Data management system and method

Abstract

To provide data management that is transparent while maintaining access authority for data.SOLUTION: For each entity, there is an access policy including access authority of each (n)th-order data for use by an application or model. For each operation, there is a data log which is a log of data on the source or target of the operation and associated with an operation log. With respect to the operation log and / or data log, there is an entity list based upon the access policy. When one or more entity lists in which an entity specified based upon a request is recorded are found among a plurality of entity lists, a processor specifies a use state at the request based upon one or more operation logs and one or more data logs specified by using the one or more entity lists, and returns data representing the specified use state to the request source.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates generally to data management. [Background technology]

[0002] One example of data to be managed is privacy data such as patient medical data. In order to provide personalized medicine, it is necessary to segment patient characteristics at a fine level, which requires a large amount of privacy data. Federated learning is known as a method of model learning using privacy data.

[0003] Patent Document 1 discloses a technology related to privacy enhancement. Patent Document 2 discloses a technology related to federated learning. Patent Document 3 discloses a technology related to machine learning. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] US10,796,782 [Patent Document 2] US2021 / 0406782 [Patent Document 3] JP6782802 Summary of the Invention [Problem to be solved by the invention]

[0005] With the advent of a data distribution society, data providers may suffer unexpected disadvantages due to secondary and tertiary data use. Although it is possible to request the suspension, deletion, or disclosure of privacy data by applying for an opt-out, it is difficult to make an appropriate opt-out application if one does not know how the data is being used. In addition, if the history of data use is unclear (difficult to track), there is a risk that the number of data providers will decrease, making it difficult to provide personalized medicine.

[0006] For these reasons, the management of privacy data is also required in federated learning, and it is desirable to provide a transparent federated learning service. Furthermore, such issues may also arise in data management outside of federated learning.

[0007] Patent Documents 1 to 3 do not disclose or suggest such problems or means for solving such problems. [Means for solving the problem]

[0008] The storage device stores an access policy for each entity. For each entity, the access policy includes access rights for each n-th order data for use in an application or model for the entity for each of one or more operation attributes (n is two or more integers where n is an integer greater than or equal to 0). For each operation, the storage device stores an operation log that is a log of the operation, a data log that is associated with the operation log and corresponds to source data that is data for the operation, and / or a data log that is associated with the operation log and corresponds to target data that is data resulting from the operation. The storage device stores an entity list based on the access policy for the operation log and / or the data log. Each entity list includes an inclusion list that is a list of entities that are permitted to use data for the operation or data corresponding to the log with which the entity list is associated, and / or an exclusion list that is a list of entities that are prohibited from using data for the operation or data corresponding to the log with which the entity list is associated. In response to a request, if the processor finds one or more entity lists in which an entity identified based on the request is recorded from the multiple entity lists, the processor identifies usage conditions based on one or more operation logs and one or more data logs identified using the one or more entity lists, and returns data representing the identified usage conditions to the requester. Effect of the Invention

[0009] According to the present invention, it is possible to provide transparent data management while maintaining data access authority. [Brief description of the drawings]

[0010] [Figure 1] 1 shows the overall configuration of a system according to an embodiment of the present invention. [Diagram 2] 1 shows the configuration of a client-server system as a data management system. [Diagram 3] 13 shows a schematic flow of processing up to storage of feature amounts in a client computer. [Figure 4] 1 shows a schematic flow of processing relating to learning in a client computer and federated learning in a server computer. [Diagram 5] Shows multiple operation logs. [Figure 6] 1 shows multiple data logs. [Figure 7] Shows multiple user lists. [Figure 8] Shows multiple operation lists. [Figure 9] Indicates multiple access policies. [Figure 10A] The access policy before the access authority was changed is shown below. [Figure 10B] The access policy after the access permissions are changed is shown below. [Figure 11A] This shows the usage data before the access privileges were changed. [Figure 11B] The usage data after the access privileges are changed is shown. [Figure 12A] This shows the lineage represented by the lineage data before the access privileges were changed. [Figure 12B] The lineage represented by the lineage data after the access privileges are changed is shown. [Figure 13A] An example of contributed data before access permissions are changed is shown. [Figure 13B] An example of contributed data after access permissions have been changed is shown. [Figure 14] The functions possessed by the client computer and the server computer are shown below. [Figure 15] 1 shows the flow of usage management processing. [Figure 16] 1 shows the flow of lineage management processing. [Figure 17] The data processing flow is shown. [Figure 18] 1 shows the flow of a learning process. [Figure 19] The flow of the inference process is shown. [Figure 20] 1 shows the flow of a contribution management process. [Figure 21] 1 shows the flow of a first access management process. [Figure 22] 13 shows the flow of a second access management process. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] In the following description, an "interface unit" may be one or more interface devices. The one or more interface devices may be at least one of the following: One or more I / O (Input / Output) interface devices. The I / O (Input / Output) interface devices are interface devices to at least one of the I / O devices and a remote display computer. The I / O interface device to the display computer may be a communications interface device. The at least one I / O device may be a user interface device, e.g., either an input device such as a keyboard and pointing device, or an output device such as a display device. One or more communication interface devices. The one or more communication interface devices may be one or more homogeneous communication interface devices (e.g., one or more NICs (Network Interface Cards)) or two or more heterogeneous communication interface devices (e.g., a NIC and an HBA (Host Bus Adapter)).

[0012] In the following description, a "memory" refers to one or more memory devices, which are an example of one or more storage devices, and may typically be a primary storage device. At least one memory device in the memory may be a volatile memory device or a non-volatile memory device.

[0013] In the following description, a "persistent storage device" may be one or more persistent storage devices, which are an example of one or more persistent storage devices. A persistent storage device may typically be a non-volatile storage device (e.g., an auxiliary storage device), and more specifically, may be, for example, a hard disk drive (HDD), a solid state drive (SSD), a non-volatile memory express (NVME) drive, or a storage class memory (SCM).

[0014] Also, in the following description, "storage device" may be at least memory, including memory and persistent storage device.

[0015] Furthermore, in the following description, a "processor" may be one or more processor devices. The at least one processor device may typically be a microprocessor device such as a CPU (Central Processing Unit), but may also be other types of processor devices such as a GPU (Graphics Processing Unit). The at least one processor device may be a single-core or multi-core. The at least one processor device may be a processor core. The at least one processor device may also be a processor device in a broader sense, such as a circuit that is a collection of gate arrays written in a hardware description language that performs part or all of the processing (e.g., a Field-Programmable Gate Array (FPGA), a Complex Programmable Logic Device (CPLD), or an Application Specific Integrated Circuit (ASIC)).

[0016] In the following description, functions may be described using the expression "yyy unit", but the functions may be realized by one or more computer programs being executed by a processor, or by one or more hardware circuits (e.g., FPGA or ASIC), or by a combination thereof. When a function is realized by a program being executed by a processor, the function may be at least a part of the processor, since the specified processing is performed using a storage device and / or an interface device, etc., as appropriate. Processing described with a function as the subject may be processing performed by a processor or a device having the processor. A program may be installed from a program source. The program source may be, for example, a program distribution computer or a storage medium (e.g., a non-transitory storage medium) that can be read by a computer. The description of each function is an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0017] In the following description, information that provides an output for an input may be described using an expression such as "xxxDS", but the information may be data of any structure (for example, structured data or unstructured data), or may be a neural network that generates an output for an input, or a learning model such as a genetic algorithm or random forest. Therefore, "xxxDS" may be referred to as "xxx information". In the following description, the configuration of each table is an example, and one table may be divided into two or more tables, or all or part of two or more tables may be one table. "DS" is an abbreviation for dataset, and may be, for example, a database.

[0018] Furthermore, any information (for example, at least one of an "ID", a "name", and a "number") may be adopted as information for identifying an element (identification information, identifier).

[0019] In addition, in the following description, when describing elements of the same type without distinguishing between them, common reference symbols will be used, and when describing elements of the same type with distinction between them, reference symbols will be used.

[0020] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the following description.

[0021] FIG. 1 shows the overall configuration of a system according to an embodiment of the present invention.

[0022] The data management system according to this embodiment is a computer system including a plurality of computers 40. The data managed by the data management system according to this embodiment is medical data related to the medical care of the user (e.g., data representing information such as date of birth, sex, and medical history), but the present invention can also manage data other than medical data, such as data related to insurance, finance, or security (e.g., various types of privacy data).

[0023] At least one computer 40 can communicate with a user terminal 101. The user terminal 101 may be an information processing terminal such as a personal computer or a smartphone. Each computer 40 and each user terminal 101 is connected to a communication network 35. Communication between the computers 40 and communication between the computer 40 and the user terminal 101 is performed via the communication network 35. The communication network for communication between the computers 40 and the communication network for communication between the computer 40 and the user terminal 101 may be different.

[0024] The computer 40 may be a general-purpose computer or a dedicated computer. The computer 40 may be a physical computer or a logical computer (for example, a virtual machine or a cloud computing service).

[0025] The computer 40 illustrated in Fig. 1 is a physical computer. The computer 40 has an interface device 170, a storage device 120, and a processor 160 connected to them. The computer 40 can play the role of either a client or a server, or both. The data and functions possessed by the computer 40 differ depending on which role the computer 40 plays. The computer 40 illustrated in Fig. 1 can play the role of either a client or a server.

[0026] The interface device 170 communicates via the communication network 35. The storage device 120 stores data and programs. The processor 160 executes the programs.

[0027] The data stored in the storage device 120 include, for example, a user list DS132, an access policy DS133, a usage DS134, a provision DS135, an application DS136, a lineage DS137, a feature DS138, an operation list DS139, a contribution DS140, a model DS141, a log DS142, and a promotion DS143. The user list DS132 is a set of user lists. The access policy DS133 is a set of access policies for each user. The usage DS134 is a set of usage data (e.g., data representing the history of usage of an application or a model). The provision DS135 is a set of provision data (data available for data processing). The application DS136 is a set of application data (e.g., data as an application program itself or data including metadata of an application program). The lineage DS137 is a set of lineage data (e.g., lineage data representing how an application used provision data). The feature DS138 is a set of feature data of provision data. The feature data may include features of data for each user represented by the provided data, or may include features of the entire provided data. The operation list DS139 is a set of operation lists. The contribution DS140 is a set of contribution data (e.g., data representing the contribution of an application or a model). The model DS141 is a set of model data (e.g., data including data on the model itself and metadata of the model). The log DS142 is a set of logs. The promotion DS143 is a set of promotion data (e.g., data including data representing conditions for promotion to a user). Each DS may consist of one piece of data, but typically includes multiple pieces of data.

[0028] The processor 160 executes the programs in the storage device 120 to realize functions such as an associative learning control unit 121, an associative learning unit 122, a machine learning control unit 123, a data loading unit 124, a learning unit 125, a data preprocessing unit 126, an inference unit 127, a usage management unit 128, a lineage management unit 129, an access management unit 130, and a contribution management unit 131. These functions 121 to 131 will be described later. These functions 121 to 131 are realized on an OS (Operating System) 150, but at least some of these functions may be functions incorporated into the OS 150.

[0029] FIG. 2 shows the configuration of a client-server system as a data management system.

[0030] The data management system includes a plurality of client computers 100 and a server computer 110. Each of the plurality of client computers 100 may be a physical computer provided in a hospital or other location, or may be a logical computer in the cloud or the like. The server computer 110 may also be a physical computer or a logical computer. In this data management system, federated learning is performed.

[0031] The client computer 100 is a computer that plays the role of a client. The server computer 110 is a computer that plays the role of a server. One or both of the client computer 100 and the server computer 110 are capable of receiving a request (query) from the user terminal 101. In FIG. 2, for the same elements present in both the client computer 100 and the server computer 110, the reference numerals of the elements in the client computer 100 include a suffix "C" and the reference numerals of the elements in the server computer 110 include a suffix "S". A request may be transmitted from the client computer 100 to the server computer 110, or a request may be transmitted from the server computer 110 to the client computer 100.

[0032] The client computer 100 has a machine learning control unit 123, a privacy DS201, a data loading unit 124, a provision DS135, a data preprocessing unit 126, a feature DS138, a learning unit 125, a model DS141C, an inference unit 127, a user list DS132, an access policy DS133C, an application DS136C, a log DS142, a usage DS134C, a lineage DS137C, a contribution DS140C and a promotion DS143C.

[0033] Server computer 110 includes associative learning control unit 121, associative learning unit 122, model DS141S, operation list DS139, access policy DS133S, application DS136S, log DS142S, utilization DS134S, lineage DS137S, contribution DS140S, and promotion DS143S.

[0034] In this data management system, for example, the following processes are carried out.

[0035] The privacy DS201 is stored in the storage device 120 of the client computer 100. The privacy DS201 may be, for example, a hospital database, and includes privacy data. The privacy data is so-called raw data, and includes data related to the medical care of each of a plurality of users. The privacy data may exist for each period, for example. For example, privacy data may exist such as privacy data for January, privacy data for February, and so on.

[0036] In the client computer 100, the data load unit 124 acquires privacy data from the privacy DS201 in response to a request from the machine learning control unit 123, converts the privacy data into provided data (data that can be used for data processing), and includes the provided data in the provided DS135. The data preprocessing unit 126 acquires provided data from the provided DS135 in response to a request from the machine learning control unit 123, generates feature amount data of the provided data, and includes the feature amount data in the feature amount DS138. The learning unit 125 creates a model using the feature amount data in the feature amount DS138 (or re-learns the model in the model DS141C) in response to a request from the machine learning control unit 123, and includes the data of the model in the model DS141C. The inference unit 127 performs inference using the model in the model DS141C.

[0037] In the client computer 100, a data log and an operation log are generated as appropriate and stored in the log DS142C. Furthermore, a user list is generated as appropriate and stored in the user list DS132. Furthermore, the machine learning control unit 123 appropriately refers to or updates the user list DS132, the access policy DS133C, the application DS136C, the log DS142, the usage DS134C, the lineage DS137C, the contribution DS140C, and the promotion DS143C.

[0038] In this embodiment, the applications are as follows. The application DS136 includes data representing each application (e.g., AID and other data). From the application DS136, the AID and other data for the application in this embodiment can be identified. Data loading process (a process of acquiring data from the privacy DS201, performing filtering and anonymization, and storing the processing results in the provision DS135). Data preprocessing (a process of acquiring data from the provided DS135, generating features to be used in learning, and storing the features in the feature DS138). Learning process (a process of acquiring features from the feature DS138, generating a model based on the features, and storing the model in the model DS141C). Federated learning process (a process that cooperates with the above learning process, exchanges model information (also called parameters) between the server computer 110 and the client computer 100, generates an integrated model from multiple models on the server computer 110 side, and stores the integrated model in the model DS141S). Inference processing (processing for obtaining a model from the model DS141C, obtaining data to be inferred from the privacy DS201, the provision DS135, or the feature DS138, and generating an inference result using the model and data).

[0039] These processes (applications) may be instructed from the user terminal 101 to the client computer 100 or the server computer 110 as appropriate (or all at once). In order to prevent leakage of personal user data (e.g., privacy data or data related thereto), the federated learning process among the above may be executed by the server computer 110, and the processes other than the federated learning process among the above may be executed by the client computer 100.

[0040] In the client computer 100, the machine learning control unit 123 acquires model data in the model DS141C and transmits the model data to the server computer 110. The server computer 110 receives model data from a plurality of client computers 100, and the federated learning control unit 121 includes the received model data in the model DS141S. In the server computer 110, in response to a request from the federated learning control unit 121, the federated learning unit 122 acquires model data from a plurality of client computers 100 from the model DS141S, generates model data based on the model data (for example, generates merged model data), and transmits the generated model data to each of the plurality of client computers 100. In the client computer 100 that receives the model data from the server computer 110, the machine learning control unit 123 includes the model data in the model DS141C. Thereafter, the model represented by the latest model data received from the server computer 110 is used for learning by the learning unit 125 or for inference by the inference unit 127.

[0041] In the server computer 110, the federated learning control unit 121 appropriately refers to or updates the operation list DS139, the access policy DS133S, the application DS136S, the log DS142S, the usage DS134S, the lineage DS137S, the contribution DS140S, and the promotion DS143S. For example, the DS133S, 136S, 142S, 134S, 137S, 140S, and 143S in the server computer 110 may include the DS133C, 136C, 142C, 134C, 137C, 140C, and 143C in each client computer 100.

[0042] FIG. 3 shows a schematic flow of processing up to storage of features in the client computer 100. In FIG.

[0043] A data log 31-1 of the privacy data in the privacy DS201 is stored in the log DS142C. The data load unit 124 acquires privacy data corresponding to the data log 31-1, generates provision data based on the privacy data, and includes the provision data in the provision DS135. In this series of operations (processing), the data load unit 124 generates an operation log 32-1 based on the data log 31-1, and generates a data log 31-2 corresponding to the stored provision data based on the operation log 32-1. The data load unit 124 also generates a user list 33-1 associated with the operation log 32-1, and also generates a user list 33-3 associated with the data log 31-2.

[0044] The data preprocessing unit 126 acquires provided data, generates three types of feature amount data based on the provided data, and includes the three types of feature amount data in the feature amount DS 138. In this series of operations (processing), the data preprocessing unit 126 generates an operation log 32-3 based on the data log 31-2, and generates data logs 31-a to 31-c corresponding to the three types of stored feature amount data based on the operation log 32-3. The data loading unit 124 also generates a user list 33-3 associated with the operation log 32-3, and also generates user lists 33-a to 33-c associated with the data logs 31-a to 31-c.

[0045] The machine learning control unit 123 includes the data logs 31-1, 31-2, and 31-a to 33-c and the operation logs 32-1 and 32-3 in the log DS142C. The machine learning control unit 123 also includes the user lists 33-1 to 33-3 and 33-a to 33-c in the user list DS132.

[0046] In the example shown in Figure 3, three types of feature data (feature data used to train the model, feature data used to verify the model, and feature data used to evaluate the model) are generated for one piece of provided data, but the number of types of feature data generated may be more or less than three.

[0047] In addition, a user list 33 is generated for each data log and each operation log. The user list 33 corresponding to the data includes a list of users whose data is included in the corresponding data (data corresponding to the data log) and / or a list of users whose data is not included in the corresponding data. The user list 33 corresponding to the operation log includes a list of users whose data is included in the target data (data as the target of the operation corresponding to the operation log) and / or a list of users whose data is not included in the target data.

[0048] FIG. 4 shows a schematic flow of processing related to learning in the client computer 100 and associative learning in the server computer 110. In FIG.

[0049] In this process, as described with reference to FIG. 3, the user list 33 is generated for each data log and each operation log.

[0050] In the client computer 100A, the learning unit 125A acquires feature data and learns, verifies, or evaluates a model. Take learning as an example. The learning unit 125A acquires training feature data and learns a model, and transmits the learned model data to the server computer 110. In this series of operations (processing), the learning unit 125A generates an operation log 32-4 based on a data log 31-a1 corresponding to the training feature data. A user list 33-4 is associated with the operation log 32-4.

[0051] In the client computer 100A, the learning unit 125A includes the data of the model after learning in the model DS 141C. The learning unit 125A generates a data log 31-6 corresponding to this data. The user list 33-6 is associated with the data log 31-6.

[0052] In the client computer 100A, the inference unit 127A performs inference using the learned model. The inference unit 127A generates an operation log 32-7 corresponding to this inference. A user list 33 may be associated with this operation log 32-7.

[0053] In the client computer 100B, the learning unit 125B acquires training feature data, learns a model, and transmits the learned model data to the server computer 110. In this series of operations (processing), the learning unit 125B generates an operation log 32-5 based on the data log 31-a2 corresponding to the training feature data. A user list 33-5 is associated with the operation log 32-5.

[0054] In the server computer 110, the associative learning unit 122 generates model data by merging the model data from the client computers 100A and 100B, and includes the merged model data in the model DS141S. The associative learning unit 122 generates an operation log 32-8 corresponding to this associative learning, and also generates a data log 31-9 corresponding to the merged model data. The associative learning unit 122 generates an operation list 34-8 associated with the operation log 32-8, and also generates an operation list 34-9 associated with the data log 31-9. The associative learning control unit 121 includes the logs 32-8 and 31-9 in the log DS142S, and includes the operation lists 34-8 and 34-9 in the operation list DS139.

[0055] The transmission of model data from multiple client computers 100 to the server computer 110 and the merging of the model data (federated learning) on ​​the server computer 110 may be repeated. The server computer 110 may transmit data of the most accurate merged model to each client computer 100. That is, the transmission of the merged model data to each client computer 100 may be performed each time a merged model is obtained, or may be performed after the merging of models is repeated.

[0056] FIG. 5 shows a number of operation logs 32.

[0057] 5 shows multiple rows, each of which is one operation log 32. The operation log 32 has information such as Log ID 501, Location 502, Application ID 503, Date 504, Type 505, Sub Type 506, Source 507, Target 508, List ID 509, Use 510, and Reproduction 511. These pieces of information 501 to 511 will be explained using one operation log 32 as an example.

[0058] Log ID 501 indicates the OID (operation ID) of the corresponding operation (the operation corresponding to operation log 32). Location 502 indicates the location where the corresponding operation was performed.

[0059] Application ID 503 indicates the AID (Application ID) of the application to which the corresponding operation belongs. In the AID, "DP" means Data Preprocessing. "LT" means Learning (Training). "LV" means Learning (Validation). "LE" means Learning (Evaluation). "I" means Inference. "FL" means Federated Learning.

[0060] Date 504 indicates the date and time when the corresponding operation was performed (the unit of date and time may be year, month, day, hour, minute, and second, or may be coarser or finer than that). Type 505 indicates the type of function that implemented the corresponding application. Sub Type 506 indicates the details of the corresponding application when the function that implemented the corresponding application is the learning unit 125 (specifically, whether it is Training, Validation, or Evaluation).

[0061] Source 507 represents the ID of data as input in the corresponding operation. Target 508 represents the ID of data as output in the corresponding operation. "PDID" means the ID of the provided data. "FSID" means the ID of the feature data. "MID" means the ID of the model.

[0062] The List ID 509 indicates the ID of the user list 33 or the operation list 34 associated with the corresponding operation. “ULID” means the ID of the user list 33. “OLID” means the ID of the operation list 34.

[0063] Use 510 indicates whether or not use of the application to which the corresponding operation belongs is permitted. "Approve" means that use is permitted. "Disapprove" means that use is prohibited. Note that if the application provider does not prohibit use of the application, "Approve" (available) may follow.

[0064] Reproduction 511 indicates whether or not reproduction of output data (data identified from Target 508) by the corresponding operation is possible. "Possible" means that reproduction is possible. "Impossible" means that reproduction is impossible.

[0065] According to the multiple operation logs 32 shown in FIG. 5, for example, the following is true: The operation corresponding to Location 502 “US1” was performed in one client computer 100, and the operation corresponding to Location 502 “US2” was performed in another client computer 100. The operation corresponding to Location 502 “Cloud-1” was performed in the server computer 110. According to Source 507 and Target 508 of operation log 32 of Log ID 501 “OID-001” to “OID-003”, data was input and output in the order of privacy DS201 → provision DS135 → feature DS138 → model DS141C. According to operation log 32 of Log ID501 “OID-005” and “OID-006”, data was obtained from feature DS138, inference was performed using a model in model DS141C, and the data output by the inference was provided to the user (user terminal 101).

[0066] FIG. 6 shows a number of data logs 31 .

[0067] 6 shows multiple rows, each of which is one data log 31. The data log 31 has information such as Log ID 601, Location 602, Date 603, Type 604, Sub Type 605, Data 606, Version 607, List ID 608, Use 609, and Reproduction 610. These pieces of information 601 to 610 will be explained using one data log 31 as an example.

[0068] Log ID 601 indicates the DID (data ID) of the corresponding data. The "corresponding data" referred to here is data corresponding to an operation, and the DID is the ID of the log related to that data. Location 602 indicates the location where the corresponding data exists. Date 603 indicates the date and time when the corresponding data was obtained.

[0069] The Type 604 indicates the type of the corresponding data. The Sub Type 605 indicates a process or application that uses the corresponding data.

[0070] Data 606 indicates an ID recognized in an operation as the ID of the corresponding data (specifically, an ID linked to Source 507 or Target 508 in FIG. 5). Version 607 indicates the version of the corresponding data.

[0071] The List ID 608 indicates the ID of the user list 33 or operation list 34 associated with the corresponding data.

[0072] Usage 609 indicates whether or not the use of the application that processes the corresponding data is permitted. "Approve" means that the use is permitted. "Disapprove" means that the use is prohibited.

[0073] Reproduction 610 indicates whether reproduction of the corresponding data is possible or not. "Possible" means that reproduction is possible. "Impossible" means that reproduction is impossible.

[0074] An operation log 32 is generated (output) using the data log 31 as input, and a data log 31 is generated (output) using the operation log 32 as input. According to Fig. 5 and Fig. 6, for example, it is as follows. That is, an operation log 32 of Log ID 501 "OID-001" is generated using the data log 31 of Log ID 501 "DID-001" as input (for example, Data 606 "Raw-001" is handed over to Source 507). Next, a data log 31 of Log ID 501 "DID-002" is generated using the operation log 32 of Log ID 501 "OID-001" as input (for example, "PDID-001" in Target 508 is handed over to Data 606 and reflected in Type 604).

[0075] According to the examples shown in FIGS. 5 and 6, the following can be said (details will be described later). A user list 33 or an operation list 34 is managed for each operation or data. This makes it possible to know which users used / did not use data for each operation or data. Data lineage can be constructed by tracing the input / output relationship between the operation log 32 and the data log 31. This makes it possible to understand when and how user data was used. - The availability of use and the availability of reproduction are managed. This makes it possible to manage processes and data that have lost reproducibility due to changes in access rights.

[0076] FIG. 7 shows a plurality of user lists 33 .

[0077] 7 shows multiple rows, each of which is one user list 33. The user list 33 has information such as List ID 701, Log ID 702, Location 703, Version 704, Exclusion Users 705, and Inclusion Users 706. These pieces of information 701 to 706 will be explained using one user list 33 as an example.

[0078] List ID 701 indicates the ID of the user list 33. Log ID 702 indicates the ID of the corresponding log (the operation log 32 or data log 31 with which the user list 33 is associated). Location 703 is the same information as Location 502 or 601 contained in the corresponding log. Version 704 indicates the version of the user list 33.

[0079] Exclusion Users 705 is a list of users (e.g., a list of user names) who are excluded (not included) from the data or operation corresponding to the corresponding log. Inclusion Users 706 is a list of users who are included from the data or operation corresponding to the corresponding log. According to the example shown in FIG. 7, for example, it is as follows. · Alice: A user who refused to provide data to machine learning / federated learning (see the row with “OID-001” in Figure 7 and Figure 5). Bob: A user who refused to provide data to the application (AID-123) (see the row with “OID-002” in Figure 7 and Figure 5). Ellen: A user who was prohibited from using her data for training features (see the row with “DID-013” in Figure 7 and Figure 6). · Frank: A user who was banned from using their data for training and validation features (see the rows with “DID-013” and “DID-014” in Figure 7 and Figure 6). · Carol: A user who attends multiple hospitals (in Fig. 7, "Carol" is written in both the rows with Location 703 "US-1" and "US-2").

[0080] FIG. 8 shows a number of operation lists 34 .

[0081] 8 shows multiple rows, each of which is one operation list 34. The operation list 34 has information such as a List ID 801, a Log ID 802, a Location 803, a Version 804, Exclusion Operations 805, and Inclusion Operations 806. These pieces of information 801 to 806 will be explained using one operation list 34 as an example.

[0082] List ID 801 indicates the ID of the operation list 34. Log ID 802 indicates the ID of the corresponding log (the operation log 32 or data log 31 with which the operation list 34 is associated). Location 803 is the same information as Location 502 or 601 contained in the corresponding log. Version 804 indicates the version of the operation list 34.

[0083] Exclusion Operations 805 is a list of operations or data (e.g., a list of OIDs or DIDs) that are excluded (not included) with respect to the corresponding data or operation in the corresponding log. Inclusion Operations 806 is a list of operations or data that are included with respect to the corresponding data or operation in the corresponding log.

[0084] Furthermore, by having the server computer 110 have an operation list 34 instead of a user list 33, when there are multiple client computers 100, the server computer 110 can manage the operation log 32 and data log 31 for each client computer 100, and it is also possible not to inform the server computer 110 of the user's name.

[0085] Furthermore, the operation list 34 is used in the server-side processing shown in Fig. 22. For example, if the reproducibility of a certain preprocessing is lost, the reproducibility of the learning process / federated learning process using the features of that preprocessing is also lost. If the reproducibility of "OID-005" in Fig. 5 is lost, it is necessary to propagate the inability to reproduce to "OID-027" in Fig. 5 and "MID-027" in Fig. 6. To realize this propagation, the operation list 34 in Fig. 8 is used.

[0086] FIG. 9 shows multiple access policies.

[0087] The access policy DS133 has an access policy 910 for each user. Each access policy 910 has a column 901 for each operation attribute. Each column 901 indicates the access authority (e.g., "permitted" or "prohibited") for each data type. The access policy 910 for each user is reflected in the user list 33 and the operation list 34.

[0088] For example, for Alice, there is only one operation attribute, "hold". Therefore, the access policy 910-1 for Alice is composed of one column 901-1. According to the access policy 910-1, Alice's data may be included in privacy data, but it is prohibited for Alice's data to be used for provided data, feature data, and model data. In other words, Alice is a user who has refused to provide data to machine learning / federated learning, and for example, "Alice" is set in Exclusion Users 705 of the user list 33 of "ULID-001".

[0089] Also, for example, for Ellen, there are three operation attributes: "reference", "create", and "hold". Therefore, Ellen's access policy 910-2 is composed of three columns 901-2a, 901-2b, and 901-2c. According to the access policy 910-2, Ellen's data is prohibited from being used as training feature data (and training model data). In other words, Ellen is a user who is prohibited from using her data as training feature data, and for example, "Ellen" is set in Exclusion Users 705 of user list 33 of "ULID-013".

[0090] Also, for example, the operation attributes for Frank are three: "reference", "create", and "retain". For this reason, Frank's access policy 910-3 is composed of three columns 901-3a, 901-3b, and 901-3c. According to column 901-3a, the use of training and validation feature data is prohibited, but the use of training and validation model data is permitted. This means that the use of models that were previously generated using feature data that includes Frank's data is permitted.

[0091] Below, taking Ellen as an example, examples of the access policy 910-2, usage data, lineage data, and contribution data before and after the change in access authority are shown.

[0092] FIG. 10A shows an access policy 910-2 before the access authority is changed. FIG. 11A shows usage data before the access authority is changed. FIG. 12A shows the lineage represented by the lineage data before the access authority is changed. FIG. 13A shows an example of contribution data before the access authority is changed. The data shown in FIG. 10A, FIG. 11A, FIG. 12A, and FIG. 13A is data corresponding to Ellen.

[0093] 11A shows a portion of the usage data in the Usage DS 134C. The usage data includes information such as ID 1101, Date 1102, Application / Model ID 1103, Start Date 1104, End Date 1105, Available Models (Total 1107, Using Training Data 1108, Using Validation Data 1109, and Using Evaluation Data 1110), Unavailable Models (Total 1111, Using Training Data 1112, Using Validation Data 1113, and Using Evaluation Data 1114), and Usage Counts 1115.

[0094] ID 1101 indicates the ID of the usage data. Date 1102 indicates the acquisition date and time of the usage data. Application / Model ID 1103 indicates the ID of the application or model corresponding to the usage data. Start Date 1104 indicates the start date and time of the application or model corresponding to the usage data. End Date 1105 indicates the end date and time of the application or model corresponding to the usage data.

[0095] Regarding Available Models, Total 1107 indicates the total number of available models, and information 1108 to 1110 indicates the breakdown thereof. That is, Using Training Data 1108 indicates the number of available models for training, Using Validation Data 1109 indicates the number of available models for validation, and Using Evaluation Data 1110 indicates the number of available models for evaluation. An application includes multiple models (versions), and when used for inference, the most accurate model is used. Specifically, for example, when the application is "cancer risk prediction," multiple models may be prepared for one application, such as a prediction model prepared in one month and a prediction model prepared in the next month.

[0096] Concerning Unavailable Models, Total 1111 indicates the total number of unavailable models, and information 1112 to 1114 indicate the breakdown thereof. That is, Using Training Data 1112 indicates the number of unavailable training models, Using Validation Data 1113 indicates the number of unavailable validation models, and Using Evaluation Data 1114 indicates the number of unavailable evaluation models.

[0097] Usage Counts 1115 indicates the number of times a model corresponding to the usage data is used, or the number of times a model belonging to an application corresponding to the usage data is used.

[0098] The lineage illustrated in FIG. 12A has a DAG structure with DID (data log 31) or OID (operation log 32) as a node. For example, by tracing the data log 31 having a DID identified using the AID as a key, from the data log 31 having the DID to the operation log 32 and the data log 31, it is possible to identify the model used among the models belonging to the application corresponding to the AID. The AID, DID, OID, and MID shown in FIG. 12A (and FIG. 12B) correspond to the AID, DID, OID, and MID in FIG. 5 and FIG. 6. For example, the flow from AID (123) to MID (027) is a flow related to federated learning. Also, the flow from AID (123) to MID (101) means that the verification feature data corresponding to "DID-014" was reused. In this way, it is possible to know how the application corresponding to AID (123) used the data (data such as Ellen's data).

[0099] 13A is a part of the contribution data in the contribution DS 140C. The contribution data includes information such as ID 1301, AID 1302, MID 1303, contribution level (information amount 1304 and general information amount), and meta information (number of available data 1306 and total number of data 1307).

[0100] An ID 1301 indicates an ID of the contribution data. An AID 1302 indicates an ID of the application corresponding to the contribution data. An MID 1303 indicates an ID of the model corresponding to the contribution data.

[0101] The amount of information 1304 is the amount of information of data involved in the model corresponding to the contributing data, and is based on the number of available data 1306 and the total number of data 1307 .

[0102] The number of available data 1306 indicates the number of data of the target user (e.g., "Ellen") of the application corresponding to the contributed data. For example, "100" means that there are 100 pieces of data for the target user (100 pieces of data among the data provided to the application). In the federated learning process, the "number of available data" means the number of pieces of data of the target user included in the privacy DS201 of all client computers 100.

[0103] The total number of data 1307 indicates the total number of data in the privacy DS 201. For example, “100000” means that there are 100000 pieces of data in the privacy DS 201. In the federated learning process, the “total number of data” means the number of pieces of data included in the privacy DS 201 of all client computers 100.

[0104] The amount of information 1304 is, for example, −log 2 (the number of available data items 1306 / the total number of data items 1307). Therefore, in the case illustrated in FIG 13A, the amount of information 1304 is “9.97”.

[0105] The generic information amount 1305 is the amount of information of data that can be used generically for data related to the model corresponding to the contributing data, and is based on the information amount 1304 and the access authority setting (e.g., the number of "permissions") for the operation attribute "creation" for the model corresponding to the contributing data. Specifically, for example, the generic information amount 1305 is the product of the information amount 1304 and the number of "permissions" for Validation and Evaluation for the operation attribute "creation" for the model corresponding to the contributing data. Therefore, when the number of "permissions" is 2, the generic information amount 1305 is "19.94", as illustrated in FIG. 13A.

[0106] In this way, the degree of contribution represented by the contribution data is based on the amount of information in the data related to the model corresponding to the contribution data and the access authority related to the model.

[0107] Fig. 10B shows the access policy 910-2 after the access authority is changed. Fig. 11B shows the usage data after the access authority is changed. Fig. 12B shows the lineage data after the access authority is changed. Fig. 13B shows an example of the contribution data after the access authority is changed.

[0108] As shown in FIG. 10B, for each of the operation attributes “reference” and “create” of the access permissions represented by access policy 910-2, the use of Ellen’s data as feature data for verification is changed from “allowed” to “prohibited,” and the use of Ellen’s data as a model for verification is changed from “allowed” to “prohibited.”

[0109] 11B, the available models for both "AID-123" and "MID-001" are changed to unavailable models. That is, for "AID-123", Using Validation Data 1109 for Available Models is changed from "3" to "0", and Using Validation Data 1113 for Unavailable Models is changed from "0" to "3". Similarly, for "MID-001", Using Validation Data 1109 for Available Models is changed from "1" to "0", and Using Validation Data 1113 for Unavailable Models is changed from "0" to "1".

[0110] As a result of this change in access authority, data corresponding to "DID-014" (feature data for verification corresponding to the unusable model for verification), data corresponding to "DID-116" (feature data for verification corresponding to the unusable model for verification), "DID-016" (data of the unusable model for verification), and "DID-037" (data of the model in which the unusable model for verification is merged by federated learning) become unusable, as shown in Fig. 12B. Specifically, for example, use 609 in the data log 31 corresponding to these data is changed to "Disapprove".

[0111] Furthermore, as a result of this access authority change, the access authority for Validation is "prohibited" and the access authority for Evaluation is "permitted", so the number of "permitted" becomes 1. Therefore, the general information amount 1305 is "9.97", the same as the information amount 1304.

[0112] FIG. 14 shows the functions that the client computer 100 and the server computer 110 have.

[0113] A usage management unit 128, a lineage management unit 129, an access management unit 130, and a contribution management unit 131 exist in both the client computer 100 and the server computer 110. Hereinafter, for each of these functions 129 to 131, the function in the client computer 100 will be labeled "client," and the function in the server computer 110 will be labeled "server."

[0114] The client usage management unit 128C and the server usage management unit 128S communicate with each other. The client lineage management unit 129C and the server lineage management unit 129S communicate with each other. The client access management unit 130C and the server access management unit 130S communicate with each other. The client contribution management unit 131C and the server contribution management unit 131S communicate with each other.

[0115] The user terminal 101 can issue a request to either the server computer 110 or the client computer 100. For example, when the target relates to a specific location, the user terminal 101 may issue a request to the client computer 100 related to that location. On the other hand, when the target relates to all locations, the user terminal 101 may issue a request to the server computer 110.

[0116] Some processes performed in this embodiment will be described below.

[0117] FIG. 15 shows the flow of the usage management process.

[0118] The client usage management unit 128C receives a usage management request from the user terminal 101, either via or not via the server usage management unit 128S, and performs the processes from S1501 onwards in response to the request.

[0119] In S1501, the client usage management unit 128C searches for a target from the user list DS132, and acquires a target ID, which is an OID and / or DID, for the found target. The "target" in this paragraph may be an element that satisfies a condition specified in a request from the user terminal 101. For example, when "Ellen" is hit as the "target," the target ID is "OID-004" (see FIG. 7). Note that the scope of the target search is Inclusion Users 705, but Exclusion Users 706 may be adopted instead of Inclusion Users 705 as the scope of the target search. This point may be the same in S1601 and / or S2001 instead of or in addition to S1501.

[0120] In S1502, the client usage management unit 128C uses the target log to identify whether a model has been generated. In this paragraph, the "target log" refers to the log (operation log 32 and / or data log 31) corresponding to the target ID acquired in S1501. In S1502, for example, by searching multiple operation logs 32 of the log DS142C using "OID-004" as a key, it is possible to identify that a model of "MID-001" has been generated (see FIG. 5).

[0121] In S1503, the client usage management unit 128C uses the target log (based on the use 510 or 609 of the target log) to specify whether the model can be used. The client usage management unit 128C also specifies how the provided data was processed to generate the model, and specifies whether the model can be used for each data processing (for example, for each of Training, Validation, and Evaluation). For example, the client usage management unit 128C specifies "OID-003" to "OID-005" corresponding to "MID-001", and specifies whether the model can be used based on the use 510 of the operation logs 32 for each of "OID-003" to "OID-005".

[0122] In S1504, the client usage management unit 128C uses the target log to identify the number of times the model has been used. For example, the client usage management unit 128C may identify the number of operation logs 32 having Type 505 "Inference" corresponding to "MID-001" as the number of inferences, or may identify the number of times the model has been provided, and may identify the number of inferences, the number of provides, or the total of these as the number of uses.

[0123] When S1504 is completed, the usage data illustrated in Fig. 11A is completed for the model (or the application to which the model belongs) identified in S1502. That is, Date 1102 may be the date and time when this usage management process was performed, Application / Model ID 1103 may be the ID of the model (or application), and Start Date 1104 and End Date 1105 may be set from Date 504 or 603 of the log for the model (or application) for the target found in S1501. Information 1107 to 1114 may be set in S1503. Usage Counts 1115 may be the number of uses identified in S1504.

[0124] In S1505, the client usage management unit 128C returns the result (completed usage data) to the user terminal 101 that requested the usage management, either via or not via the server usage management unit 128S. In addition, the client usage management unit 128C includes the result (completed usage data) in the usage DS 134C.

[0125] FIG. 16 shows the flow of the lineage management process.

[0126] The client lineage management unit 129C receives a lineage management request from the user terminal 101 via or not via the server lineage management unit 129S, and performs the processes from S1601 onwards in response to the request.

[0127] In S1601, the client lineage management unit 129C searches for a target from the user list DS132, and obtains a target ID, which is an OID and / or DID, for the found target. In this paragraph, the "target" may be an element (e.g., "Ellen") that satisfies the conditions specified in the request from the user terminal 101. Note that since the target ID of the target may exist in multiple user lists 33, multiple target IDs of the target may be obtained. In this case, S1602 and subsequent steps are performed for each of the multiple target IDs.

[0128] In S1602, the client lineage management unit 129C uses the target log to acquire a first route (usage history) from the target ID found in S1601 to the generation of a model, and a second route from the privacy data to the generation of the target ID. That is, a bidirectional search (route search) based on the target ID is performed. The first route is a route from the target ID to the downstream side, and the second route is a route from the upstream side to the target ID. In this paragraph, the "target log" is a log (operation log 32 and / or data log 31) corresponding to the target ID acquired in S1601. For example, in FIG. 12A, when the target ID is "OID-002", a first route from the target ID to "MID-101", "MID-001", and "MID-027" and a second route from the privacy data ("AID-123") to "OID-002" are identified. The combination of the first and second pathways forms a lineage.

[0129] The first route is specified, for example, as follows. (a1) The client lineage management unit 129C identifies the DID of the data log 31 having, as Data 606, an ID in Target 508 in the operation log 32 having an OID. (When the target ID is an OID, (a1) is the start of path identification.) (a2) The client lineage management unit 129C determines whether or not the Type 604 of the data log 31 having the DID is “Model” (an example of a first predetermined value). (If the target ID is a DID, (a2) is the start of the identification of the first route. If (a2) is a process following (a1), the DID is the DID identified in (a1).) (a3) If the determination result of (a2) is false, the client lineage management unit 129C identifies the OID of the operation log 32 having the Source 507 including the DID in (a2). Then, the process returns to (a1).

[0130] The second route is specified, for example, as follows. (b1) The client lineage management unit 129C identifies the DID of the data log 31 having, as Data 606, the ID in Source 507 in the operation log 32 having the OID. (When the target ID is an OID, (b1) is the start of identification of the second path.) (b2) The client lineage management unit 129C determines whether or not the Type 604 of the data log 31 having the DID is "Privacy" (an example of a second predetermined value). (If the target ID is a DID, (b2) is the start of the identification of the second path. If (b2) is a process following (b1), the DID is the DID identified in (b1).) (b3) If the determination result of (b2) is false, the client lineage management unit 129C identifies the OID of the operation log 32 having the Source 507 including the DID in (b2). After that, the process returns to (b1).

[0131] In S1603, the client lineage management unit 129C returns the result (lineage data indicating the lineage identified in S1602) to the user terminal 101 that requested the lineage management, either via or not via the server lineage management unit 129S. In addition, the client lineage management unit 129C includes the result (lineage data) in the lineage DS 137C.

[0132] FIG. 17 shows the flow of data processing.

[0133] In S1701, the data preprocessing unit 126 refers to the application DS136C, the access policy DS133C, and the provision DS135 through the machine learning control unit 123.

[0134] In S1702, the data preprocessing unit 126 allocates user data in the provided data corresponding to the application specified by the application DS136C in accordance with the access policy DS133C. Specifically, for example, the allocation is as follows. (S1702-1) The data preprocessing unit 126 acquires user data from the provided data. (S1702-2) The data preprocessing unit 126 refers to the access policy related to the user corresponding to the data acquired in S1702-1, and identifies the access authority corresponding to the "Feature." (S1702-3) The data preprocessing unit 126 acquires feature types (e.g., Training, Validation, or Evaluation) for which all of the operation attributes "reference", "creation", and "storage" are set to "permitted". In other words, if any one of the operation attributes "reference", "creation", and "storage" is set to "prohibited", the data of that user cannot be used for model creation, and so the data preprocessing unit 126 performs the next step S1702-4. (S1702-4) If there is no corresponding feature type, the data cannot be used as feature data, so the data preprocessing unit 126 sets the name of the user in Exclusion Users 705 of the user list 33 associated with the operation log 32. (S1702-5) If a corresponding feature type is found, the data pre-processing unit 126 assigns the data to one of the corresponding feature types and sets the name of the user in Inclusion Users 706 of the user list 33 associated with the assigned data log 31 (the data log 31 corresponding to the feature data of that feature type).

[0135] In S1702, S1702-1 to S1702-5 are performed for the data of all users in the provided data.

[0136] In S1703, the data preprocessing unit 126 generates feature data based on the data of a user identified from the Inclusion Users 706 in the user list 33 of the assigned data log 31 from among the provided data, and includes the feature data in the feature DS 138.

[0137] FIG. 18 shows the flow of the learning process.

[0138] In S1801, the learning unit 125 refers to the application DS136C via the machine learning control unit 123.

[0139] In S1802, the learning unit 125 refers to a plurality of data logs 31.

[0140] In S1803, the learning unit 125 judges whether or not a target data log 31 exists among the multiple data logs 31. The target data log 31 corresponds to an application identified from the application DS136C, and is a data log 31 in which Type 604 is "Feature" and Usage 510 is "Approve." The judgment in S1803 is a judgment of whether or not there is usable feature amount data.

[0141] If the determination result in S1803 is true (S1803: Yes), in S1804, the learning unit 125 performs model learning (Training, Validation, or Evaluation) using the feature amount data.

[0142] If the determination result in S1803 is true (S1803: No), the data preprocessing unit 126 performs the process shown in Fig. 17. After that, the process returns to S1802.

[0143] FIG. 19 shows the flow of the inference process.

[0144] In S1901, the inference unit 127 refers to the application DS136C through the machine learning control unit 123.

[0145] In S1902, the inference unit 127 refers to a plurality of data logs 31.

[0146] In S1903, the inference unit 127 judges whether or not a target data log 31 exists among the multiple data logs 31. The target data log 31 corresponds to an application identified from the application DS136C, and is a data log 31 in which Type 604 is "Model" and Use 510 is "Approve." The judgment in S1903 is a judgment of whether or not a usable model exists.

[0147] If the determination result in S1903 is true (S1903: Yes), in S1904, the inference unit 127 performs inference using the model.

[0148] If the determination result in S1903 is true (S1903: No), in S1905, the learning unit 125 performs the process shown in Fig. 18. After that, the process returns to S1902.

[0149] FIG. 20 shows the flow of the contribution management process.

[0150] The client contribution manager 131C receives a contribution management request from the user terminal 101 either via or not via the server contribution manager 131S, and performs the processes from S2001 onwards in response to the request.

[0151] In S2001, the client contribution management unit 131C searches for an object from the user list DS 132 and obtains an object ID, which is an OID and / or DID, for the found object. The "object" in this paragraph may be an element that satisfies the conditions specified in the request from the user terminal 101.

[0152] In S2002, the client contribution management unit 131C uses the target log to identify the AID and MID corresponding to the target ID. The "target log" is the log (the operation log 32 and / or the data log 31) corresponding to the target ID acquired in S2001.

[0153] In S2003, the client contribution management unit 131C calculates the number of data used to create the model corresponding to the AID and MID identified in S2002. The calculated number of data is the sum of the number of users represented by the Inclusion Users 706 in the user list 33 corresponding to the data log 31 having Type 604 "Feature" and the number of users represented by the Inclusion Users 706 in the user list 33 corresponding to the operation log 32 having Type 505 "Learning".

[0154] In S2004, the client contribution management unit 131C identifies the total number of data items (how many users' data items are included in the provided data) related to the provided data identified using the target ID as a key.

[0155] In S2005, the client contribution management unit 131C calculates the amount of information (=-log2(number of available data / total number of data)). The "number of available data" is the number of data calculated in S2003. The "total number of data" is the number of data identified in S2004.

[0156] In S2006, the client contribution management unit 131C calculates a general-purpose information amount based on the access policy (for example, the access policy of the user as the target identified in S2001) and the information amount calculated in S2005.

[0157] When S2006 is completed, the contribution data illustrated in Fig. 13A is completed. That is, AID 1302 and MID 1303 may be the AID and MID specified in S2002, information amount 1304 may be the information amount calculated in S2005, general information amount 1305 may be the general information amount calculated in S2006, usable data number 1306 may be the data number calculated in S2003, and total data number 1307 may be the data number specified in S2004.

[0158] In S2007, the client contribution manager 131C returns the result (completed contribution data) to the user terminal 101 that requested the contribution management, via or not via the server contribution manager 131S. In addition, the client contribution manager 131C includes the result (contribution data) in the contribution DS 140C.

[0159] FIG. 21 shows the flow of the first access management process.

[0160] The client access management unit 130C receives a first access management request from the user terminal 101 via or not via the server access management unit 130S, and performs the processes from S2101 onward in response to the request. The first access management request is a request for an impact investigation accompanying a change in access authority (an impact investigation assuming that an access authority change specified in this request has been made). The first access management request may specify, for example, a user corresponding to the access policy 910 whose access authority is changed, and how the access authority corresponding to which data type and operation type is changed (for example, the access policy 910 after the access authority change). In the explanation of FIG. 21 (and FIG. 22), "before the change" means before the change in the access authority in the access policy, and "after the change" means after the change in the access authority in the access policy.

[0161] In S2101, the client access management unit 130C acquires pre-change usage data from the usage DS 134C (or the client usage management unit 128C). The client access management unit 130C also acquires pre-change lineage data from the lineage DS 137C (or the client lineage management unit 129C). The client access management unit 130C also acquires pre-change contribution data from the contribution DS 140C (or the client contribution management unit 131C). The pre-change data acquired in S2101 may be data in DS 134C, 137C or 140C at the start of the first access management process.

[0162] In S2102, the client access management unit 130C generates post-change usage data based on the pre-change usage data acquired in S2101. Specifically, for example, the client access management unit 130C determines the value to be subtracted from the information 1107-1110 in Available Moles and the value to be added to the information 1111-1114 in Unavailable Moles based on the data type ("Privacy", "Provided", "Feature (Training)", "Feature (Validation)", "Feature (Evaluation)", "Model (Training)", "Model (Validation)", or "Model (Evaluation)") of the access authority that has been changed from "Allowed" to "Prohibited" for the access policy 910 of the authorized user (the user represented by the user list 33 (Inclusion Users 706) associated with the log 32 and / or 31 corresponding to the Application / Model ID 1103 of the usage data). Also, for example, the client access management unit 130C determines the value to be added to the information 1107-1110 in Available Moles and the value to be subtracted from the information 1111-1114 in Unavailable Moles for the access policy 910 of the prohibited user (a user represented by the user list 33 (Inclusion Users 706) associated with the log 32 and / or 31 corresponding to the Application / Model ID 1103 of the usage data) based on the data type and operation type of the access authority changed from "prohibited" to "permitted." Note that both the permitted user and the prohibited user may be a single user.

[0163] Also, the client access management unit 130C generates post-change lineage data based on the pre-change lineage data acquired in S2101. Specifically, for example, for the access policy 910 of the permitted user, based on the data type and operation type of the access authority changed from "permitted" to "prohibited", the DID corresponding to the permitted data is set to the DID corresponding to the prohibited data. Also, for example, for the access policy 910 of the prohibited user, based on the data type and operation type of the access authority changed from "prohibited" to "permitted", the client access management unit 130C sets the DID corresponding to the prohibited data to the DID corresponding to the permitted data.

[0164] Furthermore, the client access management unit 130C generates changed contribution data based on the pre-change contribution data acquired in S2101. Specifically, for example, for the access policy 910 of the permitted user, based on the data type and operation type of the access authority that have been changed from "permitted" to "prohibited", the client access management unit 130C changes the generic information amount 1305 based on the data type and operation type of the access authority that have been changed from "prohibited" to "permitted" for the access policy 910 of the prohibited user.

[0165] In S2103, the client access management unit 130C returns the result (at least the latter of the usage data, lineage data, and contribution data before the change and the usage data, lineage data, and contribution data after the change) to the user terminal 101 that requested the first access management, either via or not via the server access management unit 130S.

[0166] FIG. 22 shows the flow of the second access management process.

[0167] The client access management unit 130C receives a second access management request from the user terminal 101 via or not via the server access management unit 130S, and performs processing from S2201 onwards in response to the request. The second access management request is a request to change the access authority. The second access management request may specify, for example, a user corresponding to the access policy 910 whose access authority is to be changed, and how the access authority corresponding to which data type and operation type is to be changed (for example, the access policy 910 after the access authority is changed).

[0168] In S2201, the client access management unit 130C performs S2101 and S2102 in FIG. 21, and returns the result and an inquiry (an inquiry as to whether to implement the access authority change as requested) to the user terminal 101 that requested the second access management, either via or not via the server access management unit 130S.

[0169] In S2202, the client access management unit 130C judges whether or not the response to the inquiry (response from the user) is an answer to change the access authority. In S2201, there may be no inquiry to the user terminal 101. In that case, the judgment in S2202 may be a judgment of whether or not the result obtained in S2201 satisfies a predetermined condition. The condition may be different for each user, and the predetermined condition compared with the result in S2202 may be a condition corresponding to the user specified in the second access management request. In addition, the predetermined condition may include at least one of conditions regarding information that may be affected by the access authority change among the usage data, lineage data, and contribution data, such as a condition regarding the information 1107-1110 of Available Models, a condition regarding the information 1111-1114 of UnAvailable Models, a condition regarding a node (e.g., DID) in the lineage (e.g., a condition regarding the number of decreases or increases in the number of DIDs), and a condition regarding the amount of generic information (e.g., a condition regarding the amount of increase or decrease in the amount of generic information). Furthermore, the predetermined conditions may include conditions regarding whether or not operations or data (for example, feature amount data or model data) can be reproduced.

[0170] If the judgment result of S2202 is false (S2202: No), in S2208, the client access management unit 130C returns the result (that the access authority will not be changed) to the user terminal 101 that requested the second access management, either via or not via the server access management unit 130S.

[0171] When the judgment result of S2202 is true (S2202: Yes), in S2203, the client access management unit 130C judges whether or not the impact of the change in access authority corresponds to the promotion condition. Specifically, for example, the promotion DS143C includes promotion condition data for each element such as a user or an application. The promotion condition data indicates the ID of the element, the content of the promotion, and the promotion trigger (the condition for the promotion to be presented to the user (in other words, the condition related to the impact of the change in access authority)). According to the promotion condition data illustrated in FIG. 22, when the number of data for providing the application of "AID-123" becomes less than 80, a promotion of the product of the general contribution degree and 1 dollar is presented to the user whose access authority is changed. In S2203, for example, the client access management unit 130C identifies promotion condition data from the promotion DS143C using "AID-123" (or the ID (e.g., name) of the user whose access authority is being changed) corresponding to the top node (DID) of the graph represented by the changed lineage data as a key. The client access management unit 130C determines whether the number of data identified in S2201 (the number of data required to provide the application of "AID-123") corresponds to a promotion trigger. If the determination result of S2203 is false (S2203: No), the process proceeds to S2206.

[0172] If the determination result in S2203 is true (S2203: Yes), in S2204, the client access management unit 130C presents a promotion to the user (user terminal 101). The promotion is displayed on the user terminal 101. In presenting in S2204, the client access management unit 130C informs the user that the user can receive the presented promotion on the condition that the access authority is relaxed (the desired access authority change is modified so that the amount of data available to the user is increased) or the desired access authority change is canceled.

[0173] In S2205, the client access management unit 130C judges whether the response (response from the user) to the promotion presentation is a change in access authority as desired (requested). If the judgment result in S2205 is false (S2205: No), in S2208, the client access management unit 130C returns the result (a result that the access authority will not be changed) to the user terminal 101 that has requested the second access management, via or not via the server access management unit 130S. In the case of relaxation of the access authority, a second access management request for the change of the access authority representing the relaxed access authority is transmitted from the user terminal 101, and the process shown in FIG. 22 may be performed for the second access management request.

[0174] If the determination result in S2205 is true (S2205: Yes), in S2206, the client access management unit 130C updates the use 510 and / or reproduction 511 of the operation log 32 and / or the use 609 and / or reproduction 610 of the data log 31 in accordance with the change in the access authority. Specifically, for example, the use 609 "Disapprove" of the data log 31 and the reproduction 610 "Impossible" depend on the access authority "prohibited" for the operation attribute "reference", "create" or "retain". Furthermore, the reproduction 511 "Possible" of the operation log 32 may be the case where the use 609 "Approve" of the data log 31 corresponding to the Source 507 of the operation log 32 and the reproduction 610 "Possible" of the data log 31 corresponding to the Target 508 of the operation log 32. The use 510 "Disapprove" in the operation log 32 is a case where an application becomes unavailable, and the access authority does not have any effect on whether the application can be used or not.

[0175] In S2207, the client access management unit 130C updates at least one of the DSs among the provided DS135, the feature amount DS138, and the model DS141C, etc., in accordance with the change in the access authority. For example, if the change in the access authority is to change the operation attribute "retain" to "prohibit", the client access management unit 130C deletes the data of the user whose access authority has been changed or the data using that data from at least one of the DSs among the provided DS135, the feature amount DS138, and the model DS141C, etc. If the user's data can be identified, the client access management unit 130C creates or copies a data log 31 corresponding to the data including the user data to be deleted, records the name of the user whose access authority has been changed in the Exclusion Users 705 of the user list 33 associated with the data log 31, and updates the Version 704. If the data using the user data to be deleted is feature amount data, it is difficult to identify the user data, so the client access management unit 130C deletes the feature amount data itself.

[0176] In S2208 after S2207, the client access management unit 130C returns the result to the user terminal 101 that has made the request for the second access management, either via the server access management unit 130S or not.

[0177] In the flow shown in FIG. 22, for example, S2203 to S2205 may be omitted.

[0178] According to the above-described embodiment, when unusable data occurs or has occurred due to a change in access authority (changing from "Allowed" to "Prohibited") such as an opt-out application or withdrawal from federated learning, a model that can or cannot be reproduced or used can be identified and displayed. Also, a lineage as a usage path of the privacy data can be identified and displayed. Also, in order to provide an appropriate change in access authority such as an opt-out application, a fine-grained usage range of the privacy data (for example, a method of allocation between Training, Validation, and Evaluation) can be set.

[0179] For example, in S2201, the client access management unit 130C may check whether the values ​​of reproduction 511 and 610 change based on the pre-change data and post-change data, and present the result of the check to the user. For example, the user can determine whether or not to execute the access authority, such as "do not change the access authority if reproduction is impossible" or "change the access authority if the range in which reproduction is impossible is the range presented." The result of this determination may be the answer (answer to the inquiry) received by the client access management unit 130C.

[0180] Although one embodiment has been described above, this is an example for explaining the present invention, and the scope of the present invention is not limited to this embodiment. For example, anonymized privacy data may be adopted instead of the privacy data (for example, a correspondence table or processing (such as a hash function) between the original privacy data and the anonymized data may be used).

[0181] The above description can be summarized, for example, as follows. The following summary may include supplementary explanations of the above description and explanations of modified examples.

[0182] A storage device (e.g., storage device 120) and a processor (e.g., processor 160) are provided. The storage device stores an access policy for each entity (e.g., access policy DS133 (e.g., 133C)). For each entity, the access policy includes, for each of one or more operation attributes, access rights for each n-th order data for use in an application or model for the entity (n is an integer equal to or greater than 0). In the above embodiment, the model is a model generated by machine learning, but may be a model generated by a method other than machine learning (e.g., statistical information generated by a statistical method). The "statistical information" referred to here may be a model as a program or data. In addition, the "n-th order data" may be called a data type, and the value of "n" may be incremented each time data is used (e.g., including processing), such as zero-th order data (e.g., raw data such as privacy data), primary data (e.g., provided data), secondary data (e.g., feature amount data), tertiary data (e.g., model data), ...

[0183] The storage device stores, for each operation, an operation log (e.g., operation log 32) which is a log of the operation, a data log corresponding to source data which is data for the operation and associated with the operation log (e.g., data log 31 corresponding to Source 507), and / or a data log corresponding to target data which is data resulting from the operation and associated with the operation log (e.g., data log 31 corresponding to Target 508).

[0184] The storage device stores an entity list (e.g., user list 33) based on an access policy for an operation log and / or a data log. Each entity list includes an inclusion list (e.g., Inclusion Users 706) which is a list of entities that are permitted to use data for an operation or data corresponding to a log (e.g., log 32 or 31) with which the entity list is associated, and / or an exclusion list (e.g., Exclusion Users 705) which is a list of entities that are prohibited from using data for an operation or data corresponding to a log (e.g., log 32 or 31) with which the entity list is associated. Here, the "entity" is a user in the above embodiment, but may be an entity other than a user (e.g., a right such as a copyright). The data of an entity may be data that is not preferable to be used without the permission of a specific person (e.g., a user, a right holder, an agent), such as privacy data or security data, and the entity may be that specific person. In addition, the entity is not limited to a human being, and may be any tangible or intangible object.

[0185] In response to a request, if the processor finds one or more entity lists in which the entity identified based on the request is recorded from the multiple entity lists, the processor identifies usage conditions based on the one or more operation logs and one or more data logs identified using the one or more entity lists, and returns data representing the identified usage conditions to the requester.

[0186] This makes it possible to provide transparent data management while maintaining data access rights.

[0187] The operation log, data log, and entity list may all be generated and stored by the processor. For example, the processor may identify a data log corresponding to the input data (source data) each time an operation involving input / output of data is performed, generate an operation log of the operation based on the identified data log and a data log (a data log associated with the operation log) corresponding to the output data (target data), and store these logs in a storage device. The processor may also perform an operation based on the access policy of each entity, and may input (use) data of an entity that has permission to access the input data among the input data (e.g., m-th data), and output data as a result of the operation. The processor may generate an entity list for the operation log or the data log of the output data, in which an entity whose data was used is included in the inclusion list (or an entity whose data was not used is included in the exclusion list), and associate the generated entity list with the operation log or the data log. An entity list may exist for each operation log and each data log.

[0188] The "usage status" may be a lineage identified based on one or more identified operation logs and one or more identified data logs. The lineage may be a Directed Acyclic Graph (DAG) in which data or operations are nodes and models correspond to intermediate nodes or leaf nodes. This allows a person who receives the usage status from the data management system to understand how the data was used.

[0189] The "usage status" may include the contribution of the identified entity. The "contribution level" may include a value (e.g., the amount of information 1304 and / or the amount of generic information 1305) calculated based on the total number of data and the number of available data. The total number of data (e.g., the total number of data 1307) may be the number of data in the (mk)-order data that can be used to generate a model as the m-order data (both m and k are integers equal to or less than the maximum value of n, and m is greater than k). The number of available data (e.g., the number of available data 1306) may be the number of data corresponding to an entity that is permitted to access up to the m-order data in the access policy, out of the total number of data. This allows a person who receives the usage status from the data management system to understand the extent to which the entity's data contributes to the model (or the application to which the model belongs). In addition, the access policy may include access rights for each of multiple types of models as the m-th data, and the calculated value (e.g., the amount of general information 1305 included in the contribution degree) may be based on the total number of data and the number of available data, and the number of specified types for which access rights are permitted among the multiple types of models.

[0190] The access policy may include access rights for each of a plurality of types of models as the m-th order data, and the "usage status" may include the number of models for each type of model generated using the data of the specified entity. This allows a person who receives the usage status from the data management system to understand what type of model the entity data was used for.

[0191] The "usage status" may include the usage status before and after the change of the access authority in the access policy of the specified entity. This allows a person who receives the usage status from the data management system to understand the scope of the impact of the change of the access authority.

[0192] At least one of the operation log and the data log associated with the operation log may include reproducibility information, which is information indicating whether data provided as a result of an operation can be reproduced. The "usage status" may include the reproducibility indicated by the reproducibility information after the access authority is changed, with respect to the reproducibility information possessed by the identified one or more operation logs and one or more data logs. This allows a person who receives the usage status from the data management system to know whether the data can be reproduced after the access authority is changed.

[0193] If the usage status after the change of the access authority satisfies a predetermined condition (e.g., Promotion Trigger), the processor may present the requester with a promotion to relax the access authority or cancel the change. This provides the requester with an incentive to relax the access authority or cancel the change, thereby promoting the use of data.

[0194] The data management system may include a plurality of client computers including a client computer having a processor and a storage device, and a server computer communicating with the plurality of client computers. The server computer may generate a model by federated learning using machine learning models from the plurality of client computers and transmit the generated model to the plurality of client computers. The server computer may also store an operation log and a data log regarding operations performed by the server computer. An operation list (e.g., operation list 34) may be associated with the operation log and data log in the server computer instead of the entity list. The operation list may include an inclusion list that is a list of operations or data corresponding to entities that are permitted to use data for the operation or data corresponding to the log with which the operation list is associated, and / or an exclusion list that is a list of operations or data corresponding to entities that are prohibited from using data for the operation or data corresponding to the log with which the operation list is associated. In this way, an operation list that does not include information that can identify an entity is stored in the server computer instead of the entity list. [Explanation of symbols]

[0195] 40...Calculator

Claims

1. A storage device and a processor are provided, The storage device stores an access policy for each entity; For each entity, the access policy includes, for each of one or more operation attributes, access permissions for each n-th order data for use in the application or model for that entity, where n is an integer equal to or greater than 0; The storage device, for each operation, an operation log that is a log of the operation; a data log corresponding to source data, which is data for the operation, and associated with the operation log; and / or a data log corresponding to target data, which is data resulting from the operation, and associated with the operation log; Remember, The storage device stores an entity list based on the access policy for the operation log and / or the data log; Each entity list includes an inclusion list, which is a list of entities that are permitted to use data for the operation or data corresponding to the log with which the entity list is associated, and / or an exclusion list, which is a list of entities that are prohibited from using data for the operation or data corresponding to the log with which the entity list is associated; The processor, if, in response to the request, one or more entity lists containing the entity identified based on the request are found among the multiple entity lists, identifying usage based on the one or more operation logs and one or more data logs identified using the one or more entity lists; returning data representative of the identified usage to the source of the request; Data management system.

2. The usage status is a lineage identified based on the identified one or more operation logs and one or more data logs, The lineage is a Directed Acyclic Graph (DAG) in which data or operations are nodes and models correspond to intermediate nodes or leaf nodes. The data management system according to claim 1 .

3. The usage status includes a contribution of the identified entity; The degree of contribution includes a value calculated based on the total number of data and the number of available data, The total number of data is the number of data in the (m-k)th order data that can be used to generate a model as the mth order data (where m and k are integers equal to or less than the maximum value of n, and m is greater than k), The number of available data items is the number of data items corresponding to entities that are permitted to access up to m-th data items in the access policy, out of the total number of data items. The data management system according to claim 1 .

4. The access policy includes an access right for each of a plurality of types of models as the m-th data, The calculated value is based on the total number of data, the number of available data, and the number of predetermined types of models for which access authority is permitted among a plurality of types of models. The data management system according to claim 3.

5. The access policy includes an access right for each of a plurality of types of models as the m-th data, The usage status includes the number of models for each type of model generated using the data of the identified entity. The data management system according to claim 1 .

6. The usage status includes a usage status before and after a change in an access authority in an access policy of the identified entity. The data management system according to claim 1 .

7. At least one of the operation log and the data log associated with the operation log includes reproducibility information which is information indicating whether data can be reproduced; The usage status includes, with respect to the reproduction possibility information of the one or more specified operation logs and the one or more specified data logs, reproduction possibility represented by the reproduction possibility information after the access authority is changed. The data management system according to claim 1 .

8. When the usage status after the change of the access authority satisfies a predetermined condition, the processor presents a promotion for relaxing the access authority or canceling the change to the request source. The data management system according to claim 1 .

9. An entity list exists for each operation log and for each data log. The data management system according to claim 1 .

10. a plurality of client computers including a client computer having the processor and the storage device; a server computer communicating with said plurality of client computers; Equipped with the server computer generates a model by federated learning using the machine learning models from the plurality of client computers and transmits the generated model to the plurality of client computers; The server computer also stores an operation log and a data log regarding operations performed by the server computer, an operation list is associated with the operation log and the data log in the server computer instead of the entity list; The operation list includes an inclusion list, which is a list of operations or data corresponding to entities that are permitted to use data for the operation or data corresponding to the log with which the operation list is associated, and / or an exclusion list, which is a list of operations or data corresponding to entities that are prohibited from using data for the operation or data corresponding to the log with which the operation list is associated; The data management system according to claim 1 .

11. If the computer, in response to the request, finds one or more entity lists among the multiple entity lists in which the entity identified based on the request is recorded, it identifies usage based on the one or more operation logs and one or more data logs identified using the one or more entity lists; For each entity, the access policy includes, for each of one or more operation attributes, access permissions for each n-th order data for use in the application or model for that entity, where n is an integer equal to or greater than 0; For each operation, an operation log that is a log of the operation; a data log corresponding to source data, which is data for the operation, and associated with the operation log; and / or a data log corresponding to target data, which is data resulting from the operation, and associated with the operation log; There are For the operation log and / or the data log, there is an entity list based on the access policy; Each entity list includes an inclusion list, which is a list of entities that are permitted to use data for the operation or data corresponding to the log with which the entity list is associated, and / or an exclusion list, which is a list of entities that are prohibited from using data for the operation or data corresponding to the log with which the entity list is associated; The computer returns data representing the identified usage status to the source of the request. Data management methods.

Images