Information processing device, information processing method, and program

Abstract

To provide an information processing device, information processing method, and program for performing effective and appropriate anonymization processing and fictional naming processing on personal information.SOLUTION: An information processing system is provided, comprising acquisition means for acquiring data including personal information, processing means for processing the data acquired by the acquisition means, and display control means for providing control to display the data processed by the processing means, the display control means being configured to display a value indicative of anonymity of the processed data.SELECTED DRAWING: Figure 19

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] In recent years, analysis of data including personal information has been conducted in a wide range of fields, such as medical information and transportation usage history. It is also used in various situations in companies, such as creating new services and formulating policies and strategies.

[0003] In light of the increasing demand for analysis of data including personal information, the Act on the Protection of Personal Information was amended in 2017 to add a system of anonymously processed information in order to promote the utilization of personal information data, and a further amendment in 2020 added a system of pseudonymously processed information.

[0004] As legal systems are established, companies and organizations will be required to handle anonymously and pseudonymized information appropriately. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2011-113285 A DISCLOSURE OF THEINVENTION [Problem to be solved by the invention]

[0006] Patent Document 1 discloses a technology in which a user sets weights for identifiers, quasi-identifiers, and important information in input data, and conversion is performed that preserves k-anonymity in accordance with the set weights so as to minimize loss of usefulness.

[0007] In Patent Document 1, there is a problem that the user must determine and set the identifiers, quasi-identifiers, and important information for each attribute of the input data. In addition, there is a problem that the user cannot determine the processing method and processing level by simply setting the weights, and cannot select the processing method suitable for the user's purpose.

[0008] Therefore, there is a demand for technology that can easily determine whether each attribute of input data is an identifier, quasi-identifier, or sensitive information, and that can specify an arbitrary processing method for each attribute according to its intended use.

[0009] Therefore, an object of the present invention is to provide a technology for efficiently and appropriately anonymizing and pseudonymizing personal information. [Means for solving the problem]

[0010] The information processing system of the present invention comprises: an acquisition means for acquiring data including personal information; a processing means for processing the data acquired by the acquisition means; a display control means for controlling the display of the data processed by the processing means; The present invention is characterized by comprising: Effect of the Invention

[0011] According to the present invention, it becomes possible to carry out efficient and appropriate anonymization and pseudonymization of personal information. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a personal information processing system. [Diagram 2] A block diagram showing an example of the hardware configuration of an information processing device used as the personal information processing device 100, the personal information management server 110, and the data analysis terminal 120. [Diagram 3] A diagram showing the screen layout of the personal information processing tool [Figure 4] An example of a screen showing a list of datasets [Diagram 5] An example of the screen for registering a new dataset to be processed [Figure 6] An example of a screen that accepts various settings such as processing method [Figure 7] An example of a screen displaying detailed information about a dataset [Figure 8] An example of the evaluation result screen [Figure 9] An example of the screen when the deleted column is displayed [Figure 10] A diagram showing sample data arranged side by side [Figure 11] An example of the screen for outputting processed data [Figure 12] An example of the screen displayed when downloading processed data [Figure 13] An example of a screen for accepting input of files to be processed using the same data format [Figure 14] An example of a screen showing details of the output history [Figure 15] Flowchart showing the processing of personal information [Figure 16] Initial Settings Screen [Figure 17] A diagram showing information stored in the processing information storage area. [Figure 18] Flowchart showing details of column estimation process [Figure 19] Flowchart showing personal information processing for homogeneous data [Figure 20] Examples of data to be processed [Figure 21] An example of column type candidates and column label definitions [Figure 22] Icon that accepts instructions to switch data display layout [Diagram 23] A diagram showing the relationship between column types and conditions [Figure 24] A diagram showing the processing methods that can be selected when the column type is not set and their explanations [Diagram 25] A diagram showing the processing methods that can be selected when the column type is name and their explanations [Figure 26] A diagram showing the processing methods that can be selected when the column type is driver's license number and their explanations [Figure 27] A diagram showing the processing methods that can be selected when the column type is passport number and their explanations [Figure 28] A diagram showing the processing methods that can be selected when the column type is Basic Pension Number and their explanations [Figure 29] A diagram showing the processing methods that can be selected when the column type is Resident Record Code and their explanations [Diagram 30] A diagram showing the processing methods that can be selected when the column type is My Number (personal number) and their explanations [Diagram 31] A diagram showing the processing methods that can be selected when the column type is email address and their explanations [Diagram 32] A diagram showing the processing methods that can be selected when the column type is mobile phone number and their explanations [Diagram 33] A diagram showing the processing methods that can be selected when the column type is credit card number and their explanations [Diagram 34] A diagram showing the processing methods that can be selected when the column type is address and their explanations [Diagram 35] A diagram showing the processing methods that can be selected when the column type is zip code and their explanations [Diagram 36] A diagram showing the processing methods that can be selected when the column type is age and their explanations [Figure 37] A diagram showing the processing methods that can be selected when the column type is Date of Birth and their explanations [Figure 38] A diagram showing the processing methods that can be selected when the column type is phone number and their explanations [Figure 39] A diagram showing the processing methods that can be selected when the column type is organization name and their explanations [Diagram 40] A diagram showing the processing methods that can be selected when the column type is My Number (Corporate Number) and their explanations [Diagram 41] A diagram showing the processing methods that can be selected when the column type is job title and their explanations [Diagram 42]A diagram showing the processing methods that can be selected when the column type is gender and their explanations [Diagram 43] A diagram showing the processing methods that can be selected when the column type is position information and their explanations [Diagram 44] A diagram showing the processing methods that can be selected when the column type is disease name and their explanations [Diagram 45] A diagram showing the processing methods that can be selected when the column type is crime / penalty name and their explanations [Figure 46] A diagram showing the processing methods that can be selected when the column type is health check items and their explanations [Figure 47] A diagram showing the processing methods that can be selected when the column type is "Fault Classification" and their explanations [Figure 48] A diagram showing the processing methods that can be selected when the column type is an integer and their explanations [Figure 49] A diagram showing the processing methods that can be selected when the column type is numeric and their explanations [Figure 50] A diagram showing the processing methods that can be selected when the column type is date and their explanations [Figure 51] A diagram showing the processing methods that can be selected when the column type is date and time and their explanations [Figure 52] A diagram showing the processing methods that can be selected when the column type is number and their explanations [Diagram 53] A diagram showing the processing methods that can be selected when the column type is "item" and their explanations [Figure 54] A diagram showing the processing methods that can be selected when the column type is text and their explanations [Figure 55] A diagram showing the processing methods that can be selected when the column type is unknown and their explanations DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0014] FIG. 1 is a diagram showing an example of a configuration of a personal information processing system (information processing system) according to an embodiment of the present invention.

[0015] The personal information processing device 100 is configured to be connected to a personal information management server 110 and a data analysis terminal 120 via a network (LAN 130).

[0016] The personal information management server 110 stores and manages personal information, and provides the original personal information to be processed to the personal information processing device 100. The personal information processing device 100 holds the personal information only while the processing is being performed, and discards it after the processing is completed.

[0017] The data analysis terminal 120 is a terminal that accepts operations by a user and displays various screens, and performs data analysis, etc. by acquiring processed data from the personal information processing device 100. In the embodiment of the present invention, the processed data is acquired for the purpose of data analysis, but the purpose of use of the processed data is not particularly important.

[0018] Note that the system configuration in Figure 1 is just an example, and the system may be communicatively connected to devices not shown, or the functions of the personal information processing device 100, personal information management server 110, and data analysis terminal 120 may be provided in one or two devices, or any other configuration may be used.

[0019] FIG. 2 is a block diagram showing an example of a hardware configuration of an information processing device used as the personal information processing device 100, the personal information management server 110, and the data analysis terminal 120 in the embodiment of the present invention.

[0020] As shown in FIG. 2, the information processing device has a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, a RAM (Random Access Memory) 203, a storage device 204, an input controller 205, an audio controller 206, a video controller 207, a memory controller 208, and a communication I / F controller 209 connected via a system bus 200.

[0021] The CPU 201 comprehensively controls each device and controller connected to the system bus 200 .

[0022] ROM 202 or external memory 213 holds the BIOS (Basic Input / Output System) and OS (Operating System), which are control programs executed by CPU 201, computer-readable and executable programs for realizing this information processing method, and various necessary data (including data tables).

[0023] The RAM 203 functions as a main memory, a work area, etc., for the CPU 201. The CPU 201 loads programs and the like required for executing processes from the ROM 202 or the external memory 213 into the RAM 203, and executes the loaded programs to realize various operations.

[0024] The input controller 205 controls input from an input device such as a keyboard 210 or a pointing device such as a mouse (not shown). If the input device is a touch panel, the user can give various instructions by pressing (touching with a finger or the like) icons, cursors, or buttons displayed on the touch panel.

[0025] The touch panel may be a touch panel capable of detecting positions touched by multiple fingers, such as a multi-touch screen.

[0026] The video controller 207 controls display on an external output device such as a display 212. The display also includes the display of a notebook computer integrated with the main body. Note that the external output device is not limited to a display, and may be, for example, a projector. In addition, for the device capable of receiving the above-mentioned touch operation, an input device is also provided.

[0027] The video controller 207 is capable of controlling a video memory (VRAM) for display control, and can use part of the RAM 203 as the video memory area, or can provide a separate dedicated video memory.

[0028] The memory controller 208 controls access to the external memory 213. As the external memory, an external storage device (hard disk) for storing a boot program, various applications, font data, user files, edit files, and various data, a flexible disk (FD), or a compact flash (registered trademark) memory connected to a PCMCIA card slot via an adapter, etc., can be used.

[0029] The communication I / F controller 209 connects and communicates with external devices via a network, and executes communication control processing on the network. For example, communication using TCP / IP, telephone lines such as ISDN, and communication using 4G and 5G lines for mobile phones are possible.

[0030] The CPU 201 enables display on the display 212 by, for example, executing a process of expanding (rasterizing) an outline font in a display information area in the RAM 203. The CPU 201 also enables a user to give instructions using a mouse cursor (not shown) or the like on the display 212.

[0031] Next, a personal information processing tool according to the present invention (hereinafter referred to as this tool) will be described with reference to FIGS.

[0032] This tool generates anonymously processed information or pseudonymously processed information by processing tabular data, which is personal information. Although this embodiment targets tabular data, it may target formats such as JSON, and may be a collection of files in the same format instead of a single file. It may also be something that results in tabular data, such as a database query.

[0033] Anonymously processed information is information about an individual that is obtained by processing personal information so that a specific individual cannot be identified by deleting some of the descriptions and personal identification codes contained in the personal information, making it impossible to restore the personal information in question.

[0034] Pseudonymized information is information about an individual that has been obtained by processing personal information so that a specific individual cannot be identified unless it is compared with other information, by deleting some of the descriptions and personal identification codes contained in the personal information.

[0035] FIG. 3 shows the screen configuration of this tool, which is made up of an application bar 301 , a menu 302 , and a content area 303 .

[0036] An application bar 301 displays an icon for displaying this tool, an icon for displaying account information, the name of the selected data set, etc. A menu 302 displays functions provided by this tool. A content area 303 displays contents such as a list of data sets to be processed by this tool, the results of the processing, and various input screens.

[0037] Figure 4 is an example of a screen that displays a list of datasets. In the example in Figure 4, a dataset named "sample" is displayed. As shown in Figure 4, the dataset name, status (information showing the analysis and processing status of the dataset), processing type (pseudonym processing or anonymization), and update date and time are displayed. In addition, a delete icon is displayed in the rightmost column, and the dataset will be deleted when a selection is made on that icon.

[0038] FIG. 5 is an example of a screen for registering a new dataset to be processed, and is displayed when "New" is selected from the menu.

[0039] A data set name 501 is the name of the data set input by the user. If the input name is the same as the name of a data set that has already been registered, the user is notified of this fact and the name is controlled so that it cannot be set.

[0040] Administrator 502 is an item for setting the administrator of the data set, and is set to the signed-in account.

[0041] The processing type 503 is an item for accepting a setting of the type of processing for the data set, and accepts a selection of either anonymity processing or pseudonym processing from the user.

[0042] A pseudonymous ID generation method 504 is an item for accepting the setting of the generation method to be used in pseudonymization, and accepts the selection of either "correspondence table" or "hash (HMACSHA256)" from the user.

[0043] Pseudonym ID prefix 505 is an item that becomes effective when a correspondence table is selected as the pseudonymous ID generation method, and is pseudonymized in the format of "pseudonym ID prefix" + "random number".

[0044] Hash key update interval 506 is an item that accepts the update interval of the hash key in days.

[0045] Inventory period 507 is an item for accepting the setting of the inventory period of the data set. When the inventory period set here has elapsed since the processed data was output, the outputter (user) of the processed data is notified of the status of the processed data by e-mail or the like.

[0046] An input data file 508 is an item for accepting the designation of a file to be processed (converted into pseudonymously processed information or anonymously processed information).

[0047] By inputting the above items and pressing the Add button 509, the data set is registered as a data set to be processed. Then, a column type inference process is performed on the registered data set. The column inference process will be described in detail later.

[0048] FIG. 6 is an example of a screen that accepts various settings such as processing method.

[0049] The screen in FIG. 6 is displayed when a dataset that has completed the column estimation process and is ready for configuration is selected on the dataset list screen (FIG. 4).

[0050] The personal identification item pseudonymous ID assignment 601 displayed at the top of the screen accepts settings for whether to enable (assign) or not (assign) the function for assigning an ID to an individual identified by an item set as a personal identification item (described later), and displays the setting. It can be switched between ON (assign) and OFF (do not assign), and by setting it to ON, a pseudonymous ID will be assigned. Status 602 displays information indicating the status of analysis and processing of the data set.

[0051] Next, the reception of various settings and the display of the settings in FIG. 6 will be described.

[0052] In the column name 603, the value (column name) acquired from the first row of the data set to be processed is displayed.

[0053] A type 604 is a type inferred by a column inference process, which will be described later. The inferred type is set as the initial value, but the user can select any type using a pull-down menu. By accepting a selection from the user in this way, errors in the inference results can be corrected.

[0054] The processing method 605 is a processing method for the column data. The initial value is set to "unprocessed", and an arbitrary processing method is set by accepting a user's selection from a pull-down list. The processing methods displayed in the pull-down differ depending on the type selected in the type 604.

[0055] Processing methods that can be selected for each column type are shown in Fig. 24 to Fig. 55. Fig. 24 to Fig. 55 show processing methods that can be selected for each column type (the column type "Not Set (column type not set)" in Fig. 24, and the column type "Name" in Fig. 25) and explanations of the processing methods.

[0056] Among FIGS. 24 to 55, the processing methods that can be selected when the column type is "address" shown in FIG. 34 will be described here.

[0057] Figure 34 is a diagram showing the processing methods that can be selected when the column type is "Address" along with an explanation of the processing method. It shows that there are nine processing methods that can be selected: "Unprocessed," "Delete item," "Generalize (6 regional divisions)," "Generalize (8 regional divisions)," "Generalize (11 regional divisions)," "Generalize (Prefectures)," "Generalize (Cities, wards, towns, and villages): Tokyo's 23 wards only," and "Generalize (Cities, wards, towns, and villages: including wards of cities designated by government ordinance)."

[0058] The individual identification item 606 is a column for identifying an individual from among the data included in the data set. In other words, if the combination of values ​​of the columns selected as individual identification items is the same, the data is treated as relating to the same individual.

[0059] 6, a selection operation (click operation, touch operation, etc.) is performed on a circle shown in the column of the personal identification item to accept an instruction to set the item as a personal identification item. When the instruction is accepted, the color of the circle changes and a check mark is displayed.

[0060] The identifier 607 is a column of data contained in the data set that may be capable of independently identifying a specific individual.

[0061] The setting method is the same as for the personal identification item 606, but a type that will serve as an identifier may be registered in advance, and a column related to that type may be set as an identifier as an initial value.

[0062] The types of identifiers that are set as initial values ​​include "name (first and last name)", "driver's license number", "passport number", "basic pension number", "resident registration code", "My Number (personal identification number)", "email address", "mobile phone number", "credit card number", etc.

[0063] The quasi-identifier 608 is a column of data included in the dataset that may be able to identify a specific individual when combined with other columns.

[0064] The setting method is the same as for identifier 607, and the types of quasi-identifiers for which initial values ​​are set include "address," "zip code," "age," "date of birth," "telephone number," "organization name," "My Number (corporate number)," "job title," "gender," and "location information."

[0065] Sensitive information 609 is information that requires careful handling, such as credit card numbers and IDs and passwords, which may cause harm to individuals if leaked, as well as sensitive information such as medical history, disability classification, and criminal history.

[0066] The setting method is the same as for the identifier 607 and the quasi-identifier 608, and the types of information that are set as initial values ​​as sensitive information include "credit card number," "My Number (personal number)," "disease name," "crime name / penalty name," "health check item," "disability classification," and "annual income."

[0067] Based on the above settings, processing is performed on the data set.

[0068] Next, the statistics shown in FIG. 6 will be explained.

[0069] As shown in Figure 6, the statistical values ​​displayed for each column are "number of different types," "maximum value," "minimum value," "maximum frequency," "minimum frequency," "number of records," and "number of different types / number of records."

[0070] The number of different data 610 is a value indicating how many types of data exist in the column.

[0071] The maximum value of the data in the column is displayed as a maximum value 611. The minimum value of the data in the column is displayed as a minimum value 612. The maximum and minimum values ​​are displayed only for columns that are numeric data.

[0072] The maximum frequency 613 is the number of data items that appear most frequently (the most frequently occurring data items) among the data items in the column.

[0073] The minimum frequency 614 is the number of data items that occur least frequently among the data items in the column.

[0074] The record number 615 is the number of valid records in the column.

[0075] The number of different records / number of records 616 is the number of different columns divided by the number of records. The larger the value, the higher the possibility of identifying an individual.

[0076] Next, FIG. 7 shows an example of a screen displaying detailed information about a dataset, which is displayed when the dataset details button 619 in FIG. 6 is pressed.

[0077] As shown in Figure 7, the data set name, the person in charge of management, the processing type, whether or not to assign a pseudonymous ID to the personal identification item, the pseudonymous ID generation method, the pseudonymous ID prefix, the hash key update interval, the inventory period, the creation date and time, and the update date and time are displayed.

[0078] Next, a description will be given of the evaluation result screen, an example of which is shown in Fig. 8. The evaluation result screen is a screen that is displayed when the evaluation button 617 in Fig. 6 is pressed.

[0079] The k value in the processed k-anonymity is displayed in k-anonymity 801. The k value in k-anonymity is a value indicating how many individuals correspond to the same combination of quasi-identifiers, and k≧2 means that a single person cannot be identified. In other words, this indicates that in the processed data, there are at least k or more individuals corresponding to every combination of quasi-identifiers.

[0080] In l-diversity 802, the value of l in the processed l-diversity is displayed. The value of l in l-diversity is a value that indicates how many pieces of sensitive information there are (how many patterns there are) for data that have the same combination of quasi-identifiers. For example, even if there are multiple men in their 50s (i.e., k-anonymity is 2 or more), if all of the cases are high blood pressure, l-diversity is not satisfied (l=1), and anyone who knows what the data set is like would know that "that person has high blood pressure."

[0081] The statistical information display area 803 is an area that displays the statistical values ​​for each column before and after processing. Data whose values ​​have changed before and after processing is displayed in such a way that it is possible to distinguish that the data has changed before and after processing by changing the text color, font, size, etc.

[0082] The sample display area 804 is an area where the data of the data set before and after processing are displayed so that they can be compared. Data (item data) whose values ​​have changed due to processing are displayed so that the changes before and after processing can be easily identified by changing the character color, font, size, etc.

[0083] Display deleted columns 805 is an item that accepts a setting for whether or not to display columns deleted by processing when item deletion is set as the processing method, and displays the setting content. By turning on the "display deleted columns function", deleted columns are displayed in gray, etc.

[0084] Figure 9 shows an example of the screen when the setting is made to display deleted columns. The statistics and data of deleted columns are displayed so that it is easy to tell that they have been deleted (in the example of Figure 9, they are displayed in gray).

[0085] The arrangement switching icon 806 is an icon (button) that accepts an instruction to switch the arrangement of the data before and after processing in the sample display area 804, and is an icon that accepts an instruction to switch between horizontal arrangement (side to side) and vertical arrangement (top to bottom). The icon is a schematic representation of the display layout of the sample data.

[0086] When the icon is in the state shown in Figure 22 (A), the sample data is arranged vertically (Figures 8 and 9). When a selection operation such as a click is performed on the icon in this state, it changes to the icon shown in Figure 22 (B), and the arrangement of the sample data switches to a state where it is arranged horizontally (Figure 10).

[0087] Synchronized scrolling 807 is an item that accepts a setting for whether or not to synchronize the scrolling of the data before and after processing in the sample display area 804, and displays the setting content. When the synchronized scrolling function is ON, when a scroll operation is performed on either the data display area before or after processing, the other data is also scrolled and displayed. When it is OFF, only the data display area that accepted the scroll operation scrolls.

[0088] When the processing button 808 is pressed, processing is actually performed on the data set to be processed.

[0089] FIG. 11 is an example of a screen for outputting the processed data, and is displayed when "output" is selected from the menu.

[0090] A list of processed data and output history will be displayed as shown in Figure 11.

[0091] A list of processed data 1101 displays a list of processed data sets, along with the name of the data set, the k-anonymity value, the l-diversity value, and the creation date.

[0092] When the download icon on the right side of a record is selected, a dialog box for downloading the data set is displayed. An example of the dialog box is shown in Figure 12.

[0093] Furthermore, when a selection operation such as a click operation is received for a data set displayed in the list of processed data, the output history 1102 corresponding to the data set is displayed. When a selection of a record displayed in the output history is received, the output history details shown in FIG. 14 are displayed.

[0094] The "Process Same Type Data" button 1103 is a button that accepts an instruction to perform the same processing on a data set of the same type as the selected data set. When the "Process Same Type Data" button is pressed, the dialog shown in Fig. 13 is displayed, and processing is performed on the data file selected here.

[0095] Figure 12 is an example of a screen that is displayed when the processed data is downloaded, and is a screen that accepts the input of various information. The reason that the input of various information is accepted when downloading is because pseudonymized information is personal information, and it is necessary to manage when, to whom, what data was output, and for what purpose. The information entered here is managed as output history.

[0096] The information to be input includes output data, status, user, usage mode, destination, recipient's person in charge, purpose, and the like.

[0097] When an output button 1201 is pressed, the processed data is output.

[0098] Figure 14 is an example of a screen displaying details of the output history. Detailed information displayed includes the status (usage status of the output data), usage type, user (user name, user contact information), recipient, recipient person in charge, purpose, notes (special notes, etc.), output file name (file name of the processed data), last confirmation date, output date and time, and update date and time.

[0099] Next, the processing of personal information in the embodiment of the present invention will be described with reference to the flowchart of FIG.

[0100] FIG. 15 is a flowchart showing the process in which the CPU 201 of the personal information processing apparatus 100 reads out and executes a predetermined control program, and which performs anonymity or pseudonymization on tabular data including personal information acquired from the personal information management server 110.

[0101] In the embodiment of the present invention, the target data is in tabular format, but the target data may be in a format such as JSON, may be a collection of files in the same format instead of a single file, or may be something that results in tabular data, such as a database query.

[0102] In step S1501, an initial setting screen as shown in FIG. 16 is displayed, and a setting name 1601 for identifying the setting and a processing type 1602 ("pseudonym processing" or "anonymous processing") are acquired.

[0103] In step S1502, tabular data including personal information to be processed is obtained from the personal information management server 110.

[0104] Here, the setting name and processing type are set on the initial setting screen of FIG. 16, and the data to be processed is obtained from the personal information management server 110. However, as described above, the data to be processed and the processing method, etc. may be received using the screen of FIG. 5.

[0105] In step S1503, the column types are estimated for all columns of the table data acquired in step S1502. Details of the column estimation process will be described later with reference to the flowchart in FIG.

[0106] In step S1504, predetermined personal information attributes and processing methods for the column types estimated in step S1503 are obtained and set for each column as initial values ​​in the processing settings.

[0107] In step S1505, a setting screen as shown in FIG. 6 is displayed for the processing settings for which initial values ​​were set in step S1504, and the user is prompted to confirm and change the personal information attributes and processing method.

[0108] In this embodiment, the method is configured to select from typical processing methods (FIGS. 24 to 55) prepared in advance according to the column type, but it may be configured to allow detailed settings. Also, it may be possible to present processing methods that will result in evaluation values ​​such as k-anonymity satisfying certain conditions, or to control so that processing methods that do not satisfy the certain conditions cannot be selected.

[0109] On the setting screen, when the Evaluate button 617 is pressed, the processing settings are stored together with the settings acquired in S1501 in the processing setting storage table 1701 in the processing information storage area shown in Fig. 17, and the process proceeds to step S1506. When the End button 618 is pressed, the process ends.

[0110] In step S1506, values ​​that can evaluate anonymity, such as the k value (k-anonymity) and l value (l-diversity), when processing is performed according to the processing settings confirmed in step S1505, and statistical values ​​before and after processing for each column are calculated, and displayed on an evaluation screen such as that shown in Figure 8.

[0111] In step S1507, if the edit button is pressed on the evaluation screen, the process proceeds to step S1508, whereas if the cancel button is pressed, the process proceeds to step S1505.

[0112] In step S1508, the data to be processed is processed in accordance with the processing settings set in S1505.

[0113] In step S1509, if the processing type set in step S1501 is "pseudonym processing", the process proceeds to step S1510. If the processing type is "anonymization", the process proceeds to step S1511.

[0114] In step S1510, the processing information generated during processing is stored in the processing information storage table 602 in the processing information storage area 303 in association with the settings.

[0115] The processing information includes parameters and a correspondence table when hashing is used as a processing method.

[0116] In step S1511, the pseudonymously processed information or anonymously processed information that is the processing result is stored in the processing result storage table 1703 in the processing information storage area.

[0117] Column Estimation Next, the column estimation process according to the embodiment of the present invention will be described with reference to the flowchart of FIG.

[0118] In step S1801, repeated processing up to step S1807 is started for a column in tabular data including personal information to be processed.

[0119] In step S1802, the process starts to repeat up to step S1804 for the predefined column types (FIG. 23).

[0120] In step S1803, for each row of the column being processed, it is determined whether the condition defined for the type of the column being processed is met, and the number of matching rows is counted.

[0121] In step S1804, if there are other column types to be processed, the process repeats from step S1802. If there are no other column types to be processed, the process proceeds to step S1805.

[0122] In step S1805, the column type with the largest number of matching rows is set as the candidate column type for the column to be processed, that is, the type that is most appropriate as the column type is set as the candidate column type.

[0123] Even if a column type has the largest number of matching rows, if the proportion of the column that the type occupies is less than a specified value, the type may not be selected as a column type candidate.

[0124] In step S1806, if the combination of the column type candidate and the column label (column name) matches a predefined combination, the associated column type is set as the column type of the column to be processed. If they do not match, the column type candidate acquired in step S1805 is set as the column type.

[0125] An example of the definition of column type candidates and column labels is shown in Fig. 21. As shown in Fig. 21, a column type 2103 is registered in association with a combination of a column type candidate 2101 and a column label 2102.

[0126] In step S1807, if there are still columns to be processed, the process repeats from step S1801. If there are no more columns to be processed, the process ends.

[0127] Here, the predefined column types shown in FIG. 23 will be described.

[0128] As shown in Fig. 23, a column type 2301 and a condition 2302 are defined in association with each other. Conditions include those in which words (dictionary) are registered and whether or not the value of each row of the column matches the registered word is evaluated (determined) (in the example of Fig. 23, the conditions for the column types are "person's name", "place name", and "gender"), those that use regular expressions for determination (in the example of Fig. 23, the conditions for the column types are "postal code" and "date"), and those in which a value range is specified (in the example of Fig. 23, the condition for the column type is "weight"). In addition to the above, the number of digits or the number of characters may also be defined as a condition.

[0129] The column types in Fig. 23 are just an example, and other types may be registered (for example, the column types shown in Figs. 24 to 55). The conditions are also just an example.

[0130] Furthermore, instead of determining whether each row of a column meets a condition and selecting the column type that meets the maximum number of rows as the column type candidate, the most appropriate column type candidate may be identified by defining a condition such as the average or variance of the values ​​of each row of the column and evaluating whether the average or variance meets the condition.

[0131] It is also possible to identify free form based on the length of the text or the number of distinct values.

[0132] As described above, in this embodiment, the most suitable column type for the column to be processed is identified from among the pre-registered column types (FIG. 23) (the identified column type is set as a column type candidate), and the column type of the column is determined based on the combination of the identified column type candidate and the column label of the column to be processed. Specifically, if the combination of the identified column type candidate and the column label of the column to be processed is registered in the definition shown in FIG. 21, the column type associated with the combination of the identified column type candidate and the column label of the column to be processed is determined as the column type of the column.

[0133] Furthermore, if the combination of the identified column type candidate and the column label of the column to be processed is not registered in the definition of FIG. 21, the identified column type candidate is determined as the column type of the column.

[0134] Personal information processing of homogeneous data Next, the personal information processing process for homogenous data in the embodiment of the present invention will be described with reference to the flowchart of FIG.

[0135] In step S 1901 , settings designated by the user are obtained from the processing setting storage table 1701 .

[0136] In step S1902, tabular data of the same format as the settings obtained in step S1901 is obtained from the personal information management server as the processing target. "The same format" refers to data having the same column configuration and the same format for each column.

[0137] Note that, here, an example is described in which settings are accepted from a user, and tabular data in the same format as the settings is obtained as the data to be processed. However, as described above with reference to Figures 11 and 13, the data set to be processed may also be obtained by accepting the selection of a processed data set by the user, and accepting input of a data set of the same type as the selected data set.

[0138] In step S1903, processing information linked to the setting acquired in step S1901 is acquired from the processing information storage table 1702. If the processing type is "anonymous processing", there is no processing information because step S1510 has not been executed, and therefore new processing information is generated.

[0139] In step S1904, an evaluation similar to that in step S1506 is performed based on the acquired processing method and processing information, and the evaluation result is displayed on an evaluation screen such as that shown in FIG.

[0140] In step S1905, if the edit button is pressed on the evaluation screen, the process proceeds to step S1906, whereas if the cancel button is pressed, the process proceeds to step S1904.

[0141] The evaluation may be configured to include the processed data in the processing result storage table 1703 linked to the setting.

[0142] In step S1906, the data to be processed is processed in accordance with the processing settings.

[0143] In step S1907, if the processing type of the setting acquired in step S1901 is "pseudonym processing", the process proceeds to step S1908. If the processing type is "anonymity processing", the process proceeds to step S1909.

[0144] In step S1908, the processing information updated during processing is reflected in the processing information storage table 1702 in the processing information storage area 303.

[0145] In step S 1909 , the processed data is stored in the processing result storage table 1703 in the processing information storage area 303 .

[0146] When the user uses the processed data, the specified processed data is obtained from the processing result storage table 1703 and used.

[0147] Examples of personal information processing Next, as a specific example of personal information processing, a case where the personal information processing shown in FIG. 15 is performed on table-format data 2001 shown in FIG. 20 will be described.

[0148] In step S1501, it is assumed that the setting name "Purchase August" and the processing type "Kana processing" are acquired from the initial setting screen as shown in FIG.

[0149] In step S1502, table format data 2001 shown in FIG. 20 is acquired from the personal information management server as the processing target.

[0150] In step S1503, the column type estimation process shown in FIG. 18 is performed on the tabular data 2001 acquired in step S1502.

[0151] In step S1801, the process starts repetitively up to step S1807 for the first column 2002 ("Last Name") in the tabular data 2001.

[0152] In step S1802, the process starts to repeat up to step S1804 for the predefined column type "person's name."

[0153] In step S1803, for each row of column 2002 being processed, it is determined whether the condition defined for the column type "person's name" is met. The determination (condition) for the person's name is based on a dictionary prepared in advance. In column 1102, "Sato", "Takahashi", "Suzuki", "Tanaka", and "Fukuoka" are in the dictionary, so they are considered to be a match. As a result, the count for the column type "person's name" becomes 5.

[0154] In step S1804, if there is a next column type "place name", the process returns to step S1802.

[0155] In step S1802, the process starts to repeat up to step S1804 for the column type "place name".

[0156] In step S1803, for each row of the column 1102 being processed, it is determined whether the condition defined for the column type "place name" is met. The place name determination is also based on a dictionary prepared in advance. In column 1102, "Fukuoka" is found in the dictionary, so a match is made. As a result, the count for the column type "place name" becomes 1.

[0157] Thereafter, the same processes from S1802 to S1804 are repeated for the column types defined in the same manner.

[0158] In step S1805, the column type “person's name”, which has the maximum number of lines among the column types whose number of lines has been counted, is set as a candidate column type for column 2002.

[0159] In step S1806, since the combination of the column type candidate "person's name" and the column label "surname" does not match any predefined combination (FIG. 21), the column type of column 2002 is set to "person's name".

[0160] In step S1807, since there is still a column 2003 to be processed, the process is repeated from step S1801.

[0161] The same process is carried out for columns 2003 and 2004, and the column types are set to "person's name" and "gender", respectively.

[0162] Similarly, the processes from steps S1801 to S1805 are performed for column 2005, and “date” is obtained as a column type candidate for column 2005.

[0163] In step S1806, since the combination of the column type candidate "Date" and the column label "Date of Birth" matches the predefined combination 2102 (FIG. 21), the column type of column 2005 is set to "Date of Birth" from definition 2101.

[0164] Thereafter, the same process is repeated to estimate the column types for all columns.

[0165] In step S1504, predetermined personal information attributes and processing methods for the column types estimated in step S1503 are obtained and set for each column as initial values ​​in the processing settings.

[0166] In the tabular data 2101, an “identifier” is assigned to the columns “last name” and “first name”, a “quasi-identifier” is assigned to the columns “gender”, “date of birth”, and “address”, and “sensitive information” is assigned to the columns “annual income (yen)” as personal information attributes.

[0167] In step S1505, a setting screen as shown in FIG. 8 is displayed for the processing settings for which initial values ​​were set in step S1504, prompting the worker to confirm and change the personal information attributes and processing method.

[0168] The subsequent processing will be omitted.

[0169] As a result, it becomes easy to determine whether appropriate processing is required for "surname," "first name," "gender," "date of birth," and "address." Furthermore, it is possible to select any processing method for each column, and by repeating the evaluation, it becomes possible to consider a processing method that suits the purpose within an appropriate range.

[0170] In addition, the processing information is stored (step S1510) only in the case of pseudonym processing, and in the case of anonymization processing, re-identification from the processing result is not possible. On the other hand, in the case of pseudonym processing, by using the processing information, even when processing data of the same format such as monthly data at any time, it is possible to prevent identification of individuals from the processed data while maintaining identity and improving convenience.

[0171] The processing information is configured so that it cannot be easily obtained by users, and users will not easily re-identify themselves. Security can be further enhanced by periodically resetting (deleting) the processing information.

[0172] The present invention can be embodied, for example, as a system, an apparatus, a method, a program, or a recording medium, etc. Specifically, the present invention may be applied to a system composed of a plurality of devices, or may be applied to an apparatus composed of a single device.

[0173] Moreover, the program in the present invention is a program that enables a computer to execute the processing methods of the flowcharts shown in Figures 15, 18, and 19, and the storage medium of the present invention stores a program that enables a computer to execute the processing methods of Figures 15, 18, and 19. Note that the program in the present invention may be a program for each processing method of each device in Figures 15, 18, and 19.

[0174] As described above, it goes without saying that the object of the present invention can be achieved by supplying a recording medium on which a program that realizes the functions of the above-mentioned embodiments is recorded to a system or device, and having the computer (or CPU or MPU) of that system or device read and execute the program stored on the recording medium.

[0175] In this case, the program itself read out from the recording medium will realize the novel functions of the present invention, and the recording medium on which the program is recorded will constitute the present invention.

[0176] Examples of recording media for supplying the program include flexible disks, hard disks, optical disks, magneto-optical disks, CD-ROMs, CD-Rs, DVD-ROMs, magnetic tapes, non-volatile memory cards, ROMs, EEPROMs, silicon disks, etc.

[0177] Furthermore, it goes without saying that the functions of the above-mentioned embodiments are not only realized by the computer executing a program it has read, but also includes cases where an OS (operating system) running on the computer performs some or all of the actual processing based on the instructions of the program, and the functions of the above-mentioned embodiments are realized through that processing.

[0178] Furthermore, it goes without saying that this also includes cases where a program read from a recording medium is written into a memory provided on a function expansion board inserted into a computer or a function expansion unit connected to a computer, and then a CPU or the like provided on the function expansion board or function expansion unit performs some or all of the actual processing based on the instructions of the program code, thereby realizing the functions of the above-mentioned embodiments.

[0179] The present invention may be applied to a system consisting of multiple devices, or to an apparatus consisting of a single device. Needless to say, the present invention can also be applied to a case where the object is achieved by supplying a program to a system or apparatus. In this case, the effect of the present invention can be enjoyed by the system or apparatus by reading a recording medium storing a program for achieving the present invention into the system or apparatus.

[0180] Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or device can enjoy the effects of the present invention. Note that the present invention also includes configurations that combine the above-mentioned embodiments and their modified examples. [Explanation of symbols]

[0181] 100 Personal information processing device 110 Personal information management server 120 Data analysis terminal 120 130 LAN

Claims

1. A means for acquiring data including personal information; A selection receiving means for receiving a selection of a processing method for the data of a column constituting the data; a display control means for controlling the display of at least one of a value indicating anonymity of the data or a value indicating diversity of the data when the data is subjected to processing by the processing method selected by the selection receiving means; An information processing system comprising:

2. The display control means controls to display a processing method in which a value indicating anonymity or a value indicating diversity satisfies a predetermined condition, The information processing system according to claim 1, characterized in that the selection receiving means receives a selection of a processing method for the column data from among processing methods in which the value indicating anonymity or the value indicating diversity satisfies a predetermined condition.

3. The information processing system according to claim 1 or 2, further comprising a processing means for performing processing on the data of the column using the processing method selected by the selection receiving means.

4. An output instruction receiving means for receiving an instruction to output the data processed by the processing means; an output unit for outputting data in response to an instruction received from the output instruction receiving unit; an input receiving means for receiving, when an output instruction is received by the output instruction receiving means, an input of information relating to contact details of a user of the data for which the output instruction is received; A setting means for setting an inventory period for the data output by the output means; a notification means for notifying a contact of a user of the data received by the input receiving means when the inventory period set by the setting means has elapsed; 4. The information processing system according to claim 3, further comprising:

5. An information processing system as described in claim 3 or 4, characterized in that the display control means controls the display of data processed by the processing means.

6. An information processing system as described in any one of claims 3 to 5, characterized in that the display control means controls the display of data before processing by the processing means and data after processing in a comparable manner.

7. An information processing system as described in any one of claims 3 to 6, characterized in that the display control means controls the display of values ​​of the data that have been converted by processing by the processing means in an identifiable manner.

8. An information processing system as described in any one of claims 3 to 7, characterized in that the display control means controls the display of values ​​deleted from the data by processing by the processing means in an identifiable manner.

9. A receiving means for receiving an instruction as to whether or not to display data deleted by the processing process by said processing means, The information processing system according to any one of claims 3 to 8, characterized in that, when the display control means receives an instruction from the reception means to display the deleted data, the display control means controls the display of the deleted data in an identifiable manner.

10. An information processing system as described in any one of claims 3 to 9, characterized in that the display control means controls the display so that statistical values ​​of the data before processing by the processing means and statistical values ​​of the data after processing are displayed in a comparable manner.

11. The information processing system described in Claim 10, characterized in that the statistical values ​​include at least one of the number of variations, maximum value, minimum value, maximum frequency, minimum frequency, number of records, and number of variations / number of records.

12. An information processing device as described in any one of claims 1 to 11, characterized in that the value indicating the anonymity is the number of individual patterns corresponding to a combination of columns that can identify a specific individual in combination with other items.

13. An information processing system as described in any one of claims 1 to 12, characterized in that the value indicating the diversity is the number of patterns of sensitive information for a combination of columns that can identify a specific individual in combination with other items.

14. An acquisition step in which an acquisition means of an information processing system acquires data including personal information; a selection receiving step in which a selection receiving means of the information processing system receives a selection of a processing method for the data of a column constituting the data; a display control step of controlling a display control means of the information processing system to display at least one of a value indicating anonymity of the data or a value indicating diversity of the data when the data is processed by the processing method selected in the selection receiving step; An information processing method comprising:

15. A program for causing a computer to function as each of the means described in any one of claims 1 to 13.

Images