Information processing system, data providing device, data processing device, data receiving device, method and program

Abstract

Provided is a system capable of suppressing the amount of data to be transmitted without imposing a data manipulation restriction. A data provision device (100): sets data manipulation rules; sets predetermined random numbers; calculates signature hash values respectively corresponding to multiple data; generates a digital signature using the signature hash values; and transmits a data set, the digital signature, and the random numbers to a data manipulation device. The data manipulation device (200): performs processing for manipulating data to be manipulated; calculates manipulated hash values corresponding to the respective data to be manipulated; and outputs a manipulated data set, manipulated hash values, and the digital signature to a data reception device.　The data reception device (300) calculates verification hash values corresponding to the multiple data by using the manipulated data set and the manipulated hash values and performs verification of the verification hash values and the digital signature.

Description

[Technical Field]

[0001] The present disclosure relates to an information processing system, a data providing device, a data processing device, a data receiving device, a method, and program Regarding. [Background technology]

[0002] In recent years, the use of anonymously processed information (anonymized data), which is premised on the appropriate protection of personal information, has been increasing. When researchers and others use anonymized data, ensuring that the data has not been improperly altered (data legitimacy) is important in order to guarantee the legitimacy of the results of data utilization. In other words, if fraudulent data is used, the knowledge gained from the data will also be fraudulent, and there is a risk that policies and services based on the data will be inappropriate. Digital signature technology is a technology that can verify that electronic data has not been altered. However, if a digital signature is simply applied to the data, the anonymization process will result in the data being altered, and there is a risk that legitimacy cannot be verified.

[0003] In relation to such technology, Non-Patent Document 1 discloses a method for verifying the validity of anonymization that applies sanitizable signature technology as a technology for verifying the validity of anonymization processing on data. Non-Patent Document 1 discloses a method that can reduce the amount of data exchanged between a signature creator, an anonymizer, and a verifier. The technology disclosed in Non-Patent Document 1 manages random number data and a generalized hierarchical tree that indicate random numbers corresponding to each attribute value of the original data, separately from the original data, and performs signature generation, anonymization, and signature verification processing while referring to each piece of information. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Yumiko Togashi et al., "Proposal of an anonymization signature method capable of verifying the validity of anonymization," Computer Security Symposium 2021, 26-29 October 2021 Summary of the Invention [Problem to be solved by the invention]

[0005] The technology disclosed in Non-Patent Document 1 restricts the amount of data transmitted by imposing the restriction that "when the value of a cell is processed, other cells with the same attribute value as the value of that cell are also processed in the same way." In other words, the technology disclosed in Non-Patent Document 1 has a restriction that, for a certain attribute, the same processing must be applied to the same attribute value even in different records (cells). However, there are cases where different processing must be applied to different records even for the same attribute value. Therefore, it is desirable to remove such restrictions on processing the same attribute value.

[0006] The purpose of the present disclosure is to solve such problems and to provide a system, device, method, and program that can reduce the amount of data transmitted without imposing restrictions on data processing. [Means for solving the problem]

[0007] An information processing system according to the present disclosure includes a data providing device that provides a data set composed of a plurality of data relating to at least one attribute, a data processing device that processes at least a portion of the plurality of data, and a data receiving device that receives the data set with the portion of the data processed; the data providing device comprises: a processing rule setting means for setting a processing rule for each of the attributes; a random number setting means for setting a predetermined random number for a state corresponding to a plurality of attribute values ​​that can be taken by processing target data related to an attribute targeted for processing in the processing rule; a hash value calculation means for calculating a hash value for signature corresponding to each of the plurality of data; a signature hash value calculation means for generating a digital signature using the hash value for signature; and a first transmission means for transmitting the data set, the digital signature, and the random number to the data processing device, wherein the hash value calculation means for calculating a first hash value for the processing target data with respect to a data string obtained by using the random number set for the processing target data and the attribute value corresponding to the processing target data, calculates an intermediate hash value for a data string combining the processing target data and the first hash value, and calculates a hash value for signature corresponding to the processing target data using the intermediate hash value; the data processing device comprises processing means for performing processing to process the processing target data, processed hash value calculation means for calculating processed hash values ​​corresponding to each of the processing target data, and second transmission means for transmitting a data set resulting from processing of the processing target data, the processed hash value corresponding to the processing target data, and the digital signature to the data receiving device, wherein the processed hash value calculation means calculates, for the processed processing target data, a leading hash value for a data string obtained by using the processing target data before processing and the random number set for an attribute value corresponding to the processing target data before processing, calculates an intermediate hash value for a data string combining the processing target data before processing and the leading hash value, and calculates a processed hash value corresponding to the processing target data after processing using the intermediate hash value; The data receiving device includes a verification hash value calculation means for calculating a verification hash value corresponding to each of the plurality of data using a data set obtained by processing the data to be processed and the processed hash value, and a verification means for verifying the verification hash value and the digital signature.

[0008] a signature hash value calculation means for calculating a signature hash value corresponding to each of the plurality of data; a signature generation means for generating a digital signature using the signature hash value; and a transmission means for transmitting the data set, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data. The signature hash value calculation means calculates a first hash value for the data to be processed using the random number set for the attribute value corresponding to the data to be processed, calculates an intermediate hash value for the data to be processed and the first hash value, and calculates a first hash value for the data to be processed using the intermediate hash value.

[0009] In addition, a data processing device according to the present disclosure includes a processing means for performing processing on target data for an attribute that is subject to processing in a processing rule set for each of the attributes in a data providing device that provides a dataset consisting of a plurality of data related to at least one attribute; a processed hash value calculation means for calculating a processed hash value corresponding to each of the target data; and a transmission means for transmitting the dataset in which the processing has been performed on the target data, the processed hash value corresponding to the target data, and a digital signature generated in the data providing device to a data receiving device that receives the dataset in which some of the data has been processed. The processed hash value calculation means calculates a leading hash value for the processed target data from a data string obtained using the target data before processing and a random number set for an attribute value corresponding to the target data before processing, calculates an intermediate hash value for a data string combining the target data before processing and the leading hash value, and uses the intermediate hash value to calculate a leading hash value corresponding to the target data after processing.

[0010] In addition, the data receiving device according to the present disclosure includes: a data set obtained by processing target data related to an attribute that is the target of processing in a processing rule set for each of the attributes in a data providing device that provides a data set consisting of a plurality of data related to at least one attribute; a verification hash value calculation means that calculates a verification hash value corresponding to each of the plurality of data using a processed hash value calculated in a data processing device that processes at least some of the plurality of data and corresponding to each of the target data; and a verification means that verifies the verification hash value and a digital signature generated in the data providing device.

[0011] Furthermore, an information processing method according to the present disclosure includes the following steps: a data providing device provides a dataset consisting of a plurality of data related to at least one attribute; sets processing rules for each of the attributes; sets predetermined random numbers for states corresponding to a plurality of attribute values ​​that can be taken by processing target data related to the attribute to be processed in the processing rules; calculates a first hash value for a data string obtained by using the processing target data and the random number set for the attribute value corresponding to the processing target data; calculates an intermediate hash value for a data string combining the processing target data and the first hash value; calculates a signature hash value corresponding to the processing target data using the intermediate hash value, thereby calculating a signature hash value corresponding to each of the plurality of data; generates a digital signature using the signature hash value; and transmits the dataset, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data; the data processing device performs processing on the processing target data, calculates a first hash value for a data string obtained by using the processing target data before processing and a random number set for an attribute value corresponding to the processing target data before processing, calculates an intermediate hash value for a data string combining the processing target data before processing and the first hash value, and calculates a post-processed hash value corresponding to the processing target data after processing using the intermediate hash value, thereby calculating post-processed hash values ​​corresponding to each of the processing target data, and transmits a dataset in which the processing has been performed on the processing target data, the post-processed hash value corresponding to the processing target data, and the digital signature to a data receiving device that receives the dataset in which some data has been processed; The data receiving device calculates a verification hash value corresponding to each of the multiple data using a data set that has been processed on the data to be processed and the processed hash value, and verifies the verification hash value and the digital signature.

[0012] Furthermore, a data providing method according to the present disclosure includes: setting a processing rule for each attribute in a dataset consisting of a plurality of data relating to at least one attribute; setting a predetermined random number for a state corresponding to a plurality of attribute values ​​that data to be processed can take on relating to the attribute to be processed in the processing rule; calculating a first hash value for a data string obtained using the data to be processed and the random number set for the attribute value corresponding to the data to be processed; calculating an intermediate hash value for a data string combining the data to be processed and the first hash value; calculating a signature hash value corresponding to the data to be processed using the intermediate hash value, thereby calculating a signature hash value corresponding to each of the plurality of data; generating a digital signature using the signature hash value; and transmitting the dataset, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data.

[0013] In addition, the data processing method disclosed herein involves a data providing device that provides a dataset consisting of multiple data related to at least one attribute, performing a process to process target data related to an attribute that is subject to processing in processing rules set for each of the attributes, calculating a first hash value for a data string obtained using the target data before processing and a random number set for an attribute value corresponding to the target data before processing, calculating an intermediate hash value for a data string that combines the target data before processing and the first hash value, and using the intermediate hash value to calculate a post-processed hash value corresponding to the target data after processing, thereby calculating post-processed hash values ​​corresponding to each of the target data, and transmitting the dataset in which the target data has been processed, the post-processed hash value corresponding to the target data, and a digital signature generated by the data providing device to a data receiving device that receives the dataset in which some of the data has been processed.

[0014] In addition, the data receiving method disclosed herein uses a data set obtained by processing target data related to an attribute that is the target of processing in a processing rule set for each of the attributes in a data providing device that provides a data set consisting of multiple data related to at least one attribute, and processed hash values ​​calculated in a data processing device that processes at least some of the multiple data and corresponding to each of the target data to calculate verification hash values ​​corresponding to each of the multiple data, and verifies the verification hash values ​​against the digital signature generated in the data providing device.

[0015] Furthermore, a first program according to the present disclosure causes a computer to execute the following steps: setting a processing rule for each attribute in a dataset consisting of a plurality of data relating to at least one attribute; setting a predetermined random number for a state corresponding to a plurality of attribute values ​​that can be taken by data to be processed related to the attribute to be processed in the processing rule; calculating a first hash value for a data string obtained by using the data to be processed and the random number set for the attribute value corresponding to the data to be processed, calculating an intermediate hash value for a data string combining the data to be processed and the first hash value, and using the intermediate hash value to calculate a signature hash value corresponding to the data to be processed, thereby calculating a signature hash value corresponding to each of the plurality of data; generating a digital signature using the signature hash value; and transmitting the dataset, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data.

[0016] In addition, a second program according to the present disclosure causes a computer to execute the following steps: a step of performing processing on target data for processing related to an attribute that is subject to processing in processing rules set for each of the attributes in a data providing device that provides a dataset consisting of multiple data related to at least one attribute; a step of calculating a first hash value for a data string obtained using the target data before processing and a random number set for the attribute value corresponding to the target data before processing, calculating an intermediate hash value for a data string combining the target data before processing and the first hash value, and using the intermediate hash value to calculate a post-processed hash value corresponding to the target data after processing, thereby calculating post-processed hash values ​​corresponding to each of the target data; and a step of transmitting the dataset in which the target data for processing has been processed, the post-processed hash value corresponding to the target data, and a digital signature generated in the data providing device to a data receiving device that receives the dataset in which some data has been processed.

[0017] In addition, a third program according to the present disclosure causes a computer to execute the following steps: calculating a verification hash value corresponding to each of the plurality of data using a dataset in which processing has been performed on data to be processed related to an attribute that is subject to processing in processing rules set for each of the attributes in a data providing device that provides a dataset consisting of a plurality of data related to at least one attribute, and processed hash values ​​calculated in a data processing device that processes at least some of the plurality of data and corresponding to each of the data to be processed; and verifying the verification hash value and a digital signature generated in the data providing device. [Effects of the Invention]

[0018] According to the present disclosure, it is possible to provide a system, an apparatus, a method, and a program that can reduce the amount of data transmitted without imposing restrictions on data processing. [Brief explanation of the drawings]

[0019] [Figure 1] FIG. 10 is a diagram for explaining a technique according to a comparative example. [Figure 2] FIG. 10 is a diagram for explaining a technique according to a comparative example. [Figure 3] FIG. 10 is a diagram for explaining a technique according to a comparative example. [Figure 4] FIG. 1 is a diagram illustrating a configuration of an information processing system according to a first embodiment. [Figure 5] FIG. 1 is a diagram illustrating a configuration of a data providing device according to a first embodiment. [Figure 6] FIG. 1 is a diagram illustrating a configuration of a data processing device according to a first embodiment. [Figure 7] FIG. 2 is a diagram illustrating a configuration of a data receiving device according to the first embodiment. [Figure 8] 4 is a flowchart illustrating an information processing method executed by the information processing system according to the first embodiment. [Figure 9] 4 is a flowchart showing a data providing process executed by the data providing device according to the first embodiment; [Figure 10] 4 is a flowchart showing a data processing process executed by the data processing device according to the first embodiment. [Figure 11] 5 is a flowchart showing a data receiving process executed by the data receiving device according to the first embodiment. [Figure 12] FIG. 10 is a diagram for explaining a processing flow in an information processing system according to a second embodiment. [Figure 13] FIG. 10 is a diagram for explaining a process of a processing rule setting unit according to the second embodiment. [Figure 14] FIG. 10 is a diagram illustrating a generalized hierarchical tree according to the second embodiment. [Figure 15]FIG. 10 is a diagram illustrating a random number table according to the second embodiment. [Figure 16] FIG. 10 is a diagram for explaining the processing of the data processing device according to the second embodiment. [Figure 17] FIG. 10 is a diagram for explaining a processing flow in an information processing system according to a third embodiment. [Figure 18] FIG. 10 is a diagram for explaining the processing of the data processing device according to the third embodiment. [Figure 19] FIG. 10 is a diagram for explaining a processing flow in an information processing system according to a fourth embodiment. [Figure 20] FIG. 13 is a diagram illustrating a generalized hierarchical tree according to a fourth embodiment. [Figure 21] FIG. 10 is a diagram for explaining the processing of the data processing device according to the fourth embodiment. [Figure 22] FIG. 10 is a diagram for explaining an application example according to the present embodiment. [Figure 23] FIG. 1 is a block diagram illustrating an example of the hardware configuration of a calculation processing device capable of realizing an apparatus and a system according to each embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0020] (Outline of this embodiment) Before describing the present embodiment, an outline of the present embodiment will be described. Note that, although the present embodiment will be described below, the following embodiment does not limit the invention according to the claims. Also, not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention. Also, in the following description, the indexes (alphabetical letters) used are not necessarily common throughout this specification.

[0021] First, the basic data flow involved in signature verification involving anonymization will be described. For example, original data (dataset) consists of one or more records. A record is a unit of data collection. If the original data is medical data, a record contains one or more pieces of data related to a patient. For example, the original data consists of one or more attributes. An attribute indicates the type of data. Attributes include, for example, the name, address, age, and gender corresponding to each record. For example, the original data may be organized in a table format having rows and columns. In this case, each row corresponds to a record, and each column corresponds to an attribute. Each piece of data corresponding to each cell in the table format has an attribute value corresponding to the attribute. If the attribute is "address," the attribute value may indicate, for example, "Tokyo," "Kanagawa," and "Osaka."

[0022] In addition, the data provider who provides the original data (data set) creates a signature (electronic signature; digital signature) for the original data using random numbers and sends the original data and signature to the data processor. The data processor processes (anonymizes) the original data and sends the processed data and signature to the data recipient. Examples of processing (anonymization) include "deletion" and "generalization." "Deletion" is processing that deletes data (attribute values). "Generalization" is processing that generalizes (abstracts) attribute values. The data recipient (data verifier) ​​verifies the signature using the processed data and signature, and verifies the legitimacy of the processed data. The data recipient can utilize the processed data whose legitimacy has been verified.

[0023] Before describing this embodiment, a comparative example will be described. 1 to 3 are diagrams for explaining a technique according to a comparative example. The comparative example corresponds to the technique according to Non-Patent Document 1. FIG. 1 shows data used in the comparative example. As shown in FIG. 1, original data D1, random number data Dr, and a generalized hierarchical tree Tr are used in the comparative example.

[0024] In the original data D1, one record is configured for each row. In the example of FIG. 1, the original data D1 has five records. The original data D1 also has one or more attributes. In the example of FIG. 1, the original data D1 has the attribute "Address". The attribute value of the first row is "Tokyo", the attribute value of the second row is "Tokyo", the attribute value of the third row is "Kanagawa", the attribute value of the fourth row is "Kanagawa", and the attribute value of the fifth row is "Osaka".

[0025] The random number data Dr indicates random numbers corresponding to possible attribute values ​​for each attribute. The random number data Dr illustrated in FIG. 1 indicates random numbers corresponding to each attribute value of the attribute "address." The random number corresponding to "Tokyo" is R1, the random number corresponding to "Kanagawa" is R2, and the random number corresponding to "Osaka" is R3. In the comparative example, the random number data Dr is prepared in advance to reduce the amount of data transmitted. Furthermore, in the comparative example, the random number data Dr can be used by the data provider, data processor, and data recipient.

[0026] A generalized hierarchical tree Tr has a hierarchical structure (tree structure) and indicates rules for generalizing (abstracting) the attribute values ​​of the corresponding attributes. Figure 1 shows a generalized hierarchical tree Tr corresponding to the attribute "address." In the generalized hierarchical tree Tr, the higher the node in the hierarchical structure, the more generalized (abstract) the attribute value is, and the lower the node in the hierarchical structure, the less generalized (abstract) the attribute value is. The leaf node, which is the lowest level (level "1") in the hierarchical structure, is assigned the least abstract (least generalized) attribute value. On the other hand, the root node, which is the highest level (level "l") in the hierarchical structure, is assigned the most abstract (most generalized) attribute value. Note that l indicates the height of the generalized hierarchical tree Tr. In the generalized hierarchical tree Tr illustrated in Figure 1, l = 3.

[0027] In the generalized hierarchical tree Tr illustrated in FIG. 1, the leaf nodes at level "1" correspond to "prefecture names" such as "Tokyo" or "Kanagawa." The intermediate nodes at level "2" correspond to "region names" with a higher level of abstraction, such as "Kanto (region)" or "Kinki (region)." The root node at level "3" corresponds to the "country name" of "Japan," which is the most abstract. In the comparative example, the generalized hierarchical tree Tr is used by data providers, data processors, and data recipients.

[0028] As mentioned above, in the comparative example, the amount of data is reduced by adding the restriction that "when the value of a certain cell is processed, the same processing is also performed on other cells with the same attribute value that have the same attribute value as the value of that cell." In other words, in the comparative example, there is a restriction that for a certain attribute, the same processing must be performed on the same attribute value even if it is in a different record (cell).

[0029] FIG. 2 is a diagram illustrating a comparative example in which deletion processing is performed. When generating a signature (a), the data provider, for each cell, sets the hash value of the cell to a hash value obtained by combining the corresponding attribute value and a random number corresponding to the attribute value. However, if the same attribute value exists multiple times, the data provider generates a new random number from the random number corresponding to the attribute value and uses it to calculate the hash value. For example, if the random number for attribute value A is R and attribute value A appears three times in the attribute, the data provider combines the random numbers R, R+1, and R+2 for each attribute value, respectively. In this way, the data provider calculates a hash value H2 corresponding to each attribute. Then, one hash value is calculated from hash value H2, and a signature is generated for that hash value.

[0030] Furthermore, during the anonymization (deletion) process in (b), the data processor performs anonymization according to the data user's request, within the scope of the anonymization policy set by the signature generator. For attributes that are not processed, the original data values ​​are provided to the verifier as anonymized data. This is also the case in Figure 3.

[0031] Additionally, for the attribute to be deleted, the data processor replaces the attribute value of the attribute with the hash value of data that combines the attribute value of the attribute to be deleted with the corresponding random number, just as when generating a signature. If the attribute contains multiple identical attribute values, the data processor generates a new random number from the random number corresponding to the attribute value and uses it to calculate the hash value. In the example of Figure 2, the attribute value "Kanagawa" is the attribute to be deleted. The data recipient (data verifier) ​​is provided with anonymized data D2 and random number data Dr2 from which the attribute value "Kanagawa" to be deleted and its random number have been deleted.

[0032] Furthermore, during signature verification (c), if the random number data Dr2 contains a random number for each attribute value in the anonymized data D2 (if no processing has been performed), the data recipient (data verifier) ​​performs hash value calculations in the same manner as when the signature was generated. In the example of FIG. 2, hash value calculations are performed for the attribute values ​​"Tokyo" and "Osaka" in the same manner as when the signature was generated. On the other hand, if the random number data Dr2 does not contain a random number for each attribute value in the anonymized data D2 (if processing (deletion) has been performed), the data recipient uses the value of the anonymized data D2 as is as the hash value corresponding to that cell. In the example of FIG. 2, for the attribute value "Kanagawa," the value of the anonymized data D2 is used as is as the hash value for that cell.

[0033] In this way, the data recipient calculates a hash value H2' corresponding to the anonymized data D2. Then, the data recipient calculates one hash value from the hash value H2'. The data recipient then verifies the legitimacy of the anonymized data D2 by determining whether the value obtained by decrypting the signature for the hash value H2 corresponding to the original data D1 with the verification key matches the hash value H2' corresponding to the anonymized data D2. If the two match, the verification of the anonymized data D2 is successful; if the two do not match, the verification of the anonymized data D2 fails.

[0034] 3 is a diagram for explaining a case where generalization processing is performed according to a comparative example. When generating a signature in (a), the data provider repeats generalization for each cell according to the rule that "the hash value of data obtained by combining an attribute value and a random number is used as the random number for the attribute value of the next higher layer in the generalized hierarchical tree Tr." Then, the data provider sets the hash value of data obtained by combining the highest layer and the corresponding random number as the hash value of the cell.

[0035] For example, in the cell for the attribute value "Tokyo" in the first row, the data provider uses the hash value "E31843" of the data combining the attribute value "Tokyo" and its corresponding random number R1 as the random number corresponding to the attribute value "Kanto" in the hierarchy one level above the attribute value "Tokyo".The data provider then uses the hash value "084BF6" of the data combining the attribute value "Kanto" and its corresponding random number "E31843" as the random number corresponding to the attribute value "Japan" in the hierarchy one level above the attribute value "Kanto".

[0036] The data provider then sets the hash value "6BE6D3" of the data combining the top-level attribute value "Japan" and its corresponding random number "084BF6" as the hash value corresponding to the cell of the attribute "Address" in the first row. However, as in the case of deletion, if there are multiple identical attribute values ​​in the same attribute, the data provider generates a new random number from the random number corresponding to that attribute value and uses it to calculate the hash value. In this way, the data provider calculates the hash value H3 corresponding to each attribute. Then, one hash value is calculated from hash value H3, and a signature is generated for that hash value.

[0037] Furthermore, during anonymization (generalization processing) in (b), the data processor generalizes the target of generalization processing in the same manner as during signature generation. That is, for each cell, the data processor repeats generalization according to the rule that "the hash value of the data combining the attribute value and a random number is used as the random number for the attribute value at the next higher level in the generalization hierarchical tree Tr." The data processor then generates the generalized attribute value and the random number corresponding to that attribute value.

[0038] In the example of Figure 3, the attribute value "Tokyo" and the attribute value "Kanagawa" are generalized to the attribute value "Kanto." The data processor generates anonymized data D3 in which the generalized attribute value is associated with a corresponding random number. For cells with the attribute value "Osaka" that is not generalized, the attribute value "Osaka" is associated with a random number R3 in the anonymized data D3. The random number R3 is a random number that corresponds to the attribute value "Osaka" in the random number data Dr. The data recipient (data verifier) ​​is provided with the anonymized data D3 and the generalized generalized hierarchical tree. In the generalized generalized hierarchical tree, the attribute value before generalization has been deleted.

[0039] Furthermore, during signature verification (c), if a random number exists in the anonymized data D3 for each attribute value (if the data has not been processed), the data recipient (data verifier) ​​calculates a hash value in the same manner as when the signature was generated. In the example of FIG. 3, for the attribute value "Osaka," a hash value is calculated in the same manner as when the signature was generated. On the other hand, if a random number sequence (hash value) is associated with the anonymized data D3, the data has been processed. In this case, the data recipient uses the random number sequence (hash value) associated with the attribute value of the attribute and the generalized hierarchical tree to calculate a hash value for data combining the top layer and the corresponding random number.

[0040] For example, for the cell with the attribute value "Kanto" in the first row, the data recipient uses the hash value "084BF6" of the data combining the attribute value "Kanto" and its corresponding random number "E31843" as the random number corresponding to the attribute value "Japan" one level above the attribute value "Kanto."The data recipient then uses the hash value "6BE6D3" of the data combining the attribute value "Japan" in the highest level and its corresponding random number "084BF6" as the hash value corresponding to the cell with the attribute "Address" in the first row.

[0041] In this way, the data recipient calculates a hash value H3' corresponding to the anonymized data D3. Then, the data recipient calculates one hash value from the hash value H3'. The data recipient then verifies the legitimacy of the anonymized data D3 by determining whether the value obtained by decrypting the signature for the hash value H3 corresponding to the original data D1 with the verification key matches the hash value H3' corresponding to the anonymized data D3. If the two match, the verification of the anonymized data D3 is successful; if the two do not match, the verification of the anonymized data D3 fails.

[0042] As described above, the comparative example has a constraint that "for a certain attribute, the same processing must be applied to the same attribute value even in different records (cells)." However, there are cases where different processing must be applied to different records even for the same attribute value of a certain attribute. Therefore, it is desirable to remove such a constraint.

[0043] In a comparative example, consider a case where processing is performed without observing the above constraints. For example, in the example of Figure 2, all records having the attribute value "Kanagawa" are processed as "deleted." In contrast, for the record in the third row, the attribute value "Kanagawa" is processed as "deleted," but for the record in the fourth row, the attribute value "Kanagawa" is not processed as "deleted."

[0044] In this case, the data processor will "delete" the attribute value "Kanagawa" for the record on the third line as described above. Meanwhile, the data processor will leave the attribute value "Kanagawa" for the record on the fourth line in the anonymized data D2. Then, the data processor will ensure that the attribute value "Kanagawa" and its random number are not deleted from the random number data Dr2. In other words, the random number data Dr is provided to the data recipient.

[0045] In this case, as described above, the data recipient uses the value of the anonymized data D2 as the hash value for the cell in the third row. Meanwhile, for the cell in the fourth row, the random number R2 from the provided random number data Dr is used to calculate a hash value, just as when generating a signature. The hash values ​​generated for the cell in the third row and the cell in the fourth row are generated using the same random number R2. Therefore, there is a risk that the original value of the cell in the third row can be guessed using R2. Therefore, there is a risk that the data recipient will discover that the attribute value of the original data for the cell in the third row was "Kanagawa." This is because the data recipient now knows the random number R2 corresponding to the deleted attribute value "Kanagawa." However, unless the random number R2 is provided to the data recipient, the data recipient will not be able to generate a hash value for the cell in the fourth row. Therefore, signature verification will not be performed properly.

[0046] This can occur even in the case of "generalization" processing shown in FIG. 3. That is, assume that the attribute value "Tokyo" in the first row in FIG. 3 is generalized to the attribute value "Kanto," and the attribute value "Tokyo" in the second row is not generalized. In this case, for the record in the second row, the random number R1 corresponding to the attribute value "Tokyo" may be included in the anonymized data D3, and there is a risk that the data recipient will discover that the attribute value of the original data in the cell in the first row is "Tokyo." Therefore, in the comparative example (Non-Patent Document 1), a constraint is required that "for a certain attribute, the same processing must be applied to the same attribute value even in different records (cells)."

[0047] In contrast, in this embodiment, as will be explained below, the amount of data to be transmitted is reduced by setting a random number corresponding to each attribute value in advance, and this random number is not provided to the data recipient. Therefore, in this embodiment, it is possible to reduce the amount of data to be transmitted without imposing restrictions on data processing.

[0048] (Embodiment 1) Hereinafter, embodiments will be described with reference to the drawings. For clarity of explanation, the following description and drawings have been omitted and simplified as appropriate. In addition, the same elements in each drawing are designated by the same reference numerals, and duplicate explanations are omitted as necessary.

[0049] FIG. 4 is a diagram showing the configuration of an information processing system 10 according to the first embodiment. The information processing system 10 includes a data providing device 100, a data processing device 200, and a data receiving device 300. The data providing device 100, the data processing device 200, and the data receiving device 300 are physically separate, but may be integrated. The data providing device 100, the data processing device 200, and the data receiving device 300 are communicably connected to each other via wired or wireless communication. The data providing device 100 may be managed by the data provider described above. The data processing device 200 may be managed by the data processor described above. The data receiving device 300 may be managed by the data recipient described above.

[0050] The information processing system 10 generates a signature for data (data set) provided by the above-mentioned device, processes (anonymizes) at least a portion of the data, and verifies the signature for the data set with the processed portion of the data. Details will be described later. Note that the information processing system 10 can also function as a digital signature system (signature system or electronic signature system) for issuing a digital signature (electronic signature), a data processing system for processing data, or a signature verification system (verification system) for verifying a signature.

[0051] FIG. 5 is a diagram showing the configuration of the data providing device 100 according to the first embodiment. The data providing device 100 has, as its components, a processing rule setting unit 110, a random number setting unit 120, a signature hash value calculation unit 130, a signature generation unit 140, and a transmission unit 150. The processing rule setting unit 110 functions as processing rule setting means. The random number setting unit 120 functions as random number setting means. The signature hash value calculation unit 130 functions as signature hash value calculation means (first hash value calculation means or first calculation means). The signature generation unit 140 functions as signature generation means. The transmission unit 150 functions as transmission means (first transmission means).

[0052] The data providing device 100 receives a dataset composed of multiple data related to at least one attribute from a data provider. The data providing device 100 then provides the dataset. As described above, the dataset is composed of one or more records and one or more attributes. As described above, the dataset may be composed, for example, in a table format with rows and columns. Each row may correspond to a record, and each column may correspond to an attribute. The dataset may be, for example, medical data of multiple patients, but is not limited to this. The data providing device 100 also generates a digital signature for the provided data (dataset). The data providing device 100 may also function as a signature generation device that generates a digital signature (electronic signature).

[0053] The data providing device 100 can be realized by an information processing device such as a computer. That is, the data providing device 100 has an arithmetic device such as a CPU (Central Processing Unit) and a storage device such as a memory or a disk. The data providing device 100 realizes each of the above components by, for example, having the arithmetic device execute a program stored in the storage device. This also applies to other embodiments described later. The functions of each component will be described later.

[0054] 6 is a diagram showing the configuration of a data processing device 200 according to the first embodiment. The data processing device 200 includes, as its components, a processing unit 210, a processed hash value calculation unit 220, and a transmission unit 230. The processing unit 210 functions as processing means. The processed hash value calculation unit 220 functions as processed hash value calculation means (second hash value calculation means or second calculation means). The transmission unit 230 functions as transmission means (second transmission means).

[0055] The data processing device 200 acquires (receives) information including a data set and a digital signature from the data providing device 100. Then, the data processing device 200 processes at least a portion of the multiple data in the data set provided by the data providing device 100. Note that the data processing device 200 can also function as an anonymization device that anonymizes data (anonymization processing).

[0056] The data processing device 200 can be realized by an information processing device such as a computer. That is, the data processing device 200 has an arithmetic unit such as a CPU and a storage device such as a memory or a disk. The data processing device 200 realizes each of the above components by, for example, having the arithmetic unit execute a program stored in the storage device. This also applies to other embodiments described later. The functions of each component will be described later.

[0057] 7 is a diagram showing the configuration of a data receiving device 300 according to the first embodiment. The data receiving device 300 has, as its components, a verification hash value calculation unit 310 and a verification unit 320. The verification hash value calculation unit 310 functions as a verification hash value calculation means. The verification unit 320 functions as a verification means (signature verification means).

[0058] The data receiving device 300 acquires (receives) a data set in which some data has been processed and a digital signature from the data processing device 200. Then, the data receiving device 300 verifies the signature for the data set in which some data has been processed. Note that the data receiving device 300 can also function as a signature verification device (verification device) that verifies the signature.

[0059] The data receiving device 300 can be realized by an information processing device such as a computer. In other words, the data receiving device 300 has an arithmetic unit such as a CPU and a storage device such as a memory or a disk. The data receiving device 300 realizes each of the above components by, for example, having the arithmetic unit execute a program stored in the storage device. This also applies to other embodiments described later. The functions of each component will be described later.

[0060] 8 is a flowchart showing an information processing method executed by the information processing system 10 according to the first embodiment. The information processing method executed by the information processing system 10 can also be realized as a digital signature method (signature method or electronic signature method), a data processing system, or a signature verification method (verification method).

[0061] The information processing system 10 performs a data providing process (step S100). Specifically, the data providing device 100 of the information processing system 10 provides a data set consisting of a plurality of data relating to at least one attribute. At this time, the data providing device 100 performs a signature generation process on the provided data (data set) as described above. The process of S100 will be described in detail later.

[0062] The information processing system 10 performs data processing (step S200). Specifically, the data processing device 200 of the information processing system 10 acquires information including a data set and a digital signature from the data providing device 100. Then, the data processing device 200 processes at least a portion of the data of the data set. Details of the processing of S200 will be described later.

[0063] The information processing system 10 performs a data receiving process (step S300). Specifically, the data receiving device 300 of the information processing system 10 acquires a data set in which some data has been processed and a digital signature from the data processing device 200. Then, the data receiving device 300 verifies the signature (verification process) for the data set in which some data has been processed. Details of the process of S300 will be described later.

[0064] Fig. 9 is a flowchart showing the data providing process (S100) executed by the data providing device 100 according to the first embodiment. The flowchart in Fig. 9 shows a data providing method, but it can also be said to show a digital signature method (signature method or electronic signature method).

[0065] The data providing device 100 sets processing rules (step S102). Specifically, the processing rule setting unit 110 sets processing rules for each of the attributes of multiple data constituting the data set (original data). The processing rule setting unit 110 may set processing rules in response to an operation by a user (data provider). That is, the processing rule setting unit 110 may set processing rules arbitrarily determined by the user. In the data processing process (S200), processing performed in accordance with the processing rules can be said to be legitimate processing (anonymization). On the other hand, processing performed without following the processing rules can be said to be illegitimate processing.

[0066] Here, the processing rule may specify whether or not each attribute is to be processed (anonymized). For example, the processing rule may specify that the attribute "address" is to be processed, and that the attributes "name" and "age" are not to be processed. Note that in the data processing process (S200), it is not necessary to process the attribute values ​​of all data of the attributes that are to be processed.

[0067] The processing rules may also include a hierarchical structure having hierarchies corresponding to states including attribute values ​​before and after processing, which are set for each attribute to be processed. This hierarchical structure is, for example, the generalized hierarchical tree described above, but is not limited to this. Note that the "state including attribute values ​​after processing" includes a state in which data (attribute values) have been deleted by the "delete" process. When the processing rules include a hierarchical structure, if the processing in the data processing process (S200) conforms to the hierarchical structure, it can be said that the processing (anonymization) is legitimate.

[0068] The data providing device 100 sets a random number (step S104). Specifically, the random number setting unit 120 sets a predetermined random number for a state corresponding to a plurality of attribute values ​​that the processing target data can take regarding the attribute that is the target of processing in the processing rule. For example, if the attribute "address" is the target of processing, the random number setting unit 120 sets random numbers for the attribute value "Tokyo", the attribute value "Kanagawa", the attribute value "Osaka", etc. This random number is used in calculating a signature hash value, which will be described later, and in calculating a processed hash value in the data processing device 200. On the other hand, this random number is not used in calculating a verification hash value in the data receiving device 300, which will be described later. In other words, this random number is not transmitted to the data receiving device 300.

[0069] The data providing device 100 calculates a signature hash value (step S110). Specifically, the signature hash value calculation unit 130 calculates a signature hash value corresponding to each of the multiple data in the data set. Here, the signature hash value corresponds to each of the multiple data in the data set and is a hash value used to generate a digital signature. This will be described in more detail later.

[0070] More specifically, the signature hash value calculation unit 130 calculates a first hash value for the data to be processed using the data to be processed and a random number set for an attribute value corresponding to the data to be processed. The signature hash value calculation unit 130 also calculates an intermediate hash value for the data sequence combining the data to be processed and the first hash value. The signature hash value calculation unit 130 then uses the intermediate hash value to calculate a signature hash value corresponding to the data to be processed.

[0071] The first hash value is a hash value that corresponds to the attribute value of the data to be processed (i.e., the data before processing) among the data in the dataset. This will be described in detail later. The intermediate hash value is a hash value that is used until the signature hash value is calculated. In other words, the intermediate hash value is a hash value that corresponds to a state (attribute value) that the data to be processed can take through processing. The first hash value corresponds to the intermediate hash value that corresponds to the data to be processed. This will be described in detail later. In this embodiment, a hash chain is formed from the first hash value to the signature hash value. The first hash value of the hash chain corresponds to the first hash value, and the last hash value of the hash chain corresponds to the signature hash value. Hash values ​​other than the last hash value (signature hash value) correspond to intermediate hash values. In other words, in the hash chain, intermediate hash values ​​may exist between the first hash value and the signature hash value (last hash value).

[0072] Here, if the processing rule includes a hierarchical structure, the signature hash value calculation unit 130 may calculate, for a data string combining the processing target data and the first hash value, an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute values ​​of the processing target data. Therefore, each intermediate hash value may have a state including some corresponding attribute value after processing. Note that a hash chain can be constructed by repeating this process.

[0073] Furthermore, the signature hash value calculation unit 130 may calculate, for each data item, a hash value calculated for a corresponding attribute value for an attribute not to be processed, as a signature hash value corresponding to that data. The signature hash value calculation unit 130 may also calculate a leading hash value for a data string obtained using the processing target data, a random number set for the processing target data and the attribute value corresponding to the processing target data, and an index identifying the processing target data. This will be described in detail later. Here, the index identifying the processing target data may be, for example, the index of the record described above. In other words, this index may be the row number of a data set in a table format. This allows different leading hash values ​​to be calculated for multiple processing target data items with the same attribute values.

[0074] The data providing device 100 generates a signature (step S122). Specifically, the signature generation unit 140 generates a digital signature using a signature hash value corresponding to each of the multiple data. For example, the signature generation unit 140 may calculate a hash value for a data string that combines the signature hash values ​​of the corresponding data for each record, and generate a digital signature using the obtained hash value and a private key. This will be described in more detail later.

[0075] The data providing device 100 transmits the information (step S124). Specifically, the transmitting unit 150 transmits the data set, the digital signature, and the random number to the data processing device 200. This will be described in detail later. Note that the data providing device 100 may temporarily store the information to be transmitted before transmitting the information to the data processing device 200.

[0076] 10 is a flowchart showing the data processing (S200) executed by the data processing device 200 according to the first embodiment. The data processing device 200 performs the processing (step S202). Specifically, the processing unit 210 performs processing (anonymization) on the processing target data corresponding to the attributes of the processing target. The processing unit 210 may perform processing in response to an operation by a user (data processor). In other words, the user (data processor) may arbitrarily decide what type of processing to perform on each piece of processing target data.

[0077] The data processing device 200 calculates a post-processing hash value (step S210). Specifically, the post-processing hash value calculation unit 220 calculates a post-processing hash value corresponding to the processing target data. Here, the post-processing hash value is an intermediate hash value corresponding to each piece of processing target data (attribute value). The post-processing hash value is provided to the data receiving device 300 in pairs with the processing target data. The post-processing hash value may correspond to the processed processing target data (attribute value after processing) and the unprocessed processing target data (attribute value of the original data). In other words, if the processing target data has been processed, the post-processing hash value may correspond to the processed processing target data (attribute value after processing). Furthermore, if the processing target data has not been processed, the post-processing hash value may correspond to the unprocessed processing target data (attribute value of the original data). The post-processing hash value may be used to generate a verification hash value in the data receiving device 300, as will be described later.

[0078] Here, for the processed processing target data, the post-processing hash value calculation unit 220 calculates a first hash value for a data string obtained using the processing target data before processing and a random number set for the attribute value corresponding to the processing target data before processing. The post-processing hash value calculation unit 220 also calculates an intermediate hash value for a data string combining the processing target data before processing and the first hash value. The post-processing hash value calculation unit 220 then uses the intermediate hash value to calculate a post-processing hash value corresponding to the processing target data after processing. Details will be described later.

[0079] As described above, the processing rule may include a hierarchical structure. In this case, the post-processing hash value calculation unit 220 may calculate an intermediate hash value corresponding to the state of an upper hierarchical structure of the attribute values ​​of the processing target data before processing, for a data string that combines the processing target data before processing and the first hash value. This will be described in detail later.

[0080] Furthermore, the processed hash value calculation unit 220 may calculate a processed hash value for an attribute value that was not processed among the attributes that were subject to processing in the processing rule as follows. That is, the processed hash value calculation unit 220 may calculate, as the processed hash value, a first hash value calculated for a data string obtained using the attribute value and a random number set for the attribute value. This will be described in detail later. In this way, it is possible to calculate a verification hash value for an attribute value that was not processed among the attributes that were subject to processing in the processing rule, without providing a random number to the data receiving device 300.

[0081] Furthermore, the post-processing hash value calculation unit 220 may calculate a leading hash value for a data string obtained using the target data, a random number set for the attribute value corresponding to the target data, and an index for identifying the target data. This will be described in detail later. Here, the index for identifying the target data may be, for example, the index of the record described above. In other words, this index may be a row number of a data set in table format. This makes it possible to calculate different leading hash values ​​for multiple target data items having the same attribute values. Furthermore, the post-processing hash value calculation unit 220 can calculate the same leading hash value as the leading hash value calculated by the data providing device 100 for each target data item in the same record.

[0082] The data processing device 200 transmits the information (step S222). Specifically, the transmitting unit 230 transmits to the data receiving device 300 a data set obtained by processing the data to be processed, a post-processing hash value corresponding to the data to be processed, and a digital signature. This will be described in detail later. Note that the data processing device 200 may temporarily store the information to be transmitted before transmitting the information to the data receiving device 300.

[0083] Fig. 11 is a flowchart showing the data receiving process (S300) executed by the data receiving device 300 according to the first embodiment. The flowchart in Fig. 11 shows a data receiving method, but it can also be said to show a signature verification method (verification method).

[0084] The data receiving device 300 calculates a verification hash value (step S310). Specifically, the verification hash value calculation unit 310 calculates the verification hash value using a data set obtained by processing the data to be processed and the processed hash value. The verification hash values ​​correspond to each piece of data to be processed and each piece of data not to be processed, and are used to calculate hash values ​​to be compared (verified) with the hash value corresponding to the digital signature from the processed data set. Details will be described later.

[0085] The data receiving device 300 performs signature verification (step S322). Specifically, the verification unit 320 verifies the verification hash value and the digital signature. For example, the verification unit 320 calculates a hash value H' for a data string obtained by combining the verification hash values ​​of the corresponding data for each record. The verification unit 320 may also verify the digital signature using the digital signature, the verification key, and the hash value H'. This makes it possible to verify the authenticity of the processed data set.

[0086] In the information processing system 10 according to the first embodiment, the data providing device 100 sets predetermined random numbers for states corresponding to multiple attribute values ​​that the processing target data can take on regarding an attribute that is the target of processing in the processing rule. The data providing device 100 also calculates a first hash value for a data string obtained using the processing target data and the random numbers set for the attribute values ​​corresponding to the processing target data. The data providing device 100 also calculates an intermediate hash value for a data string combining the processing target data and the first hash value. The data providing device 100 then uses the intermediate hash value to calculate a signature hash value corresponding to the processing target data.

[0087] Furthermore, for the processed target data, the data processing device 200 calculates a first hash value for a data string obtained using the target data before processing and a random number set for the corresponding attribute value.The data processing device 200 also calculates an intermediate hash value for a data string combining the target data before processing and the first hash value.The data processing device 200 then uses the intermediate hash value to calculate a post-processing hash value corresponding to the target data after processing.

[0088] The information processing system 10 according to the first embodiment generates a digital signature using a preset random number, thereby reducing the amount of data transmitted. Furthermore, the information processing system 10 according to the first embodiment prevents the random number from being provided to the data receiving device 300 (data recipient) by virtue of the above-described configuration. Therefore, there is no need to impose a constraint that "for a certain attribute, the same processing must be performed on the same attribute value even in different records (cells)." Therefore, in this embodiment, it is possible to reduce the amount of data transmitted without imposing restrictions on data processing.

[0089] (Embodiment 2) Next, a second embodiment will be described. For clarity of explanation, the following description and drawings have been omitted and simplified as appropriate. In addition, in each drawing, the same elements are given the same reference numerals, and repeated explanations are omitted as necessary. Note that the system configuration according to the second embodiment is substantially the same as the system configuration according to the first embodiment, and therefore explanations thereof will be omitted. In other words, the information processing system 10 according to the second embodiment has a data providing device 100, a data processing device 200, and a data receiving device 300. The second embodiment corresponds to the configuration of the first embodiment described above, applied to the case where "generalization" processing (anonymization) is performed. Note that, hereinafter, for convenience of notation, "x" will be used. y " is sometimes written as "x_y".

[0090] FIG. 12 is a diagram for explaining the flow of processing in the information processing system 10 according to the second embodiment. FIG. 12 shows an example of processing (generalizing) a dataset having columns of two attributes, namely, the attribute "name" and the attribute "address." The column of the attribute "name" is an attribute column that is not subject to processing by the data processing device 200 (data processor). On the other hand, the attribute "address" is an attribute column that is subject to processing (generalization) by the data processing device 200 (data processor). In other words, the dataset contains a mixture of columns of attributes that are subject to processing and columns of attributes that are not subject to processing.

[0091] Here, it is assumed that the generalization process is performed along the generalized hierarchical tree Tr illustrated in FIG. 1. As described above, in the generalized hierarchical tree Tr, the higher the hierarchy, the more generalized (abstract) the attribute values ​​are. Note that the generalized hierarchical tree Tr is set by the data providing device 100 (data provider). It is also assumed that each node has only one adjacent parent node. In other words, it is assumed that each node has only one hierarchy above it.

[0092] The data providing device 100 provides the data processing device 200 with a data set Da1, which is original data (plain text). In a record for the name "AA", the attribute value of the attribute "address" is "Tokyo". In a record for the name "BB", the attribute value of the attribute "address" is "Tokyo". In a record for the name "CC", the attribute value of the attribute "address" is "Kanagawa". It is assumed that in the data set Da1 of the original data, the hierarchy of the attribute value of the attribute "address" is the same for all records. In the example of FIG. 12, the hierarchy of the attribute value of the attribute "address" in the data set Da1 of the original data is the lowest hierarchy "1" (prefecture name) of the generalized hierarchical tree Tr.

[0093] The data processing device 200 generalizes (anonymizes) the attribute value "Tokyo" of the attribute "Address" in the record of the name "AA" to the attribute value "Kanto". Furthermore, the data processing device 200 leaves the attribute value "Tokyo" of the attribute "Address" in the record of the name "BB" as the attribute value "Tokyo" and does not generalize it. Furthermore, the data processing device 200 generalizes (anonymizes) the attribute value "Kanagawa" of the attribute "Address" in the record of the name "CC" to the attribute value "Japan". In this way, the data processing device 200 generates anonymized data Da2 and transmits it to the data receiving device 300 (data recipient).

[0094] In this embodiment, the attribute columns to be generalized may be at different levels after generalization. In the example of Fig. 12, the attribute value "Tokyo" of the attribute "Address" in the record of the name "AA" is generalized to the level one level higher. Also, the attribute value "Tokyo" of the attribute "Address" in the record of the name "BB" is not generalized. The attribute value "Kanagawa" of the attribute "Address" in the record of the name "CC" is generalized to the level two levels higher.

[0095] Furthermore, in this embodiment, unlike the comparative example, the same attribute value may be generalized to a different hierarchical level depending on the record. In the example of Fig. 12, the attribute value "Tokyo" is generalized to the attribute value "Kanto" at the next higher hierarchical level in the record of the name "AA", but remains as "Tokyo" in the record of the name "BB", and is not generalized.

[0096] As in the case of the first embodiment, the data providing device 100 according to the second embodiment performs the signature generation process (S100), the data processing device 200 performs the data processing process (S200), and the data receiving device 300 performs the verification process (S300). These processes will be explained below.

[0097] <Signature generation process> First, the signature generation process (S100) when generalization processing is performed will be described. In the data providing device 100, the processing rule setting unit 110 sets processing rules for each of the attributes of multiple data that make up a data set (original data) (S102). First, the processing rule setting unit 110 determines whether each column (each attribute) of the data set is a target for processing (generalization).

[0098] FIG. 13 is a diagram for explaining the processing of the processing rule setting unit 110 according to the second embodiment. As shown in FIG. 13, the data set, which is the original data, is configured in a table format (matrix format). Each row corresponds to a record, and each column corresponds to an attribute. Also, the row index is i, and the column index is j. Then, the attribute value in the i-th row and j-th column is a ij Let's say.

[0099] The processing rule setting unit 110 sets attributes that are not to be processed (generalized). Also, the processing rule setting unit 110 sets attributes that are to be processed (generalized). Here, a set of columns of attributes that are not to be processed is defined as C, and a set of columns of attributes that are to be processed is defined as C'. In this case, each column is defined as c j ∈C, c j’ ∈C'. In other words, the index of the column of the attribute to be processed is set to j'.

[0100] In addition, the processing rule setting unit 110 sets a column c of attributes to be processed. j’ With respect to the generalized hierarchical tree T j’ That is, the processing rule setting unit 110 sets a generalized hierarchical tree having a hierarchical structure in which a rule for generalizing the attribute value before processing is set for each attribute to be processed, and the higher the level, the more generalized the attribute value. Note that the generalized hierarchical tree T j’ can be set for each column of the attribute to be processed. Here, the generalized hierarchical tree T j’ The height of l j’ Let's say.

[0101] FIG. 14 shows a generalized hierarchical tree T j’ FIG. 14 is a diagram illustrating the j’ is a sequence of the attribute "address", j’ In this example, the generalized hierarchical tree T j’ The height of j’ = 3. Furthermore, layer "1" (leaf node) corresponds to "prefecture names" such as "Tokyo," "Kanagawa," and "Osaka." Furthermore, layer "2" (intermediate node) corresponds to "region names" such as "Kanto" and "Kinki (region)," which have a higher level of abstraction. Furthermore, layer "3" (root node) corresponds to the "country name" of "Japan," which has the highest level of abstraction.

[0102] The random number setting unit 120 sets predetermined random numbers for states corresponding to multiple attribute values ​​that the processing target data can take on regarding the attribute that is the target of processing (generalization) in the processing rule (S104). That is, the random number setting unit 120 sets predetermined random numbers for states corresponding to multiple attribute values ​​that the processing target data can take on in the original data. Then, the random number setting unit 120 generates a random number table showing the random numbers set for each attribute value. That is, the random number setting unit 120 sets predetermined random numbers for states corresponding to multiple attribute values ​​that the processing target data can take on in the original data. j’ For the random number table R j’ Generate a random number table R j’ can be generated for each column of the attribute to be processed.

[0103] FIG. 15 is a diagram illustrating a random number table according to the second embodiment. In the example of FIG. j’ For the attribute value v of the layer "1" that can be taken by v is set. In this way, the random number table R j’ In each column, a random number is set for each attribute value.

[0104] The signature hash value calculation unit 130 calculates a signature hash value corresponding to each of the plurality of data in the data set (S110). j attribute value a ij For each row i (record), a hash function H is used to generate a hash value h using the following formula (1). ij The calculated hash value corresponds to the signature hash value for the attribute that is not to be processed.

number

[0105] The signature hash value calculation unit 130 also calculates the sequence c of the attribute to be processed. j’ For each row i (record), the random number table R j’ Using the following equations (2) to (3), row i, column c j’ The signature hash value h corresponding to the data to be processed ij’Here, the attribute value a ij’ is a generalized hierarchical tree T j’ The attribute value a is the attribute value of the layer "1" in ij’ The attribute value of the parent node in the hierarchy k of ij’ ) where p_(1,a ij’ )=a ij’ is.

[0106] Generalized hierarchical tree T in Fig. 14 j’ In the example, p_(1,a ij’ )=a ij’ = "Tokyo", p_(2,a ij’ ) = "Kanto", p_(3,a ij’ ) = "Japan". Therefore, p_(k,a ij’ ) is the attribute value a ij’ The attribute value of the kth hierarchical level is the attribute value of the kth hierarchical level or higher. ij’,k Let's say.

[0107] The signature hash value calculation unit 130 calculates the attribute value a using the following formula (2): ij’ The initial hash value h corresponding to ij’,1 Calculate.

number

[0108] As shown in equation (2), the initial hash value h ij’,1 is the attribute value a ij’ and the corresponding random number r_a ij’ The hash value obtained for the data string combined with the value obtained by adding row number i to the first hash value h ij’,1 is the attribute value a ij’ and attribute value a ij’ The random number set for attribute value a ij’ The hash value calculated for the data string obtained using the index i of the generalized hierarchical tree T j’ In the example, the attribute value a ij’The hash value obtained for the data string combining "Tokyo" and the value obtained by adding i to the random number corresponding to the attribute value "Tokyo" is the first hash value h ij’,1 Let's say.

[0109] By adding i to the random number, it is possible to make the calculated first hash value different for each record, even if the records have the same attribute value. ij’ and the random number r_a ij’ The hash value of the data string is calculated by combining the value obtained by adding the row number i to the attribute value a. However, this is not limited to this. ij’ and the random number r_a ij’ It may be a hash value of a data string combining the attribute value a and the value obtained by adding (i-1) to the attribute value a. ij’ and the random number r_a ij’ The hash value of the data string obtained by combining the value obtained by adding (2×i) to ...

[0110] Here, the attribute value a ij’ and the corresponding random number r_a ij’ The random number r_a is calculated by calculating a hash value using the data sequence obtained using ij’ Therefore, the initial hash value h ij’,1 is the random number r_a ij’ In other words, in this embodiment, the first hash value h ij’,1 By calculating the random number, it is possible to use a predetermined random number while keeping the random number secret from the data recipient. This also applies to the other embodiments.

[0111] Next, the signature hash value calculation unit 130 calculates the generalized hierarchical tree T j’ Calculate intermediate hash values ​​corresponding to the attribute values ​​of each layer.

number

[0112] Equation (3) is the attribute value p_(k,a ij’ ) and the corresponding intermediate hash value h ij’,k The hash value of the combined data is the attribute value p_((k+1),a ij’ ) corresponding intermediate hash value h ij’,k+1 In other words, for a data string that combines an intermediate hash value and an attribute value of a layer corresponding to the intermediate hash value, the signature hash value calculation unit 130 calculates an intermediate hash value that corresponds to the state of the upper layer in the layer structure of the attribute value.

[0113] In addition, in the case of k=1 in equation (3), it becomes as shown in the following equation (4). Here, as mentioned above, p_(1,a ij’ )=a ij’ Therefore, in this embodiment, unlike the comparative example, the attribute value a of the data set (original data) ij’ is used twice: once as equation (2) to calculate the initial hash value, and once as equation (3) (equation (4)) to calculate the intermediate hash value corresponding to the attribute value of the next higher layer.

number

[0114] Generalized hierarchical tree T in Fig. 14 j’ In this example, the signature hash value calculation unit 130 calculates the attribute value “Tokyo” and the corresponding initial hash value (intermediate hash value) h ij’,1 The hash value of the combined data is the intermediate hash value h ij’,2 The signature hash value calculation unit 130 calculates the attribute value "Kanto" and the corresponding intermediate hash value h ij’,2 The hash value of the combined data is calculated as the intermediate hash value h ij’,3 It is calculated as follows.

[0115] Then, the signature hash value calculation unit 130 calculates the top layer l j’ The attribute value p_(l j’ ,a ij’) and the corresponding intermediate hash value h_(i,j',l j’ ) and the hash value h_(i,j',l j’ +1) is calculated. j’ +1) in row i, column c j’ The signature hash value h corresponding to the data to be processed ij’ That is, the following equation (5) holds true.

number

[0116] That is, the signature hash value calculation unit 130 calculates a hash value for a data string that combines an attribute value at the highest level in the hierarchical structure with an intermediate hash value corresponding to that attribute value, as the signature hash value. j’ In this example, the signature hash value calculation unit 130 calculates the attribute value “Japan” and the corresponding intermediate hash value h ij’,3 The hash value h of the combined data ij’,4 row i, column c j’ The signature hash value h corresponding to ij’ It is calculated as follows.

[0117] In addition, from the hierarchy k=1 to the top hierarchy k=l j’ By repeating the calculation of equation (3) until the generalized hierarchical tree T j’ A hash chain is constructed along the

number

[0118] The hash chain shown in Equation (6) is composed of the intermediate hash value (first hash value) corresponding to the attribute value at layer k=1, the intermediate hash value corresponding to the attribute value at layer k=2, ..., the intermediate hash value corresponding to the attribute value at layer k=1. j’ The generalized hierarchical tree T in Figure 14 is composed of intermediate hash values ​​corresponding to the attribute values ​​of j’In this example, it is composed of an intermediate hash value (first hash value) corresponding to the attribute value "Tokyo", an intermediate hash value corresponding to the attribute value "Kanto", an intermediate hash value corresponding to the attribute value "Japan", and a final hash value. The final hash value corresponds to the signature hash value. In other words, the formulas (2) and (3) are the generalized hierarchical tree T j’ This indicates that intermediate hash values ​​are calculated from the first hash value to the last hash value along the line.

[0119] The signature generation unit 140 generates a digital signature using a signature hash value corresponding to each of the plurality of data (S122). Specifically, the signature generation unit 140 generates a hash value h for each row i as follows: i That is, the signature generating unit 140 calculates, for each row i, each column j (column c j’ ) data, concatenate all the hash values ​​for signature corresponding to the data, and obtain the hash value h i Calculate.

number

[0120] The signature generation unit 140 also generates the calculated hash value h i The digital signature algorithm generates a digital signature σ using the data provider's private key. i For example, the signature generation unit 140 generates a hash value h by using the RSA signature method or the DSA (Digital Signature Algorithm) signature method. i and the private key to generate a signature σ i In this example, a signature is generated for each row (each record), but a signature may be generated for the entire data. In this case, the signature generation unit 140 generates h for all i. i A set of {h i}, and generate a signature σ for h. i} indicates a set of x for i. These are similar to other embodiments.

[0121] The sending unit 150 sends at least the data set, the digital signature, and the random number to the data processing device 200. Specifically, the sending unit 150 sends the original data (data set) including information on C and C′, and the signature {σ i} and the generalized hierarchical tree {T j’} and the random number table {R j’} is transmitted to the data processing device 200.

[0122] <Data processing> Next, the data processing process (S200) when generalization processing is performed will be described. In the data processing device 200, the processing unit 210 performs processing for generalization processing (anonymization) on the processing target data corresponding to the attribute of the processing target (S202). The data processor performs generalization processing (anonymization) on the generalized hierarchical tree T transmitted from the data providing device 100. j’ In accordance with the above, generalization processing is performed on each attribute value in the attribute column that is the target of generalization processing. In the example of Fig. 14, for example, a cell with the attribute value "Tokyo" is generalized to the attribute value "Kanto" or the attribute value "Japan", or the attribute value is left as "Tokyo" without generalization. Also, for example, a cell with the attribute value "Osaka" is generalized to the attribute value "Kinki" or the attribute value "Japan", or the attribute value is left as "Osaka" without generalization.

[0123] The processing unit 210 processes the attribute column c j’ For attribute value a ij’ attribute value p_(k ij’ ,a ij’ ) in row i and column c. j’ In the cell, the attribute value p_(k ij’ ,a ij’ ) where the attribute value p_(k ij’ ,a ij’ ) is the attribute value a ij’ is generalized to create a generalized hierarchical tree T j’ Hierarchy k of ij’ For example, a ij’= If "Tokyo" is generalized to the attribute value "Kanto", then k ij’ = 2, and p_(2,a ij’ ) = "Kanto". Note that the attribute value a ij’ If we do not generalize k ij’ =1, and p_(1,a ij’ )=a ij’ is.

[0124] The processed hash value calculation unit 220 calculates a processed hash value for the attribute string to be processed (S210). Specifically, the processed hash value calculation unit 220 calculates the attribute value a ij’ The processed attribute value p_(k ij’ ,a ij’ ) corresponding intermediate hash value h_(i,j',k ij’ ) is calculated. Equation (8) is the generalized calculation of equation (3) for the hierarchy k ij’ This corresponds to the intermediate hash value h_(i,j',k ij’ ) corresponds to the processed hash value.

number

[0125] Therefore, for a data string combining an intermediate hash value and an attribute value of a hierarchical level corresponding to the intermediate hash value, the processed hash value calculation unit 220 calculates an intermediate hash value corresponding to an attribute value of a higher hierarchical level in the hierarchical structure than the attribute value of the intermediate hash value.The processed hash value calculation unit 220 then calculates the intermediate hash value corresponding to the attribute value of the processed target data as the processed hash value corresponding to the processed target data.

[0126] However, formula (8) is used when the attribute value is generalized, and is not used when the attribute value is not generalized. ij’ If p_(1,a ij’ )=a ij’ The initial hash value corresponding to the intermediate hash value hi,j’,1 This intermediate hash value h i,j’,1 corresponds to the processed hash value. In other words, for an attribute value that was not processed among the attributes that were subject to processing, the processed hash value calculation unit 220 calculates, as the processed hash value, the first hash value calculated for a data string obtained using the attribute value and a random number set for the attribute value.

[0127] Generalized hierarchical tree T in Fig. 14 j’ In the example, the attribute value "Tokyo" is k ij’ When generalizing to the attribute value “Kanto” corresponding to p_(1,a)=2, the processed hash value calculation unit 220 calculates p_(1,a)=2 using the formula (2). ij’ )=a ij’ = First hash value h corresponding to "Tokyo" i,j’,1 Then, the processed hash value calculation unit 220 calculates p_(2,a ij’ ) = processed hash value (intermediate hash value) corresponding to "Kanto" i,j’,2 On the other hand, if the attribute value “Tokyo” is not generalized, the processed hash value calculation unit 220 calculates p_(1,a ij’ )=a ij’ = Processed hash value (first hash value) corresponding to "Tokyo" i,j’,1 Calculate.

[0128] The processed hash value calculation unit 220 calculates the hash value of row i, column c j’ In the cell, the attribute value p_(k ij’ ,a ij’ ) corresponding intermediate hash value h_(i,j',k ij’ ) is set to the intermediate hash value h_(i,j',k ij’ ) corresponds to the processed hash value. The processed hash values ​​form a hash chain from the initial hash value to the hash value corresponding to the processed attribute value.

[0129] 16 is a diagram for explaining the processing of the data processing device 200 according to the second embodiment. For example, j’ For row i=1, the attribute value a 1j’In the cell, the processed (or unprocessed) attribute value p_(k 1j’ ,a 1j’ ) and the corresponding processed hash value h_(1,j',k 1j’ ) is set.

number

[0130] Similarly, the column c to be processed j’ For row i, attribute value a ij’ In the cell, the processed (or unprocessed) attribute value p_(k ij’ ,a ij’ ) and the corresponding processed hash value h_(i,j',k ij’ ) is set.

number

[0131] In addition, the data processor will j’ For the attribute values ​​of, the generalized hierarchical tree T j’ If fraudulent processing that does not comply with the above formula (6) is performed, the hash chain described above will be broken. In other words, a proper hash chain such as that shown in formula (6) above will not be constructed in the data processing device 200. Therefore, fraud will be detected in the subsequent signature verification.

[0132] The sending unit 230 sends a data set (anonymized data) obtained by processing the data to be processed, a processed hash value corresponding to the data to be processed, and a digital signature to the data receiving device 300 (S222). Specifically, the sending unit 230 sends a data set (anonymized data) obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and a digital signature to the data receiving device 300 (S222). j’ Cell (i,c j’ )(row i, column c j’ The data set in which the attribute value and the processed hash value as shown in formula (10) are set for the cells of the column c to be processed is transmitted to the data receiving device 300.j’ Cell (i,c j’ ), a set of the processed (or unprocessed) attribute value and the processed hash value as shown in formula (10) is transmitted to the data receiving device 300.

[0133] The sending unit 230 also calculates the signature {σ i} and the generalized hierarchical tree {T j’} to the data receiving device 300. The transmitting unit 230 transmits the random number table {R j’} to the data receiving device 300. That is, for attribute values ​​that have not been processed among the attributes that have been subject to processing, the first hash value is transmitted to the data receiving device 300 as the processed hash value. This allows signature verification in the data receiving device 300 without transmitting a random number to the data receiving device 300. Therefore, unlike the comparative example, the data processing device 200 does not transmit a random number to the data receiving device 300.

[0134] <Verification process> Next, the verification process (S300) when generalization processing is performed will be described. In the data receiving device 300, the verification hash value calculation unit 310 calculates a verification hash value (S310). Specifically, the verification hash value calculation unit 310 calculates a verification hash value for a column c of attributes that are not to be processed. j attribute value a ij For each row i (record), the hash value h is calculated using the above formula (1). ij The calculated hash value corresponds to the verification hash value for the attribute that is not to be processed.

[0135] In addition, the verification hash value calculation unit 310 calculates the attribute sequence c j’ For each row i (record), a generalized hierarchical tree T j’ Using this, the verification hash value h ij’ The verification hash value calculation unit 310 calculates the cell (i, c j’ ) is set to the processed (or unprocessed) attribute value p_(k ij’ ,a ij’) and the corresponding processed hash value h_(i,j',k ij’ ) (shown in the above formula (10)).

[0136] Next, the verification hash value calculation unit 310 calculates the generalized hierarchical tree T j’ Calculate the intermediate hash value corresponding to the attribute value of each layer. ij’ ,a ij’ )) is a generalized hierarchical tree T j’ In this case, the attribute value p_(k ij’ ,a ij’ ) is the attribute value of the parent node at hierarchy k. Note that k=k ij’ When p_(k ij’ ,p_(k ij’ ,a ij’ ))=p_(k ij’ ,a ij’ )

number

[0137] Equation (11) is the initial value k = k ij’ Then, the extracted attribute value p_(k ij’ ,a ij’ ) and the processed hash value h_(i,j',k ij’ ) and the hash value of the combined data is ij’ This indicates that the verification hash value calculation unit 310 calculates an intermediate hash value corresponding to an attribute value in the next higher layer in the hierarchical structure of the attribute value for a data string that combines a processed hash value and an attribute value of the processed data to be processed that corresponds to the processed hash value. Note that the initial value of equation (11) is different from that of equation (3).

[0138] Furthermore, equation (11) is the attribute value p_(k,p_(k ij’ ,a ij’ )) and its corresponding intermediate hash value h ij’,kThe hash value of the combined data is used to calculate the attribute value p_((k+1),p_(k ij’ ,a ij’ )) corresponding intermediate hash value h ij’,k+1 In other words, for a data string that combines an intermediate hash value and an attribute value of a hierarchical level corresponding to the intermediate hash value, the verification hash value calculation unit 310 calculates an intermediate hash value that corresponds to the state of the higher hierarchical level in the hierarchical structure of the attribute value.

[0139] Generalized hierarchical tree T in Fig. 14 j’ In the example, a ij’ = "Tokyo" is generalized to the attribute value "Kanto", in equation (11), the initial value k = k ij’ = 2. Therefore, p_(k ij’ ,a ij’ )=p_(2,a ij’ )="Kanto". Therefore, the verification hash value calculation unit 310 calculates the attribute value "Kanto" and the corresponding processed hash value h i,j’,2 The hash value of the combined data is calculated as the intermediate hash value h i,j’,3 It is calculated as follows.

[0140] Then, the verification hash value calculation unit 310 calculates the top layer l j’ The attribute value p_(l j’ ,p_(k ij’ ,a ij’ )) and the corresponding intermediate hash value h_(i,j',l j’ ) and the hash value h_(i,j',l j’ +1) is calculated. j’ +1) in row i, column c j’ The verification hash value h corresponding to the data to be processed ij’ In other words, the following equation (12) holds true.

number

[0141] That is, the verification hash value calculation unit 310 calculates a hash value for a data string that combines an attribute value at the highest level in the hierarchical structure with an intermediate hash value corresponding to that attribute value, as the verification hash value. j’ In this example, the verification hash value calculation unit 310 calculates the attribute value “Japan” and the corresponding intermediate hash value h ij’,3 The hash value h of the combined data ij’,4 row i, column c j’ The verification hash value h corresponding to ij’ It is calculated as follows.

[0142] The verification unit 320 performs signature verification (S322). That is, the verification unit 320 verifies the verification hash value and the digital signature. Specifically, for each row i (record), the verification unit 320 verifies each column j (column c j’ ) data, all the verification hash values ​​corresponding to the data are concatenated to obtain the hash value h i ' is calculated. Then, for every row i (record), the hash value h i ' and calculate {h i '}.

number

[0143] Then, the verification unit 320 checks the obtained {h i '} and the signature {σ i}, the verification unit 320 verifies the signature {σ i} and {h i '} and the verification key to verify the signature. In this way, the verification unit 320 verifies the validity of the processed data set provided by the data processing device 200. These are similar to the other embodiments.

[0144] If the verification is successful, it is determined that no fraudulent processing by the data processor has occurred, and that the data passed from the data processor is based on the data of the data provider. On the other hand, if the verification is unsuccessful, it is determined that there has been fraudulent processing by the data processor, or that the data may contain false data other than that based on the data of the data provider. This is also true for other embodiments.

[0145] (Embodiment 3) Next, a third embodiment will be described. For clarity of explanation, the following description and drawings have been omitted and simplified as appropriate. Furthermore, in each drawing, the same elements are given the same reference numerals, and repeated explanations are omitted as necessary. Note that the system configuration according to the third embodiment is substantially the same as the system configuration according to the first embodiment, and therefore explanations thereof will be omitted. That is, the information processing system 10 according to the third embodiment has a data providing device 100, a data processing device 200, and a data receiving device 300. The third embodiment corresponds to the configuration of the first embodiment described above applied to the case of performing "deletion" processing (anonymization).

[0146] FIG. 17 is a diagram for explaining the flow of processing in the information processing system 10 according to the third embodiment. FIG. 17 shows an example of processing (deleting) a data set having columns of two attributes, the attribute "name" and the attribute "address." As in the case of FIG. 12, the column of the attribute "name" is an attribute column that is not subject to processing by the data processing device 200 (data processor). On the other hand, the attribute "address" is an attribute column that is subject to processing (deletion) by the data processing device 200 (data processor). In the third embodiment, generalization is not performed, so a generalized hierarchical tree is not required.

[0147] The data providing device 100 provides the data processing device 200 with a dataset Db1, which is original data (plain text). The dataset Db1 is substantially the same as the dataset Da1 illustrated in FIG. 12. The data processing device 200 deletes (anonymizes) the attribute value "Tokyo" of the attribute "Address" in the record of the name "BB". The data processing device 200 also leaves the attribute value "Tokyo" of the attribute "Address" in the record of the name "AA" as the attribute value "Tokyo" and does not delete it. The data processing device 200 also leaves the attribute value "Kanagawa" of the attribute "Address" in the record of the name "CC" as the attribute value "Kanagawa" and does not delete it. In this way, the data processing device 200 generates anonymized data Db2 and transmits it to the data receiving device 300 (data recipient).

[0148] In this embodiment, the state of the attribute column to be deleted may differ after deletion. In the example of Fig. 17, the attribute value "Tokyo" of the attribute "Address" of the record of the name "AA" has not been deleted. Also, the attribute value "Tokyo" of the attribute "Address" of the record of the name "BB" has been deleted. The attribute value "Kanagawa" of the attribute "Address" of the record of the name "CC" has not been deleted.

[0149] Furthermore, in this embodiment, unlike the comparative example, even for the same attribute value, the state after deletion may differ depending on the record. In the example of Fig. 17, the attribute value "Tokyo" is not deleted in the record for the name "AA", but the attribute value "Tokyo" is deleted in the record for the name "BB".

[0150] As in the case of the first embodiment, the data providing device 100 according to the third embodiment performs the signature generation process (S100), the data processing device 200 performs the data processing process (S200), and the data receiving device 300 performs the verification process (S300). These processes will be described below.

[0151] <Signature generation process> First, the signature generation process (S100) when performing deletion processing will be described. In the data providing device 100, the processing rule setting unit 110 sets processing rules for each of the attributes of multiple data that make up the data set (original data) in the same way as in the case of generalization (S102). First, as in the case of generalization, the processing rule setting unit 110 determines whether each column (each attribute) of the data set is to be processed (deleted) or not, as exemplified in FIG. 13. In other words, the processing rule setting unit 110 sets a rule for deleting the attribute value before processing for each attribute that is to be processed.

[0152] Then, the processing rule setting unit 110 sets attributes that are not to be processed (targets for deletion). Also, the processing rule setting unit 110 sets attributes that are to be processed (targets for deletion). Here, a set of columns of attributes that are not to be processed is set as C, and a set of columns of attributes that are to be processed is set as C'. In this case, each column is set as c j ∈C, c j’ ∈C'. That is, the index of the column of the attribute to be processed is set to j'. In the case of a deletion process, the process rule setting unit 110 does not need to set a generalized hierarchical tree.

[0153] The random number setting unit 120 sets predetermined random numbers for states corresponding to multiple attribute values ​​that the processing target data regarding the attribute that is the target of processing (deletion) in the processing rule can take (S104). That is, the random number setting unit 120 sets predetermined random numbers for states corresponding to multiple attribute values ​​that the processing target data can take in the original data. Then, the random number setting unit 120 generates a random number table showing the random numbers set for each attribute value, as exemplified in FIG. 15. That is, the random number setting unit 120 sets predetermined random numbers for states corresponding to multiple attribute values ​​that the processing target data can take in the original data. j’ For the random number table R j’ Generate a random number table R j’ can be generated for each column of the attribute to be processed.

[0154] The signature hash value calculation unit 130 calculates a signature hash value corresponding to each of the plurality of data in the data set (S110).j attribute value a ij For each row i (record), a hash value h is calculated using the hash function H and the above formula (1). ij The calculated hash value corresponds to the signature hash value for the attribute that is not to be processed.

[0155] The signature hash value calculation unit 130 also calculates the sequence c of the attribute to be processed. j’ For each row i (record), the random number table R j’ Using the following equations (14) to (15), row i, column c j’ The signature hash value h corresponding to the data to be processed ij’ Calculate.

[0156] The signature hash value calculation unit 130 calculates the attribute value a using the following formula (14): ij’ The initial hash value h corresponding to ij’,1 Calculate.

number

[0157] As shown in equation (14), the initial hash value h ij’,1 is the attribute value a ij’ and the corresponding random number r_a ij’ The hash value obtained for the data string obtained by combining the value obtained by adding row number i to ...

[0158] Next, the signature hash value calculation unit 130 calculates the hash value h using the following equation (15): ij’,2 Calculate.

number

[0159] Equation (15) is the attribute value a ij’ and the corresponding initial hash value h ij’,1 The hash value h of the combined data ij’,2This shows that the hash value h ij’,2 row i, column c j’ The signature hash value h corresponding to the data to be processed ij’ In other words, the following equation (16) holds true.

number

[0160] That is, the signature hash value calculation unit 130 calculates the attribute value a ij’ and the corresponding initial hash value h ij’,1 In other words, the signature hash value calculation unit 130 calculates, as a signature hash value, a hash value calculated for a data string that combines the target data and the first hash value, for the target data.

[0161] By the calculations of equations (14) and (15), a hash chain as shown in the following equation (17) is constructed.

number

[0162] The hash chain shown in formula (17) is composed of, in order, a hash value (first hash value) corresponding to the original attribute value, and a hash value (last hash value) corresponding to the state after deletion. The last hash value corresponds to the hash value for signature. Note that a generalized hierarchical tree is not required for deletion processing, but the hash value for deletion processing can be considered as being calculated along a hierarchy of height "1".

[0163] The signature generation unit 140 generates a digital signature using a signature hash value corresponding to each of the plurality of data (S122). Specifically, the signature generation unit 140 generates a hash value h for each row i in substantially the same manner as in the second embodiment. i That is, the signature generating unit 140 calculates, for each row i, each column j (column cj’ ) data, concatenate all the hash values ​​for signature corresponding to the data, and obtain the hash value h i Furthermore, the signature generating unit 140 calculates the calculated hash value h i The digital signature algorithm generates a digital signature σ using the data provider's private key. i Generate.

[0164] The sending unit 150 sends at least the data set, the digital signature, and the random number to the data processing device 200. Specifically, the sending unit 150 sends the original data (data set) including information on C and C′, and the signature {σ i} and the random number table {R j’} is transmitted to the data processing device 200.

[0165] <Data processing> Next, the data processing process (S200) when performing deletion processing will be described. In the data processing device 200, the processing unit 210 performs processing for deletion (anonymization) on the processing target data corresponding to the attribute to be processed (S202). The data processor performs deletion processing on each attribute value in the column of the attribute to be deleted.

[0166] The processed hash value calculation unit 220 calculates a processed hash value for the attribute string to be processed (S210). Specifically, the processed hash value calculation unit 220 calculates the attribute value a ij’ An intermediate hash value corresponding to the processed state of the data is calculated. This intermediate hash value corresponds to the processed hash value.

[0167] Here, the attribute value a ij’ When deleting, the processed hash value calculation unit 220 uses the formulas (14) and (15) to calculate the attribute value a ij’ The intermediate hash value h corresponding to the state where i,j’,2 This intermediate hash value h i,j’,2corresponds to the post-processing hash value. In other words, the post-processing hash value calculation unit 220 calculates, as the post-processing hash value, a hash value calculated for a data string that combines the processing target data and the first hash value for the processing target data that has been subjected to deletion processing.

[0168] On the other hand, attribute value a ij’ If the attribute value a is not deleted, the processed hash value calculation unit 220 uses the formula (14) to calculate the attribute value a ij’ The initial hash value corresponding to the intermediate hash value h i,j’,1 This intermediate hash value h i,j’,1 corresponds to the processed hash value. In other words, for an attribute value that was not processed among the attributes that were subject to processing, the processed hash value calculation unit 220 calculates, as the processed hash value, the first hash value calculated for a data string obtained using the attribute value and a random number set for the attribute value.

[0169] 18 is a diagram for explaining the processing of the data processing device 200 according to the third embodiment. The processed hash value calculation unit 220 calculates the hash value of the data in row i and column c. j’ For cells with attribute value a ij’ When deleting, the intermediate hash value h i,j’,2 In the example of Figure 18, the attribute value a is set for the cell in row "1". 1j’ Since the hash value h is deleted, the hash value after processing corresponding to the deleted state is 1,j’,2 On the other hand, the processed hash value calculation unit 220 sets j’ For cells with attribute value a ij’ If you do not remove the attribute value a ij’ and the corresponding processed hash value (intermediate hash value), the initial hash value h i,j’,1 A pair of (a ij’ ,h i,j’,1 ) is set.

[0170] In addition, the data processor will j’If the attribute value is illegally processed in a manner that does not follow the deletion rules, the hash chain described above will be broken. In other words, a proper hash chain such as that shown in the above formula (17) will not be constructed in the data processing device 200. Therefore, the illegality will be detected in the subsequent signature verification.

[0171] The sending unit 230 sends a data set (anonymized data) obtained by processing the data to be processed, a processed hash value corresponding to the data to be processed, and a digital signature to the data receiving device 300 (S222). Specifically, the sending unit 230 sends a data set (anonymized data) obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and a digital signature to the data receiving device 300 (S222). j’ Cell (i,c j’ )(row i, column c j’ 18. In other words, the sending unit 230 sends a data set in which pairs of attribute values ​​and processed hash values ​​are set for the cells of the column c to be processed. j’ Cell (i,c j’ ), a set of the processed (or unprocessed) attribute value and the processed hash value is transmitted to the data receiving device 300.

[0172] The sending unit 230 also calculates the signature {σ i} to the data receiving device 300. The transmitting unit 230 transmits the random number table {R j’} to the data receiving device 300. That is, for attribute values ​​that were not processed among the attributes that were subject to processing, the first hash value is transmitted to the data receiving device 300 as the processed hash value. This allows signature verification to be performed in the data receiving device 300 without transmitting a random number to the data receiving device 300. Therefore, a random number is not transmitted to the data receiving device 300.

[0173] <Verification process> Next, the verification process (S300) when processing deletion will be described. In the data receiving device 300, the verification hash value calculation unit 310 calculates a verification hash value (S310). Specifically, the verification hash value calculation unit 310 calculates a verification hash value for the column c of attributes that are not to be processed.j attribute value a ij For each row i (record), the hash value h is calculated using the above formula (1). ij The calculated hash value corresponds to the verification hash value for the attribute that is not to be processed.

[0174] In addition, the verification hash value calculation unit 310 calculates the attribute sequence c j’ For each row i (record), the verification hash value h ij’ The verification hash value calculation unit 310 calculates the cell (i, c j’ ) attribute value is deleted, the processed hash value h i,j’,2 Then, the verification hash value calculation unit 310 extracts the processed hash value h i,j’,2 the verification hash value h ij’ That is, the following formula (18) holds: For the processing target data that has been subjected to deletion processing, the verification hash value calculation unit 310 calculates the post-processing hash value corresponding to the processing target data as the verification hash value.

number

[0175] On the other hand, the verification hash value calculation unit 310 calculates the cell (i, c j’ ) If the attribute value is not deleted, the attribute value a set in this cell ij’ and the corresponding processed hash value h i,j’,1 A pair of (a ij’ ,h i,j’,1 ) is extracted. The verification hash value calculation unit 310 then calculates the verification hash value h ij’ Calculate.

number

[0176] Equation (19) is the attribute value a ij’and the corresponding initial hash value h ij’,1 The hash value of the combined data is the verification hash value h ij’ The right side of equation (19) is the hash value h ij’,2 Corresponds to.

[0177] The verification unit 320 performs signature verification (S322). That is, the verification unit 320 verifies the verification hash value and the digital signature. Specifically, for each row i (record), the verification unit 320 verifies each column j (column c j’ ) data, all the verification hash values ​​corresponding to the data are concatenated to obtain the hash value h i ' is calculated. Then, for every row i (record), the hash value h i ' and calculate {h i Then, as in the second embodiment, the verification unit 320 obtains the obtained {h i '} and the signature {σ i}, the signature is verified using the verification key of the data provider and the verification algorithm in the digital signature.

[0178] (Fourth embodiment) Next, a fourth embodiment will be described. For clarity of explanation, the following description and drawings have been omitted and simplified as appropriate. Furthermore, in each drawing, the same elements are given the same reference numerals, and repeated explanations are omitted as necessary. Note that the system configuration according to the fourth embodiment is substantially the same as the system configuration according to the first embodiment, and therefore explanations thereof will be omitted. That is, the information processing system 10 according to the fourth embodiment includes a data providing device 100, a data processing device 200, and a data receiving device 300. The fourth embodiment corresponds to the configuration of the first embodiment described above, applied to the case where "generalization" and "deletion" processing (anonymization) are performed. In other words, in the fourth embodiment, the "generalization" processing is extended to "deletion" processing.

[0179] FIG. 19 is a diagram illustrating a processing flow in the information processing system 10 according to the fourth embodiment. FIG. 19 illustrates an example of processing (generalization and deletion) a dataset having columns of two attributes, namely, the attribute "name" and the attribute "address." The column of the attribute "name" is an attribute column that is not subject to processing by the data processing device 200 (data processor). On the other hand, the attribute "address" is an attribute column that is subject to processing (generalization and deletion) by the data processing device 200 (data processor). That is, the dataset contains a mixture of attribute columns that are subject to processing and attribute columns that are not subject to processing. Then, generalization and deletion processing can be performed on one attribute column that is subject to processing. That is, in the same column, records that are generalized, records that are deleted, and records that are not subjected to either processing can be mixed.

[0180] The data providing device 100 provides the data processing device 200 with a dataset Dc1, which is original data (plain text). The dataset Dc1 is substantially the same as the dataset Da1 illustrated in FIG. 12. The data processing device 200 generalizes (anonymizes) the attribute value "Tokyo" of the attribute "Address" in the record of the name "AA" to the attribute value "Kanto." The data processing device 200 also leaves the attribute value "Tokyo" of the attribute "Address" in the record of the name "BB" as the attribute value "Tokyo" and does not process it. The data processing device 200 also deletes (anonymizes) the attribute value "Kanagawa" of the attribute "Address" in the record of the name "CC." In this way, the data processing device 200 generates anonymized data Dc2 and transmits it to the data receiving device 300 (data recipient).

[0181] In this embodiment, the attribute columns to be generalized and deleted may be at different levels after generalization. In the example of Fig. 19, the attribute value "Tokyo" of the attribute "Address" in the record of the name "AA" is generalized to the next higher level. Also, the attribute value "Tokyo" of the attribute "Address" in the record of the name "BB" is not generalized. The attribute value "Kanagawa" of the attribute "Address" in the record of the name "CC" is deleted.

[0182] Furthermore, in this embodiment, unlike the comparative example, even for the same attribute value, the hierarchical level after generalization may differ depending on the record. In the example of Fig. 19, for the attribute value "Tokyo", in the record of the name "AA", it is generalized to the attribute value "Kanto" of the next higher hierarchical level, while in the record of the name "BB", it remains as the attribute value "Tokyo" and is not generalized.

[0183] As in the case of the first embodiment, the data providing device 100 according to the fourth embodiment performs the signature generation process (S100), the data processing device 200 performs the data processing process (S200), and the data receiving device 300 performs the verification process (S300). These processes will be described below.

[0184] <Signature generation process> First, the signature generation process (S100) when generalization and deletion processing is performed will be described. In the data providing device 100, the processing rule setting unit 110 sets processing rules for each of the attributes of multiple data that make up the data set (original data) as in the second embodiment (S102). First, as in the second embodiment, the processing rule setting unit 110 determines whether each column (each attribute) of the data set is to be processed (generalized and deleted) as shown in FIG. 13. That is, the processing rule setting unit 110 sets a rule for processing the attribute value before processing for each attribute that is to be processed.

[0185] Then, the processing rule setting unit 110 sets attributes that are not to be processed. Also, the processing rule setting unit 110 sets attributes that are to be processed. Here, a set of columns of attributes that are not to be processed is set as C, and a set of columns of attributes that are to be processed is set as C'. In this case, each column is set as c j ∈C, c j’ ∈C'. In other words, the index of the column of the attribute to be processed is set to j'.

[0186] The processing rule setting unit 110 sets a column c of attributes to be processed. j’ With respect to the generalized hierarchical tree T j’That is, the processing rule setting unit 110 sets a generalized hierarchical tree T j’ In the fourth embodiment, the generalized hierarchical tree T j’ has a hierarchical structure in which the higher the hierarchy, the more generalized the attribute value, and the highest hierarchy indicates a state in which the attribute value is deleted. In other words, the processing rule setting unit 110 sets a state in which the attribute value of the processing target data is deleted in a hierarchy above the second highest hierarchy, which is the most generalized hierarchy in the generalization hierarchical tree. Therefore, in the fourth embodiment, the processing of "delete" can correspond to making the most generalized attribute value into a further generalized state. Note that the generalization hierarchical tree T j’ can be set for each column of the attribute to be processed. Here, the generalized hierarchical tree T j’ The height of l j’ Let's say.

[0187] FIG. 20 shows a generalized hierarchical tree T j’ FIG. 20 is a diagram illustrating an example of j’ is a sequence of the attribute "address", j’ In this example, the generalized hierarchical tree T j’ The height of j’ = 4. Layer "1" (leaf node) corresponds to "prefecture names" such as "Tokyo," "Kanagawa," and "Osaka." Layer "2" (intermediate node) corresponds to "region names" such as "Kanto" and "Kinki (region)," which have a higher level of abstraction. Layer "3" (intermediate node) corresponds to the "country name" of "Japan," which has the highest level of abstraction. Layer "4" (root node) corresponds to a state in which an attribute value has been deleted. The state of layer "4" can also be said to be "a state generalized up to deletion."

[0188] The random number setting unit 120 sets predetermined random numbers for states corresponding to a plurality of attribute values ​​that the processing target data regarding the attribute that is the processing target in the processing rule can take (S104). That is, the random number setting unit 120 sets predetermined random numbers for states corresponding to a plurality of attribute values ​​that the processing target data can take in the original data. Then, the random number setting unit 120 generates a random number table showing the random numbers set for each attribute value, as exemplified in FIG. 15. That is, the random number setting unit 120 sets predetermined random numbers for states corresponding to a plurality of attribute values ​​that the processing target data can take in the original data. j’ For the random number table R j’ Generate a random number table R j’ can be generated for each column of the attribute to be processed.

[0189] The signature hash value calculation unit 130 calculates a signature hash value corresponding to each of the plurality of data in the data set (S110). j attribute value a ij For each row i (record), a hash value h is calculated using the hash function H and the above formula (1). ij The calculated hash value corresponds to the signature hash value for the attribute that is not to be processed.

[0190] The signature hash value calculation unit 130 also calculates the sequence c of the attribute to be processed. j’ For each row i (record), the random number table R j’ Using the following equations (20) to (22), row i, column c j’ The signature hash value h corresponding to the data to be processed ij’ Here, the attribute value a ij’ is a generalized hierarchical tree T j’ The attribute value a is the attribute value of the layer "1" in ij’ The attribute value of the parent node in the hierarchy k of ij’ ) where p_(1,a ij’ )=a ij’ The generalized hierarchical tree T in Figure 20 j’ In the example, p_(1,a ij’ )=a ij’ ="Tokyo", p_(2,aij’ ) = "Kanto", p_(3,a ij’ ) = "Japan". Also, the intermediate hash value corresponding to the state of layer k (the attribute value or the state where the attribute value is deleted) is h ij’,k Let's say.

[0191] The signature hash value calculation unit 130 calculates the attribute value a using the following formula (20): ij’ The initial hash value h corresponding to ij’,1 Calculate.

number

[0192] As shown in equation (20), the initial hash value h ij’,1 is the attribute value a ij’ and the corresponding random number r_a ij’ is the hash value obtained for the data string obtained by combining the value obtained by adding row number i to the above. Note that equation (20) is substantially the same as equation (2) above.

[0193] Next, the signature hash value calculation unit 130 calculates the generalized hierarchical tree T j’ Calculate intermediate hash values ​​corresponding to the attribute values ​​of each layer.

number

[0194] Equation (21) is the attribute value p_(k,a ij’ ) and the corresponding intermediate hash value h ij’,k The hash value of the combined data is the attribute value p_((k+1),a ij’ ) corresponding intermediate hash value h ij’,k+1 In other words, for a data string that combines an intermediate hash value and a state (attribute value) of a layer corresponding to the intermediate hash value, the signature hash value calculation unit 130 calculates an intermediate hash value that corresponds to a state (attribute value) of a layer above the state (attribute value) in the layer structure.

[0195] In addition, in the case of k=1 in equation (21), it becomes as in equation (4) above. Here, as mentioned above, p_(1,a ij’ )=a ij’ Therefore, in this embodiment, the attribute value a of the data set (original data) ij’ is used twice: once as equation (20) to calculate the initial hash value, and once as equation (21) (equation (4)) to calculate the intermediate hash value corresponding to the state (attribute value) of the next higher layer.

[0196] Also, in equation (21), k=l j’ When it is -1, the intermediate hash value h_(i,j',l) corresponding to the state corresponding to the highest layer (the state where the attribute value is deleted) is j’ ) is calculated. That is, the attribute value p_((l j’ -1),a ij’ ) (in the example in Figure 20, "Japan") and the intermediate hash value h_(i,j',l j’ -1), and the intermediate hash value h_(i,j',l j’ ) is calculated.

[0197] Furthermore, the signature hash value calculation unit 130 calculates the top layer l using the following formula (22): j’ The intermediate hash value h_(i,j',l) corresponding to the state (the state where the attribute value is deleted) j’ ) hash value h_(i,j',l j’ +1) is calculated. j’ ) does not have a corresponding attribute value (the attribute value has been deleted), so the right-hand side of equation (22) does not combine the attribute values ​​when calculating the hash value.

number

[0198] This hash value h_(i,j',l j’ +1) in row i, column c j’ The signature hash value h corresponding to the data to be processedij’ In other words, the following equation (23) holds true.

number

[0199] That is, the signature hash value calculation unit 130 calculates, as a signature hash value, a hash value calculated for an intermediate hash value corresponding to the state of the highest layer in the hierarchical structure. Also, the signature hash value calculation unit 130 calculates, as a signature hash value, a hash value calculated for an intermediate hash value calculated for a data string combining an attribute value of the second highest layer in the hierarchical structure and an intermediate hash value corresponding to that attribute value.

[0200] Generalized hierarchical tree T in Figure 20 j’ In this example, the signature hash value calculation unit 130 calculates the second highest layer (k=l) by using equation (21). j’ -1) attribute value "Japan" and the corresponding intermediate hash value h ij’,3 For the combined data, the intermediate hash value h ij’,4 Then, the signature hash value calculation unit 130 calculates the intermediate hash value h ij’,4 For hash value h ij’,5 Using equation (23), this hash value h ij’,5 is row i, column c j’ The signature hash value h corresponding to ij’ It is said that.

[0201] In addition, from the hierarchy k=1 to the top hierarchy k=l j’ By performing the calculations of the above formulas (20) to (23), the generalized hierarchical tree T j’ A hash chain is constructed along the

number

[0202] The hash chain shown in equation (24) is constructed as follows: the first hash value corresponding to the attribute value of layer k=1, the intermediate hash value corresponding to the attribute value of layer k=2, ..., layer k=1 j’ Intermediate hash value corresponding to attribute value -1, hierarchical level k=l j’ In the example of the generalized hierarchical tree in FIG. 20, the hash chain is made up of the first hash value corresponding to the attribute value "Tokyo", the intermediate hash value corresponding to the attribute value "Kanto", the intermediate hash value corresponding to the attribute value "Japan", the intermediate hash value corresponding to "Delete", and the last hash value. The last hash value corresponds to the hash value for signature. In other words, Equations (20) to (22) are the generalized hierarchical tree T j’ This indicates that intermediate hash values ​​are calculated from the first hash value to the last hash value along the line.

[0203] The signature generation unit 140 generates a digital signature using a signature hash value corresponding to each of the plurality of data (S122). Specifically, the signature generation unit 140 generates a hash value h for each row i in substantially the same manner as in the second embodiment. i That is, the signature generating unit 140 calculates, for each row i, each column j (column c j’ ) data, concatenate all the hash values ​​for signature corresponding to the data, and obtain the hash value h i Furthermore, the signature generating unit 140 calculates the calculated hash value h i The digital signature algorithm generates a digital signature σ using the data provider's private key. i Generate.

[0204] The sending unit 150 sends at least the data set, the digital signature, and the random number to the data processing device 200. Specifically, the sending unit 150 sends the original data (data set) including information on C and C′, and the signature {σ i} and the generalized hierarchical tree {T j’} and the random number table {R j’} is transmitted to the data processing device 200.

[0205] <Data processing> Next, the data processing (S200) when generalizing and deleting data will be described. In the data processing device 200, the processing unit 210 performs processing for generalizing or deleting data (anonymizing) corresponding to the attributes of the data to be processed (S202). The data processor performs the generalization hierarchical tree T j’ In accordance with the above, generalization or deletion is performed on each attribute value in the attribute column to be processed. In the example of Fig. 20, for example, for a cell with the attribute value "Tokyo", the attribute value is generalized to the attribute value "Kanto" or the attribute value "Japan", or the attribute value is left as "Tokyo" without generalization, or the attribute value is deleted. For a cell with the attribute value "Osaka", the attribute value is generalized to the attribute value "Kinki" or the attribute value "Japan", or the attribute value is left as "Osaka" without generalization, or the attribute value is deleted.

[0206] The processing unit 210 processes the attribute column c j’ If the attribute value is not deleted, the attribute value a ij’ attribute value p_(k ij’ ,a ij’ ) in row i and column c. j’ In the cell, the attribute value p_(k ij’ ,a ij’ ) where k ij’ =1, ,l j’ -1. Note that k ij’ =l j’ When , the attribute value is deleted, so the attribute value p_(k ij’ ,a ij’ ) does not exist.

[0207] Here, the attribute value p_(k ij’ ,a ij’ ) is the attribute value a ij’ is generalized to create a generalized hierarchical tree T j’ Hierarchy k of ij’ For example, a ij’= If "Tokyo" is generalized to the attribute value "Kanto", then k ij’ = 2, and p_(2,a ij’ ) = "Kanto". Note that the attribute value a ij’ If we do not generalize k ij’ =1, and p_(1,a ij’ )=a ij’ is.

[0208] The processed hash value calculation unit 220 calculates a processed hash value for the attribute string to be processed (S210). Specifically, when generalization processing is performed, the processed hash value calculation unit 220 calculates the attribute value a ij’ The processed attribute value p_(k ij’ ,a ij’ ) corresponding intermediate hash value h_(i,j',k ij’ ) is calculated. Equation (25) is the generalized calculation of equation (21) for the hierarchy k ij’ This corresponds to the process up to -1. ij’ ) corresponds to the processed hash value. ij’ =2, ,l j’ It is -1.

number

[0209] Therefore, for a data string combining an intermediate hash value and an attribute value of a hierarchical level corresponding to the intermediate hash value, the processed hash value calculation unit 220 calculates an intermediate hash value corresponding to an attribute value of a higher hierarchical level in the hierarchical structure than the attribute value of the intermediate hash value. When the target data has been generalized, the processed hash value calculation unit 220 calculates the intermediate hash value corresponding to the attribute value of the target data after processing as the processed hash value corresponding to the target data after processing.

[0210] However, formula (25) is used when the attribute value is processed (generalized or deleted), and is not used when it is not processed. ij’If p_(1,a ij’ )=a ij’ The initial hash value corresponding to the intermediate hash value h i,j’,1 This intermediate hash value h i,j’,1 corresponds to the processed hash value. In other words, for an attribute value that was not processed among the attributes that were subject to processing, the processed hash value calculation unit 220 calculates, as the processed hash value, the first hash value calculated for a data string obtained using the attribute value and a random number set for the attribute value.

[0211] Furthermore, when deletion processing is performed, the post-processing hash value calculation unit 220 calculates the layer l using the above-described formulas (20) and (21). j’ , attribute value a ij’ The intermediate hash value h_(i,j',l j’ ) is calculated by using this intermediate hash value h_(i,j',l j’ ) corresponds to the post-processing hash value. In other words, when the processing target data has been subjected to deletion processing, the post-processing hash value calculation unit 220 calculates an intermediate hash value corresponding to the state of the highest hierarchical structure as the post-processing hash value corresponding to the post-processing target data. In other words, the post-processing hash value calculation unit 220 calculates, as the post-processing hash value, an intermediate hash value calculated for a data string that combines an attribute value of the second highest hierarchical structure and an intermediate hash value corresponding to that attribute value.

[0212] Generalized hierarchical tree T in Figure 20 j’ In the example, when the attribute value “Tokyo” is generalized to the attribute value “Kanto”, the processed hash value calculation unit 220 calculates p_(1,a ij’ )=a ij’ = First hash value h corresponding to "Tokyo" i,j’,1 Then, the processed hash value calculation unit 220 calculates p_(2,a ij’ ) = processed hash value (intermediate hash value) corresponding to "Kanto" i,j’,2On the other hand, if the attribute value “Tokyo” is not processed, the processed hash value calculation unit 220 calculates p_(1,a ij’ )=a ij’ = The initial hash value h, which is the processed hash value corresponding to "Tokyo" i,j’,1 Furthermore, when deleting the attribute value "Tokyo", the processed hash value calculation unit 220 calculates p_(1,a ij’ )=a ij’ = First hash value h corresponding to "Tokyo" i,j’,1 Then, the processed hash value calculation unit 220 calculates the processed hash value (intermediate hash value) h_(i,j',l) corresponding to the deletion state using equation (21). j’ ) is calculated.

[0213] The processed hash value calculation unit 220 calculates the generalized hash value of row i and column c j’ In the cell, the attribute value p_(k ij’ ,a ij’ ) corresponding intermediate hash value h_(i,j',k ij’ ) is set. The post-processing hash value calculation unit 220 sets the value of the row i and column c j’ In the cell of j’ ) are set as the intermediate hash values ​​h_(i,j',k ij’ ) and h_(i,j',l j’ ) corresponds to the processed hash value. The processed hash values ​​form a hash chain from the initial hash value to the hash value corresponding to the processed attribute value.

[0214] 21 is a diagram for explaining the processing of the data processing device 200 according to the fourth embodiment. A generalization process is performed on row i, or no processing is performed on row i'. A deletion process is performed on row i'.

[0215] In this case, the column to be processed is c j’ For row i, attribute value a ij’In the cells of ij’ ,a ij’ ) and the corresponding processed hash value h_(i,j',k ij’ ) is set. On the other hand, the column to be processed, c j’ For row i', the attribute value a i’j’ The cell stores the intermediate hash value h_(i',j',l j’ ) is set.

[0216] In addition, the data processor will j’ For the attribute values ​​of, the generalized hierarchical tree T j’ If an illegal processing that does not comply with the above formula (24) is performed, the hash chain will be broken. In other words, an appropriate hash chain such as that shown in formula (24) above will not be constructed in the data processing device 200. Therefore, the illegal processing will be detected in the subsequent signature verification.

[0217] The sending unit 230 sends a data set (anonymized data) that includes information on C and C' and is obtained by processing the data to be processed, a processed hash value corresponding to the data to be processed, and a digital signature to the data receiving device 300 (S222). j’ Cell (i,c j’ )(row i, column c j’ For the deleted cell, a set of an attribute value and a processed hash value, or a data set in which a processed hash value corresponding to the deleted state is set, is transmitted to the data receiving device 300.

[0218] The sending unit 230 also calculates the signature {σ i} and the generalized hierarchical tree {T j’} to the data receiving device 300. The transmitting unit 230 transmits the random number table {R j’} to the data receiving device 300. That is, for attribute values ​​that have not been processed among the attributes that have been subject to processing, the initial hash value is used as the processed hash value and is transmitted to the data receiving device 300. This allows signature verification to be performed in the data receiving device 300 without transmitting a random number to the data receiving device 300. Therefore, a random number is not transmitted to the data receiving device 300.

[0219] <Verification process> Next, the verification process (S300) when generalizing and deleting is performed will be described. In the data receiving device 300, the verification hash value calculation unit 310 calculates a verification hash value (S310). Specifically, the verification hash value calculation unit 310 calculates a verification hash value for the column c of attributes that are not to be processed. j attribute value a ij For each row i (record), the hash value h is calculated using the above formula (1). ij The calculated hash value corresponds to the verification hash value for the attribute that is not to be processed.

[0220] In addition, the verification hash value calculation unit 310 calculates the attribute sequence c j’ For each row i (record), a generalized hierarchical tree T j’ Using this, the verification hash value h ij’ First, a cell that has undergone generalization or has not undergone generalization will be described. The verification hash value calculation unit 310 calculates the cell (i, c j’ ) is set to the processed (or unprocessed) attribute value p_(k ij’ ,a ij’ ) and the corresponding processed hash value h_(i,j',k ij’ ) and extract the pair.

[0221] The verification hash value calculation unit 310 calculates the generalized hierarchical tree T j’ Calculate the intermediate hash value corresponding to the attribute value of each layer. ij’ ,a ij’ )) is a generalized hierarchical tree Tj’ In this case, the attribute value p_(k ij’ ,a ij’ ) is the attribute value of the parent node at hierarchy k. Note that k=k ij’ When p_(k ij’ ,p_(k ij’ ,a ij’ ))=p_(k ij’ ,a ij’ )

number

[0222] Equation (26) is the initial value k = k ij’ Then, the extracted attribute value p_(k ij’ ,a ij’ ) and the processed hash value h_(i,j',k ij’ ) and the hash value of the combined data is ij’ This indicates that the verification hash value calculation unit 310 calculates an intermediate hash value corresponding to an attribute value in the next higher layer in the hierarchical structure of the attribute value for a data string that combines a processed hash value and an attribute value of the processed data to be processed that corresponds to the processed hash value. Note that the initial value of equation (26) is different from that of equation (21). The final value of equation (26) is also different from that of equation (11).

[0223] Furthermore, equation (26) is the attribute value p_(k,p_(k ij’ ,a ij’ )) and its corresponding intermediate hash value h ij’,k The hash value of the combined data is used to calculate the attribute value p_((k+1),p_(k ij’ ,a ij’ )) corresponding intermediate hash value h ij’,k+1 In other words, for a data string that combines an intermediate hash value and an attribute value of a hierarchical level corresponding to the intermediate hash value, the verification hash value calculation unit 310 calculates an intermediate hash value that corresponds to the state of the higher hierarchical level in the hierarchical structure of the attribute value.

[0224] Also, in equation (26), k=l j’ When it is -1, the intermediate hash value h_(i,j',l) corresponding to the state corresponding to the highest layer (the state where the attribute value is deleted) is j’ ) is calculated. That is, the attribute value p_((l j’ -1),a ij’ ) (in the example in Figure 20, "Japan") and the intermediate hash value h_(i,j',l j’ -1), and the intermediate hash value h_(i,j',l j’ ) is calculated.

[0225] Furthermore, the verification hash value calculation unit 310 calculates the top layer l using the following formula (27): j’ The intermediate hash value h_(i,j',l) corresponding to the state (the state where the attribute value is deleted) j’ ) hash value h_(i,j',l j’ +1).

number

[0226] This hash value h_(i,j',l j’ +1) in row i, column c j’ The verification hash value h corresponding to the data to be processed ij’ That is, the following equation (28) holds: In other words, the verification hash value calculation unit 310 calculates, as the verification hash value, the hash value calculated for the intermediate hash value corresponding to the state of the highest hierarchical layer in the hierarchical structure.

number

[0227] Generalized hierarchical tree T in Figure 20 j’ In the example, a ij’ = If "Tokyo" is generalized to the attribute value "Kanto", the initial value k=k ij’ = 2. Therefore, p_(k ij’ ,aij’ )=p_(2,a ij’ )="Kanto". Therefore, the verification hash value calculation unit 310 calculates the attribute value "Kanto" and the corresponding processed hash value h i,j’,2 The hash value of the combined data is calculated as the intermediate hash value h i,j’,3 The verification hash value calculation unit 310 calculates the attribute value “Japan” and the corresponding processed hash value h i,j’,3 The hash value of the combined data is calculated as the intermediate hash value h i,j’,4 Then, the verification hash value calculation unit 310 calculates the intermediate hash value h corresponding to "deletion". i,j’,4 hash value h for i,j’,5 the verification hash value h ij’ It is calculated as follows.

[0228] Next, a cell that has been subjected to deletion processing will be described. The verification hash value calculation unit 310 calculates the cell (i, c j’ ) is the processed hash value h_(i,j',l j’ ) is extracted. Then, the verification hash value calculation unit 310 extracts the processed hash value h_(i,j',l) using the above equation (27). j’ ) hash value h_(i,j',l j’ +1).

[0229] This hash value h_(i,j',l j’ +1) in row i, column c j’ The verification hash value h corresponding to the data to be processed ij’ That is, the above formula (28) holds. That is, for the processing target data that has been subjected to deletion processing, the verification hash value calculation unit 310 calculates, as the verification hash value, the hash value calculated for the post-processing hash value corresponding to the processing target data.

[0230] The verification unit 320 performs signature verification (S322). That is, the verification unit 320 verifies the verification hash value and the digital signature. Specifically, for each row i (record), the verification unit 320 verifies each column j (column c j’ ) data, all the verification hash values ​​corresponding to the data are concatenated to obtain the hash value h i ' is calculated. Then, for every row i (record), the hash value h i ' and calculate {h i Then, as in the second embodiment, the verification unit 320 obtains the obtained {h i '} and the signature {σ i}, the signature is verified using the verification key of the data provider and the verification algorithm in the digital signature.

[0231] In the second or third embodiment, it was necessary to set whether to perform "generalization" or "deletion" processing for each attribute (column). In contrast, in the information processing system 10 according to the fourth embodiment, the generalized hierarchical tree is expanded, so that both "generalization" and "deletion" processing can be performed for columns for which a generalized hierarchical tree is set. Therefore, it is no longer necessary to set either "generalization" or "deletion" for each column. Furthermore, since both "generalization" and "deletion" processing can be performed for the same column, flexible processing can be performed for that column (attribute).

[0232] In the fourth embodiment, since the number of layers (height) of the generalized hierarchical tree is increased, the calculation load of the hash function may increase compared to the second and third embodiments. Conversely, in the second and third embodiments, the calculation load of the hash function may be reduced compared to the fourth embodiment. In the fourth embodiment, the generalized hierarchical tree set for the column on which the "deletion" process has been performed is provided to the data receiving device 300. Therefore, even if the "deletion" process has been performed, the data recipient may know that the attribute value before deletion is one of the attribute values ​​at layer "1" of the generalized hierarchical tree. In contrast, in the third embodiment, since the generalized hierarchical tree is not provided to the data receiving device 300, it is possible to prevent the data recipient from knowing the attribute value before deletion when the "deletion" process has been performed.

[0233] (Application example) 22 is a diagram illustrating an application example according to this embodiment. In the above-described embodiment, it is set for each attribute whether it is to be processed or not. Therefore, for attribute #1, which is not to be processed, a hash value is calculated using a general hash function algorithm such as SHA256 (see formula (1)). Also, for attribute #2, which is to be processed, a hash value (such as a signature hash value) is calculated by applying the above-described hash chain.

[0234] Here, the processing (generalization or deletion) according to the above-described embodiment requires processing according to the generalized hierarchical tree or simply deleting the attribute value. On the other hand, there may be a desire to perform arbitrary processing on attribute #3. In this case, chameleon hashing may be applied to attribute #3. That is, for attribute #3, hash values ​​may be calculated using chameleon hashing for attribute values ​​#13 to #m3. By combining chameleon hashing with digital signatures, a sanitizable signature algorithm can be configured that allows only an entity possessing a private key corresponding to the public key used to generate the chameleon hash to modify plaintext. For example, by ensuring that only the data processor possesses the private key corresponding to the public key used to generate the chameleon hash, only the data processor can anonymize the data while maintaining the validity of the signature.

[0235] In this case, when generating a signature, for attribute #1 in formula (7), a signature hash value h is generated using a general hash function. i1 For attribute #2, the signature hash value h is calculated using the hash chain described above. i2 Furthermore, for attribute #3, the signature hash value h i3 Then, as shown in equation (7), the signature hash values ​​generated for each attribute are concatenated to obtain the hash value h i In this way, any processing can be performed on a certain attribute, which can increase the flexibility of processing.

[0236] (Example of hardware configuration) An example of the configuration of hardware resources for implementing the devices and systems according to the above-described embodiments using one calculation processing device (information processing device, computer) will be described. However, the devices according to the embodiments (data providing device, data processing device, and data receiving device) may be physically or functionally implemented using at least two calculation processing devices. Furthermore, the devices according to the embodiments may be implemented as dedicated devices or general-purpose information processing devices.

[0237] FIG. 23 is a block diagram schematically illustrating an example of the hardware configuration of a calculation processing device capable of realizing the device and system according to each embodiment. The calculation processing device 1000 has a CPU 1001, a volatile storage device 1002, a disk 1003, a non-volatile recording medium 1004, and a communication IF (Interface) 1007. Therefore, it can be said that the device according to each embodiment has the CPU 1001, the volatile storage device 1002, the disk 1003, the non-volatile recording medium 1004, and the communication IF 1007. The calculation processing device 1000 may be connectable to an input device 1005 and an output device 1006. The calculation processing device 1000 may also include the input device 1005 and the output device 1006. Furthermore, the calculation processing device 1000 can send and receive information to and from other calculation processing devices and communication devices via the communication IF 1007.

[0238] The nonvolatile recording medium 1004 is a computer-readable medium, such as a compact disc or a digital versatile disc. The nonvolatile recording medium 1004 may also be a USB (Universal Serial Bus) memory, a solid state drive, or the like. The nonvolatile recording medium 1004 stores the program and allows portability without requiring a power supply. The nonvolatile recording medium 1004 is not limited to the above-mentioned medium. The program may also be supplied via the communication IF 1007 and a communication network instead of the nonvolatile recording medium 1004.

[0239] The volatile storage device 1002 is computer-readable and can temporarily store data. The volatile storage device 1002 is a memory such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0240] That is, when executing a software program (computer program: hereinafter simply referred to as "program") stored on disk 1003, CPU 1001 copies it to volatile storage device 1002 and executes arithmetic processing. CPU 1001 reads data required to execute the program from volatile storage device 1002. When display is required, CPU 1001 displays the output result on output device 1006. When a program is input from the outside, CPU 1001 obtains the program from input device 1005. CPU 1001 interprets and executes programs corresponding to the functions (processing) of each component shown in FIGS. 5 to 7 described above. CPU 1001 executes the processing described in each of the above-mentioned embodiments. In other words, the functions of each component shown in FIGS. 5 to 7 described above can be realized by CPU 1001 executing a program stored on disk 1003 or volatile storage device 1002.

[0241] That is, each of the embodiments can be realized by the above-described programs. Furthermore, each of the embodiments can be realized by a computer-readable non-volatile recording medium on which the above-described programs are recorded.

[0242] (Variation) The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the invention. For example, in the above-described flowchart, the order of each process (step) can be modified as appropriate. Furthermore, one or more of the multiple processes (steps) may be omitted.

[0243] In the above-described embodiment, each attribute is subjected to "generalization" or "deletion" processing, but the present invention is not limited to this configuration. Any processing applicable to the present embodiment can be performed on each attribute.

[0244] In the above examples, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored on a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disk (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0245] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention.

[0246] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes. (Appendix 1) a data providing device that provides a dataset consisting of a plurality of data relating to at least one attribute; a data processing device that processes at least a portion of the plurality of data; a data receiving device that receives the data set in which some of the data has been processed; and The data providing device is a processing rule setting means for setting a processing rule for each of the attributes; a random number setting means for setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that can be taken by the processing target data relating to the attribute that is the processing target in the processing rule; a signature hash value calculation means for calculating a signature hash value corresponding to each of the plurality of data; a signature generation means for generating a digital signature using the signature hash value; a first transmitting means for transmitting the data set, the digital signature, and the random number to the data processing device; and the signature hash value calculation means calculates a first hash value for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, calculates an intermediate hash value for a data string combining the processing target data and the first hash value, and calculates a signature hash value corresponding to the processing target data using the intermediate hash value; The data processing device is a processing means for performing processing for processing the processing object data; a post-processing hash value calculation means for calculating a post-processing hash value corresponding to each of the processing object data; a second transmission means for transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and the digital signature to the data receiving device; and the post-processing hash value calculation means calculates a first hash value for a data string obtained by using the processed processing target data before processing and the random number set for an attribute value corresponding to the processed processing target data before processing, calculates an intermediate hash value for a data string combining the processed processing target data before processing and the first hash value, and calculates a post-processing hash value corresponding to the processed processing target data using the intermediate hash value; The data receiving device a verification hash value calculation means for calculating a verification hash value corresponding to each of the plurality of data by using a data set obtained by processing the processing target data and the processed hash value; a verification means for verifying the verification hash value and the digital signature; having Information processing system. (Appendix 2) the processing rule includes a hierarchical structure having hierarchical levels corresponding to states including attribute values ​​before processing and attribute values ​​after processing, the hierarchical levels being set for each attribute to be processed; the signature hash value calculation means calculates, for the processing target data, an intermediate hash value corresponding to a state of an upper hierarchical level in the hierarchical structure of the attribute value of the processing target data, for a data string combining the processing target data and a corresponding first hash value; the post-processing hash value calculation means calculates, for the processed processing target data, an intermediate hash value corresponding to a state of an upper hierarchical level in the hierarchical structure of the attribute value of the processing target data before processing, for a data string combining the processing target data before processing and a corresponding first hash value; 10. The information processing system of claim 1. (Appendix 3) the processing rule setting means sets a generalization hierarchical tree having a hierarchical structure in which a rule for generalizing an attribute value before processing is indicated for each attribute to be processed, and a higher level indicates a more generalized attribute value; the first transmitting means and the second transmitting means transmit the generalized hierarchical tree. 10. The information processing system of claim 2. (Appendix 4) the signature hash value calculation means calculates an intermediate hash value corresponding to a state of a higher layer in the hierarchical structure of an attribute value of a data string that combines an intermediate hash value and an attribute value of a layer corresponding to the intermediate hash value, and calculates, as the signature hash value, a hash value calculated for a data string that combines an attribute value of the highest layer in the hierarchical structure and the intermediate hash value corresponding to the attribute value; the processed hash value calculation means calculates an intermediate hash value corresponding to an attribute value of a higher level in the hierarchical structure of the attribute value for a data string that combines an intermediate hash value and an attribute value of a level corresponding to the intermediate hash value, and calculates the intermediate hash value corresponding to the attribute value corresponding to the processed target data as the processed hash value corresponding to the processed target data; the verification hash value calculation means calculates, for a data string combining the processed hash value and an attribute value of the processed data corresponding to the processed hash value, an intermediate hash value corresponding to an attribute value at a higher level in the hierarchical structure of the attribute value, and calculates, as the verification hash value, the hash value calculated for the data string combining the attribute value at the highest level in the hierarchical structure and the intermediate hash value corresponding to the attribute value; 10. The information processing system of claim 3. (Appendix 5) the processing rule setting means sets a state for deleting the attribute value of the processing target data in a layer above the second layer from the top, which is the layer in which the attribute value is most generalized in the generalized hierarchical tree; 10. The information processing system of claim 3. (Appendix 6) the signature hash value calculation means calculates, for a data string combining an intermediate hash value and a state of a layer corresponding to the intermediate hash value, an intermediate hash value corresponding to a state of a layer above the state in the hierarchical structure, and calculates, as the signature hash value, the hash value calculated for the intermediate hash value corresponding to the state of the highest layer in the hierarchical structure; the processed hash value calculation means calculates an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute value for a data string that combines an intermediate hash value and an attribute value of a level corresponding to the intermediate hash value; When the processing target data is subjected to generalization processing, an intermediate hash value corresponding to an attribute value corresponding to the processing target data after processing is calculated as the processed hash value corresponding to the processing target data after processing; When the data to be processed is deleted, an intermediate hash value corresponding to the state of the highest hierarchical structure is calculated as the post-processing hash value corresponding to the processed data to be processed; The verification hash value calculation means For the processing target data that has been generalized, calculate an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute value for a data string that combines the processed hash value with an attribute value of the processing target data that corresponds to the processed hash value, and calculate the hash value calculated for the intermediate hash value corresponding to the state of the highest hierarchical level in the hierarchical structure as the verification hash value; For the processing target data that has been subjected to deletion processing, a hash value calculated for the post-processing hash value corresponding to the processing target data is calculated as the verification hash value; 6. The information processing system according to claim 5. (Appendix 7) the processing rule setting means sets a processing rule for deleting an attribute value before processing for each attribute to be processed; the signature hash value calculation means calculates, for the processing target data, a hash value calculated for a data string that combines the processing target data and the leading hash value, as the signature hash value; the post-processing hash value calculation means calculates, as the post-processing hash value, a hash value calculated for a data string combining the processing target data that has been subjected to deletion processing and a corresponding first hash value; the verification hash value calculation means calculates, for the processing target data that has been subjected to deletion processing, the post-processing hash value corresponding to the processing target data as the verification hash value; 3. The information processing system according to claim 1 or 2. (Appendix 8) the processed hash value calculation means calculates, as the processed hash value, a first hash value calculated for a data string obtained using an attribute value that has not been processed among attributes that have been subject to processing in the processing rule and the random number set for that attribute value; 8. An information processing system according to any one of appendices 1 to 7. (Appendix 9) the signature hash value calculation means calculates a leading hash value for a data string obtained by using the random number set for the processing target data and an attribute value corresponding to the processing target data, and an index identifying the processing target data; the processed hash value calculation means calculates a leading hash value for the data string obtained by using the random number set for the processing target data and the attribute value corresponding to the processing target data, and an index identifying the processing target data; 9. An information processing system according to any one of appendices 1 to 8. (Appendix 10) a processing rule setting means for setting a processing rule for each of at least one attribute in a data set composed of a plurality of data relating to the attribute; a random number setting means for setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that can be taken by the processing target data relating to the attribute that is the processing target in the processing rule; a signature hash value calculation means for calculating a signature hash value corresponding to each of the plurality of data; a signature generation means for generating a digital signature using the signature hash value; a transmitting means for transmitting the data set, the digital signature, and the random number to a data processing device that processes at least a part of the plurality of data; and the signature hash value calculation means calculates a first hash value for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, calculates an intermediate hash value for a data string combining the processing target data and the first hash value, and calculates a signature hash value corresponding to the processing target data by using the intermediate hash value; Data providing device. (Appendix 11) the processing rule includes a hierarchical structure having hierarchical levels corresponding to states including attribute values ​​before processing and attribute values ​​after processing, the hierarchical levels being set for each attribute to be processed; the signature hash value calculation means calculates, for the processing target data, an intermediate hash value corresponding to a state of an upper hierarchical level in the hierarchical structure of the attribute value of the processing target data, for a data string combining the processing target data and a corresponding first hash value; 11. The data providing device according to claim 10. (Appendix 12) the processing rule setting means sets a generalization hierarchical tree having a hierarchical structure in which a rule for generalizing an attribute value before processing is indicated for each attribute to be processed, and a higher level indicates a more generalized attribute value; the transmitting means transmits the generalized hierarchical tree to the data processing device; 12. The data providing device according to claim 11. (Appendix 13) the signature hash value calculation means calculates an intermediate hash value corresponding to a state of a higher layer in the hierarchical structure of the attribute value for a data string combining an intermediate hash value and an attribute value of a layer corresponding to the intermediate hash value, and calculates, as the signature hash value, the hash value calculated for the data string combining an attribute value of the highest layer in the hierarchical structure and the intermediate hash value corresponding to the attribute value; 13. The data providing device according to claim 12. (Appendix 14) the processing rule setting means sets a state for deleting the attribute value of the processing target data in a layer above the second layer from the top, which is the layer in which the attribute value is most generalized in the generalized hierarchical tree; 13. The data providing device according to claim 12. (Appendix 15) the signature hash value calculation means calculates, for a data string combining an intermediate hash value and a state of a layer corresponding to the intermediate hash value, an intermediate hash value corresponding to a state of a layer above the state in the hierarchical structure, and calculates, as the signature hash value, the hash value calculated for the intermediate hash value corresponding to the state of the highest layer in the hierarchical structure; 15. The data providing device according to claim 14. (Appendix 16) the processing rule setting means sets a processing rule for deleting an attribute value before processing for each attribute to be processed; the signature hash value calculation means calculates, for the processing target data, a hash value calculated for a data string that combines the processing target data and the leading hash value, as the signature hash value; 12. The data providing device according to claim 10 or 11. (Appendix 17) the signature hash value calculation means calculates a leading hash value for the data string obtained by using the random number set for the data to be processed and an attribute value corresponding to the data to be processed, and an index identifying the data to be processed; 17. A data providing device according to any one of appendices 10 to 16. (Appendix 18) a data providing device that provides a data set consisting of a plurality of data relating to at least one attribute, a processing means that performs processing on processing target data relating to an attribute that is set as a processing target in a processing rule set for each of the attributes; a post-processing hash value calculation means for calculating a post-processing hash value corresponding to each of the processing object data; a transmitting means for transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and a digital signature generated by the data providing device to a data receiving device that receives the data set in which part of the data has been processed; and the post-processing hash value calculation means calculates a first hash value for a data string obtained by using the processed processing target data before processing and a random number set for an attribute value corresponding to the processed processing target data before processing, calculates an intermediate hash value for a data string combining the processed processing target data before processing and the first hash value, and calculates a post-processing hash value corresponding to the processed processing target data using the intermediate hash value; Data processing equipment. (Appendix 19) the processing rule includes a hierarchical structure having hierarchical levels corresponding to states including attribute values ​​before processing and attribute values ​​after processing, the hierarchical levels being set for each attribute to be processed; the post-processing hash value calculation means calculates, for the processed processing target data, an intermediate hash value corresponding to a state of an upper hierarchical level in the hierarchical structure of the attribute value of the processing target data before processing, for a data string combining the processing target data before processing and a corresponding first hash value; 19. The data processing device according to claim 18. (Appendix 20) the transmitting means transmits to the data receiving device a generalized hierarchical tree set in the data providing device, the generalized hierarchical tree having a hierarchical structure indicating a rule for generalizing attribute values ​​before processing for each attribute to be processed, with higher levels indicating more generalized attribute values; 19. The data processing device according to claim 18. (Appendix 21) the processed hash value calculation means calculates an intermediate hash value corresponding to an attribute value of a higher layer in the hierarchical structure of the attribute value for a data string combining an intermediate hash value and an attribute value of a layer corresponding to the intermediate hash value, and calculates the intermediate hash value corresponding to the attribute value corresponding to the processed target data as the processed hash value corresponding to the processed target data; 21. The data processing device according to claim 20. (Appendix 22) In the generalized hierarchical tree, a state for deleting the attribute value of the data to be processed is set in a layer above the second layer from the top, which is the layer in which the attribute value is most generalized. 21. The data processing device according to claim 20. (Appendix 23) the processed hash value calculation means calculates an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute value for a data string that combines an intermediate hash value and an attribute value of a level corresponding to the intermediate hash value; When the processing target data is subjected to generalization processing, an intermediate hash value corresponding to an attribute value corresponding to the processing target data after processing is calculated as the processed hash value corresponding to the processing target data after processing; When the data to be processed is subjected to deletion processing, an intermediate hash value corresponding to the state of the highest hierarchical structure is calculated as the post-processing hash value corresponding to the processed data to be processed. 23. The data processing device according to claim 22. (Appendix 24) For each attribute that is the target of processing, a processing rule is set to delete the attribute value before processing. the post-processing hash value calculation means calculates, as the post-processing hash value, a hash value calculated for a data string combining the processing target data that has been subjected to deletion processing and a corresponding first hash value; 20. The data processing device according to claim 18 or 19. (Appendix 25) the processed hash value calculation means calculates, as the processed hash value, a first hash value calculated for a data string obtained using an attribute value that has not been processed among attributes that have been subject to processing in the processing rule and the random number set for that attribute value; 25. A data processing device according to any one of appendices 18 to 24. (Appendix 26) the processed hash value calculation means calculates a leading hash value for a data string obtained by using the processing target data and a random number set for the processing target data and an attribute value corresponding to the processing target data, and an index identifying the processing target data; 26. A data processing device according to any one of appendices 18 to 25. (Appendix 27) a data providing device that provides a data set consisting of a plurality of data related to at least one attribute, wherein the data set is obtained by processing target data related to an attribute that is set as a target for processing in a processing rule set for each of the attributes, and a verification hash value calculation means that calculates a verification hash value corresponding to each of the plurality of data using a processed hash value calculated by a data processing device that processes at least a portion of the plurality of data and corresponding to each of the target data; a verification means for verifying the verification hash value and the digital signature generated by the data providing device; A data receiving device having: (Appendix 28) the processing rule includes a hierarchical structure having hierarchical levels set for each attribute to be processed, each hierarchical level corresponding to a state including an attribute value before processing and an attribute value after processing; 28. The data receiving device of claim 27. (Appendix 29) the verification hash value calculation means calculates the verification hash value using a generalized hierarchical tree set in the data providing device, the generalized hierarchical tree having a hierarchical structure that indicates a rule for generalizing attribute values ​​before processing for each attribute to be processed, and indicates more generalized attribute values ​​as the level increases; 29. The data receiving device of claim 28. (Appendix 30) the verification hash value calculation means calculates, for a data string combining the processed hash value and an attribute value of the processed data corresponding to the processed hash value, an intermediate hash value corresponding to an attribute value at a higher level in the hierarchical structure of the attribute value, and calculates, as the verification hash value, the hash value calculated for the data string combining the attribute value at the highest level in the hierarchical structure and the intermediate hash value corresponding to the attribute value; 29. The data receiving device of claim 29. (Appendix 31) In the generalized hierarchical tree, a state for deleting the attribute value of the data to be processed is set in a layer above the second layer from the top, which is the layer in which the attribute value is most generalized. 29. The data receiving device of claim 29. (Appendix 32) The verification hash value calculation means For the processing target data that has been generalized, calculate an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute value for a data string that combines the processed hash value with an attribute value of the processing target data that corresponds to the processed hash value, and calculate the hash value calculated for the intermediate hash value corresponding to the state of the highest hierarchical level in the hierarchical structure as the verification hash value; For the processing target data that has been subjected to deletion processing, a hash value calculated for the post-processing hash value corresponding to the processing target data is calculated as the verification hash value; 32. The data receiving device of claim 31. (Appendix 33) For each attribute that is the target of processing, a processing rule is set to delete the attribute value before processing. the verification hash value calculation means calculates, for the processing target data that has been subjected to deletion processing, the post-processing hash value corresponding to the processing target data as the verification hash value; 29. The data receiving device according to claim 27 or 28. (Appendix 34) A data providing device provides a dataset consisting of a plurality of data relating to at least one attribute, Setting a processing rule for each of the attributes; setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that the processing target data regarding the attribute to be processed in the processing rule can take; For the processing target data, a first hash value is calculated for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, an intermediate hash value is calculated for a data string combining the processing target data and the first hash value, and a signature hash value corresponding to the processing target data is calculated using the intermediate hash value, thereby calculating signature hash values ​​corresponding to each of the plurality of data; generating a digital signature using the signature hash value; transmitting the data set, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data; The data processing device performing a process for processing the processing target data; For the processed target data, a first hash value is calculated for a data string obtained using the processed target data before processing and a random number set for an attribute value corresponding to the processed target data before processing, an intermediate hash value is calculated for a data string combining the processed target data before processing and the first hash value, and a processed hash value corresponding to the processed target data after processing is calculated using the intermediate hash value, thereby calculating processed hash values ​​corresponding to each of the processed target data; Transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and the digital signature to a data receiving device that receives the data set in which some data has been processed; By the data receiving device, calculating a verification hash value corresponding to each of the plurality of data using a data set obtained by processing the processing target data and the processed hash value; verifying the verification hash value and the digital signature; Information processing methods. (Appendix 35) setting a processing rule for each of at least one attribute in a data set consisting of a plurality of data relating to the attribute; setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that the processing target data regarding the attribute to be processed in the processing rule can take; For the processing target data, a first hash value is calculated for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, an intermediate hash value is calculated for a data string combining the processing target data and the first hash value, and a signature hash value corresponding to the processing target data is calculated using the intermediate hash value, thereby calculating signature hash values ​​corresponding to each of the plurality of data; generating a digital signature using the signature hash value; transmitting the data set, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data; How data is provided. (Appendix 36) a data providing device that provides a data set consisting of a plurality of data relating to at least one attribute, performing processing on processing target data relating to an attribute that is set as a processing target in processing rules set for each of the attributes; For the processed target data, a first hash value is calculated for a data string obtained using the processed target data before processing and a random number set for an attribute value corresponding to the processed target data before processing, an intermediate hash value is calculated for a data string combining the processed target data before processing and the first hash value, and a processed hash value corresponding to the processed target data after processing is calculated using the intermediate hash value, thereby calculating processed hash values ​​corresponding to each of the processed target data; Transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and a digital signature generated by the data providing device to a data receiving device that receives the data set with some data processed; Data processing methods. (Appendix 37) a data providing device that provides a data set consisting of a plurality of data related to at least one attribute, the data set being processed on processing target data related to an attribute that is set as a processing target in a processing rule set for each of the attributes, and a data processing device that processes at least a portion of the plurality of data, the data set being processed on processing target data, and a verification hash value corresponding to each of the plurality of data being calculated using the processed hash value; verifying the verification hash value and the digital signature generated by the data providing device; How we receive your data. (Appendix 38) A step of setting a processing rule for each of at least one attribute in a data set consisting of a plurality of data relating to the attribute; setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that can be taken by the processing target data relating to the attribute that is the processing target in the processing rule; calculating a first hash value for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, calculating an intermediate hash value for a data string combining the processing target data and the first hash value, and calculating a signature hash value corresponding to the processing target data using the intermediate hash value, thereby calculating a signature hash value corresponding to each of the plurality of data; generating a digital signature using the signature hash value; transmitting the data set, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data; A non-transitory computer-readable medium storing a program that causes a computer to execute the program. (Appendix 39) a step of performing processing on processing target data related to an attribute that is set as a processing target in a processing rule set for each of the attributes in a data providing device that provides a data set consisting of a plurality of data related to at least one attribute; a step of calculating a first hash value for a data string obtained by using the processed target data before processing and a random number set for an attribute value corresponding to the processed target data before processing, calculating an intermediate hash value for a data string combining the processed target data before processing and the first hash value, and using the intermediate hash value to calculate a post-processed hash value corresponding to the processed target data after processing, thereby calculating post-processed hash values ​​corresponding to each of the processed target data; a step of transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and a digital signature generated by the data providing device to a data receiving device that receives the data set, some of the data of which has been processed; A non-transitory computer-readable medium storing a program that causes a computer to execute the program. (Appendix 40) a step of calculating a verification hash value corresponding to each of the plurality of data using a data set obtained by processing target data related to an attribute that is set as a target for processing in a processing rule set for each of the attributes in a data providing device that provides a data set consisting of a plurality of data related to at least one attribute, and a processed hash value calculated in a data processing device that processes at least a portion of the plurality of data and corresponding to each of the plurality of data; a step of verifying the verification hash value and a digital signature generated in the data providing device; A non-transitory computer-readable medium storing a program that causes a computer to execute the program. [Explanation of symbols]

[0247] 10 Information Processing Systems 100 Data providing device 110 Processing rule setting section 120 Random number setting section 130 Signature hash value calculation unit 140 Signature generation section 150 Transmitter 200 Data Processing Device 210 Processing section 220 Post-processing hash value calculation unit 230 Transmitter 300 Data receiving device 310 Verification hash value calculation unit 320 Verification Department

Claims

1. a data providing device that provides a data set consisting of a plurality of data relating to at least one attribute; a data processing device that processes at least a portion of the plurality of data; a data receiving device that receives the data set in which some of the data has been processed; and The data providing device is a processing rule setting means for setting a processing rule for each of the attributes; a random number setting means for setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that can be taken by the processing target data relating to the attribute that is the processing target in the processing rule; a signature hash value calculation means for calculating a signature hash value corresponding to each of the plurality of data; a signature generation means for generating a digital signature using the signature hash value; a first transmitting means for transmitting the data set, the digital signature, and the random number to the data processing device; and the signature hash value calculation means calculates a first hash value for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, calculates an intermediate hash value for a data string combining the processing target data and the first hash value, and calculates a signature hash value corresponding to the processing target data using the intermediate hash value; The data processing device is a processing means for performing processing for processing the processing object data; a post-processing hash value calculation means for calculating a post-processing hash value corresponding to each of the processing object data; a second transmission means for transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and the digital signature to the data receiving device; and the post-processing hash value calculation means calculates a first hash value for a data string obtained by using the processed processing target data before processing and the random number set for an attribute value corresponding to the processed processing target data before processing, calculates an intermediate hash value for a data string combining the processed processing target data before processing and the first hash value, and calculates a post-processing hash value corresponding to the processed processing target data using the intermediate hash value; The data receiving device a verification hash value calculation means for calculating a verification hash value corresponding to each of the plurality of data by using a data set obtained by processing the processing target data and the processed hash value; a verification means for verifying the verification hash value and the digital signature; having Information processing system.

2. the processing rule includes a hierarchical structure having hierarchical levels corresponding to states including attribute values ​​before processing and attribute values ​​after processing, the hierarchical levels being set for each attribute to be processed; the signature hash value calculation means calculates, for the processing target data, an intermediate hash value corresponding to a state of an upper hierarchical level in the hierarchical structure of the attribute value of the processing target data, for a data string combining the processing target data and a corresponding first hash value; the post-processing hash value calculation means calculates, for the processed processing target data, an intermediate hash value corresponding to a state of an upper hierarchical level in the hierarchical structure of the attribute value of the processing target data before processing, for a data string combining the processing target data before processing and a corresponding first hash value; The information processing system according to claim 1 .

3. the processing rule setting means sets a generalization hierarchical tree having a hierarchical structure in which a rule for generalizing an attribute value before processing is indicated for each attribute to be processed, and a higher level indicates a more generalized attribute value; the first transmitting means and the second transmitting means transmit the generalized hierarchical tree. The information processing system according to claim 2 .

4. the signature hash value calculation means calculates an intermediate hash value corresponding to a state of a higher layer in the hierarchical structure of an attribute value of a data string that combines an intermediate hash value and an attribute value of a layer corresponding to the intermediate hash value, and calculates, as the signature hash value, a hash value calculated for a data string that combines an attribute value of the highest layer in the hierarchical structure and the intermediate hash value corresponding to the attribute value; the processed hash value calculation means calculates an intermediate hash value corresponding to an attribute value of a higher level in the hierarchical structure of the attribute value for a data string that combines an intermediate hash value and an attribute value of a level corresponding to the intermediate hash value, and calculates the intermediate hash value corresponding to the attribute value corresponding to the processed target data as the processed hash value corresponding to the processed target data; the verification hash value calculation means calculates, for a data string combining the processed hash value and an attribute value of the processed data corresponding to the processed hash value, an intermediate hash value corresponding to an attribute value at a higher level in the hierarchical structure of the attribute value, and calculates, as the verification hash value, the hash value calculated for the data string combining the attribute value at the highest level in the hierarchical structure and the intermediate hash value corresponding to the attribute value; The information processing system according to claim 3 .

5. the processing rule setting means sets a state for deleting the attribute value of the processing target data in a layer above the second layer from the top, which is the layer in which the attribute value is most generalized in the generalized hierarchical tree; The information processing system according to claim 3 .

6. the signature hash value calculation means calculates, for a data string combining an intermediate hash value and a state of a layer corresponding to the intermediate hash value, an intermediate hash value corresponding to a state of a layer above the state in the hierarchical structure, and calculates, as the signature hash value, the hash value calculated for the intermediate hash value corresponding to the state of the highest layer in the hierarchical structure; the processed hash value calculation means calculates an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute value for a data string that combines an intermediate hash value and an attribute value of a level corresponding to the intermediate hash value; When the processing target data is subjected to generalization processing, an intermediate hash value corresponding to an attribute value corresponding to the processing target data after processing is calculated as the processed hash value corresponding to the processing target data after processing; When the data to be processed is deleted, an intermediate hash value corresponding to the state of the highest hierarchical structure is calculated as the post-processing hash value corresponding to the processed data to be processed; The verification hash value calculation means For the processing target data that has been generalized, calculate an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute value for a data string that combines the processed hash value with an attribute value of the processing target data that corresponds to the processed hash value, and calculate the hash value calculated for the intermediate hash value corresponding to the state of the highest hierarchical level in the hierarchical structure as the verification hash value; For the processing target data that has been subjected to deletion processing, a hash value calculated for the post-processing hash value corresponding to the processing target data is calculated as the verification hash value; The information processing system according to claim 5 .

7. the processing rule setting means sets a processing rule for deleting an attribute value before processing for each attribute to be processed; the signature hash value calculation means calculates, for the processing target data, a hash value calculated for a data string that combines the processing target data and the leading hash value, as the signature hash value; the post-processing hash value calculation means calculates, as the post-processing hash value, a hash value calculated for a data string combining the processing target data that has been subjected to deletion processing and a corresponding first hash value; the verification hash value calculation means calculates, for the processing target data that has been subjected to deletion processing, the post-processing hash value corresponding to the processing target data as the verification hash value; 3. The information processing system according to claim 1 or 2.

8. the processed hash value calculation means calculates, as the processed hash value, a first hash value calculated for a data string obtained using an attribute value that has not been processed among attributes that have been subject to processing in the processing rule and the random number set for that attribute value; The information processing system according to any one of claims 1 to 7.

9. the signature hash value calculation means calculates a leading hash value for a data string obtained by using the random number set for the processing target data and an attribute value corresponding to the processing target data, and an index identifying the processing target data; the processed hash value calculation means calculates a leading hash value for the data string obtained by using the random number set for the processing target data and the attribute value corresponding to the processing target data, and an index identifying the processing target data; The information processing system according to any one of claims 1 to 8.

10. a processing rule setting means for setting a processing rule for each of the attributes in a data set composed of a plurality of data relating to at least one attribute; a random number setting means for setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that can be taken by the processing target data relating to the attribute that is the processing target in the processing rule; a signature hash value calculation means for calculating a signature hash value corresponding to each of the plurality of data; a signature generation means for generating a digital signature using the signature hash value; a transmitting means for transmitting the data set, the digital signature, and the random number to a data processing device that processes at least a part of the plurality of data; and the signature hash value calculation means calculates a first hash value for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, calculates an intermediate hash value for a data string combining the processing target data and the first hash value, and calculates a signature hash value corresponding to the processing target data by using the intermediate hash value; Data providing device.

11. the processing rule includes a hierarchical structure having hierarchical levels corresponding to states including attribute values ​​before processing and attribute values ​​after processing, the hierarchical levels being set for each attribute to be processed; the signature hash value calculation means calculates, for the processing target data, an intermediate hash value corresponding to a state of an upper hierarchical level in the hierarchical structure of the attribute value of the processing target data, for a data string combining the processing target data and a corresponding first hash value; The data providing device according to claim 10.

12. the processing rule setting means sets a generalization hierarchical tree having a hierarchical structure in which a rule for generalizing an attribute value before processing is indicated for each attribute to be processed, and a higher level indicates a more generalized attribute value; the transmitting means transmits the generalized hierarchical tree to the data processing device; The data providing device according to claim 11.

13. the signature hash value calculation means calculates an intermediate hash value corresponding to a state of a higher layer in the hierarchical structure of the attribute value for a data string combining an intermediate hash value and an attribute value of a layer corresponding to the intermediate hash value, and calculates, as the signature hash value, the hash value calculated for the data string combining an attribute value of the highest layer in the hierarchical structure and the intermediate hash value corresponding to the attribute value; The data providing device according to claim 12.

14. the processing rule setting means sets a state for deleting the attribute value of the processing target data in a layer above the second layer from the top, which is the layer in which the attribute value is most generalized in the generalized hierarchical tree; The data providing device according to claim 12.

15. the signature hash value calculation means calculates, for a data string combining an intermediate hash value and a state of a layer corresponding to the intermediate hash value, an intermediate hash value corresponding to a state of a layer above the state in the hierarchical structure, and calculates, as the signature hash value, the hash value calculated for the intermediate hash value corresponding to the state of the highest layer in the hierarchical structure; The data providing device according to claim 14.

16. the processing rule setting means sets a processing rule for deleting an attribute value before processing for each attribute to be processed; the signature hash value calculation means calculates, for the processing target data, a hash value calculated for a data string that combines the processing target data and the leading hash value, as the signature hash value; The data providing device according to claim 10 or 11.

17. the signature hash value calculation means calculates a leading hash value for the data string obtained by using the random number set for the data to be processed and an attribute value corresponding to the data to be processed, and an index identifying the data to be processed; The data providing device according to any one of claims 10 to 16.

18. a data providing device that provides a data set consisting of a plurality of data relating to at least one attribute, and a processing means that performs processing on processing target data relating to an attribute that is set as a processing target in a processing rule set for each of the attributes; a post-processing hash value calculation means for calculating a post-processing hash value corresponding to each of the processing object data; a transmitting means for transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and a digital signature generated by the data providing device to a data receiving device that receives the data set in which part of the data has been processed; and the post-processing hash value calculation means calculates a first hash value for a data string obtained by using the processed processing target data before processing and a random number set for an attribute value corresponding to the processed processing target data before processing, calculates an intermediate hash value for a data string combining the processed processing target data before processing and the first hash value, and calculates a post-processing hash value corresponding to the processed processing target data using the intermediate hash value; Data processing equipment.

19. the processing rule includes a hierarchical structure having hierarchical levels corresponding to states including attribute values ​​before processing and attribute values ​​after processing, the hierarchical levels being set for each attribute to be processed; the post-processing hash value calculation means calculates, for the processed processing target data, an intermediate hash value corresponding to a state of an upper hierarchical level in the hierarchical structure of the attribute value of the processing target data before processing, for a data string combining the processing target data before processing and a corresponding first hash value; 19. The data processing device according to claim 18.

20. the transmitting means transmits to the data receiving device a generalized hierarchical tree set in the data providing device, the generalized hierarchical tree having a hierarchical structure indicating a rule for generalizing attribute values ​​before processing for each attribute to be processed, with higher levels indicating more generalized attribute values; 20. The data processing device according to claim 19.

21. the processed hash value calculation means calculates an intermediate hash value corresponding to an attribute value of a higher layer in the hierarchical structure of the attribute value for a data string combining an intermediate hash value and an attribute value of a layer corresponding to the intermediate hash value, and calculates the intermediate hash value corresponding to the attribute value corresponding to the processed target data as the processed hash value corresponding to the processed target data; 21. The data processing device according to claim 20.

22. In the generalized hierarchical tree, a state for deleting the attribute value of the data to be processed is set in a layer above the second layer from the top, which is the layer in which the attribute value is most generalized.

21. The data processing device according to claim 20.

23. the processed hash value calculation means calculates an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute value for a data string that combines an intermediate hash value and an attribute value of a level corresponding to the intermediate hash value; When the processing target data is subjected to generalization processing, an intermediate hash value corresponding to an attribute value corresponding to the processing target data after processing is calculated as the processed hash value corresponding to the processing target data after processing; When the data to be processed is subjected to deletion processing, an intermediate hash value corresponding to the state of the highest hierarchical structure is calculated as the post-processing hash value corresponding to the processed data to be processed.

23. The data processing device according to claim 22.

24. For each attribute that is the target of processing, a processing rule is set to delete the attribute value before processing. the post-processing hash value calculation means calculates, as the post-processing hash value, a hash value calculated for a data string combining the processing target data that has been subjected to deletion processing and a corresponding first hash value; 20. The data processing device according to claim 18 or 19.

25. the processed hash value calculation means calculates, as the processed hash value, a first hash value calculated for a data string obtained using an attribute value that has not been processed among attributes that have been subject to processing in the processing rule and the random number set for that attribute value; 25. A data processing device according to any one of claims 18 to 24.

26. the processed hash value calculation means calculates a leading hash value for a data string obtained by using the processing target data and a random number set for the processing target data and an attribute value corresponding to the processing target data, and an index identifying the processing target data; 26. A data processing device according to any one of claims 18 to 25.

27. a data providing device that provides a data set consisting of a plurality of data related to at least one attribute, wherein the data set is obtained by processing target data related to an attribute that is set as a target for processing in a processing rule set for each of the attributes; and a verification hash value calculation means that calculates a verification hash value corresponding to each of the plurality of data using a processed hash value calculated by a data processing device that processes at least a portion of the plurality of data and corresponding to each of the target data; a verification means for verifying the verification hash value and the digital signature generated by the data providing device; A data receiving device having:

28. the processing rule includes a hierarchical structure having hierarchical levels set for each attribute to be processed, each hierarchical level corresponding to a state including an attribute value before processing and an attribute value after processing; 28. The data receiving device according to claim 27.

29. the verification hash value calculation means calculates the verification hash value using a generalized hierarchical tree set in the data providing device, the generalized hierarchical tree having a hierarchical structure that indicates a rule for generalizing attribute values ​​before processing for each attribute to be processed, and indicates more generalized attribute values ​​as the level increases; 29. The data receiving device according to claim 28.

30. the verification hash value calculation means calculates, for a data string combining the processed hash value and an attribute value of the processed data corresponding to the processed hash value, an intermediate hash value corresponding to an attribute value at a higher level in the hierarchical structure of the attribute value, and calculates, as the verification hash value, the hash value calculated for the data string combining the attribute value at the highest level in the hierarchical structure and the intermediate hash value corresponding to the attribute value; 30. The data receiving device of claim 29.

31. In the generalized hierarchical tree, a state for deleting the attribute value of the data to be processed is set in a layer above the second layer from the top, which is the layer in which the attribute value is most generalized.

30. The data receiving device of claim 29.

32. The verification hash value calculation means For the processing target data that has been generalized, calculate an intermediate hash value corresponding to a state of a higher hierarchical level in the hierarchical structure of the attribute value for a data string that combines the processed hash value with an attribute value of the processing target data that corresponds to the processed hash value, and calculate the hash value calculated for the intermediate hash value corresponding to the state of the highest hierarchical level in the hierarchical structure as the verification hash value; For the processing target data that has been subjected to deletion processing, a hash value calculated for the post-processing hash value corresponding to the processing target data is calculated as the verification hash value; 32. The data receiving device according to claim 31.

33. For each attribute that is the target of processing, a processing rule is set to delete the attribute value before processing. the verification hash value calculation means calculates, for the processing target data that has been subjected to deletion processing, the post-processing hash value corresponding to the processing target data as the verification hash value; 29. The data receiving device according to claim 27 or 28.

34. A data providing device that provides a dataset consisting of a plurality of data relating to at least one attribute, Setting a processing rule for each of the attributes; setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that the processing target data regarding the attribute to be processed in the processing rule can take; For the processing target data, a first hash value is calculated for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, an intermediate hash value is calculated for a data string combining the processing target data and the first hash value, and a signature hash value corresponding to the processing target data is calculated using the intermediate hash value, thereby calculating signature hash values ​​corresponding to each of the plurality of data; generating a digital signature using the signature hash value; transmitting the data set, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data; The data processing device performing a process for processing the processing target data; For the processed target data, a first hash value is calculated for a data string obtained using the processed target data before processing and a random number set for an attribute value corresponding to the processed target data before processing, an intermediate hash value is calculated for a data string combining the processed target data before processing and the first hash value, and a processed hash value corresponding to the processed target data after processing is calculated using the intermediate hash value, thereby calculating processed hash values ​​corresponding to each of the processed target data; Transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and the digital signature to a data receiving device that receives the data set in which some data has been processed; By the data receiving device, calculating a verification hash value corresponding to each of the plurality of data using a data set obtained by processing the processing target data and the processed hash value; verifying the verification hash value and the digital signature; Information processing methods.

35. setting a processing rule for each of the attributes in a data set consisting of a plurality of data relating to at least one attribute; setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that the processing target data regarding the attribute to be processed in the processing rule can take; For the processing target data, a first hash value is calculated for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, an intermediate hash value is calculated for a data string combining the processing target data and the first hash value, and a signature hash value corresponding to the processing target data is calculated using the intermediate hash value, thereby calculating signature hash values ​​corresponding to each of the plurality of data; generating a digital signature using the signature hash value; transmitting the data set, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data; How data is provided.

36. a data providing device that provides a data set consisting of a plurality of data relating to at least one attribute, performing processing on processing target data relating to an attribute that is set as a processing target in processing rules set for each of the attributes; For the processed target data, a first hash value is calculated for a data string obtained using the processed target data before processing and a random number set for an attribute value corresponding to the processed target data before processing, an intermediate hash value is calculated for a data string combining the processed target data before processing and the first hash value, and a processed hash value corresponding to the processed target data after processing is calculated using the intermediate hash value, thereby calculating processed hash values ​​corresponding to each of the processed target data; Transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and a digital signature generated by the data providing device to a data receiving device that receives the data set with some data processed; Data processing methods.

37. a data providing device that provides a data set consisting of a plurality of data related to at least one attribute, the data set being processed on processing target data related to an attribute that is set as a processing target in a processing rule set for each of the attributes, and a data processing device that processes at least a portion of the plurality of data, the data set being processed on processing target data, and a verification hash value corresponding to each of the plurality of data being calculated using the processed hash value; verifying the verification hash value and the digital signature generated by the data providing device; How we receive your data.

38. setting a processing rule for each of at least one attribute in a data set consisting of a plurality of data relating to the attribute; setting predetermined random numbers for states corresponding to a plurality of attribute values ​​that can be taken by the processing target data relating to the attribute that is the processing target in the processing rule; calculating a first hash value for a data string obtained by using the processing target data and the random number set for an attribute value corresponding to the processing target data, calculating an intermediate hash value for a data string combining the processing target data and the first hash value, and calculating a signature hash value corresponding to the processing target data using the intermediate hash value, thereby calculating a signature hash value corresponding to each of the plurality of data; generating a digital signature using the signature hash value; transmitting the data set, the digital signature, and the random number to a data processing device that processes at least some of the plurality of data; A program that causes a computer to execute the following.

39. a step of performing processing on processing target data related to an attribute that is set as a processing target in a processing rule set for each of the attributes in a data providing device that provides a data set consisting of a plurality of data related to at least one attribute; a step of calculating a first hash value for a data string obtained by using the processed target data before processing and a random number set for an attribute value corresponding to the processed target data before processing, calculating an intermediate hash value for a data string combining the processed target data before processing and the first hash value, and using the intermediate hash value to calculate a post-processed hash value corresponding to the processed target data after processing, thereby calculating post-processed hash values ​​corresponding to each of the processed target data; transmitting a data set obtained by processing the data to be processed, the processed hash value corresponding to the data to be processed, and a digital signature generated by the data providing device to a data receiving device that receives the data set, some of the data of which has been processed; A program that causes a computer to execute the following.

40. a step of calculating a verification hash value corresponding to each of the plurality of data using a data set obtained by processing target data related to an attribute that is set as a target for processing in a processing rule set for each of the attributes in a data providing device that provides a data set consisting of a plurality of data related to at least one attribute, and a processed hash value calculated in a data processing device that processes at least a portion of the plurality of data and corresponding to each of the plurality of data; a step of verifying the verification hash value and a digital signature generated in the data providing device; A program that causes a computer to execute the following.

Images