Privacy-protected data aggregation device and privacy-protected data aggregation system

Abstract

A privacy-protected data aggregation device (10) comprises: an attribute information encryption unit (13) that encrypts attribute information in user data, which includes a plurality of pieces of attribute information and is to be aggregated, by a homomorphic encryption method enabling aggregation processing; an aggregation processing unit (14) that aggregates the user data in which the attribute information is encrypted for all the combinations of values, which may be taken by the plurality of types of attribute information in domain data defining values that may be taken by the respective plurality of types of attribute information included in the user data, to obtain aggregated data including the result of aggregation and the encrypted attribute information; a concealment processing unit (15) that executes concealment processing on the obtained aggregated data; and a decryption unit (16) that decrypts the aggregated data having undergone the concealment processing to obtain aggregated data including the decrypted attribute information and the result of aggregation after the concealment processing.

Description

[Technical Field]

[0001] This disclosure relates to a privacy-protected data aggregation device and a privacy-protected data aggregation system. [Background technology]

[0002] There is a widespread societal demand for aggregating data while protecting personal information within databases, and such technologies are disclosed, for example, in Patent Document 1. Furthermore, differential privacy is known as a technology that enables statistical analysis while protecting personal information within databases from attackers. In data aggregation technologies related to differential privacy, the concepts of "structural zeros" and "unstructured zeros" are known when aggregating the number of users corresponding to combinations of multiple attribute information. "Structural zeros" refer to combinations that do not structurally exist, resulting in an output (aggregation result) of "0," while "unstructured zeros" refer to combinations that structurally exist, but for which no aggregation result is output. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2010-108488 [Overview of the project] [Problems that the invention aims to solve]

[0004] In a scenario where data in individual records is aggregated using secure computation and the aggregated results are then subjected to confidential processing, if a combination of attribute information that structurally exists does not actually exist in the individual record data, that combination will not be included in the aggregation, and therefore the aggregated result will not be output. This presents a problem in that a third party would be able to see that the data for that combination does not exist in the individual record data. In other words, the data for that combination falls under the aforementioned unstructured zero, resulting in unintended disclosure due to unstructured zero.

[0005] However, Patent Document 1 does not disclose any measures to prevent unintended disclosures due to unstructured zeros as described above, and such preventative measures are eagerly awaited.

[0006] This disclosure is made to address the above-mentioned issues and aims to prevent unintended disclosures due to unstructured zeros. [Means for solving the problem]

[0007] The privacy-protecting data aggregation device relating to this disclosure comprises: an attribute information encryption unit that encrypts the attribute information in user data to be aggregated, which includes multiple attribute pieces of information, using a homomorphic encryption scheme capable of aggregation processing; an aggregation processing unit that aggregates the user data whose attribute information has been encrypted by the attribute information encryption unit for all possible combinations of values ​​of the multiple attribute pieces of information in domain data that defines the possible values ​​of each attribute piece of information included in the user data, and obtains aggregated data including the aggregation result and the encrypted attribute information; a confidentiality processing unit that performs confidentiality processing on the aggregated data obtained by the aggregation processing unit; and a decryption unit that decrypts the aggregated data that has undergone confidentiality processing and obtains aggregated data including the aggregated result after confidentiality processing and the decrypted attribute information.

[0008] In the above-described privacy-protecting data aggregation device, the attribute information encryption unit encrypts the attribute information in the user data to be aggregated, which includes multiple attribute pieces of information, using a homomorphic encryption scheme capable of aggregation processing. The aggregation processing unit aggregates the encrypted user data for all possible combinations of values ​​for the multiple attribute pieces in the domain data, obtaining aggregated data that includes the aggregation results and the encrypted attribute information. In this way, aggregation is performed for all possible combinations of values ​​for the multiple attribute pieces in the domain data, and aggregated data that includes the aggregation results and the encrypted attribute information is obtained. Then, the concealment processing unit performs concealment processing on the aggregated data obtained by the aggregation processing unit, thereby concealing the aggregated data. Furthermore, the decryption unit decrypts the aggregated data that has undergone the concealment processing, obtaining aggregated data that includes the aggregated results after concealment processing and the decrypted attribute information. In this way, the aggregated results after concealment processing can be output in a format that can be confirmed by the user. In this series of processes, aggregation is performed for all possible combinations of values ​​for the multiple attribute pieces in the domain data, so it is possible to avoid situations where unstructured zeros (i.e., combinations that structurally exist but are not output) occur, and unintended disclosure due to unstructured zeros can be prevented. [Effects of the Invention]

[0009] This disclosure helps prevent unintended disclosures due to unstructured zeros. [Brief explanation of the drawing]

[0010] [Figure 1] This is a functional block diagram of the privacy protection data aggregation device according to the first to fourth embodiments. [Figure 2] This is a flowchart showing the process of the first embodiment. [Figure 3] This is a diagram illustrating the process of the first embodiment. [Figure 4] This is a flowchart showing the process of the second embodiment. [Figure 5] This is a diagram illustrating the process of the second embodiment. [Figure 6] It is a flow chart showing the processing of the third embodiment. [Figure 7] It is a diagram for explaining the processing of the third embodiment. [Figure 8] It is a flow chart showing the processing of the fourth embodiment. [Figure 9] It is a diagram for explaining the processing of the fourth embodiment. [Figure 10] It is a functional block configuration diagram of a privacy-preserving data aggregation device according to the fifth to eighth embodiments. [Figure 11] It is a flow chart showing the processing of the fifth embodiment. [Figure 12] (a) is a diagram showing an example of user data and domain data of Company A, and (b) is a diagram showing an example of user data and domain data of Company B. [Figure 13] It is a diagram showing an aggregation image. [Figure 14] It is a diagram showing encryption of user data of Company A performed by Company A. [Figure 15] It is a diagram showing encryption of user IDs in user data of Company A performed by Company B. [Figure 16] It is a diagram showing encryption of user IDs in user data of Company B performed by Company B and Company A. [Figure 17] It is a diagram showing matching processing performed by Company B. [Figure 18] It is a diagram showing categorization of matched data performed by Company B. [Figure 19] It is a diagram showing aggregation processing performed by Company B. [Figure 20] It is a diagram showing concealment processing performed by Company B. [Figure 21] It is a diagram showing decryption processing performed by Company A. [Figure 22] It is a diagram for explaining a pattern that becomes structural zero. [Figure 23] It is a flow chart showing the processing of the sixth embodiment. [Figure 24] It is a diagram showing an example of a list with structural zero flags (flagged list). [Figure 25] This figure shows the aggregation process performed by Company B in the sixth embodiment. [Figure 26] This figure shows the confidentiality process performed by Company B in the sixth embodiment. [Figure 27] This figure shows the decoding process performed by Company A in the sixth embodiment. [Figure 28] This is a flowchart showing the processing of the seventh embodiment. [Figure 29] This figure shows the aggregation process performed by Company B in the seventh embodiment. [Figure 30] This figure shows the confidentiality process performed by Company B in the seventh embodiment. [Figure 31] This figure shows the decoding process performed by Company A in the seventh embodiment. [Figure 32] This is a flowchart showing the processing of the eighth embodiment. [Figure 33] This figure shows the aggregation process performed by Company B in the eighth embodiment. [Figure 34] This figure shows an example of the hardware configuration of a privacy-protecting data aggregation device. [Modes for carrying out the invention]

[0011] Hereinafter, the first to eighth embodiments of this disclosure will be described in order with reference to the drawings. Of these, the first embodiment describes a method for preventing unintended disclosure due to unstructured zeros in a privacy-protecting data aggregation device, and the second to fourth embodiments describe three ways to further prevent unintended disclosure due to structural zeros in the privacy-protecting data aggregation device of the first embodiment. The fifth embodiment describes a method for preventing unintended disclosure due to unstructured zeros through cooperation between the first and second devices included in the privacy-protecting data aggregation system, and the sixth to eighth embodiments describe three ways to further prevent unintended disclosure due to structural zeros in the privacy-protecting data aggregation system of the fifth embodiment.

[0012] [First Embodiment] In the first embodiment, the focus is on preventing unintended disclosure due to unstructured zeros, and a configuration for preventing unintended disclosure due to unstructured zeros in a standalone privacy-protected data aggregation device is described.

[0013] As shown in Figure 1, the privacy protection data aggregation device 10 of the first embodiment comprises, as functional blocks, a user data storage unit 11, a domain data storage unit 12, an attribute information encryption unit 13, an aggregation processing unit 14, a confidentiality processing unit 15, and a decryption unit 16. Each functional unit will be outlined below.

[0014] The user data holding unit 11 is a functional unit that holds user data to be aggregated, which includes multiple attribute information. For example, it holds user data such as ID, departure point, and arrival point, as shown in Figure 3 as "user data".

[0015] The domain data holding unit 12 is a functional unit that holds domain data that defines the possible values ​​for each attribute information included in the user data. For example, as shown in Figure 3, it holds domain data that indicates the possible values ​​for "departure point" (Narita, Haneda, Naha, ..., Kagoshima) and the possible values ​​for "arrival point" (Narita, Haneda, Naha, ..., Kagoshima).

[0016] In this embodiment, an example is described in which user data and domain data are pre-stored within the privacy protection data aggregation device 10. However, this data may also be input to the privacy protection data aggregation device 10 from an external device. In that case, the user data storage unit 11 and the domain data storage unit 12 do not become components of the privacy protection data aggregation device 10.

[0017] The attribute information encryption unit 13 is a functional unit that encrypts the attribute information in user data to be aggregated, which includes multiple attribute pieces of information, using a homomorphic encryption scheme that is capable of aggregation processing. As a homomorphic encryption scheme capable of aggregation processing, for example, an encryption scheme having additive homomorphism or complete homomorphism can be adopted.

[0018] The aggregation processing unit 14 is a functional unit that aggregates user data whose attribute information has been encrypted by the attribute information encryption unit 13 for all possible combinations of values ​​of multiple attribute information in the domain data described above, and obtains aggregated data including the aggregation result and encrypted attribute information.

[0019] The confidentiality processing unit 15 is a functional unit that performs confidentiality processing on the aggregated data obtained by the aggregation processing unit 14.

[0020] The decryption unit 16 is a functional unit that decrypts the aggregated data that has undergone confidentiality processing and obtains aggregated data that includes the aggregated results after confidentiality processing and the decrypted attribute information. Furthermore, the decryption unit 16 outputs the obtained aggregated data.

[0021] In the privacy-protecting data aggregation device 10 equipped with the functional blocks described above, the process shown in Figure 2 is executed.

[0022] First, the user data held by the user data holding unit 11 and the domain data held by the domain data holding unit 12 are read and acquired so that they can be executed in subsequent processing (step S1). As mentioned above, this data may also be acquired by being input (received) from an external device.

[0023] Next, the attribute information encryption unit 13 encrypts the attribute information of the user data using a homomorphic encryption method that allows for aggregation processing (for example, an encryption method having additive homomorphism or complete homomorphism) (step S2).

[0024] Next, the aggregation processing unit 14 aggregates user data with encrypted attribute information for all combinations of requirements in the domain data, and generates aggregated data with encrypted attribute information (step S3). As a result, aggregated data is generated that includes aggregated results (number of people) with encrypted attribute information (origin, destination), as shown in "Aggregated Data" in Figure 3. At this time, since user data is aggregated for all combinations of requirements in the domain data, even if a combination does not exist in the user data, all combinations that structurally exist are included in the aggregation without exception. For example, user data for the combination of origin "Kagoshima" and destination "Naha" does not exist in the user data, and the aggregation result (number of people) is "0 people", but it is included in the aggregated data as an aggregation result of "0 people" without being omitted. In other words, the situation in which unstructured zeros (combinations that structurally exist but are not output) occur can be avoided.

[0025] Next, the concealment processing unit 15 performs concealment processing on the aggregated data (step S4), and then the decryption unit 16 decrypts the concealed aggregated results to obtain aggregated data including the concealed aggregated results and the decrypted attribute information, and outputs it in plain text (step S5). As a result, aggregated data is obtained and output in which the attribute information (departure point, arrival point) has been decrypted and the aggregated result (number of people) has been concealed, as shown in "Concealed Aggregated Data" in Figure 3. As a result, user data for the combination of departure point "Kagoshima" and arrival point "Naha" does not exist in the user data, and the aggregated result (number of people) is "0 people", but it is included as an aggregated result of "0 people" in the aggregated data before concealment processing and as an aggregated result of "2 people" in the aggregated data after concealment processing.

[0026] As described above, according to the first embodiment, it is possible to avoid situations in which unstructured zeros (combinations that exist structurally but are not output) occur, and to prevent unintended disclosure due to unstructured zeros.

[0027] [Second Embodiment] In the second embodiment, in addition to the first embodiment which prevents unintended disclosure due to unstructured zeros, a further embodiment is described in which combinations of structured zeros are excluded from the confidentiality process and the aggregated result is fixed to zero, thereby preventing a situation in which the aggregated result of combinations of structured zeros becomes a non-zero value and the usefulness of the aggregated result (statistical information) decreases.

[0028] The functional block configuration of the privacy protection data aggregation device 10 in the second embodiment is the same as the configuration in Figure 1 described above, so redundant explanations will be omitted. However, among the functional units in Figure 1, the concealment processing unit 15 has the characteristic of referring to a flagged list in which combinations that do not exist among all possible combinations of values ​​of multiple attribute information in the domain data are flagged, fixing the aggregation result of the flagged combinations in the aggregated data to zero, and performing concealment processing on combinations that are not flagged in the aggregated data.

[0029] The "flaged list" mentioned above may, for example, be generated in advance and held by the domain data holding unit 12, or it may be generated by the domain data holding unit 12 from the domain data at that time, as described later.

[0030] In the privacy-protecting data aggregation device 10 of the second embodiment, the process shown in Figure 4 is executed. In Figure 4, the same step numbers are used for processes that are the same as those in the first embodiment (Figure 2), and a detailed explanation is omitted.

[0031] First, user data held by the user data holding unit 11 and domain data held by the domain data holding unit 12 are acquired so that they can be executed in subsequent processing (step S1). Next, the domain data holding unit 12 generates the aforementioned "flagged list" by assigning a structural zero flag to combinations that do not exist (combinations that can be structurally zero) among all possible combinations of values ​​of multiple attribute information in the domain data at that time (step S1A). For example, as shown in Figure 5 as the "flagged list", a structural zero flag of "1" is assigned to the combination of departure "Narita" and arrival "Narita" that does not exist, and similarly, a structural zero flag of "1" is assigned to the combination of departure "Narita" and arrival "Haneda" that does not exist, and the flag is set to "0" for existing combinations (for example, the combination of departure "Narita" and arrival "Naha"). Such a flagged list is transferred from the domain data holding unit 12 to the concealment processing unit 15 via the aggregation processing unit 14.

[0032] Subsequently, similar to the first embodiment, the attribute information encryption unit 13 encrypts the attribute information of the user data using a homomorphic encryption method capable of aggregation processing (for example, an encryption method having additive homomorphism or complete homomorphism) (step S2), and the aggregation processing unit 14 aggregates the user data with encrypted attribute information for all combinations of requirements in the domain data to generate aggregated data with encrypted attribute information (step S3). As a result, aggregated data including aggregated results (number of people) with encrypted attribute information (origin, destination) is generated, as shown in "Aggregated Data" in Figure 5. At this time, since the user data is aggregated for all combinations of requirements in the domain data, all combinations that structurally exist, even if they do not exist in the user data, are included in the aggregation without exception. Therefore, similar to the first embodiment, it is possible to avoid situations where unstructured zeros (combinations that structurally exist but are not output) occur.

[0033] Next, the concealment processing unit 15 refers to the flagged list and fixes the aggregated results of the flagged combinations in the aggregated data to zero, while also performing concealment processing on the combinations that are not flagged in the aggregated data (step S4A). This prevents a situation where the aggregated results of non-existent flagged combinations (combinations that can be structurally zero) are concealed and become non-zero values, thereby reducing the usefulness of the aggregated results (statistical information).

[0034] Subsequently, the decryption unit 16 decrypts the aggregated results after step S4A, in which non-existent combinations are fixed to zero, and obtains aggregated data including the aggregated results after concealment processing and the decrypted attribute information, which is output in plain text (step S5). As a result, aggregated data is obtained and output in which the attribute information (departure point, arrival point) is decrypted and the aggregated results (number of people) are concealed, as shown in "aggregated data after concealment processing" in Figure 5.

[0035] According to the second embodiment described above, the aggregated results (number of people) for combinations that could result in non-existent structural zeros (for example, the combination of departure "Narita" and arrival "Narita," and the combination of departure "Narita" and arrival "Haneda") are fixed to zero and output. This prevents situations where the aggregated results of non-existent combinations are anonymized and become non-zero values, thus reducing the usefulness of the aggregated results (statistical information). Furthermore, similar to the first embodiment, all structurally existing combinations, even if they do not exist in the user data, are included in the aggregation without exception. This avoids situations where unstructured zeros (combinations that structurally exist but are not output) occur, and prevents unintended disclosure due to unstructured zeros.

[0036] [Third Embodiment] In the third embodiment, in addition to the first embodiment which prevents unintended disclosure due to unstructured zeros, a further embodiment is described in which combinations of structured zeros are excluded from the aggregation process and not included in the aggregated data, thereby preventing a situation in which the aggregated result of combinations of structured zeros becomes a non-zero value due to subsequent concealment processing, and the usefulness of the aggregated result (statistical information) is reduced.

[0037] The functional block configuration of the privacy protection data aggregation device 10 of the third embodiment is the same as the configuration in Figure 1 described above, so redundant explanations will be omitted. However, among the functional units in Figure 1, the aggregation processing unit 14 has the characteristic of referring to a flagged list in which combinations that do not exist among all possible combinations of values ​​of multiple attribute information in the domain data are flagged, and aggregating the user data targeting combinations that are not flagged among all of the above combinations.

[0038] The "flaged list" mentioned above may, for example, be generated in advance and held by the domain data holding unit 12, or it may be generated by the domain data holding unit 12 from the domain data at that time, as described later.

[0039] In the third embodiment of the privacy protection data aggregation device 10, the process shown in Figure 6 is executed. In Figure 6, the same step numbers are used for processes that are the same as those in the first embodiment (Figure 2), and a detailed explanation is omitted.

[0040] First, user data held by the user data holding unit 11 and domain data held by the domain data holding unit 12 are acquired so that they can be executed in subsequent processing (step S1). Next, similar to the second embodiment, the domain data holding unit 12 generates the aforementioned "flagged list" by assigning a structural zero flag to combinations that do not exist (combinations that can be structurally zero) among all possible combinations of values ​​of multiple attribute information in the domain data at that time. For example, as shown in Figure 7 as the "flagged list", a structural zero flag of "1" is assigned to the combination of departure "Narita" and arrival "Narita" that does not exist, and similarly, a structural zero flag of "1" is assigned to the combination of departure "Narita" and arrival "Haneda" that does not exist, and the flag is set to "0" for existing combinations (for example, the combination of departure "Narita" and arrival "Naha"). Such a flagged list is transferred from the domain data holding unit 12 to the concealment processing unit 15 via the aggregation processing unit 14.

[0041] Then, similar to the first embodiment, the attribute information encryption unit 13 encrypts the attribute information of the user data using a homomorphic encryption method that allows aggregation processing (for example, an encryption method having additive homomorphism or complete homomorphism) (step S2). After that, the aggregation processing unit 14 refers to the flagged list and aggregates the user data with encrypted attribute information, targeting combinations that exclude the combinations with the above flag from all combinations of requirements (combinations with flag "0" in the example of Figure 5), and generates aggregated data with encrypted attribute information (step S3A). As a result, aggregated data including aggregated results (number of people) with encrypted attribute information (origin, destination) is generated, as shown in "Aggregated Data" in Figure 7. At this time, as shown by the strikethrough in Figure 7, non-existent combinations (combinations that can be structurally zero) are excluded from the aggregation processing and are not included in the aggregated data. Therefore, it is possible to prevent a situation in which the aggregated results of non-existent combinations (combinations that can be structurally zero) that are flagged are concealed and become non-zero values, thus reducing the usefulness of the aggregated results (statistical information). On the other hand, among all combinations of requirements, combinations with structural zeros are excluded from the aggregation process, while combinations other than those with structural zeros are included in the aggregation, even if they do not exist in the user data. Therefore, as in the first embodiment, it is possible to avoid situations where unstructured zeros (combinations that exist structurally but are not output) occur.

[0042] Subsequently, the concealment processing unit 15 performs concealment processing on the aggregated data (aggregated data with non-existent combinations excluded) (step S4), and the decryption unit 16 decrypts the concealed aggregated data to obtain aggregated data including the concealed aggregated results and decrypted attribute information, and outputs it in plain text (step S5). As a result, aggregated data is obtained and output as shown in "Concealed Aggregated Data" in Figure 7, in which non-existent combinations have been excluded, attribute information (departure point, arrival point) has been decrypted, and the aggregated results (number of people) have been concealed.

[0043] According to the third embodiment described above, the aggregated results (number of people) for combinations that could result in non-existent structural zeros (for example, the combination of departure "Narita" and arrival "Narita," and the combination of departure "Narita" and arrival "Haneda") are not output. This prevents a situation where the aggregated results of non-existent combinations are anonymized and become non-zero values, thus reducing the usefulness of the aggregated results (statistical information). Furthermore, similar to the first embodiment, all structurally existing combinations, even if they do not exist in the user data, are included in the aggregation without exception. This avoids the occurrence of unstructured zeros (combinations that structurally exist but are not output), and prevents unintended disclosure due to unstructured zeros.

[0044] [Fourth Embodiment] In the fourth embodiment, in addition to the first embodiment which prevents unintended disclosure due to unstructured zeros, we will describe a configuration in which the aggregation target is narrowed down based on an aggregation target list from which combinations of structured zeros have been excluded, and then the aggregation process is performed, thereby preventing a situation in which the aggregation result of combinations of structured zeros becomes a non-zero value due to subsequent concealment processing, and the usefulness of the aggregation result (statistical information) is reduced.

[0045] The functional block configuration of the privacy protection data aggregation device 10 of the fourth embodiment is the same as the configuration in Figure 1 described above, so redundant explanations will be omitted. However, among the functional units in Figure 1, the aggregation processing unit 14 has the characteristic of referring to an aggregation target list which lists combinations obtained by excluding non-existent combinations from all possible combinations of values ​​of multiple attribute information in the domain data, and aggregating the user data with respect to the combinations included in the aggregation target list.

[0046] The above-mentioned "list of items to be aggregated" may, for example, be generated in advance as described later and held by the domain data holding unit 12, or the domain data holding unit 12 may generate it from the domain data at that time.

[0047] In the fourth embodiment of the privacy protection data aggregation device 10, the process shown in Figure 8 is executed. In Figure 8, the same step numbers are used for processes that are the same as those in the first embodiment (Figure 2), and a detailed explanation is omitted.

[0048] First, the user data held by the user data holding unit 11 and the above-mentioned aggregation target list (a list describing combinations of attribute information that are structurally non-zero (subject to aggregation)) held by the domain data holding unit 12 are obtained so that they can be executed in subsequent processing (step S1B). As illustrated in Figure 9 as the "aggregation target list," the aggregation target list is a list that includes all possible "combinations of origin and destination," and all combinations in this list are subject to aggregation.

[0049] Then, similar to the first embodiment, the attribute information encryption unit 13 encrypts the attribute information of the user data using a homomorphic encryption method capable of aggregation processing (for example, an encryption method having additive homomorphism or complete homomorphism) (step S2). After that, the aggregation processing unit 14 aggregates the user data with encrypted attribute information for all combinations listed in the aggregation target list and generates aggregated data with encrypted attribute information (step S3B). As a result, aggregated data is generated that includes aggregated results (number of people) with encrypted attribute information (origin, destination) for all combinations listed in the aggregation target list, as shown in "Aggregated Data" in Figure 9. At this time, combinations that do not exist (combinations that can be structurally zero) are excluded from the aggregation target list, and are therefore not subject to aggregation processing and are not included in the aggregated data. This prevents a situation where the aggregation results of non-existent combinations (combinations that can be structurally zero) are concealed and become non-zero values, thus reducing the usefulness of the aggregated results (statistical information). On the other hand, among all combinations of requirements, combinations with structural zeros are excluded from the aggregation process, while combinations other than those with structural zeros are included in the aggregation, even if they do not exist in the user data. Therefore, as in the first embodiment, it is possible to avoid situations where unstructured zeros (combinations that exist structurally but are not output) occur.

[0050] Subsequently, the concealment processing unit 15 performs concealment processing on the aggregated data (aggregated data with non-existent combinations excluded) (step S4), and the decryption unit 16 decrypts the concealed aggregated data to obtain aggregated data including the concealed aggregated results and decrypted attribute information, and outputs it in plain text (step S5). As a result, aggregated data is obtained and output, as shown in "Concealed Aggregated Data" in Figure 9, with non-existent combinations excluded, attribute information (departure point, arrival point) decrypted, and the aggregated results (number of people) concealed.

[0051] According to the fourth embodiment described above, the aggregated results (number of people) for combinations that could result in non-existent structural zeros (for example, the combination of departure "Narita" and arrival "Narita," and the combination of departure "Narita" and arrival "Haneda") are not output. This prevents a situation where the aggregated results of non-existent combinations are anonymized and become non-zero values, thus reducing the usefulness of the aggregated results (statistical information). Furthermore, similar to the first embodiment, all structurally existing combinations, even if they do not exist in the user data, are included in the aggregation without exception. This avoids the occurrence of unstructured zeros (combinations that structurally exist but are not output), thus preventing unintended disclosure due to unstructured zeros.

[0052] [Fifth Embodiment] In the fifth embodiment, a configuration is described in which unintended disclosure due to unstructured zeros is prevented by cooperation between the first and second devices included in the privacy protection data aggregation system.

[0053] As shown in Figure 10, the privacy protection data aggregation system 1 of the fifth embodiment comprises a first device 20A that provides a first service and a second device 20B that provides a second service, and aggregates the number of target users through the cooperation of the first device 20A and the second device 20B in a process described later.

[0054] In this embodiment, the first device 20A and the second device 20B share the roles of executing a series of processes, and as will be described in detail later, as an example, the second device 20B performs matching, aggregation, and concealment processing, and the first device 20A performs decryption and output at the end. As functional blocks for this purpose, the first device 20A includes a domain data holding unit 21, an aggregation image generation unit 22, a user data holding unit 23, a first encryption unit 24, and a decryption unit 29, as shown by solid lines in Figure 10, and the second device 20B includes a domain data holding unit 21, an aggregation image generation unit 22, a user data holding unit 23, a second encryption unit 25, a matching unit 26, an aggregation processing unit 27, and a concealment processing unit 28, as shown by solid lines in Figure 10.

[0055] However, the above-described division of roles, in which the second device 20B performs matching, aggregation, and concealment processing, and the first device 20A performs decryption and output at the end, is merely one example. For example, the first device 20A and the second device 20B may have a common functional block configuration, such as including the functional unit shown by the dashed line in Figure 10. In that case, a division of roles in which the first device 20A performs matching, aggregation, and concealment processing, and the second device 20B performs decryption and output at the end, can also be realized.

[0056] The following is an overview of each functional unit. The user data holding unit 23 of the first device 20A is a functional unit that holds first user data, including a first user ID and first attribute information relating to a user of the first service, and the domain data holding unit 21 is a functional unit that holds domain data defining the possible values ​​of the first attribute information. Similarly, the user data holding unit 23 of the second device 20B is a functional unit that holds second user data, including a second user ID and second attribute information relating to a user of the second service, and the domain data holding unit 21 is a functional unit that holds domain data defining the possible values ​​of the second attribute information.

[0057] The aggregated image generation unit 22, which is included in both the first device 20A and the second device 20B, generates an aggregated image that describes all combinations of the first attribute information and the second attribute information, based on the first domain data that defines the possible values ​​of the first attribute information and the second domain data that defines the possible values ​​of the second attribute information, and shares this image with the second device 20B.

[0058] The first encryption unit 24 is a functional unit that encrypts the first user ID with the first device's user ID secret key and the first attribute information with the first device's attribute information secret key, and transmits the encrypted first user data, including the first user ID and first attribute information, to the second device 20B. It also receives the encrypted second user ID, which is obtained by encrypting the second user ID with the second device 20B's user ID secret key, from the second device 20B, encrypts the encrypted second user ID with the first device 20A's user ID secret key, and transmits it to the second device 20B.

[0059] The second encryption unit 25 is a functional unit that further encrypts the first user ID, which has been encrypted by the first encryption unit 24 with the user ID secret key of the first device, with the user ID secret key of the second device 20B, and also encrypts the second user ID with the user ID secret key of the second device 20B and transmits the encrypted second user ID to the first device 20A, where the first device 20A obtains the second user ID, which has been further encrypted with the user ID secret key of the first device 20A.

[0060] The matching unit 26 is a functional unit that matches the first user data encrypted by the first encryption unit 24 with the second user data by comparing the first user ID and the second user ID, which have both been encrypted with the secret key for the user ID of the first device 20A and the secret key for the user ID of the second device 20B.

[0061] The aggregation processing unit 27 is a functional unit that categorizes the matched data based on the unencrypted second attribute information in the second user data, aggregates the categorized matched data for all combinations described in the aggregation image above, and obtains aggregated data that includes the aggregation results for each combination of encrypted first attribute information and unencrypted second attribute information.

[0062] The concealment processing unit 28 is a functional unit that performs concealment processing on aggregated data obtained by the aggregation processing unit 27 by adding noise generated based on the publicly disclosed calculation key of the first device 20A to the aggregated data. Here, the aggregated data after noise addition satisfies differential privacy. As for the type of noise, for example, a Laplace mechanism, a Gaussian mechanism, or an exponential mechanism can be employed. The "noise" described in subsequent embodiments is also the same.

[0063] The decryption unit 29 is a functional unit that decrypts the aggregated data that has undergone confidential processing based on the publicly available calculation key of the first device 20A and the secret key for attribute information of the first device 20A, and obtains aggregated data that includes the confidential aggregated results after decryption for each combination of the decrypted first attribute information and the unencrypted second attribute information.

[0064] In the privacy-protecting data aggregation system 1 configured as described above, the process shown in Figure 11 is executed.

[0065] First, in the first device (also called the device of Company A) 20A, the first user data held by the user data holding unit 23 and the domain data held by the domain data holding unit 21 are read out and acquired so that they can be executed in subsequent processing (step S11A). As illustrated in Figure 12(a), the first user data is the user ID (ID A), including the departure and arrival locations, the above domain data includes possible values ​​for "Departure Location" (Haneda, Naha, Fukuoka, ...) and possible values ​​for "Arrival Location" (Haneda, Naha, Fukuoka, ...). In the first user data and domain data related to the first device (A company's device), the names of airports are used for "Departure Location" and "Arrival Location". Meanwhile, in the second device (also called B company's device) 20B, the second user data held by the user data holding unit 23 and the domain data held by the domain data holding unit 21 are acquired so that they can be executed in subsequent processing (step S11B). As illustrated in Figure 12(b), the second user data includes the user ID (ID B The domain data includes the origin, destination, and mode of transport, and the above domain data includes possible values ​​for "origin" (Haneda, Naha, Fukuoka, ...), possible values ​​for "destination" (Haneda, Naha, Fukuoka, ...), and possible values ​​for "mode of transport" (airplane, bullet train, car, ...). Prefecture names are used for "origin" and "destination" in the second user data and domain data related to the second device (B company's device).

[0066] Next, the aggregated image generation units 22 of the first and second devices work together to generate an aggregated image like Figure 13, which contains all combinations of the first attribute information and the second attribute information, based on the first domain data that defines the possible values ​​of the first attribute information and the second domain data that defines the possible values ​​of the second attribute information, and share this image with each other. As shown in Figure 13, the aggregated image includes all combinations of the first attribute information (A company's "departure point" and "arrival point") and the second attribute information (B company's "departure point", "arrival point", and "means of transport"), and a "aggregation result" column is provided for each combination.

[0067] Next, the first encryption unit 24 of the first device (device of company A) 20A, as shown in Figure 14, the first user ID in the first user data A The first user data is encrypted using Company A's private key a, and the first attribute information (origin, destination) is encrypted using Company A's private key A. The encrypted first user data is then sent to the second encryption unit 25 of the second device (Company B's device) 20B (step S13).

[0068] Next, the second encryption unit 25 of the second device (device of Company B) 20B encrypts the first user ID in the transmitted encrypted first user data as shown in FIG. 15 A further with the private key b of Company B (step S14), and encrypts the second user ID in the second user data as shown in FIG. 16 B with the private key b of Company B, and the encrypted second user ID B is sent to the first encryption unit 24 of the first device (device of Company A) 20A (step S15).

[0069] Next, the first encryption unit 24 of the first device (device of Company A) 20A encrypts the transmitted encrypted second user ID as shown in FIG. 16 B further with the private key a of Company A, and the encrypted second user ID B is sent to the second encryption unit 25 of the second device (device of Company B) 20B (step S16). The encrypted second user ID received by the second encryption unit 25 of the second device (device of Company B) 20B B is transferred to the matching unit 26.

[0070] Then, the matching unit 26 of the second device (device of Company B) 20B processes the encrypted second user ID as shown in FIG. 17 B including the second user data and the encrypted first user ID A including the first user data are matched based on the first and second user IDs encrypted with the private keys a and b (step S17), to obtain matched data. The matched data obtained here includes combinations of the first and second user data with matching IDs, and as illustrated in FIG. 17, includes first attribute information (departure place, arrival place) encrypted with the private key A of Company A, and unencrypted second attribute information (departure place, arrival place, transportation means). The matched data is transferred to the aggregation processing unit 27.

[0071] Next, the aggregation processing unit 27 of the second device (device of company B) 20B categorizes the matched data according to whether the unencrypted second attribute information (attribute information of company B) is common or not, as shown in Figure 18 (step S18). Furthermore, as shown in Figure 19, it aggregates the categorized matched data by category to generate aggregated data (step S19). Here, as shown in Figure 18, the "origin, destination, mode of transport" in the second attribute information is categorized into data for "Chiba, Okinawa, airplane" and data for "Tokyo, Osaka, Shinkansen". For the data for "Chiba, Okinawa, airplane", although the content is unknown because the first attribute information (Narita, Naha) is encrypted with company A's secret key A, it is determined that the first attribute information is the same because it is the same bit sequence, so the aggregation result is "2". On the other hand, regarding the "Tokyo, Osaka, Shinkansen" data, although the content is unknown because the first attribute information is encrypted with Company A's private key A, the data for "Haneda, Itami" and the data for "Haneda, Kansai International" are aggregated separately depending on whether the bit sequences are the same or not. The aggregate result for the data for "Haneda, Itami" is "2", and the aggregate result for the data for "Haneda, Kansai International" is "1". Furthermore, in this embodiment, the aggregation results are encrypted with Company A's calculation key, which is a type of public key.

[0072] The processes in steps S18 and S19 described above are performed on all combinations of first attribute information and second attribute information included in the aggregated image in Figure 13. Therefore, even if a combination does not exist in the user data, all structurally existing combinations are included in the aggregation without exception, thus avoiding the occurrence of unstructured zeros (combinations that exist structurally but are not output).

[0073] Next, the concealment processing unit 28 of the second device (device of company B) 20B performs concealment processing on the aggregated data (for example, adding noise generated by company B using company A's calculation key as shown in Figure 20), and sends the aggregated data after concealment processing to the decoding unit 29 of the first device (device of company A) 20A (step S20).

[0074] Then, the decryption unit 29 of the first device (A company's device) 20A decrypts the aggregated data after confidentiality processing that has been sent and outputs it as plaintext statistical information as shown on the right side of Figure 21 (step S21). At this time, the first attribute information included in the aggregated data after confidentiality processing is encrypted with A company's private key A, but the decryption unit 29 can use its own private key A, so it can decrypt the first attribute information. Also, the aggregated results included in the aggregated data after confidentiality processing are encrypted with A company's calculation key, but the decryption unit 29 can use its own calculation key, so it can decrypt the aggregated results as well.

[0075] According to the fifth embodiment described above, since aggregation and other processing are performed on all combinations of the first attribute information and the second attribute information, even if a combination does not exist in the user data, all structurally existing combinations are included in the aggregation without exception, thus avoiding the occurrence of unstructured zeros (combinations that exist structurally but are not output), and preventing unintended disclosure due to unstructured zeros. [Sixth Embodiment] In the sixth embodiment, in addition to the fifth embodiment which prevents unintended disclosure due to unstructured zeros, a further embodiment is described in which combinations of structured zeros are excluded from the confidentiality process and the aggregated result is fixed to zero, thereby preventing a situation in which the aggregated result of combinations of structured zeros becomes a non-zero value and the usefulness of the aggregated result (statistical information) decreases.

[0076] The functional block configuration of the privacy protection data aggregation system 1 of the sixth embodiment is the same as the configuration of Figure 10 described above, so redundant explanations will be omitted. However, among the functional units of Figure 10, the aggregation image generation unit 22 has the characteristic of generating a flagged list based on the generated aggregation image, by flagging combinations that do not exist (i.e., combinations with structural zeros) among the combinations described in the aggregation image. The concealment processing unit 28 has the characteristic of referring to the above flagged list, fixing the aggregation result to zero for the flagged combinations in the aggregation data, and performing concealment processing on combinations that do not have a flag in the aggregation data.

[0077] First, referring to Figure 22, we will explain the patterns that result in structural zeros in the user data of Company A and Company B. As shown in Figure 22, there are a total of four patterns that result in structural zeros, as follows: (1) to (4).

[0078] Pattern (1) is a pattern where the attribute information of Company A (or Company B) is the same. For example, this pattern is when both the "Departure Point" and "Arrival Point" in Company A's attribute information are "Haneda Airport". Note that in the table in Figure 22, "*" represents an arbitrary value, and if both the "Departure Point" and "Arrival Point" in Company A's attribute information are "Haneda Airport", then it falls under Pattern (1) regardless of the values ​​in Company B's attribute information.

[0079] Pattern (2) is a pattern in which the attribute information of Company A (or Company B) is different but does not exist as a combination. For example, in the attribute information of Company A, the "Departure Point" is "Haneda Airport" and the "Arrival Point" is "Narita Airport," which is a combination that does not exist.

[0080] Pattern (3) is a pattern in which the "Departure Point" attribute information in Company A's data and the "Arrival Point" attribute information in Company B's data are the same. For example, this pattern is when both the "Departure Point" in Company A's attribute information and the "Arrival Point" in Company B's attribute information are "Haneda Airport". In other words, while the attribute information of Company A and the attribute information of Company B can exist individually, combining them results in a combination that does not exist in other cases.

[0081] Pattern (4) is a pattern in which the attribute information "Departure" in Company A's data and the attribute information "Arrival" in Company B's data are different, but the combination does not exist. For example, the attribute information "Departure" in Company A's data is "Haneda Airport" and the attribute information "Arrival" in Company B's data is "Tokyo," which is a combination that does not exist. Similar to pattern (3) above, this is a pattern in which the attribute information of Company A and the attribute information of Company B can exist individually, but when combined they become a combination that does not exist.

[0082] In the sixth embodiment of the privacy protection data aggregation system 1, the process shown in Figure 23 is executed. In Figure 23, the same step numbers are used for processes that are the same as those in the fifth embodiment (Figure 11), and a detailed explanation is omitted.

[0083] First, the first user data and domain data of Company A's device 20A, and the second user data and domain data of Company B's device 20B are acquired so that they can be executed in subsequent processing (steps S11A, S11B). The aggregated image generation units 22 of the first and second devices then work together to generate and share an aggregated image like the one in Figure 13, which contains all combinations of the first attribute information and the second attribute information (step S12). Furthermore, by inputting structural zero patterns into the aggregated image, a flagged list with a structural zero flag, as shown in Figure 24, is generated (step S12A). Figure 24 illustrates a flagged list in which a column for "structural zero flag" has been added to the aggregated image. Note that Figure 24 only shows data with a structural zero flag of "1", but it goes without saying that the flag will be "0" for combinations of attribute information that are not structurally zero.

[0084] Subsequently, steps S13 to S18 in Figure 23 are performed in the same manner as in the fifth embodiment. Furthermore, the aggregation processing unit 27 of Company B's device 20B aggregates the user data (matched data) categorized based on Company B's attribute information for each category (step S19). Here, for example, as shown in Figure 25, a flagged list is used to obtain the aggregation result for each combination in the flagged list, and then aggregated data encrypted with the publicly available calculation key of Company A is obtained.

[0085] Then, as shown in Figure 26, the concealment processing unit 28 of Company B's device 20B refers to the flagged list and fixes the aggregated results to zero for combinations with the flag "1" in the aggregated data, and performs concealment processing (adding noise generated by Company B using Company A's calculation key) on combinations that are not flagged in the aggregated data, and sends the concealed aggregated data to the decoding unit 29 of the first device (Company A's device) 20A (step S20A). Furthermore, the decoding unit 29 of the first device (Company A's device) 20A decodes the received concealed aggregated data and outputs it as plaintext statistical information as shown on the right side of Figure 27 (step S21).

[0086] According to the sixth embodiment described above, the aggregated results for combinations with a flag of "1" in the flagged list (combinations that can be structurally zero) are fixed to zero and output without any concealment processing. This prevents situations where the aggregated results for non-existent combinations are concealed and become non-zero values, thus reducing the usefulness of the aggregated results (statistical information). Also, similar to the fifth embodiment, all combinations that structurally exist, even if they do not exist in the user data, are included in the aggregated results without exception. This avoids situations where unstructured zeros (combinations that structurally exist but are not output) occur, and prevents unintended disclosure due to unstructured zeros.

[0087] In the sixth embodiment, an example was shown in which the aggregated results for combinations with the flag "1" in the flagged list (combinations that can result in structural zero) are fixed to zero and output. However, instead, a form may be adopted in which the aggregated results for combinations with the flag "1" are not output.

[0088] [Seventh Embodiment] In the seventh embodiment, in addition to the fifth embodiment which prevents unintended disclosure due to unstructured zeros, a further configuration is described in which combinations of structured zeros are excluded from the aggregation process and not included in the aggregated data. This prevents a situation where the aggregated result of combinations of structured zeros becomes a non-zero value due to subsequent concealment processing, thereby reducing the usefulness of the aggregated results (statistical information).

[0089] The functional block configuration of the privacy protection data aggregation system 1 of the seventh embodiment is the same as the configuration of Figure 10 described above, so redundant explanations will be omitted. However, among the functional units of Figure 10, the aggregation image generation unit 22 has the characteristic of generating a flagged list based on an aggregation image that describes all combinations of first attribute information and second attribute information, and flagging combinations that do not exist (i.e., combinations with structural zeros) among the combinations described in the aggregation image. The aggregation processing unit 27 has the characteristic of aggregating user data targeting combinations that are not flagged by referring to the above flagged list.

[0090] In the seventh embodiment of the privacy protection data aggregation system 1, the process shown in Figure 28 is executed. In Figure 28, the same step numbers are used for processes that are the same as those in the fifth embodiment (Figure 11), and a detailed explanation is omitted.

[0091] First, the first user data and domain data of Company A's device 20A, and the second user data and domain data of Company B's device 20B are acquired so that they can be executed in subsequent processing (steps S11A, S11B). Similar to the sixth embodiment, an aggregated image like Figure 13, which describes all combinations of the first attribute information and the second attribute information, is generated and shared (step S12). By inputting a pattern of structural zeros into the aggregated image, a flagged list with structural zeros flagged as shown in Figure 24 is generated (step S12A).

[0092] Subsequently, steps S13 to S18 in Figure 23 are performed in the same manner as in the fifth embodiment. Furthermore, the aggregation processing unit 27 of Company B's device 20B aggregates the user data (matched data) categorized based on Company B's attribute information for each category. At this time, as shown in Figure 29, combinations with a flag are excluded, and the user data is aggregated using combinations without a flag (step S19A). In Figure 29, combinations excluded from aggregation are marked with a strikethrough.

[0093] Subsequently, the concealment processing unit 28 of Company B's device 20B performs concealment processing (in this case, adding noise generated by Company B using Company A's calculation key) on the aggregated data (in this case, aggregated data from which structural zeros have already been removed), as shown in Figure 30, and sends the concealed aggregated data to the decoding unit 29 of the first device (Company A's device) 20A (step S20). Furthermore, the decoding unit 29 of the first device (Company A's device) 20A decodes the received concealed aggregated data and outputs it as plaintext statistical information as shown on the right side of Figure 31 (step S21).

[0094] According to the seventh embodiment described above, combinations with a flag of "1" in the flagged list (combinations that can result in a structural zero) are not included in the aggregation and are not included in the aggregation results. This prevents situations where the aggregation results of non-existent combinations are concealed and become non-zero values, thus reducing the usefulness of the aggregation results (statistical information). Also, similar to the fifth embodiment, all combinations that exist structurally, even if they do not exist in the user data, are included in the aggregation without exception. This avoids situations where unstructured zeros (combinations that exist structurally but are not output) occur, and prevents unintended disclosure due to unstructured zeros.

[0095] In the seventh embodiment, an example was shown in which the aggregated results for combinations with the flag "1" in the flagged list (combinations that can result in a structurally zero value) are not output. However, instead, a form may be adopted in which the aggregated results for combinations with the flag "1" are fixed to zero and output.

[0096] [Eighth Embodiment] In the eighth embodiment, in addition to the fifth embodiment which prevents unintended disclosure due to unstructured zeros, we further describe a configuration in which the aggregation target is narrowed down based on an aggregation target list from which non-existent combinations are excluded, and then the aggregation process is performed, thereby preventing a situation in which the aggregation result of combinations with structured zeros becomes a non-zero value due to subsequent concealment processing, and thus reducing the usefulness of the aggregation result (statistical information).

[0097] The functional block configuration of the privacy protection data aggregation system 1 of the eighth embodiment is the same as the configuration of Figure 10 described above, so redundant explanations will be omitted. However, among the functional units of Figure 10, the aggregation image generation unit 22 has the characteristic of generating an aggregation target list which lists combinations obtained by removing non-existent combinations from the combinations described in the generated aggregation image, and the aggregation processing unit 27 has the characteristic of referring to the aggregation target list and aggregating user data targeting the combinations included in the aggregation target list.

[0098] In the eighth embodiment of the privacy protection data aggregation system 1, the process shown in Figure 32 is executed. In Figure 32, the same step numbers are used for processes that are the same as those in the fifth embodiment (Figure 11), and a detailed explanation is omitted.

[0099] First, in order to enable execution in subsequent processing, the first user data and domain data of Company A's device 20A, and the second user data and domain data of Company B's device 20B are acquired (steps S11A, S11B). Then, similar to the sixth and seventh embodiments, an aggregated image like Figure 13, which describes all combinations of the first attribute information and the second attribute information, is generated and shared (step S12).

[0100] Then, the aggregation image generation unit 22 generates an aggregation target list, as illustrated in the lower left of Figure 33, which lists the combinations obtained by removing any non-existent combinations from the combinations described in the generated aggregation image (step S12B).

[0101] Subsequently, steps S13 to S18 in Figure 23 are performed in the same manner as in the fifth embodiment. Furthermore, as shown in Figure 33, the aggregation processing unit 27 of Company B's device 20B refers to the aggregation target list and aggregates the user data (matched data) categorized based on Company B's attribute information for each combination listed in the aggregation target list, generating aggregated data (step S19B).

[0102] Subsequently, the concealment processing unit 28 of Company B's device 20B performs concealment processing (in this case, adding noise generated by Company B using Company A's calculation key) on the aggregated data (in this case, aggregated data from which structural zeros have already been removed), and sends the concealed aggregated data to the decoding unit 29 of the first device (Company A's device) 20A (step S20). Furthermore, the decoding unit 29 of the first device (Company A's device) 20A decodes the received concealed aggregated data and outputs it as plaintext statistical information (step S21).

[0103] According to the eighth embodiment described above, since only combinations listed in the aggregation target list, from which non-existent combinations have been excluded, are included in the aggregation, the aggregation results of non-existent combinations (combinations that could be structurally zero) are concealed and become non-zero values, thus preventing a decrease in the usefulness of the aggregation results (statistical information). Also, similar to the fifth embodiment, all combinations that are structurally existing, even if they do not exist in the user data, are included in the aggregation without exception, thus avoiding the occurrence of unstructured zeros (combinations that are structurally existing but not output), and preventing unintended disclosure due to unstructured zeros.

[0104] In the eighth embodiment, an example was shown in which the aggregation results for combinations that are listed in the aggregation image but not in the aggregation target list (combinations that can result in a structural zero) are not output. However, instead, a form may be adopted in which the aggregation results for the above combinations are fixed to zero and output.

[0105] (Explanation of terms, explanation of hardware configuration (Figure 34), etc.) The block diagrams used in the above descriptions of embodiments and modifications show functional units. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method of realizing each functional block is not particularly limited. That is, each functional block may be realized using one device that is physically or logically coupled, or it may be realized using two or more physically or logically separated devices that are directly or indirectly connected (for example, using wired or wireless connections). A functional block may also be realized by combining software with the one or more devices described above.

[0106] Functions include, but are not limited to, judgment, decision, judgment, calculation, calculation, processing, derivation, investigation, exploration, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, assumption, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating (mapping), and assigning. For example, a functional block (configuration part) that enables transmission is called a transmitting unit or transmitter. As mentioned above, the method of implementation is not particularly limited.

[0107] For example, the privacy-protected data aggregation device in one embodiment of this disclosure may function as a computer that performs the processing in this embodiment. Figure 34 is a diagram showing an example of the hardware configuration of the privacy-protected data aggregation device 10 according to one embodiment of this disclosure. The privacy-protected data aggregation device 10 described above may be physically configured as a computer device including a processor 1001, memory 1002, storage 1003, communication device 1004, input device 1005, output device 1006, bus 1007, etc. The first device 20A and the second device 20B shown in Figure 10 may also be configured in the same way as the privacy-protected data aggregation device 10.

[0108] In the following description, the term "device" can be replaced with "circuit," "device," "unit," etc. The hardware configuration of the privacy-protecting data aggregation device 10 may include one or more of the devices shown in the figure, or it may be configured to omit some of the devices.

[0109] Each function in the privacy protection data aggregation device 10 is realized by loading predetermined software (programs) onto hardware such as the processor 1001 and memory 1002, which allows the processor 1001 to perform calculations, control communication by the communication device 1004, and control at least one of data reading and writing in the memory 1002 and storage 1003.

[0110] The processor 1001 controls the entire computer, for example, by running an operating system. The processor 1001 may consist of a central processing unit (CPU) that includes interfaces with peripheral devices, control units, arithmetic units, registers, and so on.

[0111] Furthermore, the processor 1001 reads programs (program code), software modules, data, etc., from at least one of the storage 1003 and the communication device 1004 into the memory 1002 and executes various processes accordingly. The program used is one that causes the computer to execute at least a part of the operations described in the above embodiment. Although the above processes have been described as being executed by one processor 1001, they may be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The program may also be transmitted from a network via a telecommunications line.

[0112] Memory 1002 is a computer-readable recording medium and may consist of at least one of the following: ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. Memory 1002 may also be called a register, cache, main memory, etc. Memory 1002 can store executable programs (program code), software modules, etc., for carrying out a wireless communication method according to one embodiment of the present disclosure.

[0113] Storage 1003 is a computer-readable recording medium and may consist of at least one of the following: an optical disc such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disc, a digital multipurpose disc, a Blu-ray® disc), a smart card, flash memory (e.g., a card, a stick, a key drive), a floppy® disk, a magnetic strip, etc. Storage 1003 may also be called an auxiliary storage device. The above-mentioned storage medium may be, for example, a database including at least one of memory 1002 and storage 1003, or other suitable medium.

[0114] The communication device 1004 is hardware (transceiver / receiver device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as a network device, network controller, network card, communication module, etc.

[0115] The input device 1005 is an input device that accepts input from the outside (e.g., a keyboard, mouse, microphone, switch, button, sensor, etc.). The output device 1006 is an output device that outputs to the outside (e.g., a display, speaker, LED lamp, etc.). The input device 1005 and the output device 1006 may be configured as an integrated unit (e.g., a touch panel). Furthermore, each device such as the processor 1001 and memory 1002 are connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or different buses may be configured for each device.

[0116] Each aspect / embodiment described herein may be used individually, in combination, or switched between as needed during implementation. Furthermore, notification of specific information (e.g., notification that "X is") is not limited to explicit notification, but may also be implicit (e.g., by not providing such notification).

[0117] Although the present disclosure has been described in detail above, it will be clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the intent and scope of the present disclosure as defined by the claims. Therefore, the descriptions in the present disclosure are illustrative and not intended to be restrictive in any way.

[0118] The processing procedures, sequences, flowcharts, etc., of each aspect / embodiment described herein may be reordered, provided they are consistent with each other. For example, the methods described herein present various step elements in an exemplary order and are not limited to that specific order.

[0119] Input and output information may be stored in a specific location (e.g., memory) or managed using a management table. Input and output information may be overwritten, updated, or appended to. Output information may be deleted. Input information may be transmitted to other devices.

[0120] In this disclosure, the phrase "based on" does not mean "based solely on" unless otherwise specified. In other words, the phrase "based on" means both "based solely on" and "based at least on."

[0121] Where the terms “include,” “including,” and variations thereof are used in this disclosure, these terms are intended to be inclusive, as is the term “comprising.” Furthermore, the term “or” as used in this disclosure is not intended to mean exclusive OR.

[0122] In this disclosure, if articles are added through translation, such as a, an, and the in English, this disclosure may include the fact that the noun following these articles is plural.

[0123] In this disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "combine" may be interpreted similarly to "different." [Explanation of Symbols]

[0124] 1...Privacy protection data aggregation system, 10...Privacy protection data aggregation device, 11...User data storage unit, 12...Definition domain data storage unit, 13...Attribute information encryption unit, 14...Aggregation processing unit, 15...Confidentiality processing unit, 16...Decryption unit, 20A...First device, 20B...Second device, 21...Definition domain data storage unit, 22...Aggregation image generation unit, 23...User data storage unit, 24...First encryption unit, 25...Second encryption unit, 26...Matching unit, 27...Aggregation processing unit, 28...Confidentiality processing unit, 29...Decryption unit, 1001...Processor, 1002...Memory, 1003...Storage, 1004...Communication device, 1005...Input device, 1006...Output device, 1007...Bus.

Claims

1. An attribute information encryption unit that encrypts multiple attribute information contained in user data, An aggregation processing unit aggregates user data whose attribute information has been encrypted by the attribute information encryption unit for all possible combinations of values ​​of the plurality of attribute information, and obtains aggregated data including the aggregation result and the encrypted attribute information. A confidentiality processing unit performs confidentiality processing on the aggregated data obtained by the aforementioned aggregation processing unit, Equipped with, The aforementioned confidentiality processing unit, The aggregation result for all possible combinations of values ​​of the aforementioned multiple attribute information is fixed to zero for combinations that do not exist, and confidentiality processing is performed on combinations that do not exist. Privacy-protecting data aggregation device.

2. An attribute information encryption unit that encrypts multiple attribute information contained in user data, An aggregation processing unit aggregates user data whose attribute information has been encrypted by the attribute information encryption unit for all possible combinations of values ​​of the plurality of attribute information, and obtains aggregated data including the aggregation result and the encrypted attribute information. A confidentiality processing unit performs confidentiality processing on the aggregated data obtained by the aforementioned aggregation processing unit, Equipped with, The aforementioned aggregation processing unit, The user data is aggregated using all possible combinations of values ​​for the aforementioned multiple attribute information, excluding combinations that do not exist. Privacy-protecting data aggregation device.

3. An attribute information encryption unit that encrypts multiple attribute information contained in user data, An aggregation processing unit aggregates user data whose attribute information has been encrypted by the attribute information encryption unit for all possible combinations of values ​​of the plurality of attribute information, and obtains aggregated data including the aggregation result and the encrypted attribute information. A confidentiality processing unit performs confidentiality processing on the aggregated data obtained by the aforementioned aggregation processing unit, Equipped with, The aforementioned aggregation processing unit, The user data is aggregated using combinations obtained by excluding non-existent combinations from all possible combinations of values ​​for the aforementioned multiple attribute information. Privacy-protecting data aggregation device.

4. The confidentiality processing unit is: Based on domain data that defines the possible values ​​for each attribute information included in the user data, information regarding structurally non-existent combinations is generated, and such structurally non-existent combinations are treated as non-existent combinations, and the aggregated result is fixed to zero. The privacy protection data aggregation device according to claim 1.

5. The aggregation processing unit is: Based on domain data that defines the possible values ​​for each attribute information included in the user data, information on structurally nonexistent combinations is generated, and the user data is aggregated, focusing only on combinations that do not exist in that structure. The privacy protection data aggregation device according to claim 2.

6. The aggregation processing unit is: Based on domain data that defines the possible values ​​for each attribute information included in the user data, information on combinations other than structurally nonexistent combinations is generated, and the user data is aggregated, focusing on combinations other than those structurally nonexistent. The privacy protection data aggregation device according to claim 2.

Images