Analysis infrastructure system

Abstract

We provide an analytical platform system that utilizes data from local government infrastructure cloud systems. [Solution] The system provides an analysis platform that receives standardized data from a municipal infrastructure cloud system on a closed network via interconnection, stores replicated data synchronized with the received standardized data, processes the replicated data through a predetermined data masking process to physically separate it from the replicated data and re-store it, reads the processed data upon request from a municipal terminal, generates visualization data on a dashboard, and manages the generation of replicated data, data masking process, re-storage of processed data, and generation of visualization data in a multi-tenant manner, separating each municipality individually. The data masking process performs anonymization processing corresponding to different levels of anonymization depending on the nature of the data being analyzed.

Description

Technical Field

[0001] The disclosure in this specification relates to an analysis-based system, and particularly to a system that generates various analysis results as visualization data based on standardized data on a local government infrastructure cloud system.

Background Art

[0002] For local governments, it is essential to conduct analyses using local government core business data such as the resident information unique to each local government in order to achieve evidence-based policy making and sustainable town planning. Making) and sustainable town planning.

[0003] For example, based on predetermined demographic information including information on the number of people in a predetermined area at a predetermined time, life information for a predetermined unit of time including information related to people's lives and behaviors, and area location information including information on locations for each section located at least in a predetermined area, an analysis device has been proposed that estimates the distribution of people in an area related to an analysis target area around a specific point designated by a user based on the relationship between the predetermined life information and the predetermined area location information (see, for example, Patent Document 1).

[0004] In addition, since the resident information includes personal information, it is necessary to process it into data that cannot identify an individual in accordance with the law regarding the protection of personal information so that it can be shared.

[0005] For example, a device has been proposed that acquires unstructured information and structured information each including specific personal information, creates a graph in which element information is systematically connected based on the acquired unstructured information and structured information, and anonymizes the graph (see, for example, Patent Document 2).

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

[0007] Incidentally, the Ministry of Internal Affairs and Communications' "Local Government DX (Digital Transformation) Promotion Plan" strongly calls for the development of digital infrastructure in all local governments. As part of this, the utilization of local government infrastructure cloud systems is recommended, alongside the "standardization and commonization of core business systems." Local government infrastructure cloud systems are systems that enable local governments nationwide to handle data in a common format, thereby contributing to operational efficiency, ensuring continuity, and disaster countermeasures, and are the foundation of local government DX that the national government is promoting.

[0008] The aforementioned analysis device obtains the basic information for its analysis (demographic information, lifestyle information, and regional location information) from sources such as mobile spatial statistics and private map data, and does not utilize data from the municipal cloud infrastructure system. Furthermore, even if data from the municipal cloud infrastructure system were to be utilized, if the data were to be downloaded locally by the municipality, personal information removed and processed to render it harmless, and then input into the analysis system on the internet, then from a security standpoint, such as protecting personal information, data conversion work would be required each time the data was input into the analysis system, potentially making operation cumbersome.

[0009] Furthermore, as with the conventional technologies described above, most data processing methods that prevent the identification of personal information employed only one type of processing, such as anonymization.

[0010] However, the diverse attribute data included in local government core business data requires different levels of anonymization depending on the nature of the data. Therefore, processing with a single type of anonymization method resulted in problems such as reduced analytical accuracy due to excessive information loss and the remaining risk of re-identification of anonymized data.

[0011] The disclosures in this specification are intended to address the above-mentioned problems, and the first objective is to provide an analytical platform system that utilizes and analyzes data from a municipal infrastructure cloud system with secure and simple operation. The second objective is to provide an analytical platform system that performs data anonymization processing corresponding to different levels of anonymization depending on the nature of the data to be analyzed. [Means for solving the problem]

[0012] To resolve the above issues, one aspect of the analysis platform system disclosed herein is a municipal infrastructure cloud system built on a closed network, which receives municipal core business data from municipal systems built individually by multiple municipalities, divided into multiple versions due to revisions, as linked data, and receives it through an intermediate database via interconnection within the closed network, and a receiving unit that receives it through an intermediate database. The receiving unit includes an analysis data storage unit that stores the replication data that has been duplicated in synchronization with the multiple versions of the linked data that have been received, A data processing unit that, by performing a predetermined data masking process according to the nature of the replication data read from the analysis data storage unit, physically separates the processed data from the replication data and re-stores it in the analysis data storage unit; A generation unit that, upon request from terminals of multiple municipalities connected via the closed network, reads the processed data from the analysis data storage unit and generates visualization data on a dashboard, The system includes a control unit that, upon completion of receiving standardized data by the receiving unit, controls the following based on tenant identification information assigned to the multiple local governments: an instruction to store the data in the analysis data storage unit, an instruction to perform data masking processing and re-storage to the analysis data unit by the data processing unit, and an instruction to generate visualization data by the generation unit.

[0013] This configuration allows standardized data from the municipal cloud infrastructure to be used directly as data for analysis within the closed network environment. Therefore, data transfer via the internet becomes unnecessary.

[0014] Furthermore, another aspect of the analysis platform system disclosed herein includes, as the data masking process, a pseudonymization processing unit that converts personal identifiers such as address number, household number, and national health insurance symbol number into hash values ​​by irreversible transformation for the replicated data; an anonymization processing unit that removes geographic information below a predetermined granularity from name information and address information; and a granularity reduction processing unit that converts the date of birth into a predetermined date. The anonymization processing unit includes an attribute generation process that adds school age information in conjunction with the deletion of the name information.

[0015] This configuration allows for data anonymization processes that correspond to different levels of anonymization depending on the nature of the data. [Effects of the Invention]

[0016] The analysis platform system of the present invention has the effect of enabling secure and easy analysis by utilizing standardized data from a municipal cloud system within a closed network without using external networks such as the internet. Furthermore, by performing anonymization processing corresponding to different levels of anonymization depending on the nature of the data, it is possible to prevent a decrease in analysis accuracy due to excessive information loss and the remaining risk of re-identification of anonymized data, thereby enabling secure analysis. [Brief explanation of the drawing]

[0017] [Figure 1] Figure 1 is a block diagram of the analysis infrastructure system. [Figure 2] Figure 2 is a basic processing flow diagram of the analysis platform system. [Figure 3] Figure 3 is a block diagram of the multi-tenant management function. [Figure 4] Figure 4 is a block diagram of the data processing unit. [Figure 5] Figure 5 is a flowchart of the data processing unit. [Figure 6] Figure 6 is a diagram showing an example of the processed data. [Figure 7] Figure 7 is a block diagram of the area information addition function. [Figure 8] Figure 8 is a flowchart of the area information addition function. [Figure 9] Figure 9 is a diagram showing an example of the processed data with school district information added. [Figure 10] Figure 10 is a block diagram of the data masking processing function corresponding to the version. [Figure 11] Figure 11 is a flowchart of the data masking processing corresponding to the version. [Figure 12] Figure 12 is a diagram showing the block configuration and data flow of the cross-tabulation processing function. [Figure 13] Figure 13 is a diagram showing an example of the visualized data displayed on the dashboard.

Embodiments for Carrying Out the Invention

[0018] Hereinafter, embodiments for implementing the disclosure according to this specification will be described while referring to the drawings. When subsequent embodiments have components corresponding to the previously described embodiments, the same reference numerals are given and duplicate explanations are omitted. Also, when only a part of the configuration is described in each embodiment, reference numerals of the previously described embodiments may be used for other parts of the configuration. Even when it is not explicitly stated that combinations are possible in each embodiment, embodiments can be partially combined with each other as long as there are no particular obstacles to such combinations. Also, the sizes of the components in the drawings are appropriately emphasized for ease of explanation and do not indicate actual dimensions and the ratios between components.

[0019] <Configuration of the System> Figure 1 is a block diagram of the analysis infrastructure system 1. The analysis infrastructure system 1 is connected to the municipal infrastructure cloud system B on a closed network C (a closed network exclusively for government use). Closed network C is a network exclusively for government use that is physically and logically separated from the internet. In other words, the analysis infrastructure system 1 is built directly within the same environment as the municipal infrastructure cloud system B, which is built on closed network C.

[0020] The municipal infrastructure cloud system B is connected to municipal systems L, which are built individually by multiple municipalities. Note that, for the sake of explanation, Figure 1 shows a configuration where a single municipal system L is connected; however, in reality, as will be described later, multiple municipal systems are connected.

[0021] From the local government system L, local government core business data, such as resident registration data for each local government, is transmitted to the local government infrastructure cloud system B via the closed network C. Multiple versions of the local government core business data are transmitted sequentially as revisions are made.

[0022] The municipal infrastructure cloud system B receives the aforementioned municipal core business data as linked data, divided into the aforementioned versions. The linked data is stored in the intermediate database B1 provided by the municipal infrastructure cloud system B.

[0023] The aforementioned linked data is transmitted to the receiving unit 11 of the analysis infrastructure system 1 via the intermediate database B1 without being output outside the closed network C. The local government infrastructure cloud system B and the analysis infrastructure system 1 are connected by interconnection P (peering).

[0024] The analysis data storage unit 12 stores the replication data that has been copied in synchronization with the linked data received by the receiving unit 11.

[0025] The data processing unit 13 reads the replication data from the analysis data storage unit 12 and, through a predetermined data masking process according to the nature of the replication data, physically separates the processed data from the replication data and re-stores it in the analysis data storage unit 12. The data masking process is a data abstraction that makes it impossible to identify personal information in order to appropriately protect personal information contained in the replication data.

[0026] The generation unit 14 reads the processed data from the analysis data storage unit 12 in response to requests from terminals of the municipal systems L of the multiple municipalities connected via a virtual communication network, and generates visualization data on the dashboard. The generated visualization data is output in a format that can be viewed by the terminals of the municipal systems L (not shown).

[0027] The master data registration unit 15 receives a basic data list from the local government system L via the intermediate database B1, which consists of at least the item data of the multiple versions of linked data and various attribute data corresponding to the item data, and registers it together with the data masking processing method data associated with the various attribute data, divided into the multiple versions.

[0028] The proprietary data reception unit 16 imports proprietary data that each local government has collected independently from the local government system L.

[0029] The configuration unit 17 receives a designation from the local government system L for an item containing a personal identifier included in the proprietary data, and sets up a pseudonymization process for the same item included in the replication data using the same method as the conversion to a hash value, which is one aspect of the data masking process.

[0030] The identifier conversion unit 18 converts the proprietary data into converted data for the specified item using the kana encoding process set in the setting unit 17.

[0031] The control unit 10 performs control to automatically adjust and manage the execution order and coordination of multiple tasks, services, and workloads. Specifically, for example, upon completion of receiving standardized data by the receiving unit 11, it controls the execution of data masking processing and re-storage to the analysis data unit 12 by the data processing unit 13, and the generation unit 14 to generate visualization data, based on tenant identification information assigned to the multiple local governments.

[0032] In this embodiment, although Figure 1 describes the functions such as the control unit 10, analysis data storage unit 12, and data processing unit 13 as being grouped together on a single server, these functions do not necessarily need to be implemented on a single physical or virtual server. For example, on a cloud infrastructure, a configuration may be adopted in which the above functions are distributed and realized by multiple services (services provided by servers) such as a workflow management service, an event-driven function execution environment, a data processing service, and a database service. Furthermore, as long as the control functions or processing functions equivalent to those of the "control unit 10," "analysis data storage unit 12," and "data processing unit 13" described in this embodiment can be realized through the cooperation of these services, any configuration is included within the technical scope of the present invention. In other words, a configuration can also be adopted in which each function is realized in a distributed manner using data processing services and workflow services of a cloud service infrastructure. Even in that case, as long as the control functions and data processing functions according to the present invention are substantially realized through the cooperation of the service group, it does not depart from the gist of the present invention.

[0033] Furthermore, the servers constituting the analysis platform system 1 disclosed herein (which may be a single server or multiple servers, as described above), and other terminals of the local government system L, all include a CPU (Central Processing Unit), RAM (memory), ROM (storage), and, if necessary, input devices such as a mouse and keyboard, and output devices such as a display. The CPU controls the system to read data stored in the storage or external storage device and output it to the display, etc., in accordance with instructions received from the input devices, etc. The CPU of the server, upon receiving a predetermined signal, reads a processing program stored in the storage into memory, and controls the system to output the data to the output device (e.g., a display) using the read processing program.

[0034] <Basic Processing Flow> Figure 2 is a basic processing flow diagram of the analysis infrastructure system. The receiving unit 11 of the analysis infrastructure system 1 receives the linked data from the intermediate database B1 of the local government infrastructure cloud system B (S11). The receiving unit 11 notifies the control unit 10 of the reception completion event.

[0035] Multiple versions of the data are sequentially transmitted from the intermediate database B1, and the replicated data, synchronized with the linked data, is stored in the analysis data storage unit 12 (S12).

[0036] The data processing unit 13 reads the stored replication data from the analysis data storage unit 12 under the read control of the control unit 10 (S13). The control unit 10 instructs the data processing unit 13 to execute a data masking job for the read replication data, and the data processing unit 13 executes a predetermined data masking process, i.e., various data masking processes, according to the nature of the replication data (S14). The replication data on which the data masking process has been performed is physically separated from the replication data and re-stored in the analysis data storage unit 12 as processed data under the storage control of the control unit 10 (S15).

[0037] In response to requests from terminals of the multiple municipal systems L connected via the closed network C, the generation unit 14 reads the processed data from the analysis data storage unit 12 (S16) and generates visualization data on the dashboard (S17). The connection between the terminals of the multiple municipal systems L and the closed network C is a connection including a virtual private communication channel, for example, SSL-VPN (Secure This may be done via a Sockets Layer (Virtual Private Network).

[0038] The control unit 10 may be a PULL type that periodically polls and, upon detecting the reception completion event, issues instructions for subsequent processing, namely read control, data masking processing job execution, storage control, and visualization data generation, or a PUSH type that immediately executes orchestration when the reception completion event occurs in the receiving unit 11.

[0039] <Multi-tenant management function> Figure 3 is a block diagram of the multi-tenant management function in the analysis infrastructure system 1. In the analysis infrastructure system 1, physical resources such as the analysis data storage unit 12, data processing unit 13, and generation unit 14 described in Figure 1 are virtually divided to form multiple areas. These areas are used as dedicated areas for multiple local governments, distinguished by the tenant information.

[0040] The multi-tenant management function is controlled by the control unit 10. Specifically, based on the tenant identification information, the control unit 10 independently controls the following processes in association with the multiple local governments: storage by the analysis data storage unit 12, data masking processing in the data pipeline environment and re-storage to the analysis data storage unit 12 by the data processing unit 13, and the generation of visualization data by the generation unit 14.

[0041] The data from each of the aforementioned municipalities (as shown in Figure 3, for example, Municipality A, Municipality B...Municipality N) is stored in the intermediate database B1 of the municipal infrastructure cloud system B, and is received by the receiving unit 11 of the analysis infrastructure system 1. Subsequently, the receiving unit 11 notifies the control unit 10 of the completion event for receiving each of the aforementioned municipalities' data.

[0042] The analysis data storage unit 12 receives instructions from the control unit 10, which has received the notification, to control the import of each linked data, and stores the replicated data that has been duplicated in synchronization with the linked data of municipalities A, B, ... N. The analysis data storage unit 12 has an analysis data storage unit 12a for municipality A, an analysis data storage unit 12b for municipality B, and an analysis data storage unit 12n for municipality N, which are logically separated for each municipality, and stores the replicated data without mixing them. That is, the replicated data of municipality A is stored in the analysis data storage unit 12a for municipality A, the replicated data of municipality B is stored in the analysis data storage unit 12b for municipality B, and the replicated data of municipality N is stored in the analysis data storage unit 12n for municipality N.

[0043] The data processing unit 13 receives instructions from the control unit 10 to determine the version and tenant of the replication data for each municipality A, B, ... N, and to execute a data masking job. The data processing unit 13 then performs the data masking process and re-stores the processed data in the analysis data storage unit 12. The data processing unit 13 is also composed of a data processing unit 13a for municipality A, a data processing unit 13b for municipality B, and a data processing unit 13n for municipality N, each independently performing the data masking process and re-storing the processed data. Due to the multi-tenant management function, the processing of the data processing unit 13 is separated by municipality. That is, the data pipeline for municipality A processes only the replication data for municipality A, the data pipeline for municipality B processes only the replication data for municipality B, and the data pipeline for municipality N processes only the replication data for municipality N.

[0044] The generation unit 14, upon completion of the re-storage of the processed data for each local government, receives an instruction from the control unit 10 to generate visualization data and generates visualization data on a dashboard dedicated to each local government. Specifically, when the control unit 10 issues an instruction to generate visualization data in response to a request from terminal Lta of local government A, which is connected via the closed network C, the generation unit 14a for local government A reads the processed data from the analysis data storage unit 12a for local government A, saves it as a data source, and displays the generated visualization data on the dashboard so that it can be viewed on terminal Lta of local government A. Similarly, when the control unit 10 issues an instruction to generate visualization data in response to a request from terminal Ltb of local government B, which is connected via the closed network C, the generation unit 14b for local government B reads the processed data from the analysis data storage unit 12b for local government B, saves it as a data source, and displays the generated visualization data on the dashboard so that it can be viewed on terminal Ltb of local government B. Furthermore, in response to a request from terminal Ltn of municipality N, which is connected via the closed network C, the control unit 10 issues an instruction to generate visualization data. The generation unit 14n for municipality N reads the processed data from the analysis data storage unit 12n for municipality N, saves it as a data source, and displays the generated visualization data on the dashboard so that it can be viewed on terminal Ltn of municipality N. The control unit 10 also controls access to the visualization sites of each municipality's terminals (terminal Lta of municipality A, terminal Ltb of municipality B... terminal Ltn of municipality N) based on tenant identification information, thereby separating the scope of viewing the visualization data for each municipality.

[0045] As described above, the multi-tenant management function of the analysis platform system 1 ensures that even when multiple local governments process data on the same analysis platform system 1, the data, processing, and visualization layers are logically separated and maintained independently, preventing information mixing between local governments.

[0046] <Data Processing Department> Figure 4 is a block diagram of the data processing unit 13. As explained in Figure 1, the data processing unit 13 performs predetermined data masking processing according to the nature of the replication data, and is composed of, for example, a pseudonymization processing unit 131, an anonymization processing unit 132, and a granularity reduction processing unit 133.

[0047] The kana encoding processing unit 131 converts the personal identifiers of the address number, household number, and national health insurance symbol number in the replication data into hash values ​​using irreversible transformation (i.e., identifier transformation using a one-way function). This hash value transformation is a process that allows for internal key management but makes it difficult to restore the original information.

[0048] The anonymization processing unit 132 removes geographic information below a predetermined granularity from name information and address information. For example, all name information is deleted due to the high risk of re-identification, while address information is only partially deleted, such as removing the street number, in order to maintain its usefulness for analysis (coarser geocoding). In other words, the anonymization processing unit 132 performs processing that reduces the likelihood of personal identification while increasing the usability for policy implementation.

[0049] Furthermore, the anonymization processing unit 132 includes an attribute generation process that adds school age information in conjunction with the deletion of the name information. This attribute generation process also enhances the policy-making usability of the data.

[0050] The granularity reduction processing unit 133 converts the date of birth to a predetermined date (for example, the last day of each month), that is, it "rounds" the date.

[0051] Figure 5 is a processing flow diagram of the data processing unit 13. When the data processing unit 13 receives a control instruction for data masking processing from the control unit 10 (S21), it reads the replication data from the analysis data storage unit 12 (S22). For the replication data read, it first determines whether the data to be subjected to data masking processing is the data to be subjected to pseudonymization processing (S23).

[0052] In the case of data subject to the aforementioned pseudonymization process, for example, address numbers, household numbers, and national health insurance symbol numbers (Y in S23), hashing is performed (S24). The pseudonymized target data is then re-stored in the analysis data storage unit 12 as processed data (S29).

[0053] If the data is not subject to the aforementioned pseudonymization process (N in S23), it is determined whether the data subject to data masking is subject to anonymization (S25).

[0054] In the case of data subject to the anonymization process, for example, name information and address information (S25Y), a deletion process is performed (S26). In the case of name information, the deletion process deletes everything, but in the case of address information, for example, everything below the street number is deleted. Furthermore, an attribute generation process is performed to add school age information (S27). The anonymized target data (including the data after the attribute generation process) is re-stored in the analysis data storage unit 12 as processed data (S29).

[0055] If the data is not subject to the anonymization process (N in S25), a granularity reduction process is performed, for example, converting the date of birth to a predetermined date (for example, the last day of each month) (S28). The anonymized target data is then re-stored in the analysis data storage unit 12 as processed data (S29).

[0056] The processing flow in Figure 5 shows an example where the target data is determined in the order of pseudonymization, anonymization, and granularity reduction, for the sake of explanation. However, this order is not intended to be fixed. Any order is acceptable as long as multiple processes (pseudonymization, anonymization, and granularity reduction) are combined to process the data pipeline in a single operation.

[0057] Figure 6 shows an example of the processed data. Normally, the address number is a number of about 8 digits, the household number is a number of about 6 digits, and the national health insurance symbol number is a 2-digit symbol and a number of about 6 digits, but through the aforementioned pseudonymization process, they are converted into hash values ​​such as "33379201f808...", "C1f24d6739f3...", and "39281e7d5c0b...". The name is deleted (N / A) through the aforementioned anonymization process. The date of birth is rounded to the end of the month by the aforementioned granularity reduction process, for example, "19580331" (March 31, 1985). In other words, the date of birth is processed so that personal information cannot be identified by the aforementioned granularity reduction process, but the age based on the rounded date of birth is recorded as processed data. The address is anonymized by the aforementioned anonymization process, so that the street number and below are deleted, for example, "○○ City □□ Ward △△ Town". In addition, following the deletion of the aforementioned name, the school age is added through the attribute generation process.

[0058] However, if the anonymization processing unit 132 removes the street number and below from the address information, it may become impossible to perform effective analyses and policy formulation. Therefore, as a solution to the trade-off of reducing personal identification through the data masking process while retaining the information necessary for analysis, the analysis data infrastructure system 1 is equipped with a sequence control means that performs the anonymization process of address information after the addition of area data by the anonymization processing unit 132.

[0059] The aforementioned area data is a category that includes multiple addresses set for a specific purpose. Specifically, it includes prefectures, cities, towns, and villages (standard items in the basic data list), as well as administrative districts, uniquely designated areas (regional districts, district plans, urban regeneration special zones, landscape districts, etc., set independently by each local government), and school districts (elementary school districts, junior high school districts). If this area data is added according to the purpose of aggregation, analysis, or policy formulation, an output that meets the intended purpose can be obtained even if some of the address information is missing (deletion of street number and below).

[0060] Figure 7 is a diagram showing the configuration of the sequence control means. The analysis infrastructure system 1 includes a receiving unit 11 that receives the linked data, an analysis data storage unit 12 that stores the linked data received by the receiving unit 11 as replication data, and a regional data registration unit 19 that registers data corresponding the address information received from the local government system L via the receiving unit 11 to regional information of a predetermined category to which the address constituting the address information belongs.

[0061] Figure 8 is a processing flow diagram of the sequence control means. The area data registration unit 19 receives the area information from the local government system L (S31) and registers it (S32). If the address constituting the address information is an address belonging to a predetermined category (Y in S33), the data processing unit 13 reads the area information to which the address information belongs from the area data registration unit 19 (S34) and performs attribute generation processing to add area information to the address information (S35). After adding area information, it performs an anonymization process to delete the street number and subsequent parts of the address (S36) and stores the processed data in the analysis data storage unit 12. If the address constituting the address information is an address that does not belong to a predetermined category (N in S33), it performs an anonymization process to delete the street number and subsequent parts of the address without performing attribute generation processing to add area information (S36) and stores the processed data in the analysis data storage unit 12.

[0062] Figure 9 shows an example of processed data with school district information added as area information. The household number converted to a hash value (for example, "e7d5c0b1f738") is associated with address information with the street number and below removed (for example, "XX City □□ Ward △△ Town"). If the address constituting this address information belongs to a designated school district, school district information (for example, "XX Junior High School District") is added. In this processed data, the street number and below the address information are removed after the school district information is added. In other words, the process of identifying the school district based on the address information is performed prior to the anonymization process. Subsequently, by removing the street number and below, it is possible to perform statistical analysis at the school district level while preventing the identification of personal information. As a result, the processed data includes "address information at the town / district level" and "school district information," and can hold data that is useful for formulating educational policies and regional measures.

[0063] <Data masking process corresponding to version (version)> Figure 10 is a block diagram of the data masking processing function corresponding to the version of the linked data. The Ministry of Internal Affairs and Communications provides a standardized format for data items such as the Basic Resident Register, but revisions (addition, deletion, and modification of items) are made periodically. Therefore, multiple versions exist chronologically with each revision, but since each local government adopts a different version, it is necessary to be able to flexibly handle data masking processing for data of different versions.

[0064] The analysis platform system 1 according to this embodiment manages items in the master data registration unit for multiple versions of the basic data list resulting from the modifications, separately from the linked data. Each time a revision is made, it can be used simply by adding or modifying the master data, without having to modify the system (program) for the linked data.

[0065] In other words, the system has a master data registration unit 15 that receives a basic data list from the local government system L via the intermediate database B1, consisting of at least the item data of the multiple versions of linked data and various attribute data corresponding to the item data, and registers it together with the data masking processing method data associated with the various attribute data, divided into the multiple versions. In this embodiment, the linked data used in the local government system L employs two versions: version 3.1 (50 items) and version 4.1 (60 items).

[0066] The aforementioned attribute data includes the four basic pieces of information recorded on the resident register (name, date of birth, gender, and address), as well as the resident register code (or internal address number within the local government), household number and head of household name, and national health insurance symbol number.

[0067] The control unit 10 identifies the version numbers of the multiple versions (version 3.1 and version 4.1 in Figure 10) from the master data registration unit 15 and obtains the format data corresponding to the item data of the basic data list for the respective versions.

[0068] The data processing unit 13 applies data masking processing based on the format data acquired by the control unit 10 and re-stores the processed data in the analysis data storage unit 12.

[0069] Figure 10 shows the Resident Basic Register table as an example of a table registered in the Master Data Registration Unit 15. The format data associated with the item name "Resident Basic Number" in the Resident Basic Register table is "hashed" (a process that converts to a hash value by irreversible transformation by the Kana conversion processing unit 131). Therefore, the data processing unit 13 obtains "hashed" as the format (data masking processing rule) and performs the hashing process for the Resident Basic Number.

[0070] Figure 11 is a data masking processing flow diagram corresponding to the version. The master data registration unit 15 receives the basic data list by version (S41). Here, "by version" means by the version provided each time the basic data list is revised, and is usually provided sequentially in chronological order.

[0071] The master data registration unit 15, upon receiving the basic data list, associates each item in the basic data list with the data masking processing method data (S42) and registers it as master data (S43). In other words, it manages the items of the basic data list as master data and defines which data masking processing (deletion, hashing, rounding, appending, etc.) to apply to which item.

[0072] The control unit 10 identifies the version numbers of multiple versions received separately from the master data registration unit 15 (S44), and obtains the format data corresponding to the item data in the basic data list of the version (S45).

[0073] The data processing unit 13 applies data masking processing based on the acquired data format by the control unit 10 (S46). In other words, the processing specifications are determined at runtime. Therefore, this data masking processing can be performed, for example, using dynamic SQL. The processed data obtained by performing the data masking processing is then re-stored in the analysis data storage unit 12 (S47).

[0074] As described above, the processing specifications for data masking are stored in the master data registration unit 15, and the processing content is variably configured at runtime based on these specifications. Therefore, even if the standard format of the resident registry data is revised, data masking can be applied simply by updating the data in the master data registration unit 15, eliminating the need to modify the program itself. In other words, instead of having to modify the script for data masking (ETL script) every time the version changes, processed data corresponding to the version revision can be obtained simply by modifying the master data.

[0075] <Cross-tabulation processing function> Figure 12 shows the block structure and data flow of the cross-tabulation processing function. The solid arrows indicate the processing flow between each component of the analysis platform system 1, and the dashed arrows indicate the data flow acquired, generated, etc., by each of the components.

[0076] The visualization data generated by the generation unit 14 may include not only the processed data, but also data such as questionnaires collected independently by each local government (hereinafter referred to as "proprietary data"), which may be included in the cross-tabulation that combines the processed data with the data.

[0077] However, the address numbers in the processed data are address numbers after kanaization (hashing), whereas the address numbers in the proprietary data are raw data that has not been hashed. Therefore, the processed data and the proprietary data cannot be matched, and cross-tabulation is not possible.

[0078] The analysis platform system 1 according to this embodiment can integrate the proprietary data and the processed data having the same address number, perform the cross-tabulation, and generate the visualization data.

[0079] The proprietary data receiving unit 16 of the analysis platform system 1 receives proprietary data D21 (for example, actual data "123456") collected independently by each local government from the local government system L. The proprietary data receiving unit 16 receives the proprietary data D21 from the local government system L via the closed network C.

[0080] Furthermore, the configuration unit 17 of the analysis platform system 1 receives the designation of items containing personal identifiers included in the proprietary data D21 from the local government system L, and sets up a pseudonymization process for the same items included in the replication data using the same method as the conversion to hash values ​​by the pseudonymization processing unit 131. The configuration unit 17 also receives the designation of items containing personal identifiers from the local government system L via the closed network C.

[0081] Furthermore, the arrangement (item names, column names) of the proprietary data D21 is highly likely to differ among local governments. Therefore, a user interface should be provided on the terminal of the local government system L that allows staff to select and specify which items to apply the aforementioned kana encoding process to.

[0082] The identifier conversion unit 18 converts the original data D21 to converted data D22 for the specified item using the kana encoding process set in the setting unit 17. For example, the actual data "123456" is converted to a hash value "AABBCCDD".

[0083] On the other hand, as explained in Figure 1, etc., the local government core business data D11 (for example, actual data "123456") is received from the local government system L as linked data D12 by the receiving unit 11 of the analysis platform system 1 via the intermediate database B1 of the local government infrastructure cloud system B.

[0084] The linked data D12 received by the receiving unit 11 is stored in the analysis data storage unit 12 as replication data D13. The data processing unit 13 (pseudonymization processing unit 131) reads the replication data from the analysis data storage unit 12 and converts it into processed data D14 through pseudonymization processing. For example, the actual data "123456" is converted into a hash value "AABBCCDD".

[0085] Furthermore, the data processing unit 13 matches the items of the processed data D14 and the items of the converted data D22 using the same hash key D31 and re-stores them in the analysis data storage unit 12.

[0086] The generation unit 14 generates visualization data D32, which is cross-tabulated based on the matched processed data D14 and converted data D22.

[0087] As described above, the cross-tabulation processing function in this embodiment can safely and uniformly combine two sets of data generated in different environments and perform aggregation processing.

[0088] <Example of visualized data> Figure 13 shows an example of visualization data generated on the dashboard by the generation unit 14. In Figure 13, the upper visualization data is the regional analysis dashboard, and the lower visualization data is the health checkup overview dashboard.

[0089] The technology disclosed in this specification is not limited to the embodiments described above. That is, it encompasses the exemplary embodiments and variations thereof by those skilled in the art. It also encompasses the substitution or combination of components, elements between one embodiment and another. Furthermore, the scope of the disclosed technology is not limited to the descriptions of the embodiments. The scope of the disclosed technology is indicated by the claims and further includes all modifications within the meaning and scope equivalent to the claims. [Explanation of symbols]

[0090] L Local Government System C Closed Network B. Local Government Infrastructure Cloud System B1 Intermediate Database P interconnection 1. Analysis Platform System 10 Control Unit 11 Receiving unit 12 Analysis Data Storage Unit 13 Data Processing Department 14 Generation part 15 Master Data Registration Department 16. Proprietary Data Reception Department 17. Settings Section 18 Identifier Conversion Unit 19 Area Data Registration Section 131 Kana Conversion Processing Unit 132 Anonymization Processing Unit 133 Particle size reduction processing unit D11 Local Government Core Business Data D12 Linked Data D13 Replication Data D14 Data after processing D21 Proprietary Data D22 converted data D31 Same hash key D32 Visualization Data

Claims

1. A municipal infrastructure cloud system built on a closed network receives municipal core business data from municipal systems built individually by multiple municipalities, divided into multiple versions due to revisions, as linked data, and receives it via an intermediate database through interconnection within the closed network, with a receiving unit that receives the data. The receiving unit includes an analysis data storage unit that stores the replication data that has been duplicated in synchronization with the multiple versions of the linked data that have been received, A data processing unit that, by performing a predetermined data masking process according to the nature of the replication data read from the analysis data storage unit, physically separates the processed data from the replication data and re-stores it in the analysis data storage unit; A generation unit that, upon request from terminals of multiple municipalities connected via the closed network, reads the processed data from the analysis data storage unit and generates visualization data on a dashboard, An analysis platform system having a control unit that, upon completion of receiving standardized data by the receiving unit, controls the following based on tenant identification information assigned to the multiple local governments: an instruction to store the data in the analysis data storage unit, an instruction to perform data masking processing and re-storage to the analysis data unit by the data processing unit, and an instruction to generate visualization data by the generation unit.

2. The analysis platform system according to claim 1, wherein the control unit independently controls the data masking process, the storage and re-storage process, and the visualization data generation process in the data pipeline environment in association with the multiple local governments, based on the tenant identification information.

3. The data processing unit includes, as part of the data masking process, a pseudonymization processing unit that converts personal identifiers such as address number, household number, and national health insurance symbol number into hash values ​​by irreversible transformation for the replicated data; an anonymization processing unit that removes geographic information below a predetermined granularity from name information and address information; and a granularity reduction processing unit that converts the date of birth into a predetermined date. The analysis platform system according to claim 1, wherein the anonymization processing unit includes an attribute generation process that adds school age information in conjunction with the deletion of the name information.

4. The system includes a local government system, a local area data registration unit that registers data relating the address information received via the receiving unit to the local area information of a predetermined category to which the address constituting the address information belongs, The analysis platform system according to claim 3, wherein the anonymization processing unit reads the area information to which the address information belongs from the area data registration unit, performs attribute generation processing to be added to the address information, and then deletes the part of the address information below the street number.

5. The receiving unit receives a basic data list from the municipal system via the intermediate database, which consists of at least the item data of the multiple versions of linked data and various attribute data corresponding to the item data. The master data registration unit registers this basic data list, along with the data masking processing method data associated with the various attribute data, in multiple versions. The control unit identifies the version numbers of the multiple versions from the master data registration unit, and obtains the format data corresponding to the item data of the basic data list of the version. The analysis platform system according to claim 1, wherein the data processing unit applies data masking processing using the method data acquired by the control unit and re-stores the processed data in the analysis data storage unit.

6. From the aforementioned municipal system, each municipality has its own data reception unit that imports its own independently collected data, A setting unit receives a designation from the municipal system for an item containing a personal identifier included in the proprietary data, and sets up a pseudonymization process for the same item included in the replication data using the same method as the conversion to a hash value by the pseudonymization processing unit, The system includes an identifier conversion unit that converts the proprietary data into converted data using the kana encoding process set in the setting unit for the specified items, The data processing unit matches the items of the processed data and the items of the converted data using the same hash key and re-stores them in the analysis data storage unit. The analysis platform system according to claim 3, wherein the generation unit generates cross-tabulated visualization data based on the matched processed data and converted data.

Images