Data processing apparatus, data processing method, and program

Abstract

To improve the usefulness of data while securing the anonymity of the data.SOLUTION: A data processing apparatus 10 comprises: a pair selection unit 11, from a collection of personal data having public parts and private parts, which selects a pair of the personal data based on the consistency of the public parts and the inconsistency of the private parts; a public part change unit 12, per selected pair, which specifies the parts not matching each other in the respective public parts of the personal data forming the pair, and changes the values of the specified non-matching parts each other; and a private part change unit 13, per selected pair, which specifies the parts matching each other in the personal data forming the pair, and changes the values of the specified matching parts each other.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a data processing technique for ensuring the anonymity of big data. [Background technology]

[0002] In recent years, with the development of IT technology, the need for utilizing big data has rapidly increased, and there is a demand for balancing the effective utilization of big data with privacy protection. To meet this demand, data processing techniques have been proposed that aim to anonymize data while preventing the decline in data usefulness.

[0003] For example, Patent Document 1 discloses a device for anonymizing individual data composed of attribute items of individuals, etc. Specifically, the device disclosed in Patent Document 1 first aggregates the frequency for each attribute item selected from the individual data, calculates the total value for each combination of the attribute items, and aggregates a multidimensional cross frequency table. Furthermore, the device disclosed in Patent Document 1 performs a concealment process on the obtained multidimensional cross frequency table. Note that the concealment process is performed by combining an elimination concealment process, which erases the details on a cross table basis, and a rounding concealment process, which applies a rounding process to each cell of the multidimensional cross frequency table.

[0004] Next, the device disclosed in Patent Document 1 uses the concealed frequency table to calculate the difference between the total number and the total breakdown for each combination of attribute items. Next, the device disclosed in Patent Document 1 divides the frequency or weighted frequency by the scale R for the breakdown of the frequency table from which the difference has been calculated and the difference to convert it into an integer, sets the obtained value as the number of output records, and outputs records for each attribute using the value obtained by dividing the frequency or weighted frequency by the number of output records as a weight. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2021-033382 Summary of the Invention [Problem to be solved by the invention]

[0006] However, in the device disclosed in Patent Document 1, anonymization processing is performed on the multidimensional cross frequency table, which increases the anonymity of the data but does not significantly increase its usefulness. Therefore, when the obtained data is used for machine learning, there is a possibility that the learning accuracy will decrease.

[0007] An example of an objective of the present disclosure is to solve the above problems and improve the usefulness of data while ensuring the anonymity of the data. [Means for solving the problem]

[0008] In order to achieve the above object, a data processing device according to one aspect of the present disclosure comprises: a pair selection unit that selects a pair of personal data from a set of personal data having a public portion and an unpublished portion based on consistency of the public portion and inconsistency of the unpublished portion; a public part change unit that, for each of the selected pairs, identifies a mutually inconsistent part of the public part of each of the personal data constituting the pair, and changes the value of each of the identified inconsistent parts; an undisclosed portion change unit that identifies, for each of the selected pairs, portions of the undisclosed portions of the personal data constituting the pair that match each other, and changes the values ​​of the identified matching portions in each of the selected pairs; The present invention is characterized in that it is provided with:

[0009] In order to achieve the above object, a data processing method according to one aspect of the present disclosure includes: a pair selection step of selecting a pair of personal data from a set of personal data having a public portion and an unpublished portion based on consistency of the public portion and inconsistency of the unpublished portion; a public portion changing step of identifying, for each of the selected pairs, portions of the public portions of the personal data constituting the pair that do not match each other, and changing the values ​​of the identified portions that do not match; an undisclosed portion changing step of identifying, for each of the selected pairs, mutually matching portions of the undisclosed portions of the personal data constituting the pair, and changing the values ​​of the identified matching portions in each of the selected pairs; The present invention is characterized by having the following:

[0010] Furthermore, in order to achieve the above object, a program according to one aspect of the present disclosure includes: On the computer, a pair selection step of selecting a pair of personal data from a set of personal data having a public portion and an unpublished portion based on consistency of the public portion and inconsistency of the unpublished portion; a public portion changing step of identifying, for each of the selected pairs, portions of the public portions of the personal data constituting the pair that do not match each other, and changing the values ​​of the identified portions that do not match; an undisclosed portion changing step of identifying, for each of the selected pairs, mutually matching portions of the undisclosed portions of the personal data constituting the pair, and changing the values ​​of the identified matching portions in each of the selected pairs; The method is characterized in that: [Effects of the Invention]

[0011] As described above, according to the present disclosure, it is possible to improve the usefulness of data while ensuring the anonymity of the data. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram showing a schematic configuration of an example of a data processing device. [Figure 2] FIG. 2 is a block diagram specifically showing an example of a data processing device. [Figure 3]FIG. 3 is a diagram showing an example of the configuration of personal data to be processed. [Figure 4] FIG. 4 is an explanatory diagram illustrating an example of a pair selection process for personal data. [Figure 5] FIG. 5 is an explanatory diagram illustrating an example of a process for changing the public and private parts. [Figure 6] FIG. 6 is a flow diagram illustrating an example of the operation of the data processing device. [Figure 7] FIG. 7 is an explanatory diagram illustrating another example of the pair selection process for personal data. [Figure 8] FIG. 8 is a block diagram showing an example of a computer that realizes the data processing device. DETAILED DESCRIPTION OF THE INVENTION

[0013] (Embodiment) Hereinafter, a data processing device, a data processing method, and a program will be described in the embodiments with reference to FIGS.

[0014] [Device configuration] First, the schematic configuration of an example of a data processing device will be described with reference to Fig. 1. Fig. 1 is a diagram showing the schematic configuration of an example of a data processing device.

[0015] The data processing device 10 shown in Fig. 1 is a device for processing big data so as to ensure anonymity. As shown in Fig. 1, the data processing device 10 includes a pair selection unit 11, a public portion change unit 12, and an unpublished portion change unit 13.

[0016] The pair selection unit 11 selects pairs of personal data from a set of personal data having a public part and an undisclosed part, based on the consistency of the public part and the inconsistency of the undisclosed part.

[0017] For each selected pair, the public part modification unit 12 identifies the mismatched parts of the public parts of the personal data constituting the pair, and then modifies the values ​​of the identified mismatched parts.

[0018] For each selected pair, the undisclosed part modification unit 13 identifies matching parts of the undisclosed parts of the personal data constituting the pair, and then modifies the values ​​of the identified matching parts.

[0019] In this way, the data processing device 10 determines pairs of personal data based on the consistency of the public portion of the data and the inconsistency of the private portion, and processes the public portion and the private portion separately for each pair. Therefore, the data processing device 10 can improve the usefulness of big data while ensuring anonymity.

[0020] Next, the configurations and functions of the devices 1 to 5 in the first embodiment will be specifically described with reference to Figures 2 to 5. Figure 2 is a configuration diagram specifically showing an example of a data processing device.

[0021] As shown in Figure 2, the data processing device 10 includes a data acquisition unit 14 and a data output unit 15 in addition to the pair selection unit 11, public part modification unit 12, and private part modification unit 13 shown in Figure 1.

[0022] The data acquisition unit 14 acquires a collection of personal data to be processed, so-called big data. The data is acquired from an external database, etc. Fig. 3 is a diagram showing an example of the configuration of personal data to be processed.

[0023] As shown in Fig. 3, personal data 20 to be processed is composed of a public portion 21 and an undisclosed portion 22. The public portion includes information that can be inferred from a person's photograph (for example, gender, age, generation, etc.) and information provided when receiving various services (vague address (place of residence), date of birth, etc.). Note that information that can identify an individual by itself, such as My Number (social security number), detailed address, etc., is not included in the public portion. The undisclosed portion includes information that is generally not disclosed to third parties, such as medical conditions, preferences, income, etc.

[0024] The public portion 21 and the private portion 22 of the personal data 20 are set manually in advance. However, in the embodiment, the data acquisition unit 14 can also set the public portion 21 and the private portion 22 of the personal data 20 using a preset rule or a machine learning model. In this case, the machine learning model may be a model obtained by machine learning past examples of the public portion 21 and the private portion 22.

[0025] For example, the pair selection unit 11 first selects three or more pieces of personal data as candidates, such that the number of matching parts in the public parts of the specific personal data is a set number. Furthermore, the pair selection unit 11 selects a candidate that satisfies a set condition from among the selected candidates. Then, the pair selection unit 11 selects the selected candidate and the specific personal data as a pair. The set number here is set, for example, to an arbitrary number or an arbitrary range.

[0026] The processing in the pair selection unit 11 will be specifically described with reference to Fig. 4. Fig. 4 is an explanatory diagram illustrating an example of the pair selection processing for personal data. In Fig. 4, for ease of explanation, items in the personal data are represented by P0 to P7 and R0 to R9, and the values ​​of the corresponding data are represented by numbers 0 to 9. Note that items P0 to P7 indicate public parts, and items R0 to R9 indicate private parts. The number of settings is 5 or more.

[0027] In the example of Fig. 4, the pair selection unit 11 first selects three or more pieces of personal data as candidates that match the personal data in line number 1 at five or more locations in items P0 to P7 of the public portion. Specifically, the pair selection unit 11 selects three pieces of personal data in line numbers 2 to 4 as candidates. Note that although line numbers 5 and 6 match at six locations in items P0 to P7 of the public portion, they are not selected because the number of matching personal data is only two.

[0028] Next, in the example of FIG. 4, the pair selection unit 11 calculates a score, which is a setting condition, for each of the three candidates of line numbers 2 to 4, by comparing it with the personal data of line number 1. If there is a match between line number 2 and line number 1 in the disclosed portion, or if there is no match in the undisclosed portion, the pair selection unit 11 adds +1 to the score. Furthermore, if there are matches between line numbers 2 to 4, the pair selection unit 11 adds -1 to the score for each matching portion. If the setting condition is to have the highest score, the pair selection unit selects line number 4 from the candidates, and selects line numbers 1 and 4 as a pair.

[0029] In the embodiment, the public part modification unit 12 modifies the values ​​of the non-matching parts of the public parts of each of the personal data constituting the pair by exchanging the values ​​of the non-matching parts of the public parts of each of the personal data constituting the pair between them for each selected pair.

[0030] In the embodiment, the undisclosed portion modification unit 13 modifies the matching portions of the undisclosed portions of each of the personal data constituting the pair for each selected pair by changing the values ​​of the matching portions of the undisclosed portions to different matching values.

[0031] The processing in the public portion changing unit 12 and the private portion changing unit 13 will be specifically described using Fig. 5. Fig. 5 is an explanatory diagram illustrating an example of the processing for changing the public portion and the private portion. Also, in Fig. 5, as in Fig. 4, for ease of explanation, the items in the personal data are represented by P0 to P7 and R0 to R9, and the values ​​of the corresponding data are represented by numbers 0 to 9. Also, the items P0 to P7 indicate the public portion, and the items R0 to R9 indicate the private portion.

[0032] As shown in Fig. 5, the personal data in row number 1 and the personal data in row number 4 are selected as a pair (see Fig. 4). The public part modification unit 12 first identifies P4, P6, and P7 as parts of the public parts that do not match each other. Then, the public part modification unit 12 replaces the values ​​of P4, P6, and P7 in the personal data in row number 1 with the values ​​of P4, P6, and P7 in the personal data in row number 4, respectively.

[0033] Next, when the processing by the disclosed portion modification unit 12 is completed, the undisclosed portion modification unit 13 identifies R4 as a matching portion of the undisclosed portions. Then, the undisclosed portion modification unit 13 changes the value of R4 in the personal data of row number 1 and the value of R4 in the personal data of row number 4 to different values. In this case, the change to a different value may be performed using a random numerical value or may be performed in accordance with a preset rule.

[0034] The data output unit 15 outputs to the outside the collection of personal data (processed big data) processed by the processing in the public part change unit 12 and the private part change unit 13. The output destination is a system that uses big data, etc.

[0035] [Device operation] Next, the operation of the data processing device 10 will be described with reference to Figure 6. Figure 6 is a flow diagram showing the operation of an example of a data processing device. In the following description, Figures 1 to 5 will be referenced as appropriate. Furthermore, a data processing method is implemented by operating the data processing device 10. Therefore, in the embodiments, the description of the data processing method will be replaced with the description of the operation of the data processing device below.

[0036] As shown in FIG. 6, first, the data acquisition unit 14 acquires a collection of personal data to be processed, so-called big data (step A1).

[0037] Next, the pair selection unit 11 selects pairs of personal data from the set of personal data based on the consistency of the public parts and the inconsistency of the private parts (step A2).

[0038] Step A2 is performed until all of the personal data acquired in step A1 is selected as pairs. However, the present disclosure is not limited to this, and some of the personal data acquired in step A1 may not be selected as pairs.

[0039] Next, for each pair selected in step A2, the public part modification unit 12 identifies the parts of the public parts of the personal data that make up the pair that do not match each other, and modifies (processes) the values ​​of the identified non-matching parts in each pair (step A3).

[0040] Next, for each pair selected in step A2, the undisclosed portion modification unit 13 identifies the matching portions of the undisclosed portions of each piece of personal data that constitutes the pair, and modifies (processes) the values ​​of the identified matching portions in each pair (step A4).

[0041] Next, the pair selection unit 11 determines whether the processes of steps A3 and A4 have been executed for all pairs selected in step A2 (step A5). If the result of the determination in step A5 shows that the processes of steps A3 and A4 have not been executed for all pairs selected in step A2, steps A3 and A4 are executed again.

[0042] On the other hand, if the result of the judgment in step A5 is that the processing of steps A3 and A4 has been performed for all pairs selected in step A2, the data output unit 15 outputs to the outside the collection of personal data processed by the processing in steps A3 and A4 (processed big data) (step A6).

[0043] [Variations] A modified example of the embodiment will now be described with reference to Fig. 7. In this modified example, the pair selection process by the pair selection unit 11 differs from the example described above. Fig. 7 is an explanatory diagram illustrating another example of the pair selection process for personal data.

[0044] The example in Fig. 7 shows eight pieces of personal data with row numbers 1 to 8. Also, in Fig. 7, similar to the examples in Fig. 4 and Fig. 5, for ease of explanation, the items in the personal data are represented by P0 to P7 and R0 to R9, and the values ​​of the corresponding data are represented by numbers 0 to 9. Also, items P0 to P7 indicate public parts, and items R0 to R9 indicate private parts.

[0045] As shown in Fig. 7, the pair selection unit 11 first calculates the Hamming distance in the public portion between each piece of personal data and personal data in other rows. In the example of Fig. 7, the Hamming distance between each row and other rows is expressed as "{row number: [{Hamming distance: [row number, row number, ...]}, {Hamming distance: [row number, row number, ...]}, ...]".

[0046] The Hamming distance is calculated by comparing the public parts of two pieces of personal data and counting the number of times the values ​​differ for the same item. Therefore, since all the public parts of line number 1 and line number 2 are the same, the Hamming distance is "0." Only P4 differs between line number 1 and line number 3, so the Hamming distance is "1."

[0047] Next, the pair selection unit 11 selects one personal data and adds, as candidates to the candidate list, rows of the selected personal data whose Hamming distance is 1. If the number of rows added as candidates is less than two, the pair selection unit 11 also adds, as candidates to the candidate list, rows whose Hamming distance is 2.

[0048] In order to make it more difficult to estimate pairs using the estimated average Hamming distance in the processed data (to increase the level of security), it is sufficient to increase the number of rows added to the candidate list. However, in this case, the usefulness of the processed data decreases.

[0049] The above process of adding candidates to the candidate list is repeated until the number of added candidates becomes 2 or more. For example, in Fig. 7, when the personal data of row number 1 is selected, the pair selection unit 11 adds row numbers 3 and 8, which have a Hamming distance of 1, to the candidate list.

[0050] Next, the pair selection unit 11 evaluates the usefulness of each candidate added to the candidate list. The pair selection unit 11 compares the selected personal data with the candidate so that the public parts of the pair match as much as possible and the undisclosed parts do not match as much as possible, and calculates a score. At this time, the pair selection unit 11 adds +1 to the score when the selected personal data and the candidate match in the public parts or do not match in the undisclosed parts.

[0051] 7, when the personal data in row number 1 is selected and the candidate list has row numbers 3 and 8, the score of the personal data in row number 3 is "8" and the score of the personal data in row number 8 is "7". Therefore, the pair selection unit 11 selects the personal data in row number 1 and the personal data in row number 3 as a pair.

[0052] The pair selection unit 11 also performs the same process to select pairs for personal data of row numbers that have not yet been selected as pairs. However, if there is personal data that has already been selected as a pair, the pair selection unit 11 deletes the personal data that has already been selected as a pair from the candidate list.

[0053] For example, if the personal data in row number 2 is selected, the personal data in rows 3 and 8 have a Hamming distance of "1", but in this case row 3 is deleted from the candidate list. In this case, the personal data in row 4, which has a Hamming distance of "2", is added to the candidate list.

[0054] In this way, in the modified example, the pair selection unit 11 selects pairs using the Hamming distance. Note that the evaluation of the usefulness of the candidates in the candidate list is not limited to the above example. The evaluation of the usefulness may be performed by another method.

[0055] [Effects of the embodiment] As described above, in the embodiment, two personal data sets with high consistency in the public portions but low consistency in the private portions are paired, and data exchange and modification are performed between the paired personal data sets. This makes it possible to achieve the contradictory effects of data anonymity and data usefulness. In other words, it is possible to avoid a situation where data anonymity is high but data usefulness is low, or conversely, a situation where data anonymity is low but data usefulness is high.

[0056] [program] The program in the embodiment may be a program that causes a computer to execute steps A1 to A6 shown in Fig. 6. By installing and executing this program on a computer, the data processing device 10 and the data processing method can be realized. In this case, the processor of the computer functions and performs processing as a pair selection unit 11, a public portion change unit 12, an unpublicized portion change unit 13, a data acquisition unit 14, and a data output unit 15. In addition to a general-purpose PC, examples of the computer include a smartphone and a tablet terminal device.

[0057] The program in this embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as one of the pair selection unit 11, the public portion change unit 12, the private portion change unit 13, the data acquisition unit 14, and the data output unit 15.

[0058] [Physical configuration] Here, a computer that realizes the data processing device 10 by executing the program in the embodiment will be described with reference to Fig. 8. Fig. 8 is a block diagram showing an example of a computer that realizes the data processing device.

[0059] 8, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other.

[0060] Furthermore, the computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to or instead of the CPU 111. In this aspect, the GPU or FPGA can execute the programs in the embodiments.

[0061] The CPU 111 loads a program in the embodiment, which is composed of a group of codes and stored in the storage device 113, into the main memory 112 and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0062] The program in the embodiment is provided in a state stored in a computer-readable recording medium 120. The program in the embodiment may be distributed over the Internet connected via the communication interface 117.

[0063] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0064] The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads programs from the recording medium 120, and writes processing results from the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and other computers.

[0065] Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as flexible disks, or optical recording media such as CD-ROMs (Compact Disk Read Only Memory).

[0066] The data processing device 10 can be realized not by a computer with a program installed, but by hardware corresponding to each part, such as an electronic circuit. Furthermore, the data processing device 10 may be partially realized by a program and the remaining part by hardware. In the embodiment, the computer is not limited to the computer shown in FIG. 8.

[0067] A part or all of the above-described embodiment can be expressed by (Supplementary Note 1) to (Supplementary Note 12) described below, but is not limited to the following description.

[0068] (Appendix 1) a pair selection unit that selects a pair of personal data from a set of personal data having a public portion and an unpublished portion based on consistency of the public portion and inconsistency of the unpublished portion; a public part change unit that, for each of the selected pairs, identifies a mutually inconsistent part of the public part of each of the personal data constituting the pair, and changes the value of each of the identified inconsistent parts; an undisclosed portion change unit that identifies, for each of the selected pairs, portions of the undisclosed portions of the personal data constituting the pair that match each other, and changes the values ​​of the identified matching portions in each of the selected pairs; Equipped with A data processing device characterized by:

[0069] (Appendix 2) the pair selection unit selects three or more pieces of personal data as candidates, each of which matches a specific personal data piece with a set number of parts in the public portion, and then selects a candidate that satisfies a set condition from among the selected candidates, and selects the selected candidate and the specific personal data piece as the pair; 2. The data processing device according to claim 1.

[0070] (Appendix 3) the public portion change unit changes, for each of the selected pairs, the values ​​of the non-matching portions of the public portions of the personal data constituting the pair by exchanging the values ​​between the public portions. 2. The data processing device according to claim 1.

[0071] (Appendix 4) the undisclosed portion changing unit changes, for each of the selected pairs, values ​​of the matching portions of the undisclosed portions of the personal data constituting the pair by changing them to different matching values; 2. The data processing device according to claim 1.

[0072] (Appendix 5) a pair selection step of selecting a pair of personal data from a set of personal data having a public portion and an unpublished portion based on consistency of the public portion and inconsistency of the unpublished portion; a public portion changing step of identifying, for each of the selected pairs, portions of the public portions of the personal data constituting the pair that do not match each other, and changing the values ​​of the identified portions that do not match; an undisclosed portion changing step of identifying, for each of the selected pairs, mutually matching portions of the undisclosed portions of the personal data constituting the pair, and changing the values ​​of the identified matching portions in each of the selected pairs; having A data processing method characterized by:

[0073] (Appendix 6) In the pair selection step, three or more pieces of personal data are selected as candidates, each of which has a predetermined number of matching parts in the public portion with the specific personal data, and then, from the selected candidates, a candidate that satisfies a predetermined condition is selected, and the selected candidate and the specific personal data are selected as the pair. The data processing method described in Appendix 5.

[0074] (Appendix 7) In the public portion changing step, for each of the selected pairs, values ​​of the public portions of the personal data constituting the pair that do not match each other are changed by exchanging values ​​between the public portions. The data processing method described in Appendix 5.

[0075] (Appendix 8) In the undisclosed portion changing step, for each of the selected pairs, values ​​of the undisclosed portions of the personal data constituting the pair that match each other are changed by changing them to different matching values. The data processing method described in Appendix 5.

[0076] (Appendix 9) On the computer, a pair selection step of selecting a pair of personal data from a set of personal data having a public portion and an unpublished portion based on consistency of the public portion and inconsistency of the unpublished portion; a public portion changing step of identifying, for each of the selected pairs, portions of the public portions of the personal data constituting the pair that do not match each other, and changing the values ​​of the identified portions that do not match; an undisclosed portion changing step of identifying, for each of the selected pairs, mutually matching portions of the undisclosed portions of the personal data constituting the pair, and changing the values ​​of the identified matching portions in each of the selected pairs; A program that executes.

[0077] (Appendix 10) In the pair selection step, three or more pieces of personal data are selected as candidates, each of which has a predetermined number of matching parts in the public portion with the specific personal data, and then, from the selected candidates, a candidate that satisfies a predetermined condition is selected, and the selected candidate and the specific personal data are selected as the pair. 10. The program described in Appendix 9.

[0078] (Appendix 11) In the public portion changing step, for each of the selected pairs, values ​​of the public portions of the personal data constituting the pair that do not match each other are changed by exchanging values ​​between the public portions. 10. The program described in Appendix 9.

[0079] (Appendix 12) In the undisclosed portion changing step, for each of the selected pairs, values ​​of the undisclosed portions of the personal data constituting the pair that match each other are changed by changing them to different matching values. 10. The program described in Appendix 9. [Industrial Applicability]

[0080] As described above, according to the present disclosure, it is possible to improve the usefulness of data while ensuring the anonymity of the data. The present disclosure is useful in various fields where data processing to ensure the anonymity of big data is required. [Explanation of symbols]

[0081] 11 Pair selection section 12 Changes to the public section 13 Unpublished changes 14 Data Acquisition Section 15 Data output section 20 Personal Data 21 Public part 22 Unpublished part 110 Computer 111 CPU 112 main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display Device 120 Recording Media 121 Bus

Claims

1. a pair selection unit that selects a pair of personal data from a set of personal data having a public portion and an undisclosed portion based on consistency of the public portion and inconsistency of the undisclosed portion; a public part change unit that, for each of the selected pairs, identifies a mutually inconsistent part of the public part of each of the personal data constituting the pair, and changes the value of each of the identified inconsistent parts; an undisclosed portion change unit that, for each of the selected pairs, identifies mutually matching portions of the undisclosed portions of the personal data constituting the pair and changes the values ​​of the identified matching portions; Equipped with A data processing device characterized by:

2. the pair selection unit selects three or more pieces of personal data as candidates, each of which has a set number of matching parts in the public portion with the specific personal data, and then selects a candidate that satisfies a set condition from among the selected candidates, and selects the selected candidate and the specific personal data as the pair; 2. The data processing device according to claim 1.

3. the public portion change unit changes, for each of the selected pairs, the values ​​of the non-matching portions of the public portions of the personal data constituting the pair by exchanging the values ​​between the public portions.

2. The data processing device according to claim 1.

4. the undisclosed portion changing unit changes, for each of the selected pairs, values ​​of the matching portions of the undisclosed portions of the personal data constituting the pair by changing them to different matching values.

2. The data processing device according to claim 1.

5. a pair selection step of selecting a pair of personal data from a set of personal data having a public portion and an unpublished portion based on consistency of the public portion and inconsistency of the unpublished portion; a public portion changing step of identifying, for each of the selected pairs, portions of the public portions of the personal data constituting the pair that do not match each other, and changing the values ​​of the identified portions that do not match; an undisclosed portion changing step of identifying, for each of the selected pairs, mutually matching portions of the undisclosed portions of the personal data constituting the pair, and changing the values ​​of the identified matching portions in each of the selected pairs; having A data processing method characterized by:

6. In the pair selection step, three or more pieces of personal data are selected as candidates, each of which has a predetermined number of matching parts in the public portion with the specific personal data, and then a candidate that satisfies a predetermined condition is selected from the selected candidates, and the selected candidate and the specific personal data are selected as the pair. The data processing method according to claim 5 .

7. In the public portion changing step, for each of the selected pairs, values ​​of the public portions of the personal data constituting the pair that do not match each other are changed by exchanging values ​​between the public portions. The data processing method according to claim 5 .

8. In the undisclosed portion changing step, for each of the selected pairs, values ​​of the undisclosed portions of the personal data constituting the pair that match each other are changed by changing them to different matching values. The data processing method according to claim 5 .

9. On the computer, a pair selection step of selecting a pair of personal data from a set of personal data having a public portion and an unpublished portion based on consistency of the public portion and inconsistency of the unpublished portion; a public portion changing step of identifying, for each of the selected pairs, portions of the public portions of the personal data constituting the pair that do not match each other, and changing the values ​​of the identified portions that do not match; an undisclosed portion changing step of identifying, for each of the selected pairs, mutually matching portions of the undisclosed portions of the personal data constituting the pair, and changing the values ​​of the identified matching portions in each of the selected pairs; A program that executes.

10. In the pair selection step, three or more pieces of personal data are selected as candidates, each of which has a predetermined number of matching parts in the public portion with the specific personal data, and then a candidate that satisfies a predetermined condition is selected from the selected candidates, and the selected candidate and the specific personal data are selected as the pair. The program according to claim 9.

11. In the public portion changing step, for each of the selected pairs, values ​​of the public portions of the personal data constituting the pair that do not match each other are changed by exchanging values ​​between the public portions. The program according to claim 9.

12. In the undisclosed portion changing step, for each of the selected pairs, values ​​of the undisclosed portions of the personal data constituting the pair that match each other are changed by changing them to different matching values. The program according to claim 9.

Images