Information processing apparatus, method, and program

Abstract

To achieve an anonymization technique having both high anonymity and usefulness.SOLUTION: An information processing apparatus that is communicably connected to another information processing apparatus having a first data set and has a second data set, the information processing apparatus receiving, from the other information processing apparatus, a plurality of first conversion identifiers obtained by irreversibly converting a first identifier of a record satisfying a predetermined condition among records constituting the first data set and dummy identifiers, the number of the dummy identifiers corresponding to the number of the first identifiers and noise, calculating a noise-containing aggregate value obtained by adding the noise to an aggregate value of records satisfying the condition among records constituting a data set obtained by connecting the first data set and the second data set by an equijoin based on a number of matches between a plurality of second conversion identifiers obtained by irreversibly converting second identifiers of records satisfying the condition among records constituting the second data set and dummy identifiers of a number corresponding to a number of the second identifiers and the plurality of first conversion identifiers; SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, a method, and a program. [Background technology]

[0002] Anonymization technology is known as a technology for utilizing data containing personal information while protecting the personal information (for example, Non-Patent Document 1, etc.). In anonymization technology, personal information is generally processed not only by deleting information (identifiers) that can identify an individual, such as a name, but also by taking into consideration information (quasi-identifiers) that can identify an individual from a combination of multiple pieces of information, such as age and height. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Kii et al., Privacy-preserving data synthesis from vertically segmented data using an iterative Bayesian approach, DICOMO2023. Summary of the Invention [Problem to be solved by the invention]

[0004] However, if data is heavily processed to enhance anonymity, its usefulness may be significantly reduced, making it impossible to utilize.

[0005] The present disclosure has been made in consideration of the above points, and aims to realize an anonymization technology that is both highly anonymous and highly useful. [Means for solving the problem]

[0006] An information processing device according to one aspect of the present disclosure is an information processing device that is communicatively connected to another information processing device that has a first dataset and has a second dataset, and receives from the other information processing device a plurality of first converted identifiers that are each obtained by irreversibly converting a first identifier of a record that satisfies a predetermined condition among records that constitute the first dataset and a number of dummy identifiers corresponding to the number of the first identifiers and noise, and calculates a noisy aggregate value by adding the noise to an aggregate value of records that satisfy the condition among records that constitute a dataset that connects the first dataset and the second dataset by an equijoin, based on the number of matches between the plurality of first converted identifiers and a plurality of second converted identifiers that are each obtained by irreversibly converting a second identifier of a record that satisfies the condition among records that constitute the second dataset and a number of dummy identifiers corresponding to the number of the second identifiers. [Effects of the Invention]

[0007] It is possible to realize an anonymization technology that is both highly anonymous and useful. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 10 is a diagram illustrating an example of an equijoin. [Figure 2] FIG. 1 illustrates an example of a central differential privacy based approach. [Figure 3] 1 is a diagram illustrating an example of the overall configuration of an anonymization system according to an embodiment of the present invention. [Figure 4] FIG. 2 is a diagram illustrating an example of a hardware configuration of a data management device according to the present embodiment. [Figure 5] FIG. 2 is a diagram illustrating an example of a functional configuration of a data management device according to the present embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a data set X. [Figure 7] FIG. 2 is a diagram illustrating an example of a data set Y. [Figure 8] FIG. 2 is a sequence diagram showing an operation example (Example 1) of the anonymization system according to the present embodiment. [Figure 9] FIG. 10 is a diagram showing an example of a summary table of a data set Z′. [Figure 10] FIG. 10 is a sequence diagram showing an operation example (Example 2) of the anonymization system according to the present embodiment. [Figure 11] FIG. 10 is a sequence diagram showing an operation example (Example 3) of the anonymization system according to the present embodiment. [Figure 12] FIG. 10 is a sequence diagram showing an operation example (Example 4) of the anonymization system according to the present embodiment. [Figure 13] FIG. 10 is a sequence diagram showing an operation example (Example 5) of the anonymization system according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] An embodiment of the present invention will be described in detail below with reference to the drawings. In the following embodiment, an anonymization system 1 that can realize an anonymization technique that provides high anonymity and usefulness will be described.

[0010] <Conventional anonymization technology> Before describing the details of the anonymization system 1 according to this embodiment, conventional anonymization techniques will be described. Below, the anonymization technique described in Non-Patent Document 1 will be described as an example of an anonymization technique that can obtain anonymized data of a dataset consisting of linked data obtained by linking (equi-joining) data of the same person. The anonymization technique described in Non-Patent Document 1 is a technique that can obtain anonymized data that satisfies an anonymity index called local differential privacy (LDP).

[0011] As an example, suppose that subject A owns dataset X containing personal information, and subject B owns dataset Y containing personal information. For example, as shown in Figure 1, datasets X and Y are tabular data, and each row contains an individual's ID (an example of an identifier) ​​and attribute values ​​(e.g., age, height, etc.). Note that the first row of dataset X represents labels (in the example shown in Figure 1, "ID," "X1," "X2," etc.). Similarly, the first row of dataset Y also represents labels (in the example shown in Figure 1, "ID," "Y1," "Y2," etc.). Hereinafter, each row other than the first row of datasets X and Y will be referred to as a "record."

[0012] In this case, as shown in Figure 1, subject B wants to obtain dataset Z, which is composed of concatenated data obtained by linking records with the same ID between datasets X and Y using equijoin, and use it for analysis, etc. However, because datasets X and Y contain personal information, subject B considers obtaining dataset Z', which is anonymized data of dataset Z, while maintaining anonymity for any subject, including subjects A and B.

[0013] In the anonymization technique described in Non-Patent Document 1, subject B can obtain dataset Z′ by following steps 1 to 7 below.

[0014] Step 1: Entities A and B share a secret random number r.

[0015] Step 2: Entity A converts the ID of dataset X into ID' = H(ID, r) using hash function H. Entity A then deletes the secret random number r.

[0016] Step 3: Similarly, subject B converts the ID of data set Y into ID'=H(ID, r) using hash function H. Then, subject B similarly deletes the secret random number r.

[0017] Step 4: Entity A processes the attribute values ​​of Dataset X using a method based on LDP (hereinafter also referred to as the "LDP method") (for example, by adding noise according to a predetermined probability distribution to the attribute values) and creates Dataset X' in which the order of the records is randomly shuffled. Entity A then deletes the information used to shuffle the order of the records of Dataset X (hereinafter, the information used to shuffle the order is also referred to as "order shuffling information"). Note that the attribute values ​​refer to values ​​other than the ID' of each record, and the ID' is not processed.

[0018] Step 5: Similarly, subject B processes the attribute values ​​of dataset Y using the LDP method (for example, by adding noise according to a predetermined probability distribution to the attribute values) and creates dataset Y' in which the order of the records is randomly shuffled. After that, subject B similarly deletes the order shuffling information used to shuffle the order of the records in dataset Y. Note that, similarly, the attribute values ​​refer to values ​​other than the ID' of each record, and the ID' is not processed.

[0019] Step 6: Entity A sends dataset X' to Entity B.

[0020] Step 7: Subject B creates dataset Z' by using an equijoin to join records with matching ID' between dataset X' and dataset Y'.

[0021] In the anonymization technology described in Non-Patent Document 1, ID' is converted into irreversible random data by deleting the random number r in steps 2 and 3, making it difficult for even entities A and B to infer the correspondence between ID and ID'. Furthermore, in step 4, each attribute value is processed using an LDP method, the record order is rearranged, and the order shuffling information is deleted, making it difficult for even entity A to infer the correspondence between dataset X and dataset X'. Similarly, in step 5, each attribute value is processed using an LDP method, the record order is rearranged, and the order shuffling information is deleted, making it difficult for even entity B to infer the correspondence between dataset Y and dataset Y'.

[0022] If datasets X' and Y' satisfy LDP, then dataset Z' obtained by subject B in step 7 also satisfies LDP. Specifically, if dataset X' satisfies ε1-LDP and dataset Y' satisfies ε2-LDP, then dataset Z' satisfies (ε1+ε2)-LDP.

[0023] However, because the LDP method adds noise to each attribute value, there is a possibility that a large difference (error) may occur between the statistical data obtained from Dataset Z and the statistical data obtained from Dataset Z'. For this reason, depending on the purpose of the analysis that Subject B wants to perform, Dataset Z' may be of low usefulness, and such low usefulness may not be acceptable.

[0024] <Outline of anonymization technology realized by the anonymization system 1 according to this embodiment> To solve the problems related to the usefulness of the LDP method mentioned above, we consider using a method based on an anonymity index called Central Differential Privacy (CDP) (hereinafter referred to as the "CDP method"). The CDP method adds noise to statistical data obtained from the original data, which generally reduces errors compared to statistical data obtained by the LDP method.

[0025] For example, consider a summary table as shown in Figure 2 as statistical data. The summary table shown in Figure 2 is statistical data that tallies the number of records in dataset X of entity A that contain certain attribute values ​​for X1 and X2. Here, a summary table refers to statistical data in tabular form that tallies the number of records that satisfy a certain condition. A summary table consists of one or more cells, and each cell is set to the number of records that satisfy the condition corresponding to that cell. For example, the value of the cell corresponding to (X1, X2) = (a, d) in the summary table shown in Figure 2 is "100," which means that the number of records in dataset A of entity A that satisfy the condition (X1, X2) = (a, d) is "100."

[0026] In this case, the CDP method creates a noisy summary table by adding noise according to a predetermined probability distribution to the values ​​of each cell in the summary table, and then creates a dataset X' in the same format as the original dataset from this noisy summary table.As a result, the CDP method obtains dataset X' as anonymized data.

[0027] However, because identifiers such as IDs are lost in summary tables, even if dataset Y' is similarly created from dataset Y using the CDP method, there is a problem in that dataset X' and dataset Y' cannot be linked by an equijoin.

[0028] Therefore, the anonymization system 1 according to this embodiment realizes an anonymization technology that solves the above-mentioned problems. More specifically, the anonymization technology realized by the anonymization system 1 according to this embodiment irreversibly randomizes the IDs of the original datasets and dummy IDs, which are IDs created as dummy IDs, for each of subjects A and B, and then determines the intersection of these randomized IDs. This results in anonymized data of a summary table of datasets that are linked by equijoining the original datasets, thereby achieving both high anonymity and high usability.

[0029] Hereinafter, the maximum number of records in datasets X and Y is N (i.e., the number of records in dataset X is NX , the number of records in dataset Y is N Y Then, N=max(N X ,N Y )). In the following, we will assume that a summary table is an example of statistical data, and the number of summary values ​​contained in the summary table (i.e., the number of cells in the summary table) is D, and that a number identifying the cell is assigned to the cell in which each summary value is set. In other words, we will assume that each cell in the summary table is assigned a number i∈{1, ,D} that identifies the cell. Furthermore, we will assume that the maximum absolute value (integer) of the noise used for anonymization is M.

[0030] <Example of overall configuration of anonymization system 1 according to this embodiment> An example of the overall configuration of an anonymization system 1 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the anonymization system 1 according to this embodiment includes a data management device 10A and a data management device 10B. Furthermore, the data management device 10A and the data management device 10B are communicably connected via an arbitrary communication network 20 including, for example, the Internet.

[0031] The data management device 10A is a computer (information processing device) or computer system (information processing system) used or managed by entity A, and holds and manages dataset X. The data management device 10A can be realized, for example, by a PC (personal computer), a smartphone, a tablet terminal, a general-purpose server, etc. Note that entity A refers to a corporation, group, organization, individual, etc. that owns, possesses, or manages dataset X.

[0032] The data management device 10B is a computer (information processing device) or computer system (information processing system) used or managed by the entity B, and holds and manages the data set Y. The data management device 10B can be realized by, for example, a PC, a smartphone, a tablet terminal, a general-purpose server, etc. The entity B is a corporation, group, organization, individual, etc. that owns, possesses, or manages the data set Y.

[0033] Hereinafter, the data management device 10A, the data management device 10B, etc. will be collectively referred to as "data management device 10."

[0034] 3 is an example, and is not limited to this. For example, the anonymization system 1 may include a data management device 10C, a data management device 10D, etc. In general, the anonymization system 1 may include multiple data management devices 10, and the total number of data management devices 10 is not limited.

[0035] <Example of hardware configuration of data management device 10> An example of the hardware configuration of the data management device 10 according to this embodiment is shown in Fig. 4. As shown in Fig. 4, the data management device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0036] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the data management device 10 does not necessarily have to have at least one of the input device 101 and the display device 102, for example.

[0037] The external I / F 103 is an interface with an external device such as a recording medium 103a. The data management device 10 can read from and write to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0038] The communication I / F 104 is an interface for connecting the data management device 10 to the communication network 20. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a storage device (storage device) such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory. The processor 108 is an arithmetic device such as a CPU (Central Processing Unit).

[0039] The data management device 10 according to this embodiment has the hardware configuration shown in Fig. 4, and is therefore capable of performing the summary table calculation process described below. Note that the hardware configuration shown in Fig. 4 is merely an example, and the hardware configuration of the data management device 10 is not limited to this. For example, the data management device 10 may have multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware components other than the hardware shown in the figure.

[0040] <Example of functional configuration of data management device 10> An example of the functional configuration of the data management device 10 according to this embodiment is shown in Fig. 5. As shown in Fig. 5, the data management device 10 according to this embodiment has a pre-processing unit 201 and an anonymization processing unit 202. These units are realized, for example, by processing in which one or more programs installed in the data management device 10 are executed by the processor 108 or the like. The data management device 10 according to this embodiment also has a storage unit 203. The storage unit 203 is realized, for example, by a storage area of ​​the auxiliary storage device 107. However, the storage unit 203 may also be realized, for example, in a storage area of ​​a storage device external to the data management device 10 (e.g., a storage device present on the same network as the data management device 10).

[0041] The pre-processing unit 201 executes processing to share a dummy ID called a common dummy ID with other data management devices 10 and to generate a dummy ID called an individual dummy ID for each cell of the summary table T' of dataset Z'. The summary table T' of dataset Z' is the anonymized data of the summary table T of dataset Z, which is obtained by linking dataset X and dataset Y by equijoin. Since the summary table T' of dataset Z' can also be regarded as a noisy summary table of dataset Z, hereinafter it will be referred to as the "noisy summary table T' of dataset Z" or simply as the "noisy summary table T'".

[0042] The anonymization processing unit 202 executes processing for creating a noise-infused summary table T′ with other data management devices 10.

[0043] The storage unit 203 stores a data set managed by the data management device 10. That is, when the data management device 10 is the data management device 10A, the storage unit 203 stores the data set X. On the other hand, when the data management device 10 is the data management device 10B, the storage unit 203 stores the data set Y.

[0044] In addition to the datasets managed by the data management device 10, the memory unit 203 also stores various information shared with other data management devices 10 (such as the maximum number of records N of datasets X and Y, the maximum absolute value M of noise), common dummy IDs shared with other data management devices 10, and individual dummy IDs generated by the data management device 10.

[0045] <Example of dataset> <Dataset X> An example of a data set X stored in the storage unit 203 of the data management device 10A is shown in Fig. 6. The data set X shown in Fig. 6 is made up of a plurality of records, and each record is made up of an ID, an attribute value of a label X1, and an attribute value of a label X2. Specific examples of the labels X1 and X2 include age and height.

[0046] <Dataset Y> An example of a data set Y stored in the storage unit 203 of the data management device 10B is shown in Fig. 7. The data set Y shown in Fig. 7 is made up of a plurality of records, and each record is made up of an ID, an attribute value of a label Y1, and an attribute value of a label Y2. Specific examples of the labels Y1 and Y2 include educational background and annual income.

[0047] <Example of operation of anonymization system 1> An example of the operation of the anonymization system 1 according to this embodiment will be described below.

[0048] Example 1 A first example of the operation of the anonymization system 1 according to this embodiment will be described with reference to FIG.

[0049] The pre-processing unit 201 of the data management device 10A and the pre-processing unit 201 of the data management device 10B share various information and a common dummy ID, and each generate an individual dummy ID (step S101). Specifically, the pre-processing unit 201 of the data management device 10A and the pre-processing unit 201 of the data management device 10B execute the following steps (1) to (3).

[0050] (1) The pre-processing unit 201 of the data management device 10A and the pre-processing unit 201 of the data management device 10B share various information such as the maximum number of records N and the maximum absolute value M of noise. Note that the maximum absolute value M of noise may be determined in advance, or may be determined by either the data management device 10A or the data management device 10B.

[0051] (2) The pre-processing unit 201 of the data management device 10A and the pre-processing unit 201 of the data management device 10B share 2×M different common dummy IDs for each cell of the noisy summary table T′. However, the common dummy IDs are IDs that are not included in either the data set X or Y.

[0052] (3) The pre-processing unit 201 of the data management device 10A generates 2×M+N different individual dummy IDs for each cell of the noisy summary table T'. Similarly, the pre-processing unit 201 of the data management device 10B generates N different individual dummy IDs for each cell of the noisy summary table T'. However, the individual dummy IDs are IDs that are not included in either data set X or Y, and do not overlap with the common dummy ID or other individual dummy IDs (including individual dummy IDs generated by other data management devices 10).

[0053] The following steps S102 to S112 are repeatedly executed for each of i=1,...,D (that is, repeatedly executed for each cell). By repeatedly executing the following steps S102 to S112 for each of i=1,...,D, the data management device 10B can obtain a noise-infused summary table T' consisting of D cells. Steps S102 to S112 for a certain i∈{1,...,D} will be described below.

[0054] The anonymization processing unit 202 of the data management device 10A extracts all the IDs of the records that make up the data set X and that satisfy the condition corresponding to the i-th cell (step S102). Hereinafter, the set of IDs of the records extracted in this step will be referred to as V A Then, α=|V A |Let's say.

[0055] The anonymization processing unit 202 of the data management device 10B extracts all the IDs of the records that make up the data set Y and that satisfy the condition corresponding to the i-th cell (step S103). Hereinafter, the set of IDs of the records extracted in this step will be referred to as V. B Then, β=|V B |Let's say.

[0056] The anonymization processing unit 202 of the data management device 10B calculates the set V obtained in step S103 by dividing the set V into 2×M different common dummy IDs corresponding to the i-th cell, N−β different individual dummy IDs corresponding to the i-th cell, and BIn this way, 2×M+N conversion IDs are obtained. Hereinafter, the set of these 2×M+N conversion IDs is referred to as W B Let's say.

[0057] For example, a pseudo-random function can be used for the irreversible conversion. Specifically, the anonymization processing unit 202 of the data management device 10B converts the common dummy ID, the individual dummy ID, and the ID extracted in step S103 into pseudo-random numbers using a pseudo-random function that uses a random number r shared in advance with the data management device 10A, and uses these pseudo-random numbers as conversion IDs while deleting the random number r, thereby realizing the irreversible conversion.

[0058] The anonymization processing unit 202 of the data management device 10B randomly arranges the conversion IDs obtained in step S105 (step S105). That is, the anonymization processing unit 202 of the data management device 10B arranges a set W of 2×M+N conversion IDs. B The elements of are randomly arranged. B Let W be an ordered set consisting of elements of randomly arranged B '. Note that W B When randomly arranging the elements of , for example, pseudo-random permutation can be used.

[0059] The anonymization processing unit 202 of the data management device 10B performs the W B The information used to randomly arrange the elements (hereinafter also referred to as "order information") is deleted (step S106). The order information may be, for example, pseudo-random permutation.

[0060] The anonymization processing unit 202 of the data management device 10A generates integer noise N(i) according to a predetermined probability distribution (step S107). Note that any discrete probability distribution can be used as the predetermined probability distribution, such as a truncated discrete Laplace distribution (Reference 1).

[0061] The anonymization processing unit 202 of the data management device 10A calculates the set V obtained in step S102 by dividing the set V by the number of M+N(i) different common dummy IDs corresponding to the i-th cell, the number of M(i)+N-α different individual dummy IDs corresponding to the i-th cell, and the set V obtained in step S102. A In this way, 2M+N conversion IDs are obtained. Hereinafter, the set of these 2×M+N conversion IDs is referred to as W A Let's say.

[0062] For example, a pseudo-random function can be used for the irreversible conversion. Specifically, the anonymization processing unit 202 of the data management device 10A converts the common dummy ID, the individual dummy ID, and the ID extracted in step S102 into pseudo-random numbers using a pseudo-random function that uses a random number r shared in advance with the data management device 10B, and uses these pseudo-random numbers as conversion IDs while deleting the random number r, thereby realizing the irreversible conversion.

[0063] The anonymization processing unit 202 of the data management device 10A randomly arranges the conversion IDs obtained in the above step S108 (step S109). That is, the anonymization processing unit 202 of the data management device 10A arranges a set W of 2×M+N conversion IDs. A The elements of are randomly arranged. A Let W be an ordered set consisting of elements of randomly arranged A '. Note that W A When randomly arranging the elements of , for example, pseudo-random permutation can be used.

[0064] The anonymization processing unit 202 of the data management device 10A performs the W A The ordering information (eg, pseudo-random permutation) used to randomly arrange the elements of is deleted (step S110).

[0065] The anonymization processing unit 202 of the data management device 10A calculates the ordered set W obtained in step S109 above. A ' to the data management device 10B (step S111).

[0066] The anonymization processing unit 202 of the data management device 10B counts the number of matches between the conversion IDs, and sets the value obtained by subtracting M from the count value as the aggregate value (noise-containing aggregate value) of the i-th cell of the noise-containing summary table T' (step S112). A ' and W B The number of elements in the intersection of the datasets X and Y is counted, and the count minus M is used as the aggregate value of the i-th cell of the noisy summary table T'. This means that the number of actual ID matches between datasets X and Y plus integer noise N(i) is used as the aggregate value of the i-th cell (noisy aggregate value).

[0067] As a result of the above, the data management device 10B can obtain a noisy summary table T' in which a noisy aggregate value is set in each cell. An example of the noisy summary table T' is shown in FIG. 9. The noisy summary table T' shown in FIG. 9 is created from the data set X shown in FIG. 6 and the data set Y shown in FIG. 7, and each cell represents a noisy aggregate value. For example, the noisy aggregate value of the cell corresponding to the condition (X1, X2, Y1, Y2) = (a, d, j, l) is "35." This noisy aggregate value is a value obtained by adding noise to the aggregate value of the number of records that satisfy the condition among the records that make up the data set Z, which is formed by connecting the data sets X and Y by equijoin.

[0068] The anonymization processing unit 202 of the data management device 10B can also obtain the data set Z' by returning this noise-containing summary table T' to the format of the original data set.

[0069] In the first embodiment, since 2M+N conversion IDs are always created in both the data management devices 10A and 10B, anonymity is not compromised by the number of conversion IDs. Also, since the conversion IDs are converted into irreversible random data, anonymity is not compromised by the conversion IDs themselves. Furthermore, since the number of matches of the conversion IDs is a noisy aggregate value, no significant information other than the noisy aggregate value is obtained, and anonymity based on CDP is satisfied. Therefore, according to the first embodiment, it is possible to obtain a noisy summary table T' (and a dataset Z' obtained by converting it back into the format of the original dataset) that satisfies an anonymity index called CDP, which is more useful than LDP.

[0070] Example 2 In the first embodiment, the noise N(i) is an integer, but depending on the CDP method, the noise may be a real number. Therefore, in the second embodiment, a case where the noise is a real number will be described. As a result, even when real number noise is used in the CDP method, it is possible to obtain a noisy summary table T' (and a data set Z' obtained by converting it back to the format of the original data set) that satisfies the CDP.

[0071] A second example of the operation of the anonymization system 1 according to this embodiment will be described with reference to FIG.

[0072] Steps S201 to S206 may be similar to steps S101 to S106 in FIG. 8, respectively, and therefore a description thereof will be omitted.

[0073] The anonymization processing unit 202 of the data management device 10A generates real noise R(i) according to a predetermined probability distribution, and divides the real noise R(i) into an integer part N(i) and a decimal part r(i) (step S207).

[0074] Steps S208 to S210 may be similar to steps S108 to S110 in FIG. 8, respectively, and therefore a description thereof will be omitted.

[0075] The anonymization processing unit 202 of the data management device 10A uses the ordered set W obtained in step S209 above. A ' and the decimal part r(i) obtained in step S207 above to the data management device 10B (step S211).

[0076] The anonymization processing unit 202 of the data management device 10B counts the number of matches between the conversion IDs, subtracts M from the count value, and adds r(i) to the count value to obtain the aggregate value (noise-containing aggregate value) of the i-th cell of the noise-containing summary table T' (step S212). A ' and W B The number of elements in the intersection of the datasets X and Y is counted, and the count value is subtracted from M and added with r(i), which is the aggregate value of the i-th cell of the noisy summary table T'. This means that the actual number of ID matches between datasets X and Y plus the real noise R(i) is used as the aggregate value of the i-th cell (noisy aggregate value).

[0077] Example 3 Generally, as the number of attributes in a dataset increases, the number of cells in the summary table increases, and the summary value of each cell becomes smaller, making it more susceptible to noise. Therefore, similar to Non-Patent Document 1, we have created a number of sub-datasets X and Y by extracting IDs and some attribute values ​​from each of the datasets X and Y. * and Y * After creating the table, the noise-containing summary table T' * and dataset Z' * Create these datasets Z' * Here, a case where synthetic data is generated from the dataset Z' will be described. As a method for generating synthetic data, a data synthesis method using a Bayesian network can be used, as in Non-Patent Document 1. * Since the number of attribute values ​​of each record constituting the data set X and Y can be set to four at most, it is expected that the usefulness will be improved compared to the first embodiment when the number of attributes of the data sets X and Y is large.

[0078] A third example of the operation of the anonymization system 1 according to this embodiment will be described with reference to FIG.

[0079] The pre-processing unit 201 of the data management device 10A calculates a plurality of sub-data sets X for the data set X. * (Step S301). Here, the sub-data set X * is a dataset consisting of records in which IDs and one to several predetermined attribute values ​​are extracted from each record constituting dataset X. As a result, sub-dataset X * Set S of X ={X *} is obtained.

[0080] The pre-processing unit 201 of the data management device 10B calculates a plurality of sub-data sets Y for the data set Y. * (Step S302). Here, the sub-data set Y * is a dataset consisting of records in which IDs and one to several predetermined attribute values ​​are extracted from each record constituting dataset Y. * Set S of Y ={Y *} is obtained.

[0081] The following steps S303 to S304 are performed to find all the sub-data sets (X * ,Y * )∈S X ×S Y It is executed repeatedly for a certain (X * ,Y * )∈S X ×S Y Steps S303 and S304 relating to this will be described below.

[0082] The anonymization processing unit 202 of the data management device 10A and the anonymization processing unit 202 of the data management device 10B perform, for example, steps S101 to S112 of FIG. 8 in the same manner as in the first embodiment. * ,Y * ) to the noisy summary table T'* is created (step S303).

[0083] The anonymization processing unit 202 of the data management device 10B generates the noise-containing summary table T' * By converting it back to the original data set format, we get the data set Z' * is created (step S304).

[0084] Finally, the anonymization processing unit 202 of the data management device 10B uses a known data synthesis method (for example, a data synthesis method using a Bayesian network) to synthesize a plurality of data sets Z' * (Step S305). As a result, the data set Z' can be generated as synthetic data. Note that, for example, PrivBayes (Reference 2) is known as a data synthesis method using a Bayesian network.

[0085] Example 4 In the first to third embodiments, it is assumed that both the data management devices 10A and 10B correctly execute each step of the sequence diagram shown in Fig. 8. Therefore, for example, if the data management device 10B does not delete the random number r of the pseudorandom function used in the irreversible transformation in step S104, or does not delete the order information by not executing step S106, anonymity will not be guaranteed. Therefore, in the fifth embodiment, a case will be described in which the number of matches between transformation IDs is obtained using a secret intersection protocol. The secret intersection protocol is a cryptographic application technology that, when each entity owns a certain set, obtains only the elements or the number of elements in the intersection of those sets.

[0086] Example 4 of the operation example of the anonymization system 1 according to this embodiment will be described with reference to Fig. 12. Note that steps S407 to S414 correspond to the secret intersection protocol.

[0087] Steps S401 to S404 may be similar to steps S101 to S104 in Fig. 8, respectively, and therefore their description will be omitted. Also, steps S405 to S406 may be similar to steps S107 to S108 in Fig. 8, respectively, and therefore their description will be omitted.

[0088] The anonymization processing unit 202 of the data management device 10A converts the set of conversion IDs W A The elements of the multiplicative group G are replaced with elements of the multiplicative group G (step S407). However, it is assumed that the multiplicative group G is shared with the data management device 10B.

[0089] The anonymization processing unit 202 of the data management device 10B converts the set of conversion IDs W B The elements of the multiplicative group G are replaced with elements of the multiplicative group G (step S408). However, it is assumed that the multiplicative group G is shared with the data management device 10A.

[0090] The anonymization processing unit 202 of the data management device 10B generates a random number s and B For each element u in s are calculated (step S409).

[0091] The anonymization processing unit 202 of the data management device 10B performs the anonymization for each u calculated in step S409. s are transmitted to the data management device 10A in a random order (step S410).

[0092] The anonymization processing unit 202 of the data management device 10A generates a random number t and A For each element v of t Calculate each and (u s ) t are calculated (step S411).

[0093] The anonymization processing unit 202 of the data management device 10A t are sent to the data management device 10B in a random order, and each (u s ) tare transmitted to the data management device 10B in a random order (step S412).

[0094] The anonymization processing unit 202 of the data management device 10B t ) s are calculated (step S413).

[0095] The anonymization processing unit 202 of the data management device 10B s ) t and each (v t ) s Regarding (u s ) t and (v t ) s The number of matches (number of matches) is calculated (step S414).

[0096] The anonymization processing unit 202 of the data management device 10B subtracts M from the number of matches calculated in step S414 above, and sets the result as the aggregate value of the i-th cell of the noisy summary table T' (noisy aggregate value) (step S415).

[0097] In the fourth embodiment, the confidentiality of u and v is guaranteed based on the difficulty of the discrete logarithm problem on the multiplicative group G. A without disclosing to subject B, and W B Without revealing to subject A, W A and W B This makes it possible to guarantee anonymity even if subject B does not delete the random number r of the pseudorandom function used in the irreversible conversion or does not delete the order information.

[0098] Example 5 In Examples 1 to 4, it was not assumed that subject B would share or disclose the dataset Z' acquired by subject B to subject A. If subject B were to share or disclose the dataset Z' acquired by subject A to subject A, the anonymity of dataset Z' would not be guaranteed to subject A unless subject A deleted information related to noise. Therefore, in Example 5, a case will be described in which anonymity is guaranteed even when subject B shares or discloses the dataset Z' acquired by subject A to subject A.

[0099] A fifth example of the operation of the anonymization system 1 according to this embodiment will be described with reference to FIG.

[0100] Steps S501 to S512 may be similar to steps S101 to S112 in FIG. 8, respectively, and therefore a description thereof will be omitted.

[0101] The anonymization processing unit 202 of the data management device 10B further adds a predetermined noise to the noisy aggregated value obtained in step S512 (step S513). This ensures the anonymity of subject A even if subject A has not deleted information related to the noise.

[0102] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0103] [References] Reference 1: Q. Geng, W. Ding, R. Guo, and S. Kumar, Privacy and Utility Tradeoff in Approximate Differential Privacy. arXiv, Feb. 05, 2019. doi: 10.48550 / arXiv.1810.00877. Reference 2: Jun Zhang et al. "PrivBayes: Private Data Release via Bayesian Networks". ACM Trans. Database Syst., 42(4), October 2017. [Explanation of symbols]

[0104] 1. Anonymization system 10 Data management device 20. Communication Networks 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage 108 processors 109 Bus 201 Pre-processing section 202 Anonymization Processing Unit 203 Storage section

Claims

1. An information processing device that is communicably connected to another information processing device that has a first data set and has a second data set, receiving from the other information processing device a plurality of first converted identifiers obtained by irreversibly converting first identifiers of records that satisfy a predetermined condition among the records constituting the first data set and dummy identifiers the number of which corresponds to the number of the first identifiers and noise; calculating a noisy aggregate value by adding the noise to an aggregate value of records that satisfy the condition among records that constitute a dataset obtained by connecting the first dataset and the second dataset by equijoin, based on the number of matches between a plurality of second converted identifiers obtained by irreversibly converting second identifiers of records that satisfy the condition among records that constitute the second dataset and dummy identifiers, the number of which corresponds to the number of second identifiers, and the plurality of first converted identifiers; Information processing device.

2. The information processing device according to claim 1 , wherein the dummy identifiers include a common dummy identifier shared by the information processing device and the other information processing device, and an individual dummy identifier generated by each of the information processing device and the other information processing device.

3. The information processing device according to claim 1 , wherein the noise is integer noise.

4. the noise is real-valued noise; The information processing device includes: receiving, from the other information processing device, a plurality of first converted identifiers obtained by irreversibly converting the first identifiers and a number of dummy identifiers corresponding to the number of the first identifiers and the integer part of the real-valued noise; The information processing apparatus according to claim 1 , wherein the noise-containing aggregate value is calculated based on the number of matches and a decimal part of the real-valued noise.

5. The information processing device includes: The information processing apparatus according to claim 1 , further comprising: adding a predetermined noise to the noise-containing aggregated value.

6. The information processing device includes: The information processing device according to claim 1 , wherein the number of matches is calculated by executing a secret common set protocol with the other information processing device.

7. an information processing device that is communicably connected to another information processing device that has a first data set and that has a second data set; receiving from the other information processing device a plurality of first converted identifiers obtained by irreversibly converting first identifiers of records that satisfy a predetermined condition among the records constituting the first data set and dummy identifiers the number of which corresponds to the number of the first identifiers and noise; calculating a noisy aggregate value by adding the noise to an aggregate value of records that satisfy the condition among records that constitute a dataset obtained by connecting the first dataset and the second dataset by equijoin, based on the number of matches between a plurality of second converted identifiers obtained by irreversibly converting second identifiers of records that satisfy the condition among records that constitute the second dataset and dummy identifiers, the number of which corresponds to the number of second identifiers, and the plurality of first converted identifiers; method.

8. an information processing apparatus that is communicably connected to another information processing apparatus that has a first data set and that has a second data set; receiving from the other information processing device a plurality of first converted identifiers obtained by irreversibly converting first identifiers of records that satisfy a predetermined condition among the records constituting the first data set and dummy identifiers the number of which corresponds to the number of the first identifiers and noise; calculating a noisy aggregate value by adding the noise to an aggregate value of records that satisfy the condition among records that constitute a dataset obtained by connecting the first dataset and the second dataset by equijoin, based on the number of matches between a plurality of second converted identifiers obtained by irreversibly converting second identifiers of records that satisfy the condition among records that constitute the second dataset and dummy identifiers, the number of which corresponds to the number of second identifiers, and the plurality of first converted identifiers; A program that executes a process.

Images