Information processor, information processing system, and information processing method

Abstract

To provide an information processor, an information processing system, and an information processing method that suppress an increase in privacy risk when providing an anonymized data group.SOLUTION: An information processor 1 includes: a reception unit 131 that receives attribute number information indicating the number of attributes and update frequency information indicating an update frequency of data for each of a plurality of attributes in a predetermined period from a first device 2 that manages a data group including data for each of the plurality of attributes; a determination unit 132 that determines, on the basis of the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating an amount of noise that can be added to the data group, a budget consumption amount, which is an amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, and a transmission unit 133 that transmits the privacy budget and the budget consumption amount determined by the determination unit 132 to the first device 2.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing system, and an information processing method. [Background technology]

[0002] Conventionally, user information, which is information about users, is collected and analyzed. In this case, in order to protect the privacy of users, noise is added to at least a part of the user information to anonymize the user information (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-117679 Summary of the Invention [Problem to be solved by the invention]

[0004] When performing data analysis, data analysis is often performed from various perspectives, and multiple requests for the same data group may be made. When multiple requests for the same data group are made, if user information is anonymized multiple times for the same data group, multiple variations of the data group corresponding to the same data group are generated. In this case, analyzing multiple variations of the data group makes it easier to infer the contents of the data group before anonymization, which raises the problem of increased privacy risks, such as increased user identifiability. The increased privacy risk is particularly pronounced when multiple businesses collaborate to perform data analysis.

[0005] Therefore, the present invention has been made in consideration of these points, and aims to suppress an increase in privacy risks when providing an anonymized data group. [Means for solving the problem]

[0006] An information processing device according to a first aspect of the present invention includes a receiving unit that receives attribute number information indicating the number of attributes and update frequency information indicating the update frequency of data for each of the plurality of attributes over a predetermined period from a device that manages a data group including data for each of the plurality of attributes; a determination unit that determines a budget consumption amount, which is the amount of privacy budget to be reduced for adding noise once to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data group; and a transmission unit that transmits the privacy budget and the budget consumption amount determined by the determination unit to the device.

[0007] The receiving unit may receive, from a plurality of devices that manage a plurality of different data groups, the attribute count information and the update frequency information corresponding to the data groups managed by the devices, the plurality of devices managing each of the plurality of different data groups; the determination unit may determine the budget consumption for each of the plurality of data groups managed by each of the plurality of devices based on the number of attributes indicated in the attribute count information received from each of the plurality of devices, the update frequency indicated by the update frequency information, and the privacy budget indicating the amount of noise that can be added to the plurality of data groups; and determine an individual privacy budget, which is a privacy budget corresponding to each of the plurality of data groups, based on the budget consumption for each of the plurality of data groups and the number of attributes for each of the plurality of data groups; and the transmission unit may transmit, to each of the plurality of devices, the individual privacy budget determined by the determination unit for the data group corresponding to the device and the budget consumption.

[0008] The determination unit may identify a maximum update frequency among the update frequencies of data for each of the multiple attributes indicated by the update frequency information, and determine the budget consumption amount based on the number of attributes indicated by the attribute count information, the identified maximum update frequency, and the privacy budget.

[0009] An information processing device according to a second aspect of the present invention is an information processing device that manages a data group including data for each of a plurality of attributes, the information processing device including: an identification unit that identifies the number of the attributes and an update frequency of data for each of the plurality of attributes in a predetermined period; a transmission unit that transmits attribute number information indicating the number of the attributes identified by the identification unit and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates an amount of noise that can be added to the data group; and a privacy budget that is reduced per adding noise once to data for one attribute included in the data group, the privacy budget being determined from the management device based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget. the data group, and a memory control unit that stores the received privacy budget in a memory unit; a noise adding unit that, when adding noise to target data that is data for each of one or more attributes included in the data group, identifies a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adds noise to the target data on the condition that the privacy budget stored in the memory unit is equal to or greater than the identified subtraction amount; and a subtraction unit that, in response to the addition of noise by the noise adding unit, subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the memory unit.

[0010] The information processing device may further have a reception unit that receives a request to acquire the target data from the management device, and when the noise addition unit adds noise to the target data corresponding to the acquisition request received by the reception unit, the noise addition unit may identify the subtraction amount corresponding to the addition of noise and add noise to the target data on the condition that the privacy budget stored in the memory unit is equal to or greater than the identified subtraction amount, and the transmission unit may transmit noise-added data, which is the target data to which noise has been added by the noise addition unit, to the management device.

[0011] The memory control unit may store the noise-added data in the memory unit, and the transmission unit may transmit the noise-added data corresponding to the target data stored in the memory unit to the management device when the noise addition unit does not add noise to the target data corresponding to the acquisition request received by the reception unit.

[0012] The memory control unit stores the noise-added data in the memory unit, and when the noise adding unit adds noise to the target data corresponding to the acquisition request received by the receiving unit, the noise adding unit may add noise to the noise-added data corresponding to the target data stored in the memory unit, on the condition that the privacy budget stored in the memory unit is equal to or greater than a specified subtraction amount.

[0013] The memory control unit stores the noise-added data in the memory unit, and when the noise-added data corresponding to the target data received by the receiving unit is stored in the memory unit, the noise adding unit may add noise to the target data stored in the memory unit when an update to the target data occurs after the noise-added data is stored in the memory unit.

[0014] The noise adding unit may identify the subtraction amount that would be added if noise were added to the entire data group that has not had the noise added as a second subtraction amount, and if the privacy budget is equal to or greater than the second subtraction amount and the privacy budget after subtracting the subtraction amount corresponding to the acquisition request from the privacy budget is less than the second subtraction amount, add noise to the entire data group that has not had the noise added, and the subtraction unit may subtract the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the memory unit in response to the noise adding unit adding noise to the entire data group that has not had the noise added.

[0015] The noise addition unit adds noise to the entire data group and determines a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, the subtraction unit subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the memory unit in response to the noise addition unit adding noise to the entire data group, the memory control unit stores the data group to which noise has been added in the memory unit as a noise-added data group, and the information processing device may further have a reception unit that receives an acquisition request for the target data from the management device, and the transmission unit may transmit data from the noise-added data group that corresponds to the target data indicated by the acquisition request received by the reception unit to the management device as noise-added data.

[0016] The noise adding unit may determine the amount of subtraction from the privacy budget by multiplying the number of attributes that the target data has by the budget consumption amount.

[0017] An information processing system according to a third aspect of the present invention is an information processing system having a data management device that manages a data group including data for each of a plurality of attributes, and an information processing device, wherein the data management device has an identification unit that identifies the number of the attributes and an update frequency of data for each of the plurality of attributes in a predetermined period, and a transmission unit that transmits attribute number information indicating the number of the attributes identified by the identification unit and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates an amount of noise that can be added to the data group, and the information processing device has a reception unit that receives the attribute number information and the update frequency information from the data management device, and reduces the amount of noise that can be added to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and the privacy budget that indicates the amount of noise that can be added to the data group. The data management device may further include a determination unit that determines a budget consumption amount, which is the amount of a privacy budget, and a transmission unit that transmits budget information indicating the privacy budget and the budget consumption amount determined by the determination unit to the data management device, and a reception unit that receives the budget information from the information processing device, a memory control unit that stores the received privacy budget in a memory unit, a noise addition unit that, when adding noise to target data that is data for one or more attributes included in the data group, identifies a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adds noise to the target data on the condition that the privacy budget stored in the memory unit is equal to or greater than the identified subtraction amount, and a subtraction unit that, in response to the addition of noise by the noise addition unit, subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the memory unit.

[0018] An information processing method according to a fourth aspect of the present invention is executed by a computer and includes the steps of receiving, from a device that manages a data set including data for each of a plurality of attributes, attribute count information indicating the number of the attributes and update frequency information indicating the update frequency of data for each of the plurality of attributes over a predetermined period of time; determining a budget consumption amount, which is the amount of privacy budget to be reduced for adding noise once to data for one attribute included in the data set, based on the number of attributes indicated in the received attribute count information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data set; and transmitting the privacy budget and the determined budget consumption amount to the device.

[0019] An information processing method according to a fifth aspect of the present invention is executed by a computer that manages a data set including data on each of a plurality of attributes, and includes the steps of: identifying the number of the attributes and an update frequency of data on each of the plurality of attributes in a predetermined period; transmitting attribute number information indicating the identified number of the attributes and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates an amount of noise that can be added to the data set; and receiving from the management device an amount of the privacy budget to be reduced for adding noise once to data on one attribute included in the data set, the amount being determined based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget. receiving budget information indicating a budget consumption amount and the privacy budget; storing the received privacy budget in a storage unit; when adding noise to target data which is data for each of one or more attributes included in the data group, specifying a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adding noise to the target data on the condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount; and subtracting the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to adding noise to the target data. [Effects of the Invention]

[0020] According to the present invention, it is possible to suppress an increase in privacy risks when providing an anonymized data group. [Brief explanation of the drawings]

[0021] [Figure 1] FIG. 1 is a diagram illustrating an overview of an information processing system. [Figure 2] FIG. 2 is a diagram illustrating a functional configuration of an information processing device. [Figure 3] FIG. 2 is a diagram illustrating a functional configuration of a first device. [Figure 4] 1 is a sequence diagram showing the flow of processing in an information processing system S until an information processing device 1 collects data from a first device and a second device. [Figure 5] 10 is a flowchart showing the flow of processing in which the first device adds noise to target data. DETAILED DESCRIPTION OF THE INVENTION

[0022] [Outline of Information Processing System S] 1 is a diagram illustrating an overview of an information processing system S. The information processing system S has an information processing device 1, a first device 2 that manages a first data group, and a second device 3 that manages a second data group, and is a system for aggregating data groups in the information processing device 1.

[0023] The information processing device 1 is operated by an aggregation service provider that provides a service of aggregating data and providing the aggregated data, and is communicatively connected to external devices such as a first device 2 and a second device 3 via a communication network (not shown) such as the Internet or a mobile phone line.

[0024] The first device 2 is, for example, a computer operated by a first business operator. The first device 2 functions as a first data management device that manages a first data group including a plurality of first records in which a data ID serving as data identification information for identifying data is associated with the first data. The second device 3 is, for example, a computer operated by a second business operator. The second device 3 functions as a second data management device that manages a second data group including a plurality of second records in which a data ID common to the data IDs included in the first data group is associated with the second data. The first data group and the second data group each include data of a plurality of attributes.

[0025] The information processing device 1 functions as a budget management device that manages a privacy budget indicating the amount of noise that can be added to a data group in order to prevent an increase in privacy risk of the data being aggregated when aggregating data from the first device 2 and the second device 3. The information processing device 1 then determines a budget consumption amount, which is the amount of the privacy budget that is reduced for adding noise once to data of one attribute included in the data group.

[0026] Specifically, the information processing device 1 receives attribute count information indicating the number of attributes of data included in a data group and update frequency information indicating the update frequency of data for each of the multiple attributes over a predetermined period from each of the first device 2 and the second device 3. Then, based on the number of attributes indicated by the attribute count information, the update frequency indicated by the update frequency information, and the privacy budget, the information processing device 1 determines a budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group. The information processing device 1 transmits the determined budget consumption amount and privacy budget to the first device 2 and the second device 3.

[0027] Each of the first device 2 and the second device 3 adds noise to a data group so as not to use up the privacy budget, based on the privacy budget and budget consumption amount received from the information processing device 1, to generate noise-added data, which is a data group to which noise has been added. Then, each of the first device 2 and the second device 3 transmits the generated noise-added data to the information processing device 1. In this way, the information processing system S can prevent the content of the data group before anonymization from being easily guessed, which would be caused by repeatedly adding noise to the same data group multiple times, and can prevent an increase in privacy risk.

[0028] [Functional configuration of information processing device 1] Next, a description will be given of the functional configuration of the information processing device 1. FIG.

[0029] As shown in FIG. 2, the information processing device 1 includes a communication unit 11, a storage unit 12, and a control unit 13. The communication unit 11 is a communication interface for transmitting and receiving data to and from the first device 2, the second device 3, and the like via a communication network.

[0030] The storage unit 12 is a storage medium that stores various types of data, and includes a ROM (Read Only Memory), a RAM (Random Access Memory), a hard disk, an SSD (Solid State Drive), a flash memory, etc. The storage unit 12 stores a program executed by the control unit 13. The storage unit 12 stores a program that causes the control unit 13 to function as a receiving unit 131, a determining unit 132, and a transmitting unit 133.

[0031] The control unit 13 is, for example, a CPU (Central Processing Unit). The control unit 13 executes a program stored in the storage unit 12, thereby functioning as a receiving unit 131, a determining unit 132, and a transmitting unit 133. The control unit 13 will be described in detail later.

[0032] [Functional configuration of first device 2 and second device 3] Next, we will explain the functional configurations of the first device 2 and the second device 3. Figure 3 is a diagram showing the functional configuration of the first device 2. The functional configuration of the second device 3 is the same as the functional configuration of the first device 2, so explanation will be omitted.

[0033] As shown in FIG. 3, the first device 2 includes a communication unit 21, a storage unit 22, and a control unit . The communication unit 21 is a communication interface for transmitting and receiving data to and from the information processing device 1 and the like via a communication network.

[0034] The storage unit 22 is a storage medium that stores various types of data, and includes a ROM, a RAM, a hard disk, an SSD, a flash memory, etc. The storage unit 22 stores programs executed by the control unit 23. The storage unit 22 stores programs that cause the control unit 23 to function as an identification unit 231, a transmission unit 232, a reception unit 233, a storage control unit 234, a reception unit 235, a noise addition unit 236, and a subtraction unit 237.

[0035] A first data group is also stored in the storage unit 22. The first data group is assumed to be updated irregularly, and for example, a version of the first data group and a first data group corresponding to that version are associated and stored in the storage unit 22. The storage unit 22 is also assumed to store noise-added data in which noise is added to target data, which is data for each of one or more attributes included in the first data group, and which has been transmitted to the information processing device 1 in the past.

[0036] The control unit 23 is, for example, a CPU. The control unit 23 executes a program stored in the storage unit 22, thereby functioning as a determination unit 231, a transmission unit 232, a reception unit 233, a storage control unit 234, a reception unit 235, a noise addition unit 236, and a subtraction unit 237.

[0037] [Notification of privacy budget and budget consumption] Next, details of the control units 13 and 23 will be described with reference to sequence diagrams and flowcharts. First, a process flow in the information processing system S until the information processing device 1 collects data from the first device 2 and the second device 3 will be described.

[0038] FIG. 4 is a sequence diagram showing the flow of processing in the information processing system S until the information processing device 1 collects data from the first device 2 and the second device 3. First, the identifying unit 231 of the first device 2 identifies the number of attributes in a first data group including data of each of a plurality of attributes and the update frequency of data of each of the plurality of attributes in a predetermined period (S1).

[0039] For example, the identification unit 231 identifies the number of attributes by identifying the attributes of data corresponding to each of the multiple columns constituting the first data group. Also, different versions of the first data group are stored in the storage unit 22 of the first device 2 over a predetermined period, and the identification unit 231 identifies the update frequency of data for each of the multiple attributes over a predetermined period by identifying the number of updates of data in the multiple first data groups of different versions.

[0040] The transmission unit 232 transmits attribute number information indicating the number of attributes identified by the identification unit 231 and update frequency information indicating the update frequency to the information processing device 1 that manages the privacy budget indicating the amount of noise that can be added to a data group (S2).

[0041] Similarly, the second device 3 identifies the number of attributes and the update frequency of data for each of the multiple attributes in a predetermined period (S3), and transmits attribute number information and update frequency information to the information processing device 1 (S4).

[0042] The receiving unit 131 receives attribute number information indicating the number of attributes of the data included in the data group and update frequency information indicating the update frequency of the data for each of the multiple attributes over a specified period from each of the first device 2 and the second device 3, which are multiple devices that manage a data group including data for each of the multiple attributes.

[0043] The determination unit 132 determines the budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group managed by each of the first device 2 and the second device 3 (S5).

[0044] The determination unit 132 determines the budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, based on the number of attributes corresponding to the data included in the data group indicated by the attribute number information received by the receiving unit 131, the update frequency of the data of each of the multiple attributes over a specified period indicated by the received update frequency information, and the privacy budget indicating the amount of noise that can be added to the data group.

[0045] Specifically, the determination unit 132 determines the budget consumption amount for each of the multiple data groups managed by each of the first device 2 and the second device 3 based on the number of attributes indicated by the attribute count information received from each of the first device 2 and the second device 3, the update frequency indicated by the update frequency information, and the total privacy budget indicating the total amount of noise that can be added to the multiple data groups.

[0046] For example, the determination unit 132 identifies the maximum update frequency among the update frequencies of data for each of a plurality of attributes in a predetermined period. Then, the determination unit 132 determines the budget consumption amount based on the number of attributes indicated by the attribute number information received from each of the first device 2 and the second device 3, the identified maximum update frequency, and the total privacy budget. The number n of attributes of data included in the first data group managed by the first device 2 A The number of attributes of data included in the second data group managed by the second device 3 is n B , where ε is the total privacy budget, ε1 is the budget consumption when noise is added once to data of one attribute included in multiple data groups, and k is the maximum update frequency, the determination unit 132 determines the budget consumption ε1 using the following equation (1).

[0047]

number

[0048] The determination unit 132 also determines the budget consumption amount ε1 determined for each of the plurality of data groups and the number n of attributes for each of the plurality of data groups. A and n B Based on the above, an individual privacy budget corresponding to each of the plurality of data groups is determined (S6). The individual privacy budget corresponding to the first data group is defined as ε A , the individual privacy budget corresponding to the second data set is ε B In this case, the determination unit 132 determines the individual privacy budget ε by the following equations (2) and (3): A , ε B Determine.

[0049]

number

number

[0050] Although the determination unit 132 determines the individual privacy budget based on the maximum update frequency, this is not limiting. The determination unit 132 may also identify the average number of update frequencies or the sum of update frequencies based on the update frequency of data for each of a plurality of attributes over a predetermined period. Then, the determination unit 132 may determine the individual privacy budget based on the average number of update frequencies or the sum of update frequencies instead of the maximum update frequency.

[0051] The transmitting unit 133 transmits the privacy budget and the budget consumption amount determined by the determining unit 132 to the device that manages the data group. Specifically, the transmitting unit 133 transmits budget information indicating the individual privacy budgets and budget consumption amounts determined by the determining unit 132 for the data groups corresponding to the devices, to the first device 2 and the second device 3, which are the multiple devices (S7, S8).

[0052] The receiving unit 233 of the first device 2 receives the budget information from the information processing device 1. The receiving unit 233 receives, from the information processing device 1, the budget information indicating the budget consumption amount and the individual privacy budget determined by the determination unit 132 for the first device 2. Similarly, the second device 3 also receives the budget information from the information processing device 1.

[0053] The memory control unit 234 of the first device 2 stores the budget information received by the receiving unit 233 in the memory unit 12, thereby storing the budget consumption amount and the individual privacy budget in the memory unit 12 (S9). Similarly, the second device 3 stores the received budget information in its own memory, thereby storing the budget consumption amount and the individual privacy budget in its own memory (S10).

[0054] Next, the transmission unit 133 of the information processing device 1 makes a request to the first device 2 to acquire target data, which is data for each of one or more attributes included in the first data group managed by the first device 2 (S11). The request to acquire the target data includes a query to add noise to the target data and acquire the target data with the noise added.

[0055] The receiving unit 235 of the first device 2 receives, from the information processing device 1, a request to acquire target data, which is data for each of one or more attributes included in the first data group. The noise adding unit 236 of the first device 2 adds noise to the target data corresponding to the acquisition request received by the receiving unit 235, thereby acquiring noise-added data, which is the target data to which noise has been added (S12). Details of the noise adding unit 236 will be described later.

[0056] The transmitting unit 232 of the first device 2 transmits the noise-added data acquired by the noise adding unit 236 to the information processing device 1 (S13). If the noise adding unit 236 fails to acquire the noise-added data, the transmitting unit 232 of the first device 2 transmits error information indicating that the noise-added data could not be acquired to the information processing device 1. The receiving unit 131 of the information processing device 1 receives the noise-added data from the first device 2 and stores it in the memory unit 12.

[0057] Furthermore, the transmitting unit 133 of the information processing device 1 also requests the second device 3 to acquire target data, which is data for each of one or more attributes included in the second data group managed by the second device 3 (S14). The second device 3 acquires noise-added data, which is the target data to which noise has been added, by adding noise to the target data corresponding to the acquisition request received from the information processing device 1 (S15), and transmits the noise-added data to the information processing device 1 (S16). The receiving unit 131 of the information processing device 1 receives the noise-added data from the second device 3 and stores it in the storage unit 12.

[0058] [Details on adding noise to target data] Next, the flow of processing in which the first device 2 and the second device 3 add noise to target data will be described. Fig. 5 is a flowchart showing the flow of processing in which the first device 2 adds noise to target data. Note that the flow of processing in which the second device 3 adds noise to target data is the same as the flow of processing in which the first device 2 adds noise to target data, so a description thereof will be omitted.

[0059] When adding noise to target data corresponding to an acquisition request received by the receiving unit 235, the noise adding unit 236 identifies the amount of subtraction from the privacy budget corresponding to the addition of the noise based on the budget consumption amount (S101).

[0060] For example, the noise adding unit 236 identifies the number of columns of data to be extracted as the number of attributes to add noise to, based on the query included in the acquisition request received by the receiving unit 235. Then, the noise adding unit 236 multiplies the identified number of attributes by the budget consumption amount stored in the storage unit 22, thereby identifying the amount of deduction from the privacy budget due to adding noise to the target data.

[0061] The noise adding unit 236 adds noise to the target data on the condition that the privacy budget stored in the storage unit 22 is equal to or greater than the specified subtraction amount, and acquires the noise-added data. For example, the noise adding unit 236 determines whether the privacy budget stored in the storage unit 22 is equal to or greater than the specified subtraction amount (S102). If the noise adding unit 236 determines that the privacy budget is equal to or greater than the specified subtraction amount (YES in S102), it proceeds to S103. If the noise adding unit 236 determines that the privacy budget is less than the specified subtraction amount (NO in S102), it proceeds to S106, and performs control so as not to add noise to the target data corresponding to the acquisition request accepted by the accepting unit 235.

[0062] In S103, the noise adding unit 236 adds noise to the target data to acquire noise-added data. Here, when adding noise to the target data corresponding to the acquisition request accepted by the accepting unit 235, if noise-added data corresponding to the target data is stored in the storage unit 22, the noise adding unit 236 may add noise to the noise-added data.

[0063] Furthermore, in a case where noise-added data corresponding to the target data accepted by accepting unit 235 is stored in storage unit 22, and the target data is updated after the noise-added data is stored in storage unit 22, noise adding unit 236 may add noise to the target data stored in storage unit 22. In this way, first device 2 can generate noise-added data corresponding to the latest target data.

[0064] Next, in response to the noise adding unit 236 adding noise to the target data and obtaining the noise-added data, the subtraction unit 237 subtracts the subtraction amount corresponding to the addition of the noise, identified in S101, from the privacy budget stored in the memory unit 22 (S104).

[0065] Next, the storage control unit 234 stores the noise-added data, which is the target data to which noise has been added by the noise adding unit 236, in the storage unit 22 (S105). For example, the storage control unit 234 associates the query indicated by the acquisition request accepted by the accepting unit 235 with the noise-added data corresponding to the query and stores them in the storage unit 22.

[0066] In S106, the noise adding unit 236 determines whether or not noise-added data, in which noise has been added to target data corresponding to the acquisition request, is stored in the storage unit 12. For example, the noise adding unit 236 determines whether or not noise-added data, in which noise has been added to target data corresponding to the acquisition request, is stored by determining whether or not noise-added data is stored in association with a query indicated by the acquisition request in the storage unit 22.

[0067] When the noise adding unit 236 determines that the noise-added data is stored in the storage unit 12 (YES in S106), the process proceeds to S107, and the noise adding unit 236 acquires the noise-added data stored in the storage unit 22. Furthermore, when the noise adding unit 236 determines that the noise-added data is not stored in the storage unit 12 (NO in S106), the process according to this flowchart ends.

[0068] Note that, if the privacy budget is less than the subtraction amount and the noise-added data is not stored in the storage unit 12, the noise-added data will not be transmitted to the information processing device 1. To prevent this, the noise adding unit 236 may add noise to the entire data group in advance to generate a noise-added data group, which is a data group to which noise has been added, and the storage control unit 224 may store the noise-added data group in the storage unit 22.

[0069] In this case, in response to the receiving unit 233 receiving budget information from the information processing device 1, the noise adding unit 236 adds noise to the entire data group to generate a noise-added data group, and determines the amount of deduction from the individual privacy budget corresponding to the addition of the noise based on the budget consumption amount.

[0070] When the noise adding unit 236 adds noise to the entire data group, the subtraction unit 237 subtracts a subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit 22. Furthermore, the storage control unit 234 stores the data group to which noise has been added in the storage unit 22 as a noise-added data group.

[0071] Thereafter, the receiving unit 235 receives a request to acquire the target data from the information processing device 1, and the transmitting unit 232 transmits data from the noise-added data group stored in the memory unit 22 that corresponds to the target data indicated by the acquisition request received by the receiving unit 235 as noise-added data to the information processing device 1.

[0072] Furthermore, the noise adding unit 236 may specify, as the second subtraction amount, the amount of subtraction that would be achieved if noise were added to the entire data group to which no noise has been added, among the first data group, in response to the receiving unit 235 receiving the request to acquire the target data. Then, the noise adding unit 236 may add noise to the entire data group to which no noise has been added, when the privacy budget is equal to or greater than the second subtraction amount and the privacy budget after subtracting the subtraction amount corresponding to the acquisition request from the privacy budget is less than the second subtraction amount.

[0073] Then, in response to the noise adding unit 236 adding noise to the entire data group to which no noise has been added, the subtraction unit 237 subtracts a second subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit 22. Furthermore, the storage control unit 234 stores the noise-added data generated by adding noise to the entire data group to which no noise has been added in the storage unit 22. In this way, the information processing device 1 can prevent the noise-added data from not being transmitted to the information processing device 1, just as in the case of adding noise to the entire first data group in advance to generate the noise-added data group.

[0074] [Effects of information processing device 1] As described above, in the information processing system S according to this embodiment, the information processing device 1 receives attribute count information indicating the number of attributes and update frequency information indicating the update frequency of the data for each of the multiple attributes over a predetermined period from the first device 2 and the second device 3 that manage a data group including data for each of the multiple attributes, and determines a budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data for one attribute included in the data group, based on the number of attributes indicated by the attribute count information, the update frequency indicated by the update frequency information, and the privacy budget indicating the amount of noise that can be added to the data group, and transmits the privacy budget and the determined budget consumption amount to the first device 2 and the second device 3.

[0075] In the information processing system S according to the present embodiment, the first device 2 and the second device 3 transmit attribute count information and update frequency information to the information processing device 1, receive from the information processing device 1 budget information indicating the number of attributes indicated by the attribute count information, the update frequency indicated by the update frequency information, and a budget consumption amount determined based on the privacy budget, and store the budget in the storage unit 22. When adding noise to target data, which is data for one or more attributes included in a data group, the first device 2 and the second device 3 identify a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, add the noise to the target data on the condition that the privacy budget stored in the storage unit 22 is equal to or greater than the identified subtraction amount, and subtract the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit 22. In this way, the information processing system S can prevent an increase in privacy risk when providing an anonymized data group.

[0076] Furthermore, this invention will make it possible to contribute to Goal 9 of the United Nations' Sustainable Development Goals (SDGs), which is "Build resilient infrastructure, promote inclusive and sustainable industrialization, and promote innovation and resilience."

[0077] Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes are possible within the scope of the gist thereof. For example, in the above-described embodiments, the information processing device 1 determines the budget consumption amount and the individual privacy budget for two data groups managed by two devices, the first device 2 and the second device 3, but this is not limiting. The information processing device 1 may also determine the budget consumption amount and the individual privacy budget for three or more devices.

[0078] Furthermore, all or part of the device can be configured in any unit, functionally or physically, distributed or integrated. Furthermore, new embodiments resulting from any combination of multiple embodiments are also included in the embodiments of the present invention. The effects of the new embodiments resulting from the combination also have the effects of the original embodiments. [Explanation of symbols]

[0079] 1. Information processing equipment 2 1st device 3 Second device 11 Communications Department 12 Storage section 13 Control Unit 21 Communications Department 22 Memory section 23 Control Unit 131 Receiving unit 132 Decision Section 133 Transmitter 231 Specific part 232 Transmitter 233 Receiving Unit 234 Memory control unit 235 Reception 236 Noise Addition Unit 237 Subtraction Section S Information Processing System

Claims

1. a receiving unit that receives, from a device that manages a data group including data for each of a plurality of attributes, attribute number information indicating the number of the attributes and update frequency information indicating an update frequency of data for each of the plurality of attributes in a predetermined period; a determination unit that determines a budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data group; and a transmitter that transmits the privacy budget and the budget consumption amount determined by the determiner to the device; An information processing device having the above.

2. the receiving unit receives, from a plurality of devices that manage a plurality of different data groups, the attribute count information and the update frequency information corresponding to the data groups managed by the devices; the determination unit determines the budget consumption amount for each of a plurality of data groups managed by each of the plurality of devices based on the number of attributes indicated by the attribute count information received from each of the plurality of devices, the update frequency indicated by the update frequency information, and the privacy budget indicating the amount of noise that can be added to the plurality of data groups, and determines an individual privacy budget that is a privacy budget corresponding to each of the plurality of data groups based on the budget consumption amount for each of the plurality of data groups and the number of attributes for each of the plurality of data groups; the transmitting unit transmits, to each of the plurality of devices, the individual privacy budget determined by the determining unit for the data group corresponding to the device and the budget consumption amount; The information processing device according to claim 1 .

3. the determination unit identifies a maximum update frequency among update frequencies of data of each of a plurality of attributes indicated by the update frequency information, and determines the budget consumption amount based on the number of attributes indicated by the attribute count information, the identified maximum update frequency, and the privacy budget. The information processing device according to claim 1 .

4. An information processing device that manages a data group including data for each of a plurality of attributes, an identification unit that identifies the number of the attributes and an update frequency of data for each of the plurality of attributes in a predetermined period; a transmitter that transmits attribute number information indicating the number of the attributes identified by the identification unit and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates an amount of noise that can be added to the data group; a receiving unit that receives from the management device budget information indicating a budget consumption amount, which is an amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, determined based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget, and the privacy budget; a storage control unit that stores the received privacy budget in a storage unit; a noise adding unit that, when adding noise to target data that is data for each of one or more attributes included in the data group, specifies a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adds noise to the target data on the condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount; a subtraction unit that subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to the noise addition unit adding the noise; An information processing device having the above.

5. a receiving unit that receives a request to acquire the target data from the management device; the noise adding unit, when adding noise to the target data corresponding to the acquisition request accepted by the accepting unit, specifies the subtraction amount corresponding to the addition of the noise, and adds noise to the target data on the condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount; the transmission unit transmits noise-added data, which is the target data to which noise has been added by the noise adding unit, to the management device; The information processing device according to claim 4 .

6. the storage control unit stores the noise-added data in the storage unit; the transmitting unit, when the noise adding unit does not add noise to the target data corresponding to the acquisition request accepted by the accepting unit, transmits the noise-added data corresponding to the target data stored in the storage unit to the management device. The information processing device according to claim 5 .

7. the storage control unit stores the noise-added data in the storage unit; When adding noise to the target data corresponding to the acquisition request received by the receiving unit, the noise adding unit adds noise to the noise-added data corresponding to the target data stored in the storage unit, on condition that the privacy budget stored in the storage unit is equal to or greater than a specified subtraction amount. The information processing device according to claim 5 .

8. the storage control unit stores the noise-added data in the storage unit; When the noise-added data corresponding to the target data accepted by the accepting unit is stored in the storage unit, and the target data is updated after the noise-added data is stored in the storage unit, the noise adding unit adds noise to the target data stored in the storage unit. The information processing device according to claim 7 .

9. the noise adding unit specifies the subtraction amount when noise is added to the entire data group to which the noise has not been added as a second subtraction amount, and adds noise to the entire data group to which the noise has not been added when the privacy budget is equal to or greater than the second subtraction amount and the privacy budget after subtracting the subtraction amount corresponding to the acquisition request from the privacy budget is less than the second subtraction amount; the subtraction unit, in response to the noise adding unit adding noise to the entire data group to which the noise has not been added, subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit; The information processing device according to claim 5 .

10. the noise adding unit adds noise to the entire data group, and determines a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount; the subtraction unit, in response to the noise adding unit adding noise to the entire data group, subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit; the storage control unit stores the data group to which noise has been added as a noise-added data group in the storage unit; a receiving unit that receives a request to acquire the target data from the management device; the transmitting unit transmits, to the management device, data from the noise-added data group that corresponds to target data indicated by the acquisition request accepted by the accepting unit as noise-added data. The information processing device according to claim 4 .

11. the noise adding unit multiplies the number of attributes included in the target data by the budget consumption amount to identify the amount of subtraction from the privacy budget; The information processing device according to claim 4 .

12. An information processing system having a data management device that manages a data group including data for each of a plurality of attributes, and an information processing device, The data management device an identification unit that identifies the number of the attributes and an update frequency of data for each of the plurality of attributes in a predetermined period; a transmitter that transmits attribute number information indicating the number of the attributes identified by the identification unit and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates an amount of noise that can be added to the data group; and The information processing device includes: a receiving unit that receives the attribute number information and the update frequency information from the data management device; a determination unit that determines a budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data group; and a transmitting unit that transmits to the data management device budget information indicating the privacy budget and the budget consumption amount determined by the determining unit; and The data management device a receiving unit that receives the budget information from the information processing device; a storage control unit that stores the received privacy budget in a storage unit; a noise adding unit that, when adding noise to target data that is data for each of one or more attributes included in the data group, specifies a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adds noise to the target data on the condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount; a subtraction unit that subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to the noise addition unit adding the noise; further comprising Information processing system.

13. The computer executes receiving attribute number information indicating the number of attributes and update frequency information indicating an update frequency of data for each of the plurality of attributes in a predetermined period from a device that manages a data group including data for each of the plurality of attributes; determining a budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data group; transmitting the privacy budget and the determined budget consumption to the device; An information processing method comprising:

14. A computer that manages a data group including data for each of a plurality of attributes executes Identifying the number of attributes and a frequency of update of data for each of the plurality of attributes over a predetermined period of time; transmitting attribute number information indicating the number of the identified attributes and update frequency information indicating the update frequency to a management device that manages a privacy budget indicating the amount of noise that can be added to the data group; receiving, from the management device, budget information indicating a budget consumption amount, which is an amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, determined based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget, and the privacy budget; storing the received privacy budget in a storage unit; When adding noise to target data, which is data for each of one or more attributes included in the data group, specifying a subtraction amount from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adding noise to the target data on the condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount; a step of subtracting the subtraction amount corresponding to the addition of noise from the privacy budget stored in the storage unit in response to adding noise to the target data; An information processing method comprising:

Images