups generated by the noise addition processing step using a weight based on a value obtained by adding noise to the number of users included in the user data group for each of the groups;
An information processing method comprising: a data receiving procedure for receiving provided data, which is data used to provide data in response to a provision request;
a linking step of linking the provided data accepted by the data accepting step to an organization among a plurality of organizations that satisfies a linking condition;
a provision request acceptance procedure for accepting a data provision request;
a determination step of determining whether or not the provision candidate data, which is data specified in the provision request accepted by the provision request acceptance step, is data associated with an organization having a predetermined relationship with a requester of the provision request;
an anonymization step of anonymizing the candidate data to be provided to generate anonymously processed data when the determination step determines that the candidate data to be provided is data linked to an organization having a predetermined relationship with the requester;
a provision step of providing data in response to the provision request based on the anonymized data generated by the anonymization step ;
The linking procedure includes:
a relevance estimation model that receives data received by the data receiving procedure as an input and outputs a score indicating a relevance between each organization and the requester, and determines an organization that satisfies the linking condition based on the score output from the relevance estimation model;
An information processing program characterized by: a provision request acceptance procedure for accepting a data provision request;
a determination step of determining whether or not the provision candidate data, which is data specified in the provision request accepted by the provision request acceptance step, is data associated with an organization having a predetermined relationship with a requester of the provision request;
an anonymization step of anonymizing the candidate data to be provided to generate anonymously processed data when the determination step determines that the candidate data to be provided is data linked to an organization having a predetermined relationship with the requester;
a provision step of providing data in response to the provision request based on the anonymized data generated by the anonymization step;
The anonymization procedure is as follows:
a classification step of classifying data included in the candidate data to be provided and for which use is permitted by a user into groups according to use conditions set by the user;
a noise addition processing procedure for generating noise-added data for each group by adding noise according to the group to data resulting from an operation based on a user data group including a plurality of data classified into the same group by the classification procedure,
The providing step comprises:
a usage target data generation step of generating, as usage target data, data obtained by weighting average of the noise-added data for each of the groups generated by the noise addition processing step using a weight based on a value obtained by adding noise to the number of users included in the user data group for each of the groups;
An information processing program characterized by: