Information processing device, information processing method, and program

Abstract

To suppress increase in privacy risk when providing an anonymized data group.SOLUTION: An information processing device 1 includes: a management unit 131 that manages a noise-added data group, which is a data group with noise added to a predetermined data group, and remaining privacy budget indicating whether additional noise can be added to the predetermined data group; a reception unit 132 that receives an acquisition request for the noise-added data group from a terminal 2; an acquisition unit 133 that acquires the noise-added data group managed by the management unit 131 when the remaining privacy budget at a time of receiving the acquisition request is equal to or below the threshold; and a transmission unit 134 that transmits the noise-added data group acquired by the acquisition unit 133 to terminal 2.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] Conventionally, user information, which is information about users, is collected and analyzed. In this case, in order to protect the privacy of users, noise is added to at least a part of the user information to anonymize the user information (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-117679 Summary of the Invention [Problem to be solved by the invention]

[0004] When performing data analysis, data analysis is often performed from various perspectives, and multiple requests for the same data group may be made. When multiple requests for the same data group are made, if user information is anonymized multiple times for the same data group, multiple variations of the data group corresponding to the same data group are generated. In this case, analyzing multiple variations of the data group makes it easier to infer the contents of the data group before anonymization, which raises the problem of increased privacy risks, such as increased user identifiability. The increased privacy risk is particularly pronounced when multiple businesses collaborate to perform data analysis.

[0005] Therefore, the present invention has been made in consideration of these points, and aims to suppress an increase in privacy risks when providing an anonymized data group. [Means for solving the problem]

[0006] An information processing device according to a first aspect of the present invention includes a management unit that manages a noise-added data group, which is a data group in which noise has been added to a predetermined data group, and a remainder of a privacy budget that indicates whether the noise can be added to the predetermined data group; a reception unit that receives a request to acquire the noise-added data group from a terminal; an acquisition unit that acquires the noise-added data group managed by the management unit if the remainder of the privacy budget when the acquisition request is received is below a threshold; and a transmission unit that transmits the noise-added data group acquired by the acquisition unit to the terminal.

[0007] The specified data group has a risk tolerance value set therefor indicating the tolerance of risk that the privacy of a user related to the specified data group will be identified, and the management unit may manage the remainder of the privacy budget calculated based on the risk value indicating the risk that the privacy of the user will be identified by adding noise to the specified data group to generate the noise-added data group, and the risk tolerance value.

[0008] The management unit manages the remaining number of times that the noise can be added as the remainder of the privacy budget, which is the number of times that the noise has been added minus the number of times that the noise has been added, from the number of times that the noise can be added as the privacy budget, which is calculated by dividing the risk tolerance value by the risk value, and the acquisition unit may acquire the group of noise-added data managed by the management unit if the remaining number of times that the noise can be added is 0 when the acquisition request is received.

[0009] When the reception unit receives the acquisition request and the noise-added data group managed by the management unit does not exist, the acquisition unit may add noise to the specified data group to generate the noise-added data group.

[0010] The management unit may manage the noise-added data group generated by the acquisition unit as a noise-added data group corresponding to the predetermined data group, and update a remainder of the privacy budget.

[0011] The specified data group has multiple versions, and the management unit manages noise-added data groups corresponding to each of the multiple versions of the specified data group and the remainder of the privacy budget, and the reception unit receives from the terminal a request to acquire the noise-added data group corresponding to the specified data group, including a specification of the version, and the acquisition unit, if the remainder of the privacy budget is equal to or less than the threshold, acquires the noise-added data group managed by the management unit corresponding to the specified data group of a specified version, which is the specified version, and if the remainder of the privacy budget exceeds the threshold of the privacy budget, generates a new noise-added data group corresponding to the specified data group of the specified version.

[0012] A new data group is added to the specified data group as the version is updated, and when generating the noise-added data group, the acquisition unit may generate a noise-added differential data group by adding noise to a differential data group that indicates the difference between a specified data group corresponding to the noise-added data group managed by the management unit for a version earlier than the specified version and the specified data group corresponding to the specified version, and combine the noise-added differential data group with the noise-added data group managed by the management unit for a version earlier than the specified version to generate the noise-added data group corresponding to the specified version.

[0013] An information processing method according to a second aspect of the present invention includes the steps of managing a noise-added data group, which is a data group obtained by adding noise to a predetermined data group, and a remainder of a privacy budget indicating whether the noise can be added to the predetermined data group, executed by a computer; receiving a request from a terminal to acquire the noise-added data group; if the remainder of the privacy budget when the acquisition request is received is equal to or less than a threshold, acquiring the managed noise-added data group; and transmitting the acquired noise-added data group to the terminal.

[0014] A program according to a third aspect of the present invention causes a computer to function as a management unit that manages a noise-added data group, which is a data group in which noise has been added to a specified data group, and a remainder of a privacy budget that indicates whether the noise can be added to the specified data group; a reception unit that receives a request from a terminal to acquire the noise-added data group; an acquisition unit that acquires the noise-added data group managed by the management unit if the remainder of the privacy budget when the acquisition request is received is below a threshold; and a transmission unit that transmits the noise-added data group acquired by the acquisition unit to the terminal. [Effects of the Invention]

[0015] According to the present invention, it is possible to suppress an increase in privacy risks when providing an anonymized data group. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 is a diagram illustrating an overview of an information processing system. [Figure 2] FIG. 2 is a diagram illustrating a functional configuration of an information processing device. [Figure 3] FIG. 10 is a diagram illustrating an example of management information. [Figure 4] 10 is a flowchart showing a flow of processing up to when the information processing device transmits a group of noise-added data to a terminal. DETAILED DESCRIPTION OF THE INVENTION

[0017] [Outline of Information Processing System S] 1 is a diagram illustrating an overview of an information processing system S. The information processing system S is a system having an information processing device 1 that provides a predetermined data group and a terminal 2, and is a system for aggregating the data group in the terminal 2.

[0018] The information processing device 1 is, for example, a computer used by a predetermined business that provides a predetermined data group. The predetermined data group is, for example, a group of user-related data collected by the predetermined business from users who use a service provided by the predetermined business. Note that while only one information processing device 1 is shown in FIG. 1, it is assumed that there are multiple predetermined businesses, and each of the multiple predetermined businesses uses a different information processing device 1 and is capable of providing the predetermined data group to the terminal 2.

[0019] The information processing device 1 manages a predetermined data group, a noise-added data group, which is a data group obtained by adding noise to the predetermined data group, and the remaining privacy budget for the predetermined data group. Here, the privacy budget is information indicating whether or not additional noise can be added to the predetermined data group, and if so, how much noise can be added.

[0020] The terminal 2 is a computer used by an aggregator that collects and aggregates data groups from a plurality of predetermined businesses and provides the aggregated data groups to various businesses including the plurality of businesses as data groups for analysis. The information processing device 1 and the terminal 2 are connected to each other so as to be able to communicate with each other via a communication network (not shown) such as the Internet or a mobile phone line.

[0021] In this embodiment, the information processing device 1 receives a request to acquire a noise-added data group from the terminal 2 ((1) in FIG. 1). The information processing device 1 determines whether the remaining privacy budget at the time of receiving the request to acquire the noise-added data group is equal to or less than a threshold ((2) in FIG. 1). If the information processing device 1 determines that the remaining privacy budget is equal to or less than the threshold, it acquires the noise-added data group that it manages ((3-1) in FIG. 1) and transmits the acquired noise-added data group to the terminal 2 ((4) in FIG. 1). On the other hand, if the information processing device 1 determines that the remaining privacy budget is equal to or greater than the threshold, it generates a noise-added data group by adding noise to a predetermined data group that it manages ((3-2) in FIG. 1), reduces the privacy budget by an amount corresponding to the added noise, and transmits the generated noise-added data group to the terminal 2 ((4) in FIG. 1).

[0022] When data analysis is performed on a data group aggregated by terminal 2, the data analysis is often performed from various perspectives. In response to this, information processing device 1 may receive multiple acquisition requests for the same data group from terminal 2 and provide the data group multiple times in response to the acquisition requests. When multiple acquisition requests for the same data group are received, if user information is anonymized multiple times for the same data group, multiple variations of data groups corresponding to the same data group are generated. In this case, analyzing multiple variations of the data group makes it easier to infer the content of the data group before anonymization, which can lead to increased privacy risks, such as increased user identifiability. In response to this, information processing device 1 manages the remaining privacy budget for a specific data group, and if the remaining budget is less than a threshold, it does not generate new noise-added data but instead transmits noise-added data that it manages and has already provided to terminal 2 to terminal 2, thereby preventing an increase in privacy risks.

[0023] [Functional configuration of information processing device 1] Next, a description will be given of the functional configuration of the information processing device 1. FIG.

[0024] As shown in FIG. 2, the information processing device 1 includes a communication unit 11, a storage unit 12, and a control unit 13. The communication unit 11 is a communication interface for transmitting and receiving data to and from the terminal 2 and the like via a communication network.

[0025] The storage unit 12 is a storage medium that stores various types of data, and includes a ROM (Read Only Memory), a RAM (Random Access Memory), a hard disk, an SSD (Solid State Drive), a flash memory, etc. The storage unit 12 stores programs executed by the control unit 13. The storage unit 12 stores programs that cause the control unit 13 to function as a management unit 131, a reception unit 132, an acquisition unit 133, and a transmission unit 134.

[0026] The control unit 13 is, for example, a CPU (Central Processing Unit). The control unit 13 executes a program stored in the storage unit 12, thereby functioning as a management unit 131, a reception unit 132, an acquisition unit 133, and a transmission unit .

[0027] The management unit 131 manages a predetermined data group, a noise-added data group which is a data group obtained by adding noise to the predetermined data group, and a remainder of the privacy budget which indicates whether or not noise can be added to the predetermined data group. Whether or not noise can be added to the predetermined data group indicates, for example, how much noise can be added to the predetermined data group.

[0028] Here, the noise-added data group is assumed to satisfy ε-local differential privacy. ε is, for example, a parameter indicating the strength of privacy. Furthermore, a risk tolerance value indicating the tolerance of the risk that the privacy of a user associated with a given data group will be identified based on the data included in the noise-added data group is set for the given data group. Furthermore, when a noise-added data group is generated so as to satisfy ε-local differential privacy by adding noise to the given data group once, the risk of the user's privacy being identified is assumed to increase. A value indicating the amount of risk increase in this case is referred to as a risk value. The management unit 131 manages the risk tolerance value when generating a noise-added data group so as to satisfy ε-local differential privacy and the remainder of the privacy budget calculated based on the risk value.

[0029] Specifically, the management unit 131 manages the remaining number of times noise can be given as the remainder of the privacy budget, which is the number of times noise has been given minus the number of times it can be given, which is the number of times noise has been given, from the number of times noise can be given as the privacy budget, which is calculated by dividing the risk tolerance value by the risk value.

[0030] Furthermore, the predetermined data group has multiple versions, and the management unit 131 manages noise-added data groups corresponding to the predetermined data group of each of the multiple versions, and the remaining number of times that can be added, which is the remainder of the privacy budget. For example, the storage unit 12 stores management information that associates the noise-added data group of each of the multiple versions with the remaining number of times that can be added, and the management unit 131 manages the noise-added data group of each of the multiple versions and the remaining number of times that can be added based on the management information.

[0031] 3 is a diagram showing an example of management information. As shown in FIG. 3, it can be seen that the management information associates the version of a predetermined data group, information indicating the predetermined data group corresponding to that version, information indicating the noise-added data group corresponding to that version, and the remaining number of times noise can be added. Here, the version of the predetermined data group indicates, for example, the year / month or date when the predetermined data group of that version was created, and a new data group is added to the predetermined data group as the version is updated.

[0032] Furthermore, the predetermined data group and the noise-added data group are, for example, tables stored in a database, and the information indicating the predetermined data group and the noise-added data group is, for example, a table name. Note that the predetermined data group and the noise-added data group may be views with no entity or materialized views with entity, and in this case, the information indicating the predetermined data group and the noise-added data group may be, for example, a view name or a query indicating a view.

[0033] The reception unit 132 receives a request to acquire a noise-added data group from the terminal 2. For example, the reception unit 132 receives a request to acquire a noise-added data group corresponding to a predetermined data group, including a designation of the version of the predetermined data group, from the terminal 2. For example, the acquisition request includes designated version information indicating the version of the designated predetermined data group.

[0034] When the acquisition unit 133 receives a request to acquire a noise-added data group from the terminal 2, it acquires the noise-added data group in response to the acquisition request. If the remaining privacy budget for a predetermined data group when the reception unit 132 receives the acquisition request is equal to or less than a threshold, the acquisition unit 133 acquires the noise-added data group managed by the management unit 131, and if the remaining privacy budget exceeds the threshold, the acquisition unit 133 adds noise to the predetermined data group to generate a noise-added data group and acquires the noise-added data group. Here, noise indicates, for example, replacement of actual data with other data that the actual data could be.

[0035] Specifically, first, the acquisition unit 133 refers to the management information stored in the storage unit 12 and determines whether or not there is a noise-added data group corresponding to the designated version indicated by the version information included in the acquisition request accepted by the acceptance unit 132. If the acquisition unit 133 determines that there is no noise-added data group corresponding to the designated version, it adds noise to a predetermined data group corresponding to the designated version to generate a noise-added data group.

[0036] When the acquisition unit 133 determines that a noise-added data group corresponding to the specified version exists, it identifies the remaining number of times that can be added as the remainder of the privacy budget corresponding to the predetermined data group corresponding to the specified version.

[0037] If the identified remaining privacy budget is equal to or less than a threshold, i.e., if the remaining number of times that can be added is 0, the acquisition unit 133 acquires a noise-added data group managed by the management unit 131 corresponding to a predetermined data group of the specified version. Furthermore, if the identified remaining privacy budget exceeds a threshold, i.e., if the remaining number of times that can be added is 1 or more, the acquisition unit 133 generates a noise-added data group by adding further noise to the noise-added data group corresponding to the specified version. Note that, if the identified remaining privacy budget exceeds a threshold, the acquisition unit 133 may add noise to the predetermined data group corresponding to the specified version and generate a new noise-added data group corresponding to the predetermined data group of the specified version.

[0038] When generating the noise-added data group, the acquiring unit 133 may identify the noise-added data group for a version earlier than the designated version that is managed by the managing unit 131. In this case, for example, the acquiring unit 133 identifies the noise-added data group managed by the managing unit 131 for the version immediately preceding the designated version.

[0039] The acquiring unit 133 then identifies the difference between the predetermined data group corresponding to the identified noise-added data group and the predetermined data group of the specified version as a differential data group indicating a data group added with the version update. The acquiring unit 133 generates a noise-added differential data group by adding noise to the identified differential data group.

[0040] The acquisition unit 133 combines the generated noise-added difference data group with a noise-added data group corresponding to the version immediately preceding the designated version to generate a noise-added data group corresponding to the designated version.

[0041] In this way, when the version of a specified data group is updated, a new version of the noise-added data group is generated using the noise-added data group corresponding to the old version, so the information processing device 1 can prevent the variation of the noise-added data group from increasing as the version is updated.

[0042] The management unit 131 manages the noise-added data group generated by the acquisition unit 133 as a noise-added data group corresponding to a predetermined data group, and updates the remainder of the privacy budget. Specifically, when a noise-added data group corresponding to a designated version does not exist and a noise-added data group is newly generated, the management unit 131 adds information indicating the noise-added data group and information associating the designated version with information indicating the predetermined data group corresponding to the designated version to the management information.

[0043] In addition, if the remaining number of times that can be applied corresponding to the specified version is one or more and a new noise-added data group is generated, the management unit 131 updates the information indicating the noise-added data group associated with the specified version to information indicating the newly generated noise-added data group, and subtracts one from the remaining number of times that can be applied. The transmitting unit 134 transmits the noise-added data group acquired by the acquiring unit 133 to the terminal 2 that sent the acquisition request.

[0044] [Operation flow] Next, a description will be given of the flow of processing related to the information processing device 1. Fig. 4 is a flowchart showing the flow of processing up to when the information processing device 1 transmits a noise-added data group to the terminal 2. First, the receiving unit 132 receives a request to acquire a noise-added data group from the terminal 2 (S1).

[0045] The acquisition unit 133 refers to the management information stored in the storage unit 12 and determines whether or not a noise-added data group of the specified version indicated by the version information included in the acquisition request exists (S2). If the acquisition unit 133 determines that a noise-added data group of the specified version exists (YES in S2), it proceeds to S3, and if it determines that a noise-added data group of the specified version does not exist (NO in S2), it proceeds to S6.

[0046] In S3, the acquisition unit 133 identifies the remaining number of times that can be given corresponding to the noise-added data group. Then, the acquisition unit 133 determines whether the identified remaining number of times that can be given is 0 (S4). If the acquisition unit 133 determines that the remaining number of times that can be given is 0 (YES in S4), it proceeds to S5, and if it determines that the remaining number of times that can be given is not 0 (NO in S4), it proceeds to S6.

[0047] In S5, the acquisition unit 133 acquires the noise-added data group managed by the management unit 131, that is, the noise-added data group associated with the designated version in the management information stored in the storage unit 12.

[0048] On the other hand, in S6, the acquisition unit 133 generates a noise-added data group using a predetermined data group corresponding to the specified version. After generating the noise-added data group, the acquisition unit 133 updates the management information (S7). After the noise-added data group is acquired in S5, or after the management information is updated in S7, the transmission unit 134 transmits the noise-added data group to the terminal 2 (S8).

[0049] [Variations] In the above-described embodiment, the management unit 131 manages the remaining number of times that can be assigned as a remainder of the privacy budget, but this is not limited to this. For example, the management unit 131 may manage the risk tolerance value as a remainder of the privacy budget and reduce the risk value from the risk tolerance value in response to the generation of a new noise-added data group. Then, when the reception unit 132 receives a request to acquire a noise-added data group, if the risk value is higher than the risk tolerance value, the acquisition unit 133 may acquire the noise-added data group managed by the management unit 131.

[0050] [Effects of information processing device 1] As described above, the information processing device 1 according to the present embodiment manages a noise-added data group, which is a data group obtained by adding noise to a predetermined data group, and a remaining privacy budget indicating whether or not additional noise can be added to the predetermined data group. The information processing device 1 receives a request to acquire the noise-added data group from the terminal 2, and if the remaining privacy budget at the time of receiving the acquisition request is equal to or less than a threshold, the information processing device 1 acquires the noise-added data group that it manages and transmits it to the terminal 2. In this way, the information processing device 1 can suppress an increase in privacy risk when providing an anonymized data group.

[0051] Furthermore, this invention will make it possible to contribute to Goal 9 of the United Nations' Sustainable Development Goals (SDGs), which is "Build resilient infrastructure, promote inclusive and sustainable industrialization, and promote innovation and resilience."

[0052] The present invention has been described above using embodiments, but the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes are possible within the scope of the gist of the present invention. For example, all or part of the device can be configured by functionally or physically distributing or integrating any unit. Furthermore, new embodiments resulting from any combination of multiple embodiments are also included in the embodiments of the present invention. The effects of the new embodiments resulting from the combination also have the effects of the original embodiments. [Explanation of symbols]

[0053] 1. Information processing equipment 2. Terminal 11 Communications Department 12 Storage section 13 Control Unit 131 Management Department 132 Reception Department 133 Acquisition Department 134 Transmitter S Information Processing System

Claims

1. a management unit that manages a noise-added data group, which is a data group obtained by adding noise to a predetermined data group, and a remainder of a privacy budget that indicates whether the noise can be added to the predetermined data group; a receiving unit that receives a request to acquire a noise-added data group from a terminal; an acquisition unit that acquires the noise-added data group managed by the management unit when a remaining privacy budget at the time of receiving the acquisition request is equal to or less than a threshold; a transmitting unit that transmits the noise-added data group acquired by the acquiring unit to the terminal; An information processing device having the above.

2. a risk tolerance value indicating a tolerance of risk that the privacy of a user related to the predetermined data group may be identified is set for the predetermined data group; the management unit manages the remainder of the privacy budget calculated based on a risk value indicating a risk that the user's privacy will be identified by adding noise to the predetermined data group to generate the noise-added data group, and the risk tolerance value. The information processing device according to claim 1 .

3. the management unit manages, as a remainder of the privacy budget, a remaining number of times that the noise can be given, which is the number of times that the noise has been given, subtracted from the number of times that the noise can be given as the privacy budget, which is calculated by dividing the risk tolerance value by the risk value; When the remaining number of times that the noise can be added is 0 when the acquisition request is received, the acquisition unit acquires the noise-added data group managed by the management unit. The information processing device according to claim 2 .

4. When the noise-added data group managed by the management unit does not exist when the reception unit receives the acquisition request, the acquisition unit adds noise to the predetermined data group to generate a noise-added data group. The information processing device according to claim 1 .

5. the management unit manages the noise-added data group generated by the acquisition unit as a noise-added data group corresponding to the predetermined data group, and updates a remainder of the privacy budget. The information processing device according to claim 4 .

6. the predetermined data group has a plurality of versions, the management unit manages a noise-added data set corresponding to each of a plurality of versions of a predetermined data set and a remainder of the privacy budget; the receiving unit receives, from the terminal, a request to acquire the noise-added data group corresponding to the predetermined data group, the request including the designation of the version; When the remainder of the privacy budget is equal to or less than the threshold, the acquisition unit acquires a noise-added data group managed by the management unit corresponding to the predetermined data group of a designated version that is the designated version, and when the remainder of the privacy budget exceeds the threshold, generates a new noise-added data group corresponding to the predetermined data group of the designated version. The information processing device according to claim 1 .

7. a new data group is added to the predetermined data group according to a version update; When generating the noise-added data group, the acquisition unit generates a noise-added differential data group by adding noise to a differential data group indicating a difference between a predetermined data group corresponding to the noise-added data group managed by the management unit for a version earlier than the designated version and the predetermined data group corresponding to the designated version, and combines the noise-added differential data group with the noise-added data group managed by the management unit for a version earlier than the designated version to generate a noise-added data group corresponding to the designated version. The information processing device according to claim 6 .

8. The computer executes A step of managing a noise-added data group, which is a data group obtained by adding noise to a predetermined data group, and a remainder of the privacy budget, which indicates whether the noise can be added to the predetermined data group additionally; receiving a request to acquire a noise-added data group from a terminal; acquiring the managed noise-added data set if the remaining privacy budget at the time of receiving the acquisition request is equal to or less than a threshold; transmitting the acquired noise-added data group to the terminal; An information processing method comprising:

9. Computer, a management unit that manages a noise-added data group, which is a data group obtained by adding noise to a predetermined data group, and a remainder of a privacy budget that indicates whether the noise can be added to the predetermined data group; a reception unit that receives a request to acquire a noise-added data group from a terminal; an acquisition unit that acquires the noise-added data set managed by the management unit when a remaining privacy budget at the time of receiving the acquisition request is equal to or less than a threshold; and a transmission unit that transmits the noise-added data group acquired by the acquisition unit to the terminal; A program that functions as a

Images