Information processing device, data checking method, and program

Abstract

To simply show an identification possibility level of data containing personal information.SOLUTION: A checking device 1, information processing device, includes: an acquisition processing unit 31, acquisition means, which acquires a prescribed anonymize index k indicating possibility that objective data containing personal information and a person in the objective data are specified; a calculation processing unit 34, calculation means, which calculates a score based on the objective data and the anonymize index to the objective data; and a display processing unit 35, display means, which executes a process for displaying the score.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to an information processing device, a data check method, and a program. [Background technology]

[0002] Conventionally, with the enforcement of the Personal Information Protection Law, information that identifies a specific individual has been subjected to processing to reduce the identifiability of the individual by deletion, replacement, etc., so as to prevent the information from being used in an inappropriate manner. For example, Patent Document 1 describes a technology related to this type of identifiability reduction processing. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2008-217425 A Summary of the Invention [Problem to be solved by the invention]

[0004] When providing data that includes personal information to a third party, it is necessary to perform a process to reduce identifiability. However, even if a process to reduce identifiability is performed, the anonymity of the data set to be provided cannot be guaranteed. The so-called anonymization index k can be used as an index showing the possibility of identifying an individual, but it does not by itself guarantee the anonymity of the target data. Conventional technologies have room for improvement in terms of grasping the identifiability of data that includes personal information.

[0005] The present invention aims to easily indicate the level of identifiability of data, including personal information. [Means for solving the problem]

[0006] In order to achieve the above-mentioned objective, one aspect of the present invention is an information processing device comprising: an acquisition means for acquiring target data including personal information and a predetermined anonymization index indicating the possibility that an individual in the target data may be identified; a calculation means for calculating a score based on the target data and the anonymization index for the target data; and a display means for executing a process to display the score.

[0007] Another aspect of the present invention is a data checking method by a computer, the data checking method including: an acquisition step of acquiring target data including personal information and a predetermined anonymization index indicating the possibility that an individual in the target data may be identified; a calculation step of calculating a score based on the target data and the anonymization index for the target data; and a display step of executing a process to display the score.

[0008] Moreover, one aspect of the present invention is a program for causing a computer to execute an acquisition step of acquiring target data including personal information and a predetermined anonymization index indicating the possibility that an individual in the target data will be identified, a calculation step of calculating a score based on the target data and the anonymization index for the target data, and a display step of executing a process to display the score. Effect of the Invention

[0009] According to the present invention, the level of identifiability of data including personal information can be easily indicated. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram illustrating an outline of an information processing device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram showing a hardware configuration of the checking device. [Diagram 3] FIG. 2 is a functional block diagram showing an example of a functional configuration of a checking device. [Figure 4] FIG. 11 is a diagram showing an example of target data determined by a checking device. [Diagram 5] 13 is a flowchart showing the operation of a sharing process performed by the checking device. [Figure 6] FIG. 13 is a diagram showing an example of a suggestion made by the checking device when the gender item does not match the conditions. [Figure 7] FIG. 13 is a diagram showing an example of a suggestion made by the checking device when the blood type item does not match the conditions. [Figure 8] FIG. 13 is a diagram showing an example of a suggestion made by the checking device when a combination of items including gender and blood type does not match the conditions. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] <Overall composition> Hereinafter, this embodiment will be described with reference to the drawings. Fig. 1 is a diagram showing an outline of the configuration of a data check system 100 to which a check device 1 as an information processing device according to this embodiment is applied. As shown in Fig. 1, the data check system 100 according to this embodiment includes a check device 1 installed in an institution such as a university, and a database 2 in which data to be checked by the check device 1 is registered.

[0012] The check device 1 is an information processing device that determines the level of anonymity (identifiability) at which an individual can be identified for data including personal information. The user is, for example, an institution that handles data including personal information, such as a university. The user is not limited to an institution, and may be an individual.

[0013] The database 2 provides data to be checked to the checking device 1. The database 2 may be in a format provided on a cloud by a server (not shown), or may be in a format constructed in the checking device 1 as a local terminal.

[0014] In this embodiment, the data to be checked that is registered in database 2 is data including personal information that needs to be made less identifiable, but the type is not particularly limited. Below, an example will be described in which data related to subjects (medical information) is the data to be checked. Note that data related to subjects is not limited to patients receiving medical care. Data related to subjects may be data related to the health of persons not receiving medical care, or may be data unrelated to medical care (such as response data to a questionnaire, etc.).

[0015] <Hardware configuration> Next, an example of a hardware configuration that constitutes the checking device 1 will be described. 2 is a block diagram showing a hardware configuration of the checking device 1 according to this embodiment. The checking device 1 includes a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a bus 14, an input / output interface 15, an output unit 16, an input unit 17, a storage unit 18, a communication unit 19, and a drive 20.

[0016] The CPU 11 executes various processes according to a program recorded in the ROM 12 or a program loaded from the storage unit 18 to the RAM 13. The RAM 13 also stores data and the like required for the CPU 11 to execute various processes. The CPU 11, the ROM 12, and the RAM 13 are interconnected via a bus 14. An input / output interface 15 is also connected to this bus 14.

[0017] An output unit 16, an input unit 17, a storage unit 18, a communication unit 19, and a drive 20 are connected to the input / output interface 15. The output unit 16 is composed of a display, a speaker, etc., and outputs various information as images and sounds. The input unit 17 is composed of a keyboard, a mouse, etc., and inputs various information. The storage unit 18 is composed of a hard disk, a DRAM (Dynamic Random Access Memory), etc., and stores various data. The communication unit 19 communicates with other devices via a network including the Internet.

[0018] Removable media 21, which may be a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is appropriately attached to the drive 20. Programs read from the removable media 21 by the drive 20 are installed in the storage unit 18 as necessary. The removable media 21 can also store various data stored in the storage unit 18 in the same manner as the storage unit 18.

[0019] As described above, the database 2 may be constructed by a server having the same hardware configuration as that shown in FIG. 2, or may be constructed in the storage unit 18 of the checking device 1 or the like.

[0020] <Functional configuration> Next, the functional configuration of the checking device 1 will be described. Fig. 3 is a functional block diagram showing an example of the functional configuration of the checking device 1. As shown in Fig. 3, the checking device 1 includes, as functional units operating in the CPU 11, a discriminability reducing unit 30, an acquisition processing unit 31, a priority setting unit 32, a judgment processing unit 33, a calculation processing unit 34, and a display processing unit 35.

[0021] The distinctiveness reducing unit 30 is a distinctiveness reducing means that executes a processing process for reducing distinctiveness of target data based on a preset setting.

[0022] In the processing, in order to make it difficult to identify an individual, processing is performed to reduce the identifiability of items in the target data that require reduction in identifiability. For example, items included in the target data (items to be anonymized) that are subject to reduction in identifiability include patient information, genome information (e.g., information required for genome analysis), and information held by a pathology diagnosis result system (pathology diagnosis result). The patient information includes, for example, the name, sex, blood type, medical history, height, age, and the like. The medical history includes at least one of the following: disease name, medication, drug administration history, surgical history, and test results.

[0023] In this embodiment, an example will be described in which a process using so-called k-anonymization is used as a processing process for reducing identifiability. In the process using k-anonymization, target data is converted so that there are k or more pieces of data with the same attribute, and the probability that an individual is identified is reduced to 1 / k or less. The value of k is a numerical value that is set in advance according to the security level, the type of information to be handled, and the like. For example, k=5 or k=10 is set. In the processing process, when the target of reducing identifiability is patient information, a process is executed to reduce the identifiability of an individual by deleting all or part of information on name, sex, medical history, height, age, and the like, changing numerical values, or performing mask processing. The change of numerical values ​​is, for example, a process of changing age (e.g., 19 years old) to a generation (e.g., teens or 15 to 19 years old, etc.). Note that the effect of the processing process in this embodiment is to reduce the identifiability of an individual, and it is not necessary to achieve irreversibility. In this embodiment, an example will be described in which the discriminability reduction unit 30 automatically performs some or all of the processing for reducing the discriminability described above, but some or all of the processing may also be performed by a user.

[0024] The acquisition processing unit 31 acquires an anonymization index k indicating the value of k in the processing, and target data that is to be subjected to the processing using the anonymization index k. The anonymization exponent k is, for example, a numerical value set by a user. The larger the value of k, the smaller the probability of being identified, and the smaller the value of k, the greater the probability of being identified. The acquisition processing unit 31 acquires the target data, for example, by reading out data registered in the database 2 or reading out data previously stored in the storage unit 18 of the check device 1 by downloading or the like.

[0025] The priority setting unit 32 is a priority setting means that executes a process of setting essential items and priorities (priorities) for the items to be anonymized. For example, the priority setting unit 32 can set items that are highly necessary to reduce the identifiability as essential items.

[0026] The setting of the priority order by the priority setting unit 32 will be described. The priority setting unit 32 can set the priority order for determining the order of reducing identifiability, for example. When age, sex, and blood type are set as the required items as the items to be anonymized, the order of performing the processing to reduce identifiability is set based on the priority order. For example, if the priority setting unit 32 sets the priority order as age, sex, and blood type, processing to reduce identifiability is performed starting from blood type, which has the lowest priority. If processing to reduce identifiability by deletion, grouping, or the like is performed on blood type but does not satisfy the standard of the preset anonymization index k (if it is less than 1 / k), processing to reduce identifiability is performed on gender, which has a lower priority than age.

[0027] Items set to a low priority are preferentially deleted in the calculation process of the calculation processing unit 34 described below, or processes for changing the values, such as rounding, are executed. Items with a low priority are items that are less likely to be handled in statistical processing, etc., and are data that are less affected by deletion, modification, etc. For example, since records (data) indicating that a man has breast cancer have an extremely low incidence in men, the priority of the combination of male and breast cancer may be set low, taking into consideration the balance between the possibility of identifying an individual and statistical processing.

[0028] Furthermore, the priority setting unit 32 of this embodiment can also execute a process of weighting anonymization target items for which a high priority has been set. The weighting is a numerical value used in the calculation of a score, which will be described later.

[0029] The determination processing unit 33 is a determination means for determining whether or not an anonymization target item has a level of identifiability that makes it impossible to identify an individual. The determination criterion of the determination processing unit 33 is set based on the anonymization index k. In this embodiment, the determination criterion is whether or not an anonymization target item satisfies a criterion based on the anonymization index k that is set in advance. For example, when the number of a certain attribute in an anonymization target item is less than k, the determination processing unit 33 determines that the anonymization target item does not satisfy a certain criterion.

[0030] Furthermore, the determination processing unit 33 determines whether or not a combination of a plurality of items to be anonymized, rather than only a single item to be anonymized, has a level of identifiability that makes it impossible to identify an individual.

[0031] Furthermore, the determination processing unit 33 can set items that have no or little effect on identifiability as non-target items for anonymization that are targets for reducing identifiability in the target data to be determined. For example, the determination processing unit 33 can set items such as an ID given to the target data, the acquisition date and time of the record, body temperature, and items in the target data that have already been processed to reduce identifiability as non-target items. Items that have been processed to reduce identifiability include, for example, an individual's date of birth (e.g., January 1, 1990) that has undergone processing to change only the year of birth (e.g., 1990, etc.), processing to change the year of birth to an age group (e.g., 30s, etc.), processing to change only the month of birth (e.g., January 1990, etc.), etc. In this case, since processing to reduce identifiability has already been performed, there is little need to perform a determination, and the items are set as non-target items.

[0032] In addition, when weighting is set by the priority setting unit 32, the judgment processing unit 33 may apply the weighting to the judgment process. For example, the judgment criterion may be made stricter by increasing the value of k in the judgment criterion by weighting, or conversely, the judgment criterion may be made looser by decreasing the value of k.

[0033] The calculation processing unit 34 calculates a score based on the target data and the anonymization index k for the target data. The score is an index indicating the effectiveness of applying the anonymization index k to a combination of a plurality of anonymization target items included in the target data.

[0034] An example of the score calculated by the calculation processing unit 34 will be described. The calculation processing unit 34 acquires the number of combinations of all items to be anonymized, and the number of combinations for which anonymization cannot be performed because the identifiability does not meet the standard and there is a high possibility of identifying an individual. Then, the calculation processing unit 34 calculates the ratio of combinations of items that satisfy the anonymization index k to all combinations of items to be anonymized. For example, the calculation processing unit 34 calculates the score using the formula shown below. Score = (number of items that can be anonymized / total number of combinations) x 100

[0035] Furthermore, when weighting based on priority is set, the calculation processing unit 34 reflects the weighting in the score calculation. The weighting can be, for example, a coefficient set to the number of items that cannot be anonymized. The calculation processing unit 34 calculates the above-mentioned score after reflecting the coefficient. Note that the weighting set for a specific item is set so as to reduce the weight in the case of a combination of multiple items.

[0036] The display processing unit 35 executes a process of presenting information based on the judgment result of the judgment processing unit 33 and the calculation result of the calculation processing unit 34 to the user. The display processing unit 35 may also have a function of judging whether the score is good or bad with respect to a preset judgment value, and may be configured to display the judgment result together with the score. For example, the display processing unit 35 may judge whether the anonymization index k for the target data is appropriate or not based on a result of comparing the score calculated based on the above-mentioned score calculation method with a preset judgment value (for example, score: 95). Furthermore, the display processing unit 35 may also display an operation screen for receiving the user's operation result.

[0037] <Processing content> Next, an example of the check process will be described. Fig. 4 is a diagram showing an example of target data judged by the check device 1. Fig. 4 shows a subject data group having four items, namely, anonymized ID, date of birth, sex, and blood type, as an example of target data including personal data. It is assumed that the value of anonymization index k, which is the judgment criterion, is set to 5. It is also assumed that, among the items, the anonymized ID and date of birth are set as not to be judged.

[0038] Hereinafter, the check process for a subject data group having four items will be described with reference to FIG. 5 is a flowchart showing the operation of the check process by the check device 1. This flowchart is an example, and the order and contents of the processes are not limited to those shown.

[0039] In step S10, the acquisition processing unit 31 acquires an anonymization index k. The anonymization index k is, for example, a numerical value that is preset by a user or preset in the check device 1. In this example, it is assumed that the numerical value of the anonymization index k is set to 5. In this case, five or more pieces of data belonging to a certain item name are required.

[0040] In step S11, the acquisition processing unit 31 acquires target data selected by the user. The target data is, for example, a data set of medical information selected from the database 2 by the user operating the check device 1. In this example, it is assumed that the target data shown in FIG. 5 is selected.

[0041] In step S12, the determination processing unit 33 starts a determination process (check). The determination processing unit 33, for example, acquires and analyzes the items of target data selected by the user as items to be anonymized.

[0042] In step S13, the determination processing unit 33 determines whether or not the gender previously set as the determination target is included in the items of the target data and whether or not the gender attribute (male, female) matches the condition based on the anonymization index k=5. If the condition is not met, the determination processing unit 33 advances the process to step S14 (step S13; No). If the condition is met, the determination processing unit 33 advances the process to step S15 without going through step S14 (step S13; Yes).

[0043] In step S14, the judgment processing unit 33 generates information to be presented to the user when the condition is not met. In the example of Fig. 5, the number of men in the target data is 15 and the number of women is 3, so the number of women is < 5 (= k). Therefore, there are items with less than 5 examples for gender, and from the perspective of identifying individuals, there is a 1 in 3 probability that a woman will be identified as an individual in the target data. Therefore, the gender in this target data does not meet the criteria based on the anonymization index k = 5.

[0044] In this embodiment, the determination processing unit 33 generates an alternative that establishes a relationship between the anonymization index k and the gender in the target data. For example, the determination processing unit 33 generates a proposal to change the value of the anonymization index k as an alternative proposal. In this example, if the anonymization index k is decreased and changed to 3 to relax the criteria, the relationship between the anonymization index k and the gender in the target data will be acceptable. Therefore, the determination processing unit 33 generates changing k from 5 to 3 as one of the alternative proposals. Also, for example, the determination processing unit 33 generates a proposal to reduce the identifiability of the target data (for example, a proposal to delete three records of the target) as an alternative proposal. When maintaining the anonymization index k at 5, if the identifiability reduction unit 30 deletes three female cases from the target data, the relationship between the anonymization index k and the target data can be established. Therefore, the determination processing unit 33 generates deleting three female cases from the target data as one of the alternative proposals. The determination processing unit 33 stores the trial-calculated alternative proposal in the storage unit 18 to present it to the user in the display processing described later, and shifts the process to step S15.

[0045] In step S15, the determination processing unit 33 determines whether the blood type set in advance as the determination target is included in the items of the target data and whether the attributes of the blood type (A, B, AB, O) match the conditions based on the anonymization index k = 5. If they do not match the conditions, the determination processing unit 33 proceeds to step S16 (step S15; No). If they match the conditions, the determination processing unit 33 proceeds to step S17 without going through step S16 (step S15; Yes).

[0046] In step S16, when they do not match the conditions, the determination processing unit 33 generates information to be presented to the user. In the example of FIG. 5, there are 5 cases of type A, 5 cases of type B, 4 cases of type AB, and 4 cases of type O in the target data. Therefore, type AB and type O do not match the conditions (AB, O < k = 5). Therefore, there are items with less than 5 cases in terms of blood type, and from the perspective of identifying an individual, type AB and type O will be identified with a probability of 1 / 4. Therefore, the blood type in this target data does not meet the criteria based on the anonymization index k = 5.

[0047] The determination processing unit 33 generates an alternative that establishes a relationship between the anonymization index k and the blood type in the target data. For example, the determination processing unit 33 generates an alternative plan to change the value of the anonymization index k. In this example, if the anonymization index k is reduced to 4 to relax the criteria, the relationship between the anonymization index k and the blood type in the target data will not be a problem. Therefore, the determination processing unit 33 generates a change from k=5 to k=4 as one of the alternative plans. Also, for example, the determination processing unit 33 generates an alternative plan for reducing the identifiability of the target data. When the anonymization index k is maintained at 5, the relationship between the anonymization index k and the target data can be established by deleting four cases of blood type AB and four cases of blood type O from the target data by the identifiability reduction unit 30. Therefore, the determination processing unit 33 generates one of the alternative plans in which the four cases of blood type AB and four cases of blood type O are deleted from the target data. The determination processing unit 33 stores the calculated alternative plan in the storage unit 18 to present it to the user in the display process described later, and proceeds to step S17.

[0048] In step S17, the judgment processing unit 33 judges whether or not a combination of items that is set as a judgment target in advance is included in the items of the target data and whether or not judgment processing for the combination of items can be executed. In this embodiment, the combination of sex and blood type is set as a judgment target.

[0049] The determination processing unit 33 determines whether or not the combination of sex and blood type meets the condition based on the anonymization index k=5. If the condition is not met, the determination processing unit 33 advances the process to step S18 (step S17; No). If the condition is met, the determination processing unit 33 advances the process to step S19 without going through step S18 (step S17; Yes). In this embodiment, an example of a combination of two items is described, but in the case of three or more items, the processing is performed by combining the items in the same way and targeting all combination patterns. For example, if nwo is a natural number equal to or greater than 3, n C n + n C n-1 ,..., n C2 The processing is performed on the following combinations:

[0050] In step S18, the judgment processing unit 33 generates information to be presented to the user when the condition is not met. In the example of FIG. 5, the combinations of female and type A (one example), female and type AB (one example), or female and type O (one example) are examples that do not meet the condition of less than k=5. There are less than five combinations of gender and blood type. From the viewpoint of identifying an individual, the combination of gender and blood type in this target data does not meet the criteria based on the anonymization index k=5.

[0051] The determination processing unit 33 generates an alternative that establishes a relationship between the anonymization index k and the blood type in the target data. For example, the determination processing unit 33 generates an alternative plan to change the value of the anonymization index k. In this example, if the anonymization index k is reduced to 3 to relax the criteria, the relationship between the anonymization index k and the blood type in the target data will not be a problem. Therefore, the determination processing unit 33 generates a change from k=5 to k=3 as one of the alternative plans. Also, for example, the determination processing unit 33 generates an alternative plan that reduces the identifiability of the target data. When the anonymization index k is maintained at 5, the relationship between the anonymization index k and the target data can be established by deleting three female cases, four blood types A, four blood types AB, and four blood types O from the target data by the identifiability reduction unit 30. Therefore, the determination processing unit 33 generates one alternative plan that deletes three female cases, four blood types A, four blood types AB, and four blood types O from the target data. The determination processing unit 33 stores the estimated alternative plan in the storage unit 18 to present it to the user in the display process described later, and proceeds to step S19.

[0052] In step S19, the calculation processing unit 34 calculates the score of the anonymization index k=5 for the target data based on the relationship between the target data and the anonymization index k=5. For example, the calculation processing unit 34 calculates the ratio of the number of combinations of items that satisfy the anonymization index k to the number of all combinations of items to be anonymized as a percentage. Note that, if weighting has been set by the priority setting unit 32, the calculation processing unit 34 calculates the score reflecting the weighting. As described above, if weighting has been set among the combinations of multiple items, the calculation processing unit 34 performs a process of subtracting the weighting value.

[0053] In step S20, the display processing unit 35 executes a process of presenting to the user the score calculated by the calculation processing unit 34, the alternatives generated by the judgment processing unit 33, etc. The display processing unit 35 displays the score and the presented alternatives on the output unit 16 as images, for example.

[0054] In step S21, the display processing unit 35 judges whether or not the user has performed an operation to select an alternative. For example, the display processing unit 35 judges that the above-mentioned selection operation has been performed when the user has pressed the "Execute" button displayed on the output unit 16. If the user has not performed an operation to select an alternative, the display processing unit 35 ends the process (step S21; No).

[0055] If the user does not perform an operation to select an alternative, the display processing unit 35 sets parameters and target data based on the alternative selected by the user, and returns the process to step S19 (step S21; Yes). The parameters based on the alternative are, for example, the numerical value of the anonymization index k changed based on the alternative, or the target data after processing in which some data has been deleted or numerical values ​​or character strings have been changed based on the alternative. In step S19, the calculation processing unit 34 recalculates the score based on the newly set parameters and target data. Then, in step S20, the display processing unit 35 presents the recalculated score and an image based on the recalculated data to the user. The process of step S21 is similar.

[0056] Next, an example of alternatives and score recalculation presented to the user by the display process in step S20 will be described with reference to FIGS.

[0057] Fig. 6 is a diagram showing an example of a suggestion made by the check device 1 when the gender item does not match the condition. Fig. 6 shows that the gender item does not match the anonymization index k=5, and shows a text message 51 for matching the condition. In this example, a text message is shown proposing changing the anonymization index k to k=3 as a first alternative for changing the anonymization index k, and a text message is shown proposing deleting female from the gender as a second alternative for processing to reduce identifiability.

[0058] In addition, an execute button 61 is shown near the text message of the first alternative as an operation display unit for recalculating the score when the first alternative is adopted. When the execute button 61 is operated by the user, k is changed from 5 to 3, and then the calculation processing unit 34 executes a score calculation process, and the execution result is displayed by the display processing unit 35. In addition, an execute button 62 is shown near the text message of the second alternative as an operation display unit for recalculating the score when the second alternative is adopted. When the execute button 62 is operated by the user, the identifiability reduction unit 30 executes a processing process for reducing identifiability by deleting "female" (3 examples) from "gender", and then the calculation processing unit 34 executes a score calculation process, and the execution result is displayed by the display processing unit 35.

[0059] Fig. 7 is a diagram showing an example of a suggestion made by the check device 1 when the blood type item does not match the condition. Fig. 7 shows that the blood type item does not match the anonymization index k=5, and shows a text message 52 for making the condition match. In this example, a text message is shown proposing changing the anonymization index k to k=4 as a first alternative for changing the index k, and a text message is shown proposing deleting four cases of type AB and four cases of type O as a second alternative for processing to reduce identifiability.

[0060] Also in FIG. 7, an execute button 61 is shown near the text message of the first alternative as an operation display unit for recalculating the score when the first alternative is adopted. When the execute button 61 is operated by the user, k is changed from 5 to 4, and then the calculation processing unit 34 executes the score calculation process, and the execution result is displayed by the display processing unit 35. Also, execute buttons 63 and 64 are shown near the text message of the second alternative as operation display units for recalculating the score when the second alternative is adopted. The execute button 63 is an operation display unit for the user to instruct the deletion of the four O type cases, and the execute button 64 is an operation display unit for the user to instruct the deletion of the four AB type cases. When the execute button 63 or the execute button 64 is operated, a processing process for reducing the corresponding distinguishability is executed by the distinguishability reduction unit 30, and then the calculation processing unit 34 executes the score calculation process, and the execution result is displayed by the display processing unit 35.

[0061] Fig. 8 is a diagram showing an example of a suggestion made by the check device 1 when the combination of items of gender and blood type does not match the conditions. Fig. 8 shows that the items of gender and blood type do not match the anonymization index k=5, and shows a text message 53 for matching the conditions. In this example, a text message is shown proposing changing the anonymization index k to k=3 as a first alternative for changing the index k, and a text message is shown proposing deleting female, type A, type AB, and type O as a second alternative for processing to reduce identifiability. The alternatives are displayed, for example, in an order based on a preset priority.

[0062] 8, an execute button 61 is shown near the text message of the first alternative as an operation display unit for recalculating the score when the first alternative is adopted. When the execute button 61 is operated by the user, k is changed from k=5 to k=3, and then the score calculation process is executed by the calculation processing unit 34, and the execution result is displayed by the display processing unit 35.

[0063] In addition, near the text message of the second alternative, execute buttons 62 to 65 are shown as an operation display unit for recalculating the score when the second alternative is adopted. The execute button 62 is for instructing to delete female from the target data, and the execute button 63 is for instructing to delete type O from the target data. The execute button 64 is for the user to instruct to delete type AB, and the execute button 65 is for the user to instruct to delete type A. When the execute buttons 62 to 65 are operated, a process for reducing the corresponding distinguishability is executed by the distinguishability reduction unit 30, and then a score calculation process is executed by the calculation processing unit 34, and the execution result is displayed by the display processing unit 35.

[0064] As described above, the check device 1 (information processing device) of this embodiment includes an acquisition processing unit 31 (acquisition means) that acquires target data including personal information and a predetermined anonymization index k that indicates the possibility that an individual in the target data will be identified, a calculation processing unit 34 (calculation means) that calculates the score of the anonymization index k for the target data, and a display processing unit 35 (display means) that executes a process to display the score. Note that the target data referred to here may have already been subjected to a processing process to reduce identifiability.

[0065] In addition, the computer-based data checking method of this embodiment includes an acquisition step of acquiring target data including personal information and a predetermined anonymization index k indicating the possibility that an individual in the target data may be identified, a calculation step of calculating a score of the anonymization index k for the target data, and a display step of executing a process to display the score.

[0066] In addition, the program of this embodiment causes a computer to execute an acquisition function for acquiring target data including personal information and a predetermined anonymization index k indicating the possibility that an individual may be identified in the case of the target data, a calculation function for calculating a score of the anonymization index k for the target data, and a display function for executing a process to display the score.

[0067] <Advantageous Effects of the Present Embodiment> By configuring the check device 1, the data check method, and the program in this way, it is possible to objectively determine whether anonymity has been achieved by the score. Since a certain degree of anonymity is guaranteed, it is also easy to provide a data set to a user who wishes to perform statistical analysis, etc.

[0068] The check device 1 of this embodiment further includes a judgment processor 33 (judgment means) that judges whether or not an anonymization target item or a combination of multiple anonymization target items that are targets of reducing identifiability in the target data satisfies a criterion based on the anonymization index k. This makes it possible to judge whether or not the anonymization index k is appropriate based on the anonymization target item or the combination of anonymization target items.

[0069] Moreover, the checking device 1 of this embodiment further includes a priority setting unit 32 that sets, for items to be anonymized, essential items or priorities for the judgment of the judgment processing unit 33. This makes it possible to reliably make important elements (items) for use in the analysis of a data set, etc., into judgment targets, and to set priorities so as to avoid changes due to processing, etc., as much as possible.

[0070] In addition, in this embodiment, when a priority is set, the priority setting unit 32 sets weights for the items to be anonymized based on the priority, so that different importance levels for each item can be reflected in the score.

[0071] In this embodiment, the determination processing unit 33 sets items not to be determined for the items to be anonymized. This makes it possible to eliminate items that do not take into consideration the possibility of identifying an individual and items that are not necessary for analysis, etc., thereby improving the processing efficiency of the determination process and calculation process.

[0072] In this embodiment, the calculation processing unit 34 calculates a score based on a combination of items to be anonymized that are to be targeted for reducing the identifiability of the target data. This makes it possible to obtain a score that reflects a combination of a plurality of items, and to provide the user with a more accurate index for determining anonymity.

[0073] Furthermore, in this embodiment, the calculation processing unit 34 calculates the score based on the ratio of items that satisfy the anonymization index k to all combinations of items to be anonymized. This allows the score to be quantified by simple processing based on the ratio of the number of items that satisfy the anonymization index k. Note that the combination of items that satisfy the anonymization index k may be added to the score calculation. For example, the score can be calculated based on the ratio of the number of combinations of items that satisfy the anonymization index k.

[0074] In this embodiment, the calculation processing unit 34 calculates a score based on the changed anonymization index k or the changed target data when the anonymization index k is changed or when processing is performed on the target data to reduce identifiability, and the display processing unit 35 executes processing to display the changed score. This makes it possible to check the score when the anonymization index k or the target data is changed, and makes it easy to adjust the anonymization index k or the target data.

[0075] In this embodiment, the display processing unit 35 displays execution buttons 61 to 65 (operation display unit) for instructing recalculation of the score based on the changed anonymization index k or the changed target data. This allows the user to confirm the change in the value of the anonymization index k or the score after the change in the target data with a simple operation.

[0076] <Other> Although one embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and modifications, improvements, etc. within the scope that can achieve the object of the present invention are included in the present invention.

[0077] Also, for example, the above-mentioned series of processes can be executed by hardware or software. In other words, the above-mentioned functional configuration is merely an example and is not particularly limited. That is, it is sufficient that the information processing system is provided with a function capable of executing the above-mentioned series of processes as a whole, and the type of functional block used to realize this function is not particularly limited to the above example. In addition, the location of the functional block is not particularly limited and may be arbitrary. For example, the functional block of the server may be transferred to another device or the like. Conversely, the functional block of the other device may be transferred to the server or the like. In addition, one functional block may be configured as a single piece of hardware, may be configured as a single piece of software, or may be configured as a combination of them.

[0078] When a series of processes is executed by software, a program constituting the software is installed in a computer or the like from a network or a recording medium. The computer may be a computer built into dedicated hardware. The computer may also be a computer capable of executing various functions by installing various programs, such as a server, a general-purpose smartphone, or a personal computer. When handling large amounts of data, technology such as quantum computing may be used.

[0079] The recording medium containing such a program may be configured not only as a removable medium (not shown) distributed separately from the device main body in order to provide the program to the user, etc., but also as a recording medium etc. provided to the user in a state in which the medium is pre-installed in the device main body. Since the program can be distributed via a network, the recording medium may be mounted on or accessible to a computer connected or connectable to the network.

[0080] In this specification, the steps describing the program recorded on the recording medium include not only processes performed in chronological order, but also processes that are not necessarily performed in chronological order but are performed in parallel or individually. In addition, in this specification, the term "system" refers to an overall device composed of multiple devices, multiple means, etc. [Explanation of symbols]

[0081] 1: Check device (information processing device) 2: Database 30: Distinctness reduction unit (distinctness reduction means) 31: Acquisition processing unit (acquisition means) 32: Priority setting section (priority setting means) 33: Determination processing unit (determination means) 34: Calculation processing unit (calculation means) 35: Display processing unit (display means) 100: Data Check System

Claims

1. An acquisition means for acquiring target data including personal information and a predetermined anonymization index indicating the possibility that an individual in the target data may be identified; A calculation means for calculating a score based on the target data and the anonymization index for the target data; A display means for executing a process of displaying the score; An information processing device comprising:

2. The anonymization target item or a combination of the anonymization target items that are targets for reducing the identifiability in the target data is further provided with a determination means for determining whether or not the anonymization target item or a combination of the anonymization target items satisfies a criterion based on the anonymization index. The information processing device according to claim 1 .

3. The anonymization target items further include a priority setting unit that sets essential items or priorities in the judgment of the judgment unit. The information processing device according to claim 2 .

4. the priority setting means, when the priority is set, sets weights for the items to be anonymized based on the priority; The information processing device according to claim 3 .

5. The determination means sets items that are not to be determined as items to be anonymized. The information processing device according to claim 2 .

6. The calculation means calculates a score based on a plurality of combinations of anonymization target items that are targets for reducing identifiability in the target data.

6. An information processing device according to claim 1.

7. the calculation means calculates a score based on a ratio of items that satisfy the anonymization index to all combinations of the items to be anonymized, The information processing device according to claim 6.

8. The calculation means calculates the anonymization index after the change or a score based on the target data after the change when the anonymization index is changed or when a processing process for reducing identifiability is performed on the target data, The display means executes a process of displaying the changed score.

6. An information processing device according to claim 1.

9. The display means displays an operation display unit for instructing recalculation of the changed anonymization index or a score based on the changed target data. The information processing device according to claim 8.

10. A data checking method by a computer, comprising the steps of: An acquisition step of acquiring target data including personal information and a predetermined anonymization index indicating the possibility that an individual in the target data may be identified; A calculation step of calculating a score based on the target data and the anonymization index for the target data; A display step of executing a process of displaying the score; A data checking method including:

11. An acquisition step of acquiring target data including personal information and a predetermined anonymization index indicating the possibility that an individual in the target data may be identified; A calculation step of calculating a score based on the target data and the anonymization index for the target data; A display step of executing a process of displaying the score; A program for causing a computer to execute the above.

Images