Information processing apparatus, information processing method, and program

Abstract

To provide an information processor, an information processing method and a program for suppressing costs required for k-anonymization using a generalization tree.SOLUTION: An information processing apparatus 100 includes an identifier which is an element of an item individually identifiable as personal information of the same person, and a quasi-identifier which is an element of a plurality of items individually identifiable by a combination, and a generation unit which generates tree data in which an element and an attribute including the element are expressed in a hierarchical structure based on the element of a predetermined item in the plurality of pieces of personal information, and an anonymization unit which replaces the element of the predetermined item in the plurality of pieces of personal information with an attribute based on the tree data, and outputs the anonymized personal information.SELECTED DRAWING: Figure 21

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] It is necessary to utilize data that contains personal information while protecting privacy. However, in order to protect privacy, it is not enough to simply delete information that can uniquely identify an individual, such as name or social insurance number. It is known that even information that cannot uniquely identify an individual, such as date of birth, address, or gender, can make it possible to identify an individual by combining multiple pieces of information.

[0003] In this situation, a technique known as "k-anonymization" is known as a technique for protecting data privacy. Here, in the data described above, information that can uniquely identify an individual by itself, such as a name, is called an "identifier," while information that cannot uniquely identify an individual by itself, such as an address, but can be used in combination with other information to identify an individual, is called a "quasi-identifier." "k-anonymization" reduces the risk of individuals being identified by processing quasi-identifiers so that for every individual in the data, there are at least k other individuals with the exact same quasi-identifier.

[0004] An example of k-anonymization will be explained with reference to Figure 1. If fictitious medical record data such as that shown in Figure 1 (1-1) exists, "illness" is the "identifier" and "gender," "age," and "address" are the "quasi-identifiers." In this case, if k-anonymization is performed with k=2, the result will be as shown in Figure 1 (1-2). As a result, even if a third party obtains data such as "male," "23 years old," and "resident in Kita Ward, Tokyo," they will not be able to identify the "illness" as "pneumonia." In other words, with the above-mentioned k-anonymization, there will be multiple patients (k people) with the same "quasi-identifier," making it impossible to identify the "illness" as an "identifier."

[0005] As shown in this example, "k-anonymization" requires that each quasi-identifier be converted into information that covers a wider range than the information itself. The breadth of the range to be covered varies depending on the nature of each piece of information, the scale of the data itself, the value of k, and other factors. The k-anonymization algorithm uses a generalization tree that is created in advance for each quasi-identifier and hierarchically clustered using information from a wider range. For example, in the above example, the "address" generalization tree shown in Figure 1 (1-3) can be used to replace the information of each quasi-identifier, which is "address," with information from a wider range, thereby enabling optimal anonymization processing. Another example of k-anonymization is disclosed in Patent Document 1. The k-anonymization technology described in Patent Document 1 uses a Hu-Tucker code tree for the generalization tree. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-184213 Summary of the Invention [Problem to be solved by the invention]

[0007] However, as mentioned above, k-anonymization presupposes the existence of a generalization tree, and creating a generalization tree is costly. In other words, creating a generalization tree varies depending on the data to be anonymized, with many factors such as the structure, the type and scope of information handled, and the overall size of the data, and creating a general-purpose generalization tree requires labor and costs corresponding to the labor required. As a result, the problem of k-anonymization using a generalization tree being costly arises.

[0008] Therefore, one of the objectives of the present disclosure is to solve the above-mentioned problem that k-anonymization using a generalization tree is costly. [Means for solving the problem]

[0009] An information processing device according to an embodiment of the present disclosure includes: a generation unit that generates tree data in which an identifier, which is an element of an item that can identify the individual by itself, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual by combining them, as personal information of the same individual, and that generates tree data in which the element and attributes that include the element are expressed in a hierarchical structure based on elements of predetermined items of the quasi-identifiers in the plurality of personal information; an anonymization unit that anonymizes the plurality of personal information by replacing elements of the predetermined items in the plurality of personal information with attributes based on the tree data, and outputs the anonymized personal information; Equipped with The structure is as follows. Furthermore, an information processing method according to an embodiment of the present disclosure includes: As personal information of the same individual, an identifier, which is an element of an item that can identify the individual on its own, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual in combination, and tree data is generated that represents the element and attributes that include the element in a hierarchical structure based on the element of a predetermined item of the quasi-identifier in the plurality of personal information; anonymizing the elements of the predetermined items in the plurality of personal information by replacing them with attributes based on the tree data, and outputting the anonymized personal information; The structure is as follows. Furthermore, a program according to an embodiment of the present disclosure includes: As personal information of the same individual, an identifier, which is an element of an item that can identify the individual on its own, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual in combination, and tree data is generated that represents the element and attributes that include the element in a hierarchical structure based on the element of a predetermined item of the quasi-identifier in the plurality of personal information; anonymizing the elements of the predetermined items in the plurality of personal information by replacing them with attributes based on the tree data, and outputting the anonymized personal information; Have the computer perform the process, The structure is as follows. [Effects of the Invention]

[0010] With the above-described configuration, the present disclosure can reduce the cost of k-anonymization using a generalization tree. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram for explaining a technique related to the present disclosure. [Figure 2] 1 is a block diagram illustrating an example of a configuration of an anonymization device according to the present disclosure. [Figure 3] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 4] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 5] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 6] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 7] 10 is a flowchart illustrating an example of a processing operation of an anonymization device according to the present disclosure. [Figure 8] 1 is a block diagram illustrating an example of a configuration of an anonymization device according to the present disclosure. [Figure 9] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 10] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 11] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 12] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 13] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 14] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 15] 10 is a flowchart illustrating an example of a processing operation of an anonymization device according to the present disclosure. [Figure 16] 1 is a block diagram illustrating an example of a configuration of an anonymization device according to the present disclosure. [Figure 17] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 18] FIG. 10 is a diagram illustrating an example of a process performed by an anonymization device according to the present disclosure. [Figure 19] 10 is a flowchart illustrating an example of a processing operation of an anonymization device according to the present disclosure. [Figure 20] FIG. 1 is a block diagram illustrating an example of a hardware configuration of an information processing device according to the present disclosure. [Figure 21] 1 is a block diagram illustrating an example of a configuration of an information processing device according to the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0012] First Embodiment A first embodiment of the present disclosure will be described with reference to the drawings, which may be relevant to any embodiment.

[0013] The anonymization device 10 of the present disclosure is used to anonymize personal information to protect the privacy of the personal information. In this embodiment, the personal information to be anonymized by the anonymization device 10 is assumed to be information in which an "identifier," which is an element of an item that can identify the individual alone, is associated with "quasi-identifiers," which are elements of multiple items that can identify the individual in combination. As an example, as shown in FIG. 3 , the present embodiment handles personal information in which an "identifier," such as "name," is associated with "quasi-identifiers," such as "occupation" and "age." The anonymization device 10 receives multiple pieces of personal information, such as those shown in FIG. 3 , as original data before anonymization. The anonymization device 10 then extracts each quasi-identifier of the personal information as a classification target, creates a generalization tree for each classification target, and performs k-anonymization using the generalization tree. The specific configuration and operation of the anonymization device 10 will be described below.

[0014] [composition] The anonymization device 10 in this embodiment is configured with one or more information processing devices each including a calculation device and a storage device. As shown in Fig. 2, the anonymization device 10 includes a generalization tree generation unit 11, a generalization tree storage unit 12, and an anonymization unit 13. The functions of the generalization tree generation unit 11 and the anonymization unit 13 can be realized by the calculation device executing a program for realizing each function stored in the storage device. The generalization tree storage unit 12 is also configured with the storage device.

[0015] 1, the generalization tree generation unit 11 (generation unit) further includes a classification object acceptance unit 11a, a prompt generation unit 11b, an LLM unit 11c, and a generalization tree output unit 11d. The generalization tree generation unit 11 generates a generalization tree for each classification object in each of the units 11a-11d, as described below, and stores the generated generalization trees in the generalization tree storage unit 12.

[0016] The classification object acceptance unit 11a extracts elements of each item, which is a quasi-identifier in the original data of personal information, as classification objects 1, 2, ..., N (N is the number of quasi-identifier items). For example, in FIG. 3, elements of the items "occupation" and "age" are extracted as classification objects 1 and 2, respectively. In this embodiment, the element of the item "occupation" is mainly defined as classification object 1, and processing for this will be described. Then, the classification object acceptance unit 11a converts the classification objects input in data format into a natural language form. At this time, as shown in FIG. 4, the classification object acceptance unit 11a separately handles, for "occupation," the conversion of elements of the classification object, such as "department store clerk" and "convenience store clerk" into a natural language form from the conversion of an attribute, which is an "item" of the classification object, such as "occupation," into a natural language form.

[0017] The prompt generator 11b combines the obtained classification target with a prepared prompt template for generating a generalization tree, and generates a natural language prompt to be actually input into the LLM (Large Language Models). The prompt template shown in Figure 4 is the portion of the prompt text that is not in bold, and includes the role and purpose of the LLM, a natural language output format specification for the generalization tree, and an instruction to create a generalization tree. Using this template, the prompt generator 11b writes the elements of the classification target, such as department store clerk, between the natural language output format specification for the generalization tree and the instruction to create a generalization tree, and writes the attributes of the classification target within the instruction to create a generalization tree, thereby generating a prompt.

[0018] The LLM unit 11c inputs the generated prompt into the LLM and obtains an output in the form of natural language. The LLM is a large-scale language model trained on various text data, and outputs an answer appropriate to the input content by inferring the meaning of the input natural language text. Examples of LLMs include ChatGPT and Llama2, but the model of the present invention is not limited to these. Figure 5 shows an example of output by the LLM. In this way, by specifying the format of Markdown bullet points within the prompt, output according to that format can be obtained. In this example, Markdown bullet points are specified, but any format that can be expressed in natural language is acceptable.

[0019] It should be noted that the LLM is implemented in an external information processing device connected to the anonymization device 10 via a network. The LLM unit 11c can obtain the above-described output from the LLM by sending the above-described prompt to the LLM of the external information processing device and inputting it. It should be noted that the LLM may be implemented in the anonymization device 10.

[0020] The generalization tree output unit 11d extracts the part of the LLM output that describes the generalization tree and converts the natural language generalization tree into a data structure. In the example of Figure 5, the output from the LLM is expressed as a hierarchical structure in the form of an itemized list, and this hierarchical structure is converted into a tree format.

[0021] Specifically, in the example of Figure 5, the generalization tree is constructed such that the attribute corresponding to the item to be classified, "occupation," i.e., "occupation" itself, is at the top level, and lower-level attributes, such as "retail" and "agriculture, forestry, and fisheries," which further classify "occupation," are located at levels (nodes) below "occupation." The generalization tree is then constructed such that each element is contained in each of the lower-level attributes according to the content of each element, and each attribute is located at a level (leaf) lower than the attribute "retail" (node). In the example of Figure 5, a generalization tree is generated in which the elements "department store clerk" and "convenience store clerk" (leaves) belong to the lower-level attribute "retail" (node), and the elements "fisherman," "farmer," and "dairy farmer" (leaves) belong to the lower-level attribute "agriculture, forestry, and fisheries" (node).

[0022] In the above, a generalization tree is generated for an item expressed in natural language, such as "occupation," but a generalization tree can also be generated for an item expressed in numerical values, such as "age." In this case, a generalization tree is generated in which, for example, the "age" attribute is located at the top level, and age range attributes, such as "20-39 years old" and "40-59 years old," are located at lower levels, and the age of each element belongs to each of these lower level attributes.

[0023] Although the above description has been given of a case in which the generalization tree is generated using an LLM, the generalization tree generation unit 11 may generate a generalization tree without using an LLM. For example, the generalization tree generation unit 11 may store a tree consisting of a hierarchical structure of attributes set in advance according to an item, or may have a function of generating a hierarchical structure of attributes according to the content of an item. For example, as shown in FIG. 5, the generalization tree generation unit 11 may store a tree of each attribute corresponding to the item "occupation" or generate a tree of attributes according to the content of the item "occupation," and then, according to the content of an input element, arrange the element so that the element is included in the corresponding attribute, thereby generating a final generalization tree. Note that the method of generating a generalization tree by the generalization tree generation unit 11 is not limited to the above-described method and may be any method.

[0024] The anonymization unit 13 performs k-anonymization on the elements of each item of the quasi-identifier using the generalization tree stored in the generalization tree storage unit 12. At this time, after the generalization trees are generated for all classification targets as described above, the anonymization unit 13 performs k-anonymization on the elements of each item in order using the generalization tree. However, the anonymization unit 13 may perform k-anonymization processing on the elements of all items simultaneously. Alternatively, the anonymization unit 13 may perform k-anonymization using the generalization tree every time the generalization tree for each classification target is generated by the generalization tree generation unit 11.

[0025] Specifically, the anonymization unit 13 anonymizes each element of the item to be processed by replacing it with the attribute to which the element belongs, based on the generalization tree corresponding to the item. As an example, for the item "occupation" of the personal information (original data) shown in FIG. 3, the generalization tree shown in FIG. 5 is used to replace each element of the item "occupation" with the attribute to which the element belongs. For example, the elements "department store clerk" and "convenience store clerk" are replaced with the attribute "retail industry", and the elements "fisherman", "farmer", and "dairy farmer" are replaced with the attribute "agriculture, forestry, and fisheries". Furthermore, for the item "age" of the personal information (original data) shown in FIG. 3, the age generalization tree is used to replace each age element with an attribute of an age range that includes the age. In this way, the anonymization unit 13 k-anonymizes the personal information (original data), as shown in FIG. 6. Then, the anonymization unit 13 outputs the anonymized personal information.

[0026] [Operation] Next, the operation of the above-mentioned anonymization device 10 will be described. First, in order to generate generalization trees for all quasi-identifiers of personal information (original data), the generalization tree generation unit 11 defines the total number of quasi-identifiers as N and defines a variable i representing the quasi-identifier currently being processed as an initial value of 1 (step S1 in FIG. 7). Then, the generalization tree generation unit 11 repeats loop processing until generalization trees are generated for all quasi-identifiers (step S2 in FIG. 7).

[0027] The classification target acceptance unit 11a accepts an input of an element of the ith item among the quasi-identifiers of personal information (original data) as classification target i in the form of data such as CSV (step S3 in FIG. 7). Then, the classification target acceptance unit 11a converts the accepted data of classification target i into a character string (step S4 in FIG. 7). As an example, here, as shown in FIG. 3, the classification target acceptance unit 11a accepts an input of an element of the item "occupation" among the quasi-identifiers of personal information (original data) as classification target 1, and converts the item "occupation" and the element "department store clerk" and the like into character strings in natural language format, as shown in FIG. 4.

[0028] The prompt generation unit 11b uses the prompt template as a template and writes the data of classification target i after converting it into a character string in the section where the classification target is written, thereby generating a prompt to be input into the LLM (step S5 in FIG. 7). As an example, as shown in FIG. 5, the prompt generation unit 11b generates a prompt by incorporating each element of the classification target, such as "department store clerk," and the item "occupation," which is an attribute of the classification target, into a template consisting of the role and purpose of the LLM, a specification of the output format of the generalization tree in natural language, and an instruction to create the generalization tree.

[0029] The LLM unit 11c provides the generated prompt to the LLM and obtains an output in natural language (step S6 in FIG. 7). As an example, the LLM unit 11c obtains an output in the form of Markdown bullet points for the item "Occupation," as shown in FIG.

[0030] The generalization tree output unit 11d extracts only the portion of the LLM output that describes the generalization tree (step S7 in FIG. 7). Thereafter, the generalization tree output unit 11d converts the generalization tree written in natural language into the form of a data structure (step S8 in FIG. 7). The generalization tree output unit 11d saves the generalization tree as a data structure generated as described above in the generalization tree storage unit 12 as the generalization tree for classification object i (step S9 in FIG. 7). As an example, the LLM unit 11c generates a generalization tree in which each element is arranged so as to be included in the subordinate attributes "retail industry" and "agriculture, forestry, and fisheries" into which the attribute of the item "occupation" is classified, as shown in FIG. 5.

[0031] Thereafter, the generalization tree generation unit 11 increments the value of i by 1 (step S10 in FIG. 7) and returns to the beginning of the loop (step S2 in FIG. 7). Then, the generalization tree generation unit 11 generates a generalization tree for the next classification target i in the same manner as described above and stores it in the generalization tree storage unit 12 (steps S3-S9 in FIG. 7).

[0032] After generalization trees are generated for all quasi-identifiers, the k-anonymization unit 13 acquires all generalization trees from the generalization tree storage unit 12 (step S11 in FIG. 7). Then, the anonymization unit 13 performs an anonymization process using each acquired generalization tree (step S12 in FIG. 7). As an example, the anonymization unit 13 replaces the items "occupation" and "age", which are quasi-identifiers of the personal information (original data) shown in FIG. 3, with the attributes to which each element belongs, using a generalization tree such as that shown in FIG. 5. In this way, the personal information is k-anonymized, as shown in FIG. 6. Then, the anonymization unit 13 outputs the anonymized personal information.

[0033] As described above, in the present disclosure, the generalization tree generation unit 11 creates a generalization tree according to the contents of the quasi-identifiers from the original data of personal information, and k-anonymizes the personal information using this generalization tree. In other words, there is no need to create a generalization tree by manually analyzing data, etc. This reduces the man-hours required to create a generalization tree, and the cost of creating a generalization tree can be reduced. As a result, the cost of k-anonymization using a generalization tree can be reduced.

[0034] <Second embodiment> A second embodiment of the present disclosure will be described with reference to the drawings, which may be relevant to any embodiment.

[0035] In the anonymization device 10, it may happen that some elements to be classified are not reflected in the generated generalization tree. For example, in the anonymization device 10, as shown in FIG. 9, the element "farmer" included in the original data may not be reflected in the generalization tree. In addition, in the anonymization device 10, it may happen that the generated generalization tree is not suitable for k-anonymization, that is, does not satisfy the requirements set for k-anonymization. For example, when the requirement for k-anonymization is set to k=2, that is, the number of elements belonging to each attribute is two or more, in the anonymization device 10, as shown in FIG. 10, the attribute "fisheries" contains only one element "fisherman," and the generalization tree does not satisfy the requirements. In this embodiment, to solve such problems, the anonymization device 10 is configured as follows.

[0036] [composition] As shown in FIG. 8, the anonymization device 10 of this embodiment further includes a generalization tree correction unit 21 (determination unit) in addition to the configuration of the anonymization device 10 described in the first embodiment. The function of the generalization tree correction unit 21 is realized by a computing device executing a program for realizing the function stored in a storage device. In this embodiment, the generalization tree correction unit 21 determines whether the generalization tree generated by the generalization tree generation unit 11 reflects all elements in the classification target and whether the requirements for k-anonymization are met, and corrects the generalization tree as appropriate to generate a generalization tree that satisfies the above determinations. The processing of the generalization tree correction unit 21 is repeated until these determinations are met.

[0037] Here, as shown in FIG. 8, the generalization tree correction unit 21 includes a missing classification target addition unit 22, which further includes a missing classification target determination unit 22a and an additional prompt generation unit 22b.

[0038] The missing classification target determination unit 22a compares the generalization tree as a data structure obtained from the generalization tree output unit 11d with the elements of the classification target currently being processed using regular expressions or the like, and extracts elements of the classification target that are missing from the generalization tree. As an example, as shown in Figure 11, the generalization tree output unit 11d outputs a generalization tree with missing elements from the original personal information data, and by comparing the elements in this generalization tree with the original elements that are the original data, "farmer" is extracted as a missing element. Note that, hereinafter, missing elements are referred to as missing classification targets.

[0039] The addition prompt generation unit 22b converts the extracted missing classification target into natural language, combines it with a prompt for adding an element to a generalization tree prepared in advance, and generates a prompt in the form of natural language for actual input into the LLM. As an example, as shown in Figure 12, the addition prompt generation unit 22b converts the element "farmer", which is the missing classification target, from a data format into natural language, and creates a prompt for instructing the generation of a generalization tree in which the element "farmer" is added to the previous generalization tree.

[0040] In this embodiment, the LLM unit 11c and generalization tree output unit 11d (generation unit) input the prompt generated by the addition prompt generation unit 22b to the LLM, and obtain a regenerated generalization tree by adding the missing classification target element. Specifically, the LLM unit 11c inputs a prompt to the same LLM that created the previous generalization tree, i.e., the LLM holding the information of the previous generalization tree, to perform additional processing as a process following the previous generation, thereby obtaining a generalization tree including all elements in the generalization tree output unit 11d. As an example, as shown in FIG. 12, a generalization tree including all elements, including the element "farmer" extracted as a missing classification target, is regenerated.

[0041] As shown in FIG. 8, the generalization tree correcting unit 21 also includes a node correcting unit 23, which further includes an anonymization requirement determining unit 23a and a correction prompt generating unit 23b.

[0042] The anonymization requirement determination unit 23a determines whether the requirements for k-anonymization are met from the generalization tree as a data structure obtained from the generalization tree output unit 11d and the data currently being processed. If the requirements are not met, the unit extracts the node, i.e., the attribute. If the requirements are met, the unit outputs the generalization tree to the generalization tree storage unit 12. As an example, as shown in FIG. 11, the unit first calculates the number of elements belonging to the attributes "retail," "agriculture," and "fisheries," which are each node output from the generalization tree output unit 11d. Then, the unit extracts attributes that do not meet the requirement for k-anonymization, k=2, because the number of elements is less than 2. In this example, the unit extracts the node, i.e., the attribute "fisheries."

[0043] The correction prompt generation unit 23b converts the attribute, which is the extracted node, into natural language, combines it with a prepared prompt for integrating the target node with a similar node in the generalization tree, and generates a prompt in the form of natural language for actual input into the LLM. As an example, as shown in Figure 14, the correction prompt generation unit 23b converts the attribute "fisheries," which is the extracted node, from a data format into natural language, and creates a prompt that instructs regenerating the generalization tree by merging the node "fisheries" in the previous generalization tree with other similar nodes.

[0044] Then, the LLM unit 11c and generalization tree output unit 11d (generation unit) in this embodiment input the prompt generated by the additional prompt generation unit 22b to the LLM to obtain a generalization tree in which nodes that do not satisfy the requirements have been corrected. Specifically, the LLM unit 11c inputs a prompt to the same LLM that created the previous generalization tree, i.e., the LLM holding information about the previous generalization tree, to perform node correction processing as a process following the previous generation, thereby obtaining a generalization tree that satisfies the requirements for k-anonymization in the generalization tree output unit 11d. As an example, as shown in FIG. 14, the node "Fisheries" that does not satisfy the requirements is merged with another node "Agriculture" to become the node "Agriculture, Forestry, and Fisheries," and a corrected generalization tree is regenerated.

[0045] [Operation] Next, a description will be given of the operation of the anonymization device 10. Note that the following mainly describes the operation that differs from the first embodiment.

[0046] First, the generalization tree generation unit 11 generates a generalization tree for all quasi-identifiers of personal information (original data) in the same manner as described above (steps S1 to S8 in FIG. 15). Then, the missing classification target determination unit 22a determines whether the elements of the generated generalization tree satisfy the elements of classification target i (step S21 in FIG. 15). Specifically, as shown in FIG. 11, the elements in the generated generalization tree are compared with the original elements, which are the original data, to determine whether there are any missing elements. Then, as shown in FIG. 11, if the missing element "farmer" is found, it is determined that the elements of the generalization tree do not satisfy the requirements (No in step S21 in FIG. 15), and the element is extracted and converted into a character string (step S22 in FIG. 15).

[0047] Next, the addition prompt generator 22b generates a prompt by describing the missing element in a template of a prompt for adding the missing element (step S23 in FIG. 15). As an example, as shown in FIG. 12, a prompt is generated to instruct the generation of a generalization tree to which the element "farmer" that is the target of missing classification has been added.

[0048] Then, by using the created prompt and returning to the process of obtaining output from the LLM again (step S6 in FIG. 15), a generalization tree that includes the elements of classification target i is generated. In other words, a generalization tree that includes all the elements of the classification target is generated. As an example, as shown in FIG. 12, a generalization tree that includes "farmers," which was missing from the previous generalization tree, is generated.

[0049] Furthermore, the anonymization requirement determination unit 23a determines whether the requirements for k-anonymization are satisfied for a generalization tree for which the insufficient classification target determination unit 22a has determined that the element of classification target i is satisfied (Yes in step S21 of FIG. 15 ) (step S24 of FIG. 15 ). Specifically, the anonymization requirement determination unit 23a acquires the value of k, which is a requirement for k-anonymization, and calculates the number of leaves (elements) (number of elements) belonging to each node (attribute) of the generalization tree as shown in FIG. 13 , and compares the number of elements of each node with k. Then, if there is a node (attribute) with the number of elements less than k, the anonymization requirement determination unit 23a determines that anonymity cannot be ensured by k-anonymization, that is, the requirements for k-anonymization are not satisfied (Yes in step S24 of FIG. 15 ). Thereafter, the anonymization requirement determination unit 23a extracts attributes that are nodes with the number of elements less than k, as shown in FIG. 13 , and converts the attributes that are such nodes into character strings as shown in FIG. 14 (step S25 of FIG. 15 ).

[0050] Next, the correction prompt generator 23b generates a prompt by describing the extracted node in a template of a prompt for node correction (step S26 in FIG. 15). As an example, as shown in FIG. 14, a prompt is generated to instruct regeneration of a generalization tree by merging the attribute "fisheries," which is a node that does not satisfy the requirements, with other similar nodes.

[0051] Then, by returning to the process of obtaining output from the LLM again using the created prompt (step S6 in FIG. 15), a generalization tree that satisfies the requirements for k-anonymization is generated. In other words, a generalization tree is generated in which the number of elements belonging to an attribute in each node is k or more. As an example, as shown in FIG. 14, in the previous generalization tree, there was a node to which the number of leaves belonging was less than k, but a generalization node is generated in which the number of elements belonging to all nodes is k or more. In this case, elements in the generalization tree may disappear when the LLM is output again, but this can be resolved by repeating the processes from step S21 onwards described above in FIG. 15.

[0052] Thereafter, the generalization tree output unit 11d regenerates the generalization tree as described above, and stores the generalization tree that satisfies the elements of classification target i and the requirements for k-anonymization in the generalization tree storage unit 12 as the generalization tree for classification target i (step 9 in FIG. 15). Then, as in the first embodiment, the anonymization unit 13 performs anonymization processing using each acquired generalization tree (steps S11 and S12 in FIG. 15), and outputs the anonymized personal information.

[0053] As described above, in the present disclosure, a generalization tree is generated from the original data of personal information according to the content of the quasi-identifier, and the generalization tree is generated to satisfy the elements to be classified and the requirements of k-anonymization. This reduces the man-hours required to create a generalization tree and the cost of creating a generalization tree. As a result, the cost of k-anonymization using a generalization tree can be reduced.

[0054] <Third embodiment> A third embodiment of the present disclosure will be described with reference to the drawings, which may be relevant to any embodiment.

[0055] As described in the second embodiment, when the anonymization device 10 re-outputs a generalization tree, elements other than the added elements may disappear, or the clustering (classification) of nodes, i.e., attributes, may change. For example, as shown in FIG. 17, when the anonymization device 10 regenerates a generalization tree that lacks the element "farmer," the new generalization tree may have the element "farmer" added, but may lack another element, "convenience store clerk." To solve such problems, the anonymization device 10 is configured as follows.

[0056] [composition] 16, the anonymization device 10 of this embodiment further includes a correction determination unit 31, a buffer storage unit 32, a generalization tree extraction unit 33, a buffer 34, and a buffer clear unit 35 in addition to the configuration of the anonymization device 10 described in the second embodiment. The functions of the correction determination unit 31, the buffer storage unit 32, the generalization tree extraction unit 33, and the buffer clear unit 35 are realized by the arithmetic device executing a program for realizing the function stored in the storage device. The buffer 34 is also configured by the storage device.

[0057] First, the addition prompt generation unit 22b and the correction prompt generation unit 23b of the generalization tree correction unit 21 in this embodiment create a prompt that instructs regenerating only the changed portion of the corrected generalization tree. For example, as in the example of Figure 18, if the element "farmer" is missing in the generalization tree that was initially output, a prompt is created that instructs re-outputting only the changed portion of the generalization tree in which the missing element "farmer" has been added.

[0058] Modification determination unit 31 determines whether the generalization tree obtained from generalization tree output unit 11d is the entire generalization tree that was initially output by the processing of generalization tree generation unit 11, or a generalization tree containing only the modified portion by generalization tree modification unit 21. In the example of Fig. 17, the determination is made based on whether the buffer is empty, and if it is empty, it is determined that it is the entire generalization tree that was initially output, and if it is not empty, it is determined that it is a generalization tree containing only the modified portion.

[0059] If the correction determination unit 31 determines that the generalization tree is the entire generalization tree, the buffer storage unit 32 stores the entire generalization tree in the buffer 34, and if the generalization tree is determined to be the generalization tree of only the corrected portion, the buffer storage unit 32 reflects the generalization tree of only the corrected portion in the buffer 34. That is, as shown in FIG. 18 , the buffer storage unit 32 stores the first generalization tree with missing elements in the buffer 34 as is, but for the generalization tree with only the corrected portion, it integrates the generalization tree with only the corrected portion with the generalization tree with missing elements in the buffer 34, and updates and stores the integrated generalization tree in the buffer 34.

[0060] The generalization tree extraction unit 33 extracts the generalization tree currently stored in the buffer 34 and outputs it to the generalization tree correction unit 21 .

[0061] The buffer clearing unit 35 stores the generalization tree in the generalization tree storage unit 12, and before moving on to generalization tree generation for the next classification target or processing by the anonymization unit 13, clears the generalization tree in the buffer 34 to empty the buffer 34.

[0062] [Operation] Next, a description will be given of the operation of the anonymization device 10. Note that the following mainly describes the operation that differs from the second embodiment.

[0063] First, the generalization tree generation unit 11 generates generalization trees for all quasi-identifiers of personal information (original data) in the same manner as described above (steps S1 to S8 in FIG. 19 ). Then, the correction determination unit 31 determines whether the obtained generalization tree is the first generalization tree in the generalization tree generation for the classification target i, that is, whether a generalization tree is not present in the buffer 34 (step S31 in FIG. 19 ). At this time, since no generalization tree is present in the buffer 34 (No in step S31 in FIG. 19 ), the buffer storage unit 32 stores the entire obtained generalization tree in the buffer 34 (step S32 in FIG. 19 ). Then, the generalization tree extraction unit 33 outputs the generalization tree stored in the buffer 34 to the generalization tree correction unit 21 for subsequent processing, such as determining whether the elements of the classification target i are satisfied (step S34 in FIG. 19 ).

[0064] Next, as described above, generalization tree correction unit 21 performs the correction process on the generalization tree output from buffer 34 (steps S21 to S26 in FIG. 19). At this time, if the initially generated generalization tree does not satisfy the element or k-anonymization requirements, addition prompt generation unit 22b and correction prompt generation unit 23b create prompts instructing the regeneration of only the changed portions of the corrected generalization tree (steps S23 and S26 in FIG. 19). As a result, LLM generates a generalization tree containing only the changed portions (steps S6 to S8 in FIG. 19).

[0065] Thereafter, the correction determination unit 31 again checks whether or not a generalization tree exists in the buffer 34, and determines whether the obtained generalization tree is a generalization tree containing only the corrected portion (step S31 in FIG. 19). At this time, since a generalization tree exists in the buffer 34 (Yes in step S31 in FIG. 19), the buffer storage unit 32 integrates the generalization tree containing only the corrected portion into the entire generalization tree in the buffer 34, updates the generalization tree in the buffer 34, and stores it (step S33 in FIG. 19). Then, the generalization tree extraction unit 33 outputs the generalization tree stored in the buffer 34 to the generalization tree correction unit 21, as described above (step S34 in FIG. 19).

[0066] By repeating the above-described process, a generalization tree that satisfies the requirements for classification target i and k-anonymization is generated (Yes in step S21 and Yes in S24 in FIG. 19), and generalization tree correction unit 21 stores the generated generalization tree as the generalization tree for classification target i in generalization tree storage unit 12 (step S9 in FIG. 19). After that, buffer clear unit 35 deletes the generalization tree from buffer 34 (step S35 in FIG. 19).

[0067] Thereafter, similarly to the first and second embodiments, the anonymization unit 13 performs anonymization processing using each of the acquired generalization trees (steps S11 and S12 in FIG. 19) and outputs the anonymized personal information.

[0068] As described above, in the present disclosure, a generalization tree is generated from the original data of personal information according to the content of the quasi-identifier, and the generalization tree is generated to satisfy the elements to be classified and the requirements of k-anonymization. This reduces the man-hours required to create a generalization tree and the cost of creating a generalization tree. As a result, the cost of k-anonymization using a generalization tree can be reduced.

[0069] Although the above describes a case where the generated generalization tree lacks elements, the method can also be applied to a case where the generated generalization tree does not satisfy the requirements for k-anonymization. In this case, the initially generated generalization tree that does not satisfy the requirements for k-anonymization is first stored in buffer 34. After that, when a generalization tree is regenerated in which the nodes (attributes) that do not satisfy the requirements for k-anonymization have been corrected, the generalization tree containing only the corrected parts is merged into the initial generalization tree in buffer 34.

[0070] <Fourth embodiment> Next, a fourth embodiment of the present disclosure will be described with reference to the drawings. In this embodiment, an overview of the anonymization device and the like described in the above-mentioned embodiments is shown. Note that the drawings may be relevant to any of the embodiments.

[0071] First, a description will be given of the hardware configuration of the information processing device 100 in the present disclosure. The information processing device 100 is configured as a general information processing device, and is equipped with the following hardware configuration, as an example, as shown in FIG. ·CPU(Central Processing Unit)101(Arithmetic unit) ROM (Read Only Memory) 102 (storage device) RAM (Random Access Memory) 103 (storage device) Programs 104 loaded into RAM 103 A storage device 105 for storing a group of programs 104 A drive device 106 that reads and writes from a storage medium 110 external to the information processing device A communication interface 107 that connects to a communication network 111 outside the information processing device Input / output interface 108 for inputting and outputting data Bus 109 connecting each component

[0072] 20 shows an example of the hardware configuration of the information processing device 100, and the hardware configuration of the information processing device is not limited to the above-described case. For example, the information processing device may be configured with a part of the above-described configuration, such as excluding the drive device 106. Furthermore, the information processing device may use a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an MPU (Micro Processing Unit), an FPU (Floating point number Processing Unit), a PPU (Physics Processing Unit), a TPU (Tensor Processing Unit), a quantum processor, a microcontroller, or a combination thereof, instead of the above-described CPU.

[0073] The information processing device 100 can be equipped with the generation unit 121 and the anonymization unit 122 shown in Fig. 21 by having the CPU 101 acquire and execute the program group 104. The program group 104 is stored in advance in, for example, the storage device 105 or the ROM 102, and is loaded into the RAM 103 and executed by the CPU 101 as needed. The program group 104 may be supplied to the CPU 101 via the communication network 111, or may be stored in advance in the storage medium 110, and the drive device 106 may read out the programs and supply them to the CPU 101. However, the generation unit 121 and the anonymization unit 122 described above may be constructed using dedicated electronic circuits for realizing such means.

[0074] The generation unit 121 associates, as personal information of the same individual, identifiers that are elements of items that can identify the individual on their own with quasi-identifiers that are elements of multiple items that can identify the individual in combination, and generates tree data that represents, based on elements of predetermined items of the quasi-identifiers in the multiple personal information, the elements and attributes that include the elements in a hierarchical structure.The anonymization unit 122 anonymizes the elements of the predetermined items in the multiple personal information by replacing them with attributes based on the tree data, and outputs the anonymized personal information.

[0075] With the above configuration, the present disclosure can generate a generalization tree according to the content of quasi-identifiers from original personal information data, thereby reducing the man-hours required to create the generalization tree. This reduces the cost of creating the generalization tree and the cost of k-anonymization using the generalization tree.

[0076] At least one of the functions of the generation unit 121 and the anonymization unit 122 described above may be executed by an information processing device installed and connected anywhere on the network, that is, they may be executed by so-called cloud computing.

[0077] The above-described program can be stored and supplied to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / Ws, and semiconductor memories (e.g., mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (Random Access Memory)). The program can also be supplied to a computer by various types of transitory computer-readable media. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. The transitory computer-readable media can supply the program to a computer via a wired communication path such as an electric wire or optical fiber, or via a wireless communication path.

[0078] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each of the above-described embodiments can be combined with other embodiments as appropriate.

[0079] <Additional Notes> Some or all of the above embodiments may be described as follows: The following provides an overview of the configurations of an information processing device, an information processing method, and a program according to the present disclosure. However, the present disclosure is not limited to the configurations described in the following supplementary notes. Note that the configurations described in Supplements 2 to 8.1, which are dependent on Supplementary Note 1 below, and some or all of the functions of the configurations, may also be dependent on other Supplements 9 and 10 in the same dependent relationship as Supplements 2 to 8.1. Furthermore, not limited to Supplements 1, 9, and 10, but also within the scope of each of the above-described embodiments, similar hardware, software, various recording means for recording software, or systems may similarly be made to be dependent on the configurations described as Supplements and some or all of the functions of the configurations. (Appendix 1) a generation unit that generates tree data in which an identifier, which is an element of an item that can identify the individual by itself, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual by combining them, as personal information of the same individual, and that generates tree data in which the element and attributes that include the element are expressed in a hierarchical structure based on elements of predetermined items of the quasi-identifiers in the plurality of personal information; an anonymization unit that anonymizes the plurality of personal information by replacing elements of the predetermined items in the plurality of personal information with attributes based on the tree data, and outputs the anonymized personal information; An information processing device comprising: (Appendix 2) 10. The information processing device according to claim 1, the generating unit generates the tree data by including elements of the predetermined items in the plurality of personal information in attributes according to the contents of the predetermined items. Information processing device. (Appendix 3) 10. The information processing device according to claim 2, the generating unit generates the tree data by including elements of the predetermined items in the plurality of personal information in attributes positioned at a lower level, with an attribute corresponding to the predetermined item at the top level. Information processing device. (Appendix 3.1) 4. The information processing device according to claim 3, the generation unit inputs elements of the predetermined items in the plurality of personal information into a large-scale language model, and causes the large-scale language model to generate the tree data in which the elements of the predetermined items in the plurality of personal information are included in attributes located in a lower hierarchy, with attributes corresponding to the predetermined items at the top hierarchy; Information processing device. (Appendix 4) 10. The information processing device according to claim 1, a determination unit that determines whether the tree data includes all elements of the predetermined items in the plurality of personal information; the generation unit regenerates the tree data so as to include all elements of the predetermined item according to the result of the determination. Information processing device. (Appendix 5) 5. The information processing device according to claim 4, the determination unit extracts elements of the predetermined items in the plurality of personal information that are not included in the tree data; the generation unit regenerates the tree data so as to include the extracted elements and all elements of the predetermined items. Information processing device. (Appendix 6) 5. The information processing device according to claim 4, The generation unit stores the generated tree data in a buffer, and then, when the tree data is regenerated, the changes made to the tree data due to the regeneration are integrated into the tree data in the buffer to form the regenerated tree data. Information processing device. (Appendix 7) 10. The information processing device according to claim 1, a determination unit that determines whether the number of elements of the predetermined item included in one attribute in the tree data satisfies a requirement set for the anonymization; the generation unit regenerates the tree data according to the result of the determination so that the number of elements of the predetermined item included in one attribute in the tree data satisfies the requirement. Information processing device. (Appendix 8) 8. The information processing device according to claim 7, the determination unit extracts attributes in the tree data in which the number of elements of the predetermined item included in one attribute does not satisfy the requirement; the generation unit regenerates the tree data by integrating the extracted attribute with other attributes so that the number of elements of the predetermined item included in one attribute in the tree data satisfies the requirement. Information processing device. (Appendix 8.1) 8. The information processing device according to claim 7, The generation unit stores the generated tree data in a buffer, and then, when the tree data is regenerated, the changes made to the tree data due to the regeneration are integrated into the tree data in the buffer to form the regenerated tree data. Information processing device. (Appendix 9) As personal information of the same individual, an identifier, which is an element of an item that can identify the individual on its own, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual in combination, and tree data is generated that represents the element and attributes that include the element in a hierarchical structure based on the element of a predetermined item of the quasi-identifier in the plurality of personal information; anonymizing the elements of the predetermined items in the plurality of personal information by replacing them with attributes based on the tree data, and outputting the anonymized personal information; Information processing methods. (Appendix 9.1) 10. The information processing method according to claim 9, generating the tree data by including elements of the predetermined items in the plurality of personal information in attributes according to the contents of the predetermined items; Information processing methods. (Appendix 9.2) 9.1, a method for processing information according to claim 9.1, generating the tree data by including elements of the predetermined items in the plurality of personal information in attributes positioned at lower levels, with the attributes corresponding to the predetermined items at the top level; Information processing methods. (Appendix 9.3) 9.2, a method for processing information according to claim 9.2, inputting elements of the predetermined items in the plurality of personal information items into a large-scale language model, and causing the large-scale language model to generate the tree data in which the elements of the predetermined items in the plurality of personal information items are included in attributes located in lower hierarchical levels, with attributes corresponding to the predetermined items at the top level; Information processing methods. (Appendix 9.4) 10. The information processing method according to claim 9, determining whether the tree data includes all elements of the predetermined items in the plurality of personal information; regenerating the tree data so as to include all elements of the predetermined item according to the result of the determination; Information processing methods. (Appendix 9.5) 9.4. An information processing method according to claim 9.4, comprising: extracting elements that are not included in the tree data from among the elements of the predetermined items in the plurality of personal information; regenerating the tree data to include the extracted elements and all elements of the predetermined item; Information processing methods. (Appendix 9.6) 9.4. An information processing method according to claim 9.4, comprising: The generated tree data is stored in a buffer, and then when the tree data is regenerated, the changed parts of the tree data due to the regeneration are integrated into the tree data in the buffer to form the regenerated tree data. Information processing methods. (Appendix 9.7) 10. The information processing method according to claim 9, determining whether the number of elements of the predetermined item included in one attribute in the tree data satisfies the requirements set for the anonymization; regenerating the tree data in accordance with the result of the determination so that the number of elements of the predetermined item included in one attribute in the tree data satisfies the requirement; Information processing methods. (Appendix 9.8) 9. A method of processing information according to claim 9.7, comprising: extracting attributes in the tree data in which the number of elements of the predetermined item included in one attribute does not satisfy the requirement; regenerating the tree data by integrating the extracted attribute with other attributes so that the number of elements of the predetermined item included in one attribute in the tree data satisfies the requirement; Information processing methods. (Appendix 9.9) 9. A method of processing information according to claim 9.7, comprising: The generated tree data is stored in a buffer, and then when the tree data is regenerated, the changed parts of the tree data due to the regeneration are integrated into the tree data in the buffer to form the regenerated tree data. Information processing device. (Appendix 10) As personal information of the same individual, an identifier, which is an element of an item that can identify the individual on its own, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual in combination, and tree data is generated that represents the element and attributes that include the element in a hierarchical structure based on the element of a predetermined item of the quasi-identifier in the plurality of personal information; anonymizing the elements of the predetermined items in the plurality of personal information by replacing them with attributes based on the tree data, and outputting the anonymized personal information; A program that causes a computer to perform a process. [Explanation of symbols]

[0080] 10 Anonymization device 11 Generalization tree generation part 11a Classification Object Receiving Section 11b Prompt generation section 11c LLM Department 11d Generalization tree output part 12 Generalization tree storage section 13 Anonymization Department 21 Generalization Tree Modification 22 Addition of missing classification targets 22a Deficiency classification target determination unit 22b Additional prompt generation section 23 Node Modification Section 23a Anonymization requirement determination section 23b Correction prompt generation section 31 Correction judgment part 32 Buffer storage unit 33 Generalization Tree Extraction 34 buffers 35 Buffer clearing section 100 Information processing device 101 CPU 102 ROM 103 RAM 104 Programs 105 Storage device 106 Drive device 107 Communication Interface 108 Input / Output Interface 109 Bus 110 Storage medium 111 Communication Network 121 Generation part 122 Anonymization Department

Claims

1. a generation unit that generates tree data in which an identifier, which is an element of an item that can identify the individual by itself, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual by combining them, as personal information of the same individual, and that generates tree data in which the element and attributes that include the element are expressed in a hierarchical structure based on elements of predetermined items of the quasi-identifiers in the plurality of personal information; an anonymization unit that anonymizes the plurality of personal information by replacing elements of the predetermined items in the plurality of personal information with attributes based on the tree data, and outputs the anonymized personal information; An information processing device comprising:

2. 2. The information processing device according to claim 1, the generating unit generates the tree data by including elements of the predetermined items in the plurality of personal information in attributes according to the contents of the predetermined items. Information processing device.

3. 3. The information processing device according to claim 2, the generating unit generates the tree data by including elements of the predetermined items in the plurality of personal information in attributes positioned at a lower level, with an attribute corresponding to the predetermined item at the top level. Information processing device.

4. 2. The information processing device according to claim 1, a determination unit that determines whether the tree data includes all elements of the predetermined items in the plurality of personal information; the generation unit regenerates the tree data so as to include all elements of the predetermined item according to the result of the determination. Information processing device.

5. 5. The information processing device according to claim 4, the determination unit extracts elements of the predetermined items in the plurality of personal information that are not included in the tree data; the generation unit regenerates the tree data so as to include the extracted elements and all elements of the predetermined items. Information processing device.

6. 5. The information processing device according to claim 4, The generation unit stores the generated tree data in a buffer, and then, when the tree data is regenerated, the changes made to the tree data due to the regeneration are integrated into the tree data in the buffer to form the regenerated tree data. Information processing device.

7. 2. The information processing device according to claim 1, a determination unit that determines whether the number of elements of the predetermined item included in one attribute in the tree data satisfies a requirement set for the anonymization; the generation unit regenerates the tree data in accordance with the result of the determination so that the number of elements of the predetermined item included in one attribute in the tree data satisfies the requirement. Information processing device.

8. 8. The information processing device according to claim 7, the determination unit extracts attributes in the tree data in which the number of elements of the predetermined item included in one attribute does not satisfy the requirement; the generation unit regenerates the tree data by integrating the extracted attribute with other attributes so that the number of elements of the predetermined item included in one attribute in the tree data satisfies the requirement. Information processing device.

9. As personal information of the same individual, an identifier, which is an element of an item that can identify the individual on its own, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual in combination, and tree data is generated that represents the element and attributes that include the element in a hierarchical structure based on the element of a predetermined item of the quasi-identifier in the plurality of personal information; anonymizing the elements of the predetermined items in the plurality of personal information by replacing them with attributes based on the tree data, and outputting the anonymized personal information; Information processing methods.

10. As personal information of the same individual, an identifier, which is an element of an item that can identify the individual on its own, is associated with a quasi-identifier, which is an element of a plurality of items that can identify the individual in combination, and tree data is generated that represents the element and attributes that include the element in a hierarchical structure based on the element of a predetermined item of the quasi-identifier in the plurality of personal information; anonymizing the elements of the predetermined items in the plurality of personal information by replacing them with attributes based on the tree data, and outputting the anonymized personal information; A program that causes a computer to perform a process.

Images