Information processing device and privacy-protected data linkage system

Abstract

An information processing device (10) holds user data including user IDs and attribute information relating to users, and comprises: an encryption unit (11) that encrypts user IDs in user data to be aggregated on the basis of a self-cypher key held by the device itself and a keyed one-way commutative operation, and encrypts the attribute information in the user data by a homomorphic encryption scheme capable of aggregation processing, thereby generating encrypted user data of the user data; an aggregation processing unit (12) that counts the number of encrypted user data sharing the attribute information, thereby generating encrypted aggregated data; and a concealment processing unit (13) that executes concealment processing on the generated encrypted aggregated data, thereby generating encrypted statistical information.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus and a privacy protection data sharing system.

Background Art

[0002] When performing statistical analysis or the like on confidential user data managed in a database in information processing apparatuses (apparatuses widely including computers, servers, etc., hereinafter referred to as "apparatuses") of multiple organizations, it is necessary to take some measures from the perspective of privacy protection. As an example of the above measures, a technique for integrating both pieces of data while keeping the data to be kept confidential confidential by means of a system configuration having an interface capable of handling both the data to be kept confidential and the data that may be disclosed is known (Patent Document 1 below).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, in the technique of Patent Document 1, it is essential to select data to be kept confidential from the input user data, and it is not assumed until the case where the data that may be disclosed is not included in the user data, that is, the entire input user data is subject to anonymization, and there is room for improvement in this regard.

[0005] Also, in an information processing apparatus of a single organization, for example, when performing statistical analysis or the like on user data including information on users to be kept confidential (hereinafter referred to as "attribute information"), it is eagerly desired to prevent leakage of information to be kept confidential and eliminate the risk of privacy infringement by generating statistical information in which the correspondence with individuals is excluded.

[0006] This disclosure aims to prevent the leakage of confidential information and eliminate the risk of privacy violations by generating statistical information that excludes any correspondence with individuals. [Means for solving the problem]

[0007] The information processing device relating to this disclosure is an information processing device that holds user data including a user ID and attribute information relating to a user, and generates statistical information relating to a target user, and comprises: an encryption unit that generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by the device, and by encrypting the attribute information in the user data to be aggregated using a homomorphic encryption scheme capable of aggregation processing; an aggregation processing unit that generates encrypted aggregated data by counting the number of encrypted user data that share the same attribute information with the encrypted user data generated by the encryption unit; and a privacy processing unit that generates encrypted statistical information by performing privacy processing on the encrypted aggregated data generated by the aggregation processing unit.

[0008] In the above-described information processing device, the encryption unit encrypts the user ID in the user data to be aggregated based on a self-encrypting key held by the device and a keyed one-way commutative operation, and also encrypts the attribute information in the same user data using a homomorphic encryption scheme that enables aggregation processing, thereby generating encrypted user data for the user data to be aggregated. The order in which the encryption of user IDs and attribute information is performed is arbitrary. The aggregation processing unit then generates encrypted aggregated data by counting the number of encrypted user data entries with common attribute information among the encrypted user data generated by the encryption unit. This count is performed, for example, by categorizing multiple records constituting encrypted user data represented as binary values ​​by corresponding parts of the attribute information, and then summing them vertically (with identical bits in the bit sequence) for each category. Furthermore, the concealment processing unit performs concealment processing on the generated encrypted aggregated data to generate encrypted statistical information. As a result, by generating statistical information that excludes correspondence with individuals, it is possible to prevent the leakage of confidential information and eliminate the risk of privacy infringement. [Effects of the Invention]

[0009] According to this disclosure, by generating statistical information that excludes correspondences with individuals, it is possible to prevent the leakage of confidential information and eliminate the risk of privacy violations. [Brief explanation of the drawing]

[0010] [Figure 1] This is a configuration diagram of the information processing device according to the first embodiment. [Figure 2] This is a flowchart showing the processes performed in the information processing device according to the first embodiment. [Figure 3] (a) is a diagram illustrating the input of user data, (b) is a diagram illustrating the encryption of user IDs, and (c) is a diagram illustrating the encryption of attribute information. [Figure 4](a) is a diagram to explain the aggregation process, (b) is a diagram to explain the concealment process, and (c) is a diagram to explain the decryption process. [Figure 5] This is a diagram illustrating the configuration of the privacy-protecting data sharing system according to the second embodiment. [Figure 6] This is a flowchart showing the processes performed in the privacy-protecting data linkage system according to the second embodiment. [Figure 7] (a) is a diagram illustrating the input of user data, and (b) is a diagram illustrating the anonymization process. [Figure 8] This diagram illustrates the irreversible transformation of IDs. [Figure 9] This is a diagram to explain ID encryption. [Figure 10] (a) is a diagram illustrating the encryption of attribute information, and (b) is a diagram illustrating the sending and receiving of encrypted IDs. [Figure 11] This is a diagram to explain ID re-encryption. [Figure 12] This is a diagram to explain data matching. [Figure 13] This is a diagram to explain the aggregation process. [Figure 14] This is a diagram to explain the confidentiality process. [Figure 15] This is a diagram to explain the decoding process. [Figure 16] This figure shows a modified example of the configuration of the information processing device according to the first embodiment. [Figure 17] This figure shows a modified example of the configuration of the privacy-protecting data linkage system according to the second embodiment. [Figure 18] This figure shows another modified example of the configuration of the privacy-protecting data linkage system according to the second embodiment. [Figure 19] This figure shows a modified example of the configuration of a privacy-protecting data linkage system that does not require attribute information as a mandatory requirement, but aggregates user data that includes at least the user ID. [Figure 20]It is a flowchart showing the processes executed in the privacy protection data linkage system of FIG. 19. [Figure 21] It is a diagram showing an example of the hardware configuration of an information processing apparatus.

Embodiments for Carrying Out the Invention

[0011] Hereinafter, various embodiments according to the present disclosure will be described with reference to the drawings. Hereinafter, as a first embodiment, in an information processing apparatus of a single organization, an embodiment of generating statistical information for which the correspondence with individuals is excluded, targeting user data including attribute information to be kept confidential will be described. As a second embodiment, an embodiment of generating statistical information for which the correspondence with individuals is excluded by the cooperation between one of a plurality of devices and a partner device in a privacy protection data linkage system having a plurality of devices that hold user data including user IDs and attribute information regarding users will be described.

[0012] (First Embodiment) As shown in FIG. 1, the information processing apparatus 10 in the first embodiment includes an encryption unit 11, a totaling processing unit 12, and a confidentiality processing unit 13 as the minimum necessary components for generating statistical information for which the correspondence with individuals is excluded by itself, and further includes a decryption unit 14 as a component for restoring the generated statistical information. Hereinafter, the functions of each unit will be described.

[0013] The encryption unit 11 acquires user data including a user ID and attribute information regarding the user from an external device, encrypts the user ID in the user data to be totaled based on its own encryption key held by its own device and a keyed one-way convertible operation, and encrypts the attribute information in the user data to be totaled by a homomorphic encryption method capable of totaling processing, thereby generating encrypted user data regarding the user data to be totaled. The encryption unit 11 includes an ID encryption unit 11A having a function of encrypting the user ID and an attribute information encryption unit 11B having a function of encrypting the attribute information. Note that the execution order of encrypting the user ID and encrypting the attribute information may be either first, and is arbitrary.

[0014] The aggregation processing unit 12 is a functional unit that generates encrypted aggregated data by counting the number of encrypted user data entries with common attribute information among the encrypted user data generated by the encryption unit 11. The counting method will be described later.

[0015] The confidentiality processing unit 13 is a functional unit that performs confidentiality processing on encrypted aggregate data generated by the aggregation processing unit 12 and generates encrypted statistical information.

[0016] The decryption unit 14 is a functional unit that decrypts encrypted statistical information generated by the confidentiality processing unit 13 based on a decryption method corresponding to the encryption performed by the encryption unit 11, and outputs the obtained statistical information to an external device.

[0017] Next, the processes executed in the information processing device 10 will be explained using Figures 2, 3(a) to 3(c), and 4(a) to 4(c).

[0018] First, the user data to be aggregated is input into the encryption unit 11 (step S1 in Figure 2). The user data input here includes a user ID and attribute information about the user, as shown in Figure 3(a). For example, a telephone number is used as the user ID, and attribute information such as gender, age, and purchase frequency are exemplified.

[0019] Next, as shown in Figure 3(b), the ID encryption unit 11A in the encryption unit 11 encrypts the user ID in the user data with a pre-prepared secret key a, and obtains ID-encrypted data (step S2).

[0020] Next, as shown in Figure 3(c), the attribute information encryption unit 11B in the encryption unit 11 encrypts the attribute information in the ID encrypted data with a pre-prepared secret key A to obtain encrypted user data (step S3).

[0021] Next, as shown in Figure 4(a), the aggregation processing unit 12 generates encrypted aggregate data (step S4) by counting the number of encrypted user data entries with common attribute information among the encrypted user data generated by the encryption unit 11. This count is performed, for example, by categorizing multiple records that make up the encrypted user data represented by binary values ​​based on corresponding parts of the attribute information, and then summing them vertically (with identical bits in the bit sequence) for each category. After generating the encrypted aggregate data, the user ID is no longer needed, so the aggregation processing unit 12 removes the user ID and generates the encrypted aggregate data.

[0022] Next, as shown in Figure 4(b), the concealment processing unit 13 performs concealment processing on the encrypted aggregated data generated by the aggregation processing unit 12 to generate encrypted statistical information (step S5). For example, Figure 4(b) shows an example in which noise is added to the aggregation results in the encrypted aggregated data to generate encrypted statistical information that includes the aggregated results with noise added. In this way, "encrypted statistical information" is generated as statistical information from which the correspondence with individuals has been excluded.

[0023] Furthermore, as shown in Figure 4(c), the decryption unit 14 uses a decryption method corresponding to the encryption performed by the encryption unit 11 to decrypt the encrypted statistical information generated by the confidentiality processing unit 13, and outputs the obtained plaintext statistical information to an external device (step S6).

[0024] According to the first embodiment described above, since "encrypted statistical information" is generated as statistical information that excludes correspondence with individuals, the standalone information processing device 10 can prevent the leakage of attribute information that should be kept confidential and eliminate the risk of privacy infringement.

[0025] (Second Embodiment) Next, as a second embodiment, we will describe an embodiment in which a privacy-protecting data linkage system has multiple devices that hold user data including user IDs and attribute information about users, and in which statistical information that excludes correspondence with individuals is generated by the linkage between one of the multiple devices and the other device.

[0026] As shown in Figure 5, the privacy protection data linkage system 1 in the second embodiment has "Company A's device" (hereinafter referred to as "device 20A") as one device and "Company B's device" (hereinafter referred to as "device 20B") as the counterparty device.

[0027] Device 20A comprises an anonymization processing unit 21, an irreversible ID conversion unit 22, an encryption unit 23, a data transmission / reception unit 24, a data matching unit 25, an aggregation processing unit 26, and a confidentiality processing unit 27. Device 20B, on the other hand, comprises an anonymization processing unit 21, an irreversible ID conversion unit 22, an encryption unit 23, a data transmission / reception unit 24, and a decryption unit 28. The functions of each unit will be described below.

[0028] The anonymization processing unit 21 is a functional unit that performs privacy protection processing on attribute information targeting user data held by its own device prior to the encryption of the user ID, and is provided in common to devices 20A and 20B. For example, one or more of the following privacy protection methods may be employed: k-anonymization, l-diversity, and t-approximation. An example of performing k-anonymization will be described later.

[0029] The ID irreversible conversion unit 22 is a functional unit that performs an irreversible conversion process to a user ID on user data held by its own device prior to the encryption of the user ID, and is provided in common to devices 20A and 20B. The above irreversible conversion process includes a hashing process, and after the ID irreversible conversion unit 22 performs the hashing process to the user ID, it discards the salt used in the hashing process.

[0030] The encryption unit 23 provided in the device 20A is a functional unit that generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by the device itself, and includes an ID encryption unit 23A that performs this functional operation.

[0031] In contrast, the encryption unit 23 provided in the device 20B is a functional unit that generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by the device itself, and by encrypting the attribute information in the user data to be aggregated using a homomorphic encryption scheme that can be aggregated. It includes an ID encryption unit 23A that has the function of encrypting the user ID and an attribute information encryption unit 23B that has the function of encrypting the attribute information. Note that the execution order of the encryption of the user ID and the encryption of the attribute information can be either first or second, and is arbitrary.

[0032] The data transmission / reception unit 24 is a functional unit that transmits and receives encrypted user data, and is provided in common to devices 20A and 20B.

[0033] The data matching unit 25 is a functional unit that matches the encrypted user data of device 20A, generated by the encryption unit 23 of device 20A, with the encrypted user data of device 20B, which is the counterpart device, based on the user ID corresponding portion identified based on predetermined user data structure information, and is provided in device 20A.

[0034] The aggregation processing unit 26 is a functional unit located in device 20A that generates encrypted aggregated data for a target user by counting the number of encrypted user data entries whose user IDs match as a result of matching by the data matching unit 25. The counting method will be described later.

[0035] The confidentiality processing unit 27 is a functional unit that performs confidentiality processing on encrypted aggregate data generated by the aggregation processing unit 26 to generate encrypted statistical information, and is located in the device 20A.

[0036] The decryption unit 28 is a functional unit that decrypts encrypted statistical information transmitted from the device 20A based on a decryption method corresponding to the encryption performed by the attribute information encryption unit 23B, and outputs the obtained statistical information to an external device. It is located in the device 20B.

[0037] Next, we will explain the processes performed in the privacy protection data linkage system 1 using Figures 6 to 15.

[0038] First, in devices 20A and 20B, the user data to be aggregated is input to the anonymization processing unit 21 (steps A1 and B1 in Figure 6). As shown in Figure 7(a), the user data of company A input here includes a user ID and attribute information about the user. For example, a telephone number is used as the user ID, and attribute information such as gender, age, and purchase frequency are examples of the data. Similarly, the user data of company B input also includes a user ID and attribute information about the user. A telephone number is used as the user ID, and attribute information such as distance traveled estimated from location information is an example of the data.

[0039] Next, as shown in Figure 7(b), in each of the devices 20A and 20B, the anonymization processing unit 21 performs anonymization processing as a process for protecting the privacy of attribute information for the user data held by its own device (steps A2 and B2). Here, we illustrate k-anonymization, which reduces the probability of an individual being identified to less than 1 / k by transforming the user data so that there are k or more user data with the same attribute information (satisfying k-anonymity). For example, with k-anonymization set to k=2, in the attribute information (travel distance estimated from location information) of Company B's user data, both the attribute information of 11km and the attribute information of 12km are transformed into attribute information of 10km so that there are two or more user data with the same attribute information (travel distance = 10km).

[0040] Next, as shown in Figure 8, in devices 20A and 20B, the ID irreversible conversion unit 22 performs an irreversible conversion process to a user ID on the user data held by its own device (steps A3 and B3). Specifically, the ID irreversible conversion unit 22 performs a hashing process on the user ID (in this case, a telephone number as an example), and then discards the salt used in the hashing process.

[0041] Next, as shown in Figure 9, in device 20A, the ID encryption unit 23A encrypts the deidentification hash (the portion corresponding to the user ID in the user data) with a pre-prepared secret key a to obtain the ID encrypted data for company A (step A4). Similarly, in device 20B, the ID encryption unit 23A encrypts the deidentification hash (the portion corresponding to the user ID in the user data) with a pre-prepared secret key b to obtain the ID encrypted data for company B (step B4).

[0042] Next, as shown in Figure 10(a), in the device 20B, the attribute information encryption unit 23B encrypts the attribute information in the ID encrypted data of Company B obtained in step B4 using a pre-prepared secret key B with a homomorphic encryption scheme that enables aggregation processing, thereby generating encrypted user data for Company B (step B5).

[0043] Next, as shown in Figure 10(b), in device 20A, the data transmission / reception unit 24 transmits the encrypted ID of Company A, which is included in the encrypted ID data of Company A obtained in step A4, to the data transmission / reception unit 24 of device 20B (step A5). Also, in device 20B, the data transmission / reception unit 24 transmits the encrypted user data of Company B (i.e., data including Company B's encrypted ID and encrypted attribute information), obtained in step B5, to the data transmission / reception unit 24 of device 20A (step B6).

[0044] Next, as shown in Figure 11, in device 20A, the ID encryption unit 23A re-encrypts the encrypted ID of company B contained in the encrypted user data of company B transmitted from device 20B in step B6 using secret key a, and obtains an encrypted ID of company B encrypted with both secret keys a and b (step A6). Similarly, in device 20B, the ID encryption unit 23A re-encrypts the encrypted ID of company A transmitted from device 20A in step A5 using secret key b, and obtains an encrypted ID of company A encrypted with both secret keys a and b (step B7). Then, in device 20B, the data transmission / reception unit 24 transmits the "encrypted ID of company A encrypted with both secret keys a and b" obtained in step B7 to device 20A (step B8), and the data transmission / reception unit 24 of device 20A receives the encrypted ID of company A (step A7).

[0045] Next, as shown in Figure 12, in the device 20A, the data matching unit 25 replaces the "encrypted ID encrypted with secret key a" in the "encrypted ID of company A" obtained in the ID encryption of step A4 with the "encrypted ID of company A encrypted with both secret keys a and b" received in step A7, thereby obtaining the encrypted user data of company A shown in the upper left of Figure 12. The data matching unit 25 also replaces the "encrypted ID of company B encrypted with secret key b" in the "encrypted user data of company B" received in step A5 with the "encrypted ID of company B encrypted with both secret keys a and b" obtained in the re-encryption of step A6, thereby obtaining the encrypted user data of company B shown in the upper right of Figure 12. Then, the data matching unit 25 matches the encrypted user data of company A and the encrypted user data of company B using the "encrypted ID of company A encrypted with both secret keys a and b" and the "encrypted ID of company B encrypted with both secret keys a and b" as keys (step A8). Here, if the encrypted ID of Company A, encrypted with both secret keys a and b, matches the encrypted ID of Company B, encrypted with both secret keys a and b, the attribute information in Company A's encrypted user data and the encrypted attribute information in Company B's encrypted user data are joined as a single record in the encrypted matching data. After joining, the encrypted ID of Company A, encrypted with both secret keys a and b, and the encrypted ID of Company B, encrypted with both secret keys a and b, are deleted. This results in encrypted matching data, as shown in the lower part of Figure 12, which includes the unencrypted attribute information of Company A and the encrypted attribute information of Company B. Since Company B's attribute information is encrypted, Company A cannot know its contents, and the encrypted matching data is generated without Company B disclosing the contents of its confidential attribute information to Company A.

[0046] Next, as shown in Figure 13, in the device 20A, the aggregation processing unit 26 performs the following aggregation processing on the encrypted matching data (step A9). As mentioned above, the attribute information in the encrypted ID data of company B is encrypted in step B5 above using a secret key B prepared in advance with a homomorphic encryption scheme that is capable of aggregation processing. Therefore, in reality, each attribute piece of information included in the encrypted matching data in Figure 13 is composed of a binary value with a predetermined format (bit arrangement), and for example, for "gender", if the first and second bits in the encrypted matching data are "10", it indicates "male", and if they are "01", it indicates "female". Furthermore, regarding the "travel distance" encrypted with secret key B, for example, if the P-th bit from the beginning of the encrypted matching data is "1", it represents "10km", if the (P+1)-th bit is "1", it represents "20km", if the (P+2)-th bit is "1", it represents "30km", and so on. For example, in a record where the P-th bit of the bit sequence representing the "travel distance" is "1", all bits other than the P-th bit of the bit sequence representing the "travel distance" are set to "0". In this case, since company A does not know secret key B, it cannot grasp the actual content of the "travel distance" (10km, 20km, etc.) as described above, and can only grasp it as a simple bit sequence. Based on the above, the aggregation processing unit 26 performs the following aggregation processing as an example.

[0047] First, the aggregation processing unit 26 categorizes the multiple records that make up the encrypted matching data based on Company A's attribute information (unencrypted gender, age, purchase frequency). Specifically, it divides the multiple records that make up the encrypted matching data into several categories, such as "male, 20s, high frequency," "male, 20s, low frequency," "male, 30s, high frequency," "male, 30s, low frequency," and so on.

[0048] Next, the aggregation processing unit 26 performs aggregation processing for each category by taking the sum vertically (using the same bits in the bit sequence) on multiple records represented as binary values ​​belonging to that category. Note that the attribute information of Company B, represented as binary values, is encrypted using an encryption method with homomorphic encryption properties, so the sum can be calculated even in the encrypted state. As a result, for each category, the number of records where the P-th bit is "1" (i.e., the aggregation result for a travel distance of 10km), the number of records where the (P+1)-th bit is "1" (i.e., the aggregation result for a travel distance of 20km), the number of records where the (P+2)-th bit is "1" (i.e., the aggregation result for a travel distance of 30km), and so on, can be obtained.

[0049] Furthermore, the aggregation processing unit 26 obtains encrypted aggregate data by adding aggregate data for each category to the categorized encrypted matching data, and then changing the encrypted aggregate data to the orderly data format shown in the lower part of Figure 13. In the aggregation process of step A9 described above, since company A does not know the secret key B, it is not possible to grasp the actual content (10km, 20km, etc.) of company B's attribute information, "travel distance," and thus the situation in which the actual content of company B's attribute information is leaked to company A can be prevented.

[0050] Next, as shown in Figure 14, in the device 20A, the concealment processing unit 27 performs the following concealment processing on the encrypted aggregated data generated by the aggregation processing unit 26 to generate encrypted statistical information (step A10). For example, the concealment processing unit 27 generates noise using B company's calculation key B' (a type of public key), and adds the generated noise to the encrypted aggregated data to generate encrypted statistical information. Note that the above calculation key B' corresponds to the private key B and is assumed to have been shared between B company and A company in advance.

[0051] Then, the data transmission / reception unit 24 in device 20A transmits the encrypted statistical information generated in step A10 to device 20B (step A11), and the data transmission / reception unit 24 in device 20B receives the encrypted statistical information (step B9).

[0052] Furthermore, in device 20B, the received encrypted statistical information is sent to the decryption unit 28. The decryption unit 28 in device 20B, which knows the secret key B, decrypts the encrypted statistical information as shown in Figure 15 and outputs the obtained statistical information as appropriate (step B10). For example, the statistical information may be displayed or printed by a predetermined operation performed by the operator of device 20B.

[0053] As described above, by coordinating between Company A's device 20A and Company B's device 20B, it is possible to generate statistical information that excludes correspondence with individuals without disclosing confidential attribute information or private keys to other devices.

[0054] Both device 20A and device 20B are equipped with an ID irreversible conversion unit 22 that performs an irreversible conversion process to convert user data held by its own device into a user ID prior to encryption of the user ID, thereby enhancing the effectiveness of de-identification. Furthermore, since the irreversible conversion process includes hashing, it eliminates the need to apply a special irreversible conversion process and allows the application of a general irreversible conversion process such as hashing, improving ease of implementation. In addition, after performing the hashing process on the user ID, the ID irreversible conversion unit 22 discards the salt used in the hashing process. By discarding the salt used in the hashing process in this way, it is possible to ensure that the possibility of data recovery is completely eliminated.

[0055] Both device 20A and device 20B are equipped with an anonymization processing unit 21 that performs privacy-protecting processing on attribute information targeting user data held by their respective devices prior to encryption of user IDs, thereby enhancing the effectiveness of de-identification. Furthermore, since the privacy protection includes at least one of k-anonymization, l-diversity, and t-approximation, it eliminates the need to apply special privacy protections and allows the application of general privacy protections such as k-anonymization, l-diversity, and t-approximation, thereby improving ease of implementation.

[0056] Furthermore, the concealment processing performed by the concealment processing unit 27 includes concealment processing based on differential privacy. Therefore, it eliminates the need to apply special concealment processing and allows the application of general concealment processing based on differential privacy, thereby improving ease of implementation.

[0057] The data transmission / reception unit 24 of device 20A transmits the encrypted statistical information generated by the confidentiality processing unit 27 to the data transmission / reception unit 24 of device 20B, and the decryption unit 28 of device 20B decrypts the encrypted statistical information based on the decryption method corresponding to the encryption by the encryption unit 23. In this way, the encrypted statistical information can be restored to plaintext statistical information.

[0058] (Regarding variations) The following describes various modifications of the first and second embodiments described above.

[0059] (Variation 1) Figure 16 shows a modified version of the information processing device according to the first embodiment, which is capable of generating encrypted statistical information in cooperation with other information processing devices having the same configuration. As shown in Figure 16, the information processing device 10 according to Modification 1 further includes a data transmission / reception unit 15 and a data matching unit 16 in addition to the configuration shown in Figure 1 of the first embodiment. The data transmission / reception unit 15 is a functional unit that transmits and receives encrypted user data to and from other devices, similar to the data transmission / reception unit 24 described in the second embodiment. The data matching unit 16 is a functional unit that matches encrypted user data generated by its own device's encryption unit 11 with encrypted user data from other devices received from other devices, based on a user ID corresponding portion identified based on predetermined user data structure information.

[0060] If devices A and B are configured as shown in Figure 16, then in each device, the encryption unit 11 encrypts the user data it holds using its own device's key, the data transmission / reception unit 15 exchanges the encrypted user data between devices A and B, and the encryption unit 11 then double-encrypts the received user data from the other device using its own device's key. Subsequently, the data transmission / reception unit 15 of device B transmits the double-encrypted user data from device A to device A.

[0061] Then, in Company A's device, the data matching unit 16 matches the double-encrypted user data of Company A's device with the double-encrypted user data of Company B's device based on the user ID corresponding portion identified based on predetermined user data structure information. The aggregation processing unit 12 counts the number of encrypted user data entries where the user ID corresponding portion matches as a result of the matching by the data matching unit 16, thereby generating encrypted aggregated data for the target user. Furthermore, the concealment processing unit 13 performs concealment processing on the encrypted aggregated data to generate encrypted statistical information. The generated encrypted statistical information is sent from the data transmission / reception unit 15 of Company A's device to the data transmission / reception unit 15 of Company B's device, and the decryption unit 14 of Company B's device decrypts the encrypted statistical information and can output the obtained statistical information as appropriate.

[0062] With the above-described modification 1, if multiple organizations have the same device configuration as shown in Figure 16, it becomes possible to generate statistical information using data from two or more parties through secure matching and confidentiality processing. Furthermore, the configuration in Figure 16 may also be modified by adding either or both of the anonymization processing unit 21 and the ID irreversible conversion unit 22 described in the second embodiment. In this case, the effectiveness of de-identification can be enhanced.

[0063] (Modification 2) Figure 17 shows a modified configuration of the privacy-protecting data linkage system according to the second embodiment. As shown in Figure 17, the privacy-protecting data linkage system 1 according to modified example 2 is configured such that, in the configuration of Figure 5 according to the second embodiment, each of the devices 20A and 20B does not have an anonymization processing unit 21, as indicated by the dashed lines.

[0064] The anonymization processing unit 21 is a functional unit that performs privacy-protecting processing on attribute information targeting user data held by its own device prior to the encryption of user IDs. While the presence of this unit in each device 20A and 20B enhances privacy protection, it is not a mandatory requirement. Therefore, as shown in Figure 17, a simpler configuration in which each of the devices 20A and 20B does not have an anonymization processing unit 21 is also acceptable, allowing the privacy-protecting data linkage system 1 to be configured with fewer configuration requirements.

[0065] (Variation 3) Figure 18 shows another modified example of the configuration of the privacy-protecting data linkage system according to the second embodiment. As shown in Figure 18, the privacy-protecting data linkage system 1 according to Modification 3 is configured in the same way as the configuration of Figure 5 according to the second embodiment, with each of the devices 20A and 20B lacking an anonymization processing unit 21 and an ID irreversible conversion unit 22, as indicated by the dashed lines.

[0066] The ID irreversible conversion unit 22 is a functional unit that performs irreversible conversion processing to user IDs on user data held by its own device prior to encryption of user IDs. While its inclusion in each device 20A and 20B enhances privacy protection, it is not a mandatory requirement. Therefore, as shown in Figure 18, a simpler configuration is permitted in which each of the devices 20A and 20B does not include the ID irreversible conversion unit 22 in addition to the anonymization processing unit 21, allowing the privacy protection data linkage system 1 to be configured with even fewer configuration requirements than the modified example 2 described above.

[0067] (Modification 4) In the above embodiment, we described a process that aggregates user data including both user ID and attribute information. However, attribute information is not a mandatory requirement, and the aggregation may be limited to user data that includes at least the user ID. Below, we will describe an example in which such user data is aggregated, and the number of people (number of users) that can be matched using the user ID as the key is aggregated in cooperation between Company A and Company B.

[0068] As shown in Figure 19, in the privacy protection data linkage system 1 according to modified example 4, each device 20A and 20B includes an ID encryption unit 23A that generates encrypted user data for aggregated user data by encrypting the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by its own device, and a data transmission / reception unit 24 that sends and receives the encrypted user data. Device 20A further includes a data matching unit 25 that matches the encrypted user data of its own device (device 20A) generated by the ID encryption unit 23A with the encrypted user data of the other device (device 20B) received by the data transmission / reception unit 24 based on the user ID corresponding portion identified based on predetermined user data structure information, and an aggregation processing unit 26 that generates encrypted aggregated data for the target user by counting the number of encrypted user data with matching user ID corresponding portions as a result of the matching by the data matching unit 25. It goes without saying that since Figure 19 shows the minimum necessary configuration, devices 20A and 20B may have configurations other than those described above.

[0069] In the privacy protection data linkage system 1 according to Modification 4, the process shown in Figure 20 is executed. The process shown in Figure 20 corresponds to a part of the process in Figure 6 described in the second embodiment, and the same step numbers are used for mutually corresponding processes between Figure 20 and Figure 6. Although redundant detailed explanations are omitted here, up to steps A6 and B7, without disclosing the contents of the user data to the other party, an encrypted ID of company A, encrypted with both company A's secret key a and company B's secret key b, and an encrypted ID of company B, also encrypted with both secret keys a and b, are obtained. Subsequently, the data matching unit 25 of device 20A matches the encrypted ID of company A and the encrypted ID of company B (step A8), and the aggregation processing unit 26 counts the number of encrypted user data where the user ID corresponding portion matches as a result of the above matching, thereby obtaining the number of people (number of users) that could be matched as an aggregated result (step A9). In this way, in a process that does not require attribute information as a mandatory requirement, but aggregates user data that includes at least a user ID, it is possible to obtain the number of matching users as the aggregated result without disclosing the contents of the user data to the other party.

[0070] The gist of this disclosure is found in the following [1] to

[10] . [1] An information processing device that holds user data including a user ID and attribute information about the user, and generates statistical information about the target user, An encryption unit generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by the device, and by encrypting the attribute information in the user data to be aggregated using a homomorphic encryption scheme capable of aggregation processing. An aggregation processing unit generates encrypted aggregate data by counting the number of encrypted user data entries that share the same attribute information with the encrypted user data generated by the encryption unit, A confidentiality processing unit performs confidentiality processing on the encrypted aggregated data generated by the aggregation processing unit to generate encrypted statistical information, An information processing device equipped with the following features. [2] The information processing device is an information processing device that generates statistical information relating to the target user in cooperation with the other device, A data transmission unit that transmits and receives the encrypted user data with the other party device, A data matching unit matches the encrypted user data of its own device generated by the encryption unit with the encrypted user data of the other device received by the data transmission / reception unit, based on the user ID corresponding portion identified based on predetermined user data structure information. Furthermore, The information processing apparatus according to [1] generates encrypted aggregate data relating to the target user by counting the number of encrypted user data whose user ID corresponding portion matches as a result of matching by the data matching unit. [3] An information processing device that holds user data including user IDs and generates statistical information about a target user in cooperation with a counterparty device, An ID encryption unit generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by the device itself, A data transmission unit that transmits and receives the encrypted user data with the other party device, A data matching unit matches the encrypted user data of its own device generated by the ID encryption unit with the encrypted user data of the other device received by the data transmission / reception unit, based on the user ID corresponding portion identified based on predetermined user data structure information. The aggregation processing unit generates encrypted aggregate data relating to the target user by counting the number of encrypted user data entries in which the user ID corresponding portion matches as a result of matching by the data matching unit, An information processing device equipped with the following features. [4] A privacy-protecting data linkage system comprising a plurality of devices that hold user data including user IDs and attribute information about the user, wherein one of the plurality of devices and a partner device cooperate to generate statistical information about the target user, The aforementioned device includes an ID encryption unit that generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by the device, The counterparty device includes an encryption unit that, based on a self-encrypting key and a keyed one-way commutative operation held by its own device, encrypts the user ID in the user data to be aggregated, and encrypts the attribute information in the user data to be aggregated using a homomorphic encryption scheme capable of aggregation processing, thereby generating encrypted user data for the user data to be aggregated. The aforementioned device and the counterpart device further comprise a data transmission / reception unit for sending and receiving the encrypted user data, The aforementioned first device is A data matching unit matches the encrypted user data of its own device generated by the encryption unit with the encrypted user data of the other device received by the data transmission / reception unit, based on the user ID corresponding portion identified based on predetermined user data structure information. The aggregation processing unit generates encrypted aggregate data relating to the target user by counting the number of encrypted user data entries in which the user ID corresponding portion matches as a result of matching by the data matching unit, A confidentiality processing unit performs confidentiality processing on the encrypted aggregated data generated by the aggregation processing unit to generate encrypted statistical information, Furthermore, Privacy-protecting data sharing system. [5] The first device and the other device are The privacy protection data linkage system according to [4] further comprises an anonymization processing unit that performs privacy protection processing on user data held by its own device prior to the encryption of the user ID. [6] The privacy protection includes at least one of k-anonymization, l-diversity, and t-approximation in the privacy protection data linkage system according to [5]. [7] The privacy protection data linkage system described in any one of [4] to [6] includes a privacy protection process based on differential privacy. [8] The data transmission unit of the first device transmits the encrypted statistical information generated by the confidentiality processing unit to the data transmission unit of the other device. The privacy protection data linkage system according to any one of [4] to [7] further comprises a decryption unit that decrypts the encrypted statistical information received by the data transmission / reception unit of the counterparty device based on a decryption method corresponding to the encryption by the encryption unit. [9] A privacy-protecting data linkage system comprising a plurality of devices that hold user data including user IDs, wherein one of the plurality of devices and a partner device cooperate to generate statistical information about a target user, The aforementioned device one and the aforementioned counterpart device, An ID encryption unit generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by the device itself, A data transmission unit that transmits and receives the encrypted user data, Equipped with, The aforementioned first device is A data matching unit matches the encrypted user data of its own device generated by the ID encryption unit with the encrypted user data of the other device received by the data transmission / reception unit, based on the user ID corresponding portion identified based on predetermined user data structure information. The aggregation processing unit generates encrypted aggregate data relating to the target user by counting the number of encrypted user data entries in which the user ID corresponding portion matches as a result of matching by the data matching unit, Furthermore, Privacy-protecting data sharing system.

[10] The first device and the other device are Prior to encrypting the user ID, an ID irreversible conversion unit performs an irreversible conversion process on user data held by its own device to the user ID. A privacy-protecting data sharing system described in any one of items [4] to [9], further comprising the above.

[11] The privacy-protecting data linkage system according to

[10] , wherein the irreversible transformation process includes a hashing process.

[12] The ID irreversible conversion unit performs hashing on the user ID and then discards the salt used in the hashing process, the privacy protection data linkage system according to

[11] .

[0071] (Explanation of terms, explanation of hardware configuration (Figure 21), etc.) The block diagrams used in the description of the above embodiments show functional units. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method of realizing each functional block is not particularly limited. That is, each functional block may be realized using one device that is physically or logically coupled, or it may be realized using two or more physically or logically separated devices that are directly or indirectly connected (for example, using wired or wireless connections). A functional block may also be realized by combining the above one device or the above multiple devices with software.

[0072] Functions include, but are not limited to, judgment, decision, determination, calculation, calculation, processing, derivation, investigation, exploration, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, assumption, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating (mapping), and assigning. For example, a functional block (configuration part) that enables transmission is called a transmitting unit or transmitter. In all cases, as mentioned above, the method of implementation is not particularly limited.

[0073] For example, the information processing device 10 in this embodiment may function as a computer that performs the processing of the present disclosure. Figure 21 is a diagram showing an example of the hardware configuration of the information processing device 10. The information processing device 10 described above may be physically configured as a computer device including a processor 1001, memory 1002, storage 1003, communication device 1004, input device 1005, output device 1006, bus 1007, etc. Devices 20A and 20B in Figure 5 may also have a similar configuration to the information processing device 10.

[0074] In the following explanation, the term "device" can be replaced with "circuit," "device," "unit," etc. The hardware configuration of the information processing device 10 may include one or more of the devices shown in the figure, or it may be configured to omit some of the devices.

[0075] Each function in the information processing device 10 is realized by loading predetermined software (programs) onto hardware such as the processor 1001 and memory 1002, which allows the processor 1001 to perform calculations, control communication by the communication device 1004, and control at least one of data reading and writing in the memory 1002 and storage 1003.

[0076] The processor 1001 controls the entire computer, for example, by running an operating system. The processor 1001 may consist of a central processing unit (CPU) that includes interfaces with peripheral devices, control units, arithmetic units, registers, and so on.

[0077] Furthermore, the processor 1001 reads programs (program code), software modules, data, etc., from at least one of the storage 1003 and the communication device 1004 into the memory 1002 and executes various processes accordingly. The program used is one that causes the computer to execute at least a part of the operations described in the above embodiment. Although the above processes have been described as being executed by one processor 1001, they may be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The program may also be transmitted from a network via a telecommunications line.

[0078] Memory 1002 is a computer-readable recording medium and may consist of at least one of the following: ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. Memory 1002 may also be called a register, cache, main memory, etc. Memory 1002 can store executable programs (program code), software modules, etc., for carrying out a wireless communication method according to one embodiment of the present disclosure.

[0079] Storage 1003 is a computer-readable recording medium and may consist of at least one of the following: an optical disc such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disc, a digital multipurpose disc, a Blu-ray® disc), a smart card, flash memory (e.g., a card, a stick, a key drive), a floppy® disk, a magnetic strip, etc. Storage 1003 may also be called an auxiliary storage device. The above-mentioned storage medium may be, for example, a database, server, or other suitable medium including at least one of memory 1002 and storage 1003.

[0080] The communication device 1004 is hardware (transceiver / receiver device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as a network device, network controller, network card, communication module, etc. The communication device 1004 may be configured to include, for example, a high-frequency switch, duplexer, filter, frequency synthesizer, etc., in order to implement at least one of frequency division duplex (FDD) and time division duplex (TDD).

[0081] The input device 1005 is an input device that accepts input from an external source (e.g., a keyboard, mouse, microphone, switch, button, sensor, etc.). The output device 1006 is an output device that outputs to an external source (e.g., a display, speaker, LED lamp, etc.). The input device 1005 and the output device 1006 may be configured as an integrated unit (e.g., a touch panel).

[0082] Furthermore, each device, such as the processor 1001 and memory 1002, is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or different buses may be configured for each device.

[0083] Furthermore, the information processing device 10 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), and an FPGA (Field Programmable Gate Array), and some or all of each functional block may be realized by such hardware. For example, the processor 1001 may be implemented using at least one of these hardware components.

[0084] Information notification is not limited to the embodiments described herein and may be carried out by other means. For example, information notification may be carried out by physical layer signaling (e.g., DCI (Downlink Control Information), UCI (Uplink Control Information)), upper layer signaling (e.g., RRC (Radio Resource Control) signaling, MAC (Medium Access Control) signaling, broadcast information (MIB (Master Information Block), SIB (System Information Block))), other signals, or combinations thereof. RRC signaling may also be called RRC messages, and may be, for example, RRC Connection Setup messages, RRC Connection Reconfiguration messages, etc.

[0085] Each aspect / embodiment described in this disclosure includes LTE (Long Term Evolution), LTE-A (LTE-Advanced), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), 6th generation mobile communication system (6G), xth generation mobile communication system (xG) (xG (where x is, for example, an integer or decimal)), FRA (Future Radio Access), NR (new Radio), New radio access (NX), Future generation radio access (FX), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), and IEEE This may apply to at least one system utilizing 802.20, UWB (Ultra-WideBand), Bluetooth®, or other appropriate systems, and to next-generation systems extended, modified, created, or defined based thereon. It may also apply to a combination of multiple systems (for example, a combination of at least one of LTE and LTE-A with 5G).

[0086] The processing procedures, sequences, flowcharts, etc., of each aspect / embodiment described herein may be reordered, provided they are consistent with each other. For example, the methods described herein present various step elements in an exemplary order and are not limited to that specific order.

[0087] Input and output information may be stored in a specific location (e.g., memory) or managed using a management table. Input and output information may be overwritten, updated, or appended to. Output information may be deleted. Input information may be transmitted to other devices.

[0088] The determination may be made by a value represented by 1 bit (0 or 1), by a boolean value (true or false), or by a numerical comparison (for example, a comparison with a predetermined value).

[0089] Each aspect / embodiment described herein may be used individually, in combination, or switched between as needed during implementation. Furthermore, notification of specific information (e.g., notification that "X is") is not limited to explicit notification, but may also be implicit (e.g., by not providing such notification).

[0090] Although the present disclosure has been described in detail above, it will be clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the intent and scope of the present disclosure as defined by the claims. Therefore, the descriptions in the present disclosure are illustrative and not intended to be restrictive in any way.

[0091] Software should be broadly interpreted to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, execution threads, procedures, functions, and so on, whether they are called software, firmware, middleware, microcode, hardware description languages, or by any other name.

[0092] Furthermore, software, instructions, information, etc., may be transmitted and received via a transmission medium. For example, if software is transmitted from a website, server, or other remote source using at least one of wired technology (such as coaxial cable, fiber optic cable, twisted pair, or digital subscriber line (DSL)) and wireless technology (such as infrared or microwave), then at least one of these wired and wireless technologies is included in the definition of a transmission medium.

[0093] The information, signals, etc. described in this disclosure may be represented using any of the various different techniques. For example, the data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be referred to throughout the above description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

[0094] In addition, terms used in this disclosure and terms necessary for understanding this disclosure may be replaced with terms having the same or similar meanings. For example, at least one of the communication channel and the symbol may be a signal (signaling). Also, the signal may be a message. Furthermore, the component carrier (CC) may be called a carrier frequency, cell, frequency carrier, etc.

[0095] The terms “system” and “network” as used in this disclosure are interchangeable.

[0096] Furthermore, the information, parameters, etc., described in this disclosure may be expressed using absolute values, relative values ​​from a given value, or other corresponding information. For example, wireless resources may be indicated by an index.

[0097] The names used for the parameters described above are not restrictive in any way. Furthermore, the formulas and other expressions using these parameters may differ from those expressly disclosed in this disclosure. Various communication channels (e.g., PUCCH, PDCCH, etc.) and information elements can be identified by any suitable name, and therefore, the various names assigned to these various communication channels and information elements are not restrictive in any way.

[0098] As used in this disclosure, the terms “determining” and “determining” may encompass a wide variety of actions. “Determining” may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, inquiry (e.g., searching in a table, database, or other data structure), and ascertaining. “Determining” may also include, for example, receiving (e.g., receiving information), transmitting (e.g., sending information), input, output, and accessing (e.g., accessing data in memory). Furthermore, "judgment" and "decision" can include considering something as having been "judged" or "decided" after resolving, selecting, choosing, establishing, comparing, etc. In other words, "judgment" and "decision" can include considering something as having been "judged" or "decided" after some action. Also, "judgment (decision)" can be reinterpreted as "assuming," "expecting," or "considering."

[0099] In this disclosure, the phrase "based on" does not mean "based solely on" unless otherwise specified. In other words, the phrase "based on" means both "based solely on" and "based at least on."

[0100] Any reference to elements using the designations “first,” “second,” etc., as used in this disclosure does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient way to distinguish between two or more elements. Accordingly, references to the first and second elements do not imply that only two elements may be employed, or that the first element must precede the second element in any way.

[0101] Where the terms “include,” “including,” and variations thereof are used in this disclosure, these terms are intended to be inclusive, as is the term “comprising.” Furthermore, the term “or” as used in this disclosure is not intended to mean exclusive OR.

[0102] In this disclosure, if articles are added through translation, such as a, an, and the in English, this disclosure may include the fact that the noun following these articles is plural.

[0103] In this disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "combine" may be interpreted similarly to "different." [Explanation of Symbols]

[0104] 1...Privacy protection data linkage system, 10...Information processing device, 11...Encryption unit, 11A...ID encryption unit, 11B...Attribute information encryption unit, 12...Aggregation processing unit, 13...Confidentiality processing unit, 14...Decryption unit, 15...Data transmission / reception unit, 16...Data matching unit, 20A, 20B...Information processing device, 21...Anonymization processing unit, 22...ID irreversible conversion unit, 23...Encryption unit, 23A...ID encryption unit, 23B...Attribute information encryption unit, 24...Data transmission / reception unit, 25...Data matching unit, 26...Aggregation processing unit, 27...Confidentiality processing unit, 28...Decryption unit, 1001...Processor, 1002...Memory, 1003...Storage, 1004...Communication device, 1005...Input device, 1006...Output device, 1007...Bus.

Claims

1. An ID encryption unit obtains user data including a user ID, performs a hashing process on the user ID using a salt, and then encrypts the resulting hash value with a self-encrypting key held by the device to generate encrypted user data. A data transmission unit that transmits and receives the encrypted user data between the other device and the other device, A data matching unit that matches the encrypted user data of its own device generated by the ID encryption unit with the encrypted user data of the other device received by the data transmission / reception unit, The aggregation processing unit generates encrypted aggregate data by counting the number of encrypted user data entries in which the portion corresponding to the user ID matches as a result of matching by the data matching unit, A confidentiality processing unit performs confidentiality processing on the encrypted aggregated data generated by the aggregation processing unit to generate encrypted statistical information, Equipped with, The encrypted user data of the counterparty device includes data whose attribute information is encrypted using a homomorphic encryption scheme. The attribute information is composed of a binary value in which a flag is set at the bit position corresponding to the content of the attribute information. The aggregation processing unit performs the count by taking the sum of identical bits in the bit sequence for a plurality of records represented by the binary values. Information processing device.

2. The information processing apparatus according to claim 1, wherein the data matching unit matches based on a portion corresponding to the user ID, which is identified based on predetermined structural information of the user data.

3. It has multiple devices that hold user data including user IDs and attribute information about the user, One of the aforementioned plurality of devices includes an ID encryption unit that performs a hashing process using a salt on the user ID, then discards the salt, and encrypts the resulting hash value with a self-encrypting key held by the device to generate encrypted user data. Among the aforementioned plurality of devices, the counterparty device includes an encryption unit that performs a hashing process using a salt on the user ID, then discards the salt, and encrypts the resulting hash value with a self-encrypting key held by its own device, and also encrypts the attribute information using a homomorphic encryption scheme to generate encrypted user data. The aforementioned device and the counterpart device further comprise a data transmission / reception unit for sending and receiving the encrypted user data, The aforementioned first device is A data matching unit that matches the encrypted user data of one device generated by the ID encryption unit with the encrypted user data of the other device received by the data transmission / reception unit, The aggregation processing unit generates encrypted aggregate data by counting the number of encrypted user data entries in which the portion corresponding to the user ID matches as a result of matching by the data matching unit, A confidentiality processing unit performs confidentiality processing on the encrypted aggregated data generated by the aggregation processing unit to generate encrypted statistical information, Furthermore, The attribute information encrypted by the encryption unit of the counterparty device is composed of a binary value in which a flag is set at the bit position corresponding to the content of the attribute information. The aggregation processing unit of the first device performs the count by taking the sum of identical bits in the bit sequence for a plurality of records represented by the binary value. Privacy-protecting data sharing system.

4. The aforementioned device one and the aforementioned counterpart device, Prior to encrypting the user ID, an anonymization processing unit performs privacy protection processing on the user data held by its own device, Furthermore, The privacy-protecting data sharing system according to claim 3.

5. The data transmission / reception unit of the first device transmits the encrypted statistical information generated by the confidentiality processing unit to the data transmission / reception unit of the other device. The counterparty device further comprises a decryption unit that decrypts the encrypted statistical information received by the data transmission / reception unit of the counterparty device based on a decryption method corresponding to the encryption performed by the encryption unit. The privacy-protecting data sharing system according to claim 3.

Images