Privacy-protected data aggregation device and privacy-protected data aggregation system

Abstract

A privacy-protected data aggregation device (10) comprises: an attribute information encryption unit (13) that encrypts attribute information in user data, which includes a plurality of pieces of attribute information and is to be aggregated, by a homomorphic encryption method enabling aggregation processing; an aggregation processing unit (14) that aggregates the user data in which the attribute information is encrypted for all the combinations of values, which may be taken by the plurality of types of attribute information in domain data defining values that may be taken by the respective plurality of types of attribute information included in the user data, to obtain aggregated data including the result of aggregation and the encrypted attribute information; a concealment processing unit (15) that executes concealment processing on the obtained aggregated data; and a decryption unit (16) that decrypts the aggregated data having undergone the concealment processing to obtain aggregated data including the decrypted attribute information and the result of aggregation after the concealment processing.

Description

Privacy-protecting data aggregation device and privacy-protecting data aggregation system

[0001] The present disclosure relates to a privacy-preserving data aggregation device and a privacy-preserving data aggregation system.

[0002] There is a widespread social demand for tabulation processing while protecting personal information in databases, and such technology is disclosed, for example, in Patent Document 1. Differential privacy is also known as a technology that enables statistical analysis while protecting personal information in databases from attackers. In data tabulation technology related to differential privacy, the concepts of "structural zero" and "non-structural zero" are known when counting the number of users corresponding to a combination of multiple attribute information. Of these, "structural zero" refers to a combination that does not structurally exist, resulting in an output (tabulation result) of "0," while "non-structural zero" refers to a combination that structurally exists but for which the tabulation result is not output.

[0003] JP 2010-108488 A

[0004] Consider a case where individual data is aggregated using secure computation and the aggregation results are kept confidential. If a combination of structurally existing attribute information does not actually exist in the individual data, the combination will not be included in the aggregation, and the aggregation results will not be output. This poses a problem in that a third party may discover that the data for that combination does not exist in the individual data. In other words, the data for that combination falls under the unstructured zeros mentioned above, which could result in unintended disclosure due to unstructured zeros.

[0005] However, Patent Document 1 does not disclose any measures to prevent unintended disclosure due to the above-mentioned non-structural zeros, and such measures are eagerly awaited.

[0006] The present disclosure has been made to solve the above problem, and aims to prevent unintentional disclosure due to non-structural zeros.

[0007] The privacy-preserving data aggregation device according to the present disclosure includes an attribute information encryption unit that encrypts attribute information in user data to be aggregated, the attribute information including multiple pieces of attribute information, using a homomorphic encryption method that enables aggregation processing; an aggregation processing unit that aggregates the user data whose attribute information has been encrypted by the attribute information encryption unit for all combinations of possible values ​​of the multiple pieces of attribute information in domain data that defines the possible values ​​of each piece of attribute information included in the user data, thereby obtaining aggregated data including the aggregation results and the encrypted attribute information; a confidentiality processing unit that performs confidentiality processing on the aggregated data obtained by the aggregation processing unit; and a decryption unit that decrypts the aggregated data that has been confidentiality processed, and obtains aggregated data including the aggregation results after the confidentiality processing and the decrypted attribute information.

[0008] In the privacy-preserving data aggregation device, the attribute information encryption unit encrypts attribute information in the user data to be aggregated, which includes multiple pieces of attribute information, using a homomorphic encryption scheme capable of aggregation processing. The aggregation processing unit aggregates the user data with the encrypted attribute information for all possible combinations of values ​​of the multiple attribute information in the domain data, thereby obtaining aggregated data including the aggregation results and the encrypted attribute information. In this manner, aggregation is performed for all possible combinations of values ​​of the multiple attribute information in the domain data, thereby obtaining aggregated data including the aggregation results and the encrypted attribute information. The confidentiality processing unit then performs confidentiality processing on the aggregated data obtained by the aggregation processing unit, thereby concealing the aggregated data. Furthermore, the decryption unit decrypts the confidentiality-processed aggregated data to obtain the confidentiality-processed aggregated data including the confidentiality-processed aggregation results and the decrypted attribute information. In this manner, the confidentiality-processed aggregated results can be output in a format that can be confirmed by the user. In this series of processes, aggregation is performed for all possible combinations of values ​​of the multiple attribute information in the domain data, thereby avoiding the occurrence of non-structural zeros (i.e., combinations that exist structurally but are not output), thereby preventing unintended disclosure due to non-structural zeros.

[0009] According to the present disclosure, unintentional disclosure due to non-structural zeros can be prevented.

[0010] 1 is a functional block diagram of a privacy-preserving data aggregation device according to first to fourth embodiments. FIG. 1 is a flow diagram showing the processing of the first embodiment. FIG. 2 is a flow diagram for explaining the processing of the first embodiment. FIG. 3 is a flow diagram for explaining the processing of the second embodiment. FIG. 4 is a flow diagram for explaining the processing of the second embodiment. FIG. 5 is a flow diagram for explaining the processing of the third embodiment. FIG. 6 is a flow diagram for explaining the processing of the third embodiment. FIG. 7 is a flow diagram for explaining the processing of the fourth embodiment. FIG. 8 is a functional block diagram of a privacy-preserving data aggregation device according to fifth to eighth embodiments. FIG. 9 is a flow diagram for explaining the processing of the fifth embodiment. (a) is a diagram showing an example of user data and domain data of company A, and (b) is a diagram showing an example of user data and domain data of company B. A diagram showing an image of aggregation. A diagram showing encryption of company A's user data by company A. A diagram showing encryption of user IDs in company A's user data by company B. A diagram showing encryption of user IDs in company B's user data by company B and company A. A diagram showing matching processing by company B. A diagram showing categorization of matched data by company B. A diagram showing aggregation processing by company B. A diagram showing confidentiality processing by company B. A diagram showing decryption processing by company A. A diagram for explaining a pattern resulting in structural zeros. FIG. 10 is a flow diagram showing the processing of a sixth embodiment. FIG. 11 is a diagram showing an example of a list to which a structural zero flag is assigned (flagged list). FIG. 12 is a diagram showing the aggregation processing by company B in the sixth embodiment. FIG. 13 is a diagram showing the confidentiality processing by company B in the sixth embodiment. FIG. 14 is a diagram showing the decryption processing by company A in the sixth embodiment. FIG. 15 is a flow diagram showing the processing of a seventh embodiment. FIG. 16 is a diagram showing the aggregation processing by company B in the seventh embodiment. FIG. 17 is a diagram showing the confidentiality processing by company B in the seventh embodiment. FIG. 18 is a diagram showing the decryption processing by company A in the seventh embodiment. FIG. 19 is a flow diagram showing the processing of an eighth embodiment. FIG. 19 is a diagram showing the aggregation processing by company B in the eighth embodiment. FIG. 20 is a diagram showing an example of the hardware configuration of a privacy-preserving data aggregation device.

[0011] Hereinafter, first to eighth embodiments of the present disclosure will be described in order with reference to the drawings. Of these, the first embodiment describes a mode in which unintended disclosure due to unstructured zeros is prevented in a privacy-preserving data aggregation device. The second to fourth embodiments describe three modes in which unintended disclosure due to structured zeros is further prevented in the privacy-preserving data aggregation device of the first embodiment. The fifth embodiment describes a mode in which unintended disclosure due to unstructured zeros is prevented by cooperation between first and second devices included in a privacy-preserving data aggregation system. The sixth to eighth embodiments describe three modes in which unintended disclosure due to structured zeros is further prevented in the privacy-preserving data aggregation system of the fifth embodiment.

[0012] First Embodiment In the first embodiment, the focus is on preventing unintended disclosure due to unstructured zeros, and a form of preventing unintended disclosure due to unstructured zeros in a single privacy-preserving data aggregation device will be described.

[0013] 1, the privacy-preserving data aggregation device 10 of the first embodiment includes, as functional blocks, a user data holding unit 11, a domain data holding unit 12, an attribute information encryption unit 13, an aggregation processing unit 14, a confidentiality processing unit 15, and a decryption unit 16. Each functional unit will be outlined below.

[0014] The user data storage unit 11 is a functional unit that stores user data to be aggregated, including multiple pieces of attribute information, and stores user data such as ID, departure point, and arrival point, for example, as shown in Figure 3 as "user data."

[0015] The domain data storage unit 12 is a functional unit that stores domain data that defines the possible values ​​of each attribute information included in the user data, and stores domain data that indicates the possible values ​​of the "departure point" (Narita, Haneda, Naha, ... Kagoshima) and the possible values ​​of the "arrival point" (Narita, Haneda, Naha, ... Kagoshima), such as the "domain data" shown in Figure 3.

[0016] In this embodiment, an example is described in which user data and domain data are stored in advance within the privacy protection data collection device 10, but these data may also be input to the privacy protection data collection device 10 from an external device, in which case the user data storage unit 11 and the domain data storage unit 12 are not components of the privacy protection data collection device 10.

[0017] The attribute information encryption unit 13 is a functional unit that encrypts attribute information in user data to be aggregated, which includes multiple pieces of attribute information, using a homomorphic encryption method that enables aggregation processing. As the homomorphic encryption method that enables aggregation processing, for example, an encryption method that has additive homomorphism or fully homomorphism can be adopted.

[0018] The aggregation processing unit 14 is a functional unit that aggregates user data whose attribute information has been encrypted by the attribute information encryption unit 13 for all combinations of possible values ​​of multiple attribute information in the above-mentioned domain data, and obtains aggregated data including the aggregation results and the encrypted attribute information.

[0019] The confidentiality processing unit 15 is a functional unit that performs confidentiality processing on the aggregated data obtained by the aggregation processing unit 14 .

[0020] The decoding unit 16 is a functional unit that decodes the aggregated data that has been concealed, and obtains aggregated data that includes the aggregation results after the concealment process and the decoded attribute information, and further, the decoding unit 16 outputs the obtained aggregated data.

[0021] The privacy preserving data aggregation device 10 having the above-described functional blocks executes the process shown in FIG.

[0022] First, the user data held by the user data holding unit 11 and the domain data held by the domain data holding unit 12 are read and acquired so that they can be executed in subsequent processing (step S1). As mentioned above, these data may be acquired by being input (received) from an external device.

[0023] Next, the attribute information encryption unit 13 encrypts the attribute information of the user data using a homomorphic encryption method that allows aggregation processing (for example, an encryption method having additive homomorphism or complete homomorphism) (step S2).

[0024] Next, the counting unit 14 counts the user data with encrypted attribute information for all combinations of requirements in the domain data, generating counted data with encrypted attribute information (step S3). This generates counted data including counted results (number of people) with encrypted attribute information (departure point, arrival point), as shown in the "counted data" in FIG. 3 . Since user data is counted for all combinations of requirements in the domain data, all structurally existing combinations are counted, even if they do not exist in the user data. For example, user data for the combination of departure point "Kagoshima" and arrival point "Naha" does not exist in the user data, and the counted result (number of people) is "0," but it is included in the counted data without being omitted. In other words, the occurrence of non-structural zeros (combinations that exist structurally but are not output) can be avoided.

[0025] Next, the anonymization processing unit 15 anonymizes the aggregated data (step S4), and the decryption unit 16 decrypts the anonymized aggregated results to obtain aggregated data including the anonymized aggregated results and the decrypted attribute information, and outputs the aggregated data in plain text (step S5). As a result, aggregated data in which the attribute information (place of departure, place of arrival) is decrypted and the aggregated results (number of people) are anonymized is obtained and output, as shown in the "agonymized aggregated data" in Figure 3. As a result, although user data for the combination of the departure place "Kagoshima" and the arrival place "Naha" does not exist in the user data and the aggregated result (number of people) is "0 people," it is included as the aggregated result "0 people" in the aggregated data before the anonymization processing and is included as the aggregated result "2 people" in the aggregated data after the anonymization processing.

[0026] As described above, according to the first embodiment, it is possible to avoid the occurrence of non-structural zeros (combinations that exist structurally but are not output), and to prevent unintended disclosure due to non-structural zeros.

[0027] [Second embodiment] In the second embodiment, in addition to the first embodiment that prevents unintended disclosure due to non-structural zeros, a form will be described in which structural zero combinations are excluded from the confidentiality processing and the aggregation result is fixed to zero, thereby preventing a situation in which the aggregation result of a structural zero combination becomes a non-zero value and the usefulness of the aggregation result (statistical information) is reduced.

[0028] The functional block configuration of the privacy-preserving data aggregation device 10 of the second embodiment is similar to the configuration shown in Fig. 1, and therefore a duplicated description will be omitted. However, among the functional units shown in Fig. 1, the anonymization processing unit 15 has a feature that it refers to a flagged list in which non-existent combinations are flagged among all possible combinations of values ​​of a plurality of attribute information in the domain data, fixes the aggregation results of flagged combinations in the aggregated data to zero, and performs anonymization processing on combinations that are not flagged in the aggregated data.

[0029] The above-mentioned "flagged list" may be generated in advance and stored by the domain data storage unit 12, or may be generated by the domain data storage unit 12 from the domain data at that time, as described below.

[0030] The privacy protection data aggregation device 10 of the second embodiment executes the process shown in Fig. 4. In Fig. 4, the same processes as those of the first embodiment (Fig. 2) are assigned the same step numbers, and detailed descriptions thereof will be omitted.

[0031] First, the user data held by the user data holding unit 11 and the domain data held by the domain data holding unit 12 are acquired so that subsequent processing can be performed (step S1). Next, the domain data holding unit 12 generates the aforementioned "flagged list" by flagging non-existent combinations (combinations that could result in structural zeros) among all possible combinations of values ​​of multiple attribute information in the domain data at that time with a structural zero flag (step S1A). For example, as shown in the "flagged list" in FIG. 5, a structural zero flag of "1" is assigned to the non-existent combination of departure "Narita" and arrival "Narita." Similarly, a structural zero flag of "1" is assigned to the non-existent combination of departure "Narita" and arrival "Haneda." Existing combinations (e.g., a combination of departure "Narita" and arrival "Naha") are flagged with a "0." This flagged list is transferred from the domain data holding unit 12 to the anonymization processing unit 15 via the aggregation processing unit 14.

[0032] Thereafter, as in the first embodiment, the attribute information encryption unit 13 encrypts the attribute information of the user data using a homomorphic encryption method capable of aggregation (e.g., an encryption method having additive homomorphism or fully homomorphism) (step S2), and the aggregation processing unit 14 aggregates the user data with encrypted attribute information for all combinations of requirements in the domain data to generate aggregated data with encrypted attribute information (step S3). As a result, aggregated data including the aggregation results (number of people) with encrypted attribute information (departure point, arrival point) is generated, as in the "aggregated data" in FIG. 5 . Since the user data is aggregated for all combinations of requirements in the domain data, all structurally existing combinations are included in the aggregation, even if they do not exist in the user data. Therefore, as in the first embodiment, the occurrence of non-structural zeros (combinations that exist structurally but are not output) can be avoided.

[0033] Next, the anonymization processing unit 15 refers to the flagged list and fixes the count results of flagged combinations in the count data to zero, and performs anonymization processing on combinations that are not flagged in the count data (step S4A). This prevents the count results of flagged combinations that do not exist (combinations that can be structurally zero) from being anonymized to a non-zero value, thereby preventing a situation in which the usefulness of the count results (statistical information) is reduced.

[0034] Thereafter, the decryption unit 16 decrypts the counting result after step S4A in which non-existent combinations are fixed to zero, obtains counting data including the counting result after the anonymization process and the decrypted attribute information, and outputs the result in plain text (step S5). As a result, as shown in the "counting data after anonymization process" in Fig. 5, the attribute information (place of departure, place of arrival) is decrypted and the counting result (number of people) is anonymized, and the resulting data is output.

[0035] According to the second embodiment described above, the counting results (number of people) for combinations that could result in non-existent structural zeros (for example, the combination of departure airport "Narita" and arrival airport "Narita" and the combination of departure airport "Narita" and arrival airport "Haneda") are fixed to zero and output, so that the counting results for non-existent combinations are concealed and become non-zero values, preventing a situation in which the usefulness of the counting results (statistical information) is reduced. Also, as in the first embodiment, all structurally existing combinations are included in the counting process without omission, even if they do not exist in the user data. This makes it possible to avoid situations in which non-structural zeros (combinations that exist structurally but are not output) occur, and also prevents unintended disclosure due to non-structural zeros.

[0036] [Third Embodiment] In the third embodiment, in addition to the first embodiment which prevents unintended disclosure due to non-structural zeros, a form will be described in which structural zero combinations are excluded from the aggregation process and are not included in the aggregated data, thereby preventing a situation in which the aggregation result of structural zero combinations becomes a non-zero value due to subsequent confidentiality processing, thereby reducing the usefulness of the aggregation result (statistical information).

[0037] The functional block configuration of the privacy-preserving data aggregation device 10 of the third embodiment is similar to that of Fig. 1, and therefore a duplicated description will be omitted. However, among the functional units of Fig. 1, the aggregation processing unit 14 has a feature that it refers to a flagged list in which non-existent combinations are flagged among all possible combinations of values ​​of a plurality of attribute information in the domain data, and aggregates the user data for combinations that are not flagged among all the combinations.

[0038] The above-mentioned "flagged list" may be generated in advance and stored by the domain data storage unit 12, or may be generated by the domain data storage unit 12 from the domain data at that time, as described below.

[0039] The privacy protection data aggregation device 10 of the third embodiment executes the process shown in Fig. 6. In Fig. 6, the same processes as those of the first embodiment (Fig. 2) are assigned the same step numbers, and detailed descriptions thereof will be omitted.

[0040] First, the user data held by the user data holding unit 11 and the domain data held by the domain data holding unit 12 are acquired (step S1) so that they can be executed in subsequent processing. Next, as in the second embodiment, the domain data holding unit 12 generates the aforementioned "flagged list" by flagging non-existent combinations (combinations that could result in structural zeros) among all possible combinations of values ​​of multiple attribute information in the domain data at that time with a structural zero flag. For example, as shown in the "flagged list" in FIG. 7 , a structural zero flag of "1" is assigned to the non-existent combination of departure "Narita" and arrival "Narita." Similarly, a structural zero flag of "1" is assigned to the non-existent combination of departure "Narita" and arrival "Haneda." Existing combinations (e.g., a combination of departure "Narita" and arrival "Naha") are flagged with a "0." This flagged list is transferred from the domain data holding unit 12 to the anonymization processing unit 15 via the aggregation processing unit 14.

[0041] Then, as in the first embodiment, the attribute information encryption unit 13 encrypts the attribute information of the user data using a homomorphic encryption method capable of aggregation (e.g., an encryption method having additive homomorphism or fully homomorphism) (step S2). Then, the aggregation processing unit 14 refers to the flagged list and aggregates the user data with encrypted attribute information for combinations excluding the flagged combinations from all combinations of requirements (combinations with a flag of "0" in the example of FIG. 5 ), thereby generating aggregated data with encrypted attribute information (step S3A). As a result, aggregated data including the aggregation results (number of people) with encrypted attribute information (departure point, arrival point) is generated, as shown in the "aggregated data" of FIG. 7 . At this time, as shown by the strikethrough in FIG. 7 , non-existent combinations (combinations that can result in structural zeros) are excluded from the aggregation process and are not included in the aggregated data. Therefore, the aggregation results of flagged non-existent combinations (combinations that can result in structural zeros) are concealed to non-zero values, which prevents a situation in which the usefulness of the aggregation results (statistical information) is reduced. On the other hand, among all combinations of requirements, combinations with structural zeros are excluded from the aggregation process, but combinations other than combinations with structural zeros are included in the aggregation process even if they do not exist in the user data. Therefore, as in the first embodiment, it is possible to avoid the occurrence of non-structural zeros (combinations that exist structurally but are not output).

[0042] Thereafter, the anonymization processing unit 15 performs anonymization on the aggregated data (aggregated data from which non-existent combinations have been removed) (step S4), and the decryption unit 16 decrypts the aggregated data after the anonymization processing to obtain aggregated data including the aggregation results after the anonymization processing and the decrypted attribute information, and outputs the aggregated data in plain text (step S5). As a result, aggregated data in which the attribute information (place of departure, place of arrival) has been decrypted and the aggregation results (number of people) have been anonymized after the non-existent combinations have been removed is obtained and output, as shown in the "agonymized aggregated data" in Fig. 7.

[0043] According to the third embodiment as described above, the aggregation results (number of people) of combinations that could result in non-existent structural zeros (for example, the combination of departure airport "Narita" and arrival airport "Narita" and the combination of departure airport "Narita" and arrival airport "Haneda") are not output, so that the aggregation results of non-existent combinations are concealed and become non-zero values, preventing a situation in which the usefulness of the aggregation results (statistical information) is reduced. Also, as in the first embodiment, all structurally existing combinations are included in the aggregation without omission, even if they do not exist in the user data, so that it is possible to avoid situations in which non-structural zeros (combinations that exist structurally but are not output) occur, and it is also possible to prevent unintended disclosure due to non-structural zeros.

[0044] [Fourth embodiment] In the fourth embodiment, in addition to the first embodiment that prevents unintended disclosure due to non-structural zeros, a form will be described in which the aggregation targets are narrowed down based on an aggregation target list that excludes structural zero combinations, and then aggregation processing is performed, thereby preventing a situation in which the aggregation result of structural zero combinations becomes a non-zero value due to subsequent confidentiality processing, thereby reducing the usefulness of the aggregation result (statistical information).

[0045] The functional block configuration of the privacy-preserving data aggregation device 10 of the fourth embodiment is the same as that of Fig. 1, and therefore a duplicated description will be omitted. However, among the functional units of Fig. 1, the aggregation processing unit 14 has a feature that it refers to an aggregation target list that lists combinations, excluding non-existent combinations, from all possible combinations of values ​​of a plurality of attribute information in the domain data, and aggregates the user data for the combinations included in the aggregation target list.

[0046] The above-mentioned "list of targets to be aggregated" may be generated in advance as described below and stored by the domain data storage unit 12, or may be generated by the domain data storage unit 12 from the domain data at the time.

[0047] The privacy protection data aggregation device 10 of the fourth embodiment executes the process shown in Fig. 8. In Fig. 8, the same processes as those of the first embodiment (Fig. 2) are assigned the same step numbers, and detailed descriptions thereof will be omitted.

[0048] First, in order to enable subsequent processing, the user data held by the user data holding unit 11 and the above-mentioned aggregation target list (a list describing combinations of attribute information that are not structurally zero (to be aggregated)) held by the domain data holding unit 12 are acquired (step S1B). As shown as an example of the "aggregation target list" in Fig. 9, the aggregation target list is a list that includes all possible "combinations of departure and arrival points," and all combinations in the list are aggregated.

[0049] Then, as in the first embodiment, the attribute information encryption unit 13 encrypts the attribute information of the user data using a homomorphic encryption method capable of aggregation (e.g., an encryption method having additive homomorphism or fully homomorphism) (step S2). The aggregation processing unit 14 then aggregates the user data with encrypted attribute information for all combinations listed in the aggregation target list, generating aggregated data with encrypted attribute information (step S3B). As a result, aggregated data including aggregation results (number of people) with encrypted attribute information (departure point, arrival point) for all combinations listed in the aggregation target list is generated, as shown in the "aggregated data" in FIG. 9 . At this time, non-existent combinations (combinations that can result in structural zeros) are excluded from the aggregation target list and are therefore not included in the aggregated data. This prevents the aggregation results of non-existent combinations (combinations that can result in structural zeros) from being concealed and becoming non-zero, thereby reducing the usefulness of the aggregation results (statistical information). On the other hand, among all combinations of requirements, combinations with structural zeros are excluded from the target of the aggregation process, but combinations other than combinations with structural zeros are included in the aggregation process even if they do not exist in the user data. Therefore, as in the first embodiment, it is possible to avoid the occurrence of non-structural zeros (combinations that exist structurally but are not output).

[0050] Thereafter, the anonymization processing unit 15 performs anonymization on the aggregated data (aggregated data from which non-existent combinations have been removed) (step S4), and the decryption unit 16 decrypts the aggregated data after the anonymization processing to obtain aggregated data including the aggregation results after the anonymization processing and the decrypted attribute information, and outputs the aggregated data in plain text (step S5). As a result, aggregated data from which non-existent combinations have been removed, attribute information (places of departure and arrival) has been decrypted, and the aggregation results (number of people) have been anonymized is obtained and output, as shown in the "agonymized aggregated data" in Fig. 9.

[0051] According to the fourth embodiment as described above, the aggregation results (number of people) of combinations that could result in non-existent structural zeros (for example, the combination of departure airport "Narita" and arrival airport "Narita" and the combination of departure airport "Narita" and arrival airport "Haneda") are not output, so that the aggregation results of non-existent combinations are concealed and become non-zero values, preventing a situation in which the usefulness of the aggregation results (statistical information) is reduced. Also, as in the first embodiment, all structurally existing combinations are included in the aggregation without omission, even if they do not exist in the user data, so that it is possible to avoid the occurrence of non-structural zeros (combinations that exist structurally but are not output), and to prevent unintended disclosure due to non-structural zeros.

[0052] Fifth Embodiment In the fifth embodiment, a form will be described in which unintended disclosure due to unstructured zeros is prevented by cooperation between first and second devices included in a privacy-preserving data aggregation system.

[0053] As shown in Figure 10, the privacy-protecting data aggregation system 1 of the fifth embodiment includes a first device 20A that provides a first service and a second device 20B that provides a second service, and aggregates the number of target users through cooperation between the first device 20A and the second device 20B by a process described below.

[0054] In this embodiment, the first device 20A and the second device 20B share the responsibility of executing a series of processes, which will be described in detail later. As an example, the second device 20B performs matching, tallying, and concealment processing, and the first device 20A finally performs decryption and output. As functional blocks for this, the first device 20A includes a domain data storage unit 21, a tally image generation unit 22, a user data storage unit 23, a first encryption unit 24, and a decryption unit 29, all of which are shown by solid lines in Figure 10. The second device 20B includes a domain data storage unit 21, a tally image generation unit 22, a user data storage unit 23, a second encryption unit 25, a matching unit 26, a tally processing unit 27, and a concealment processing unit 28, all of which are shown by solid lines in Figure 10.

[0055] However, the above-described division of roles in which the second device 20B performs matching, counting, and concealment processing, and the first device 20A finally performs decryption and output, is merely an example, and the first device 20A and the second device 20B may have a common functional block configuration by including, for example, the functional units indicated by dashed lines in Fig. 10. In that case, it is also possible to realize a division of roles in which the first device 20A performs matching, counting, and concealment processing, and the second device 20B finally performs decryption and output.

[0056] The functional units are outlined below. The user data storage unit 23 of the first device 20A is a functional unit that stores first user data including a first user ID and first attribute information related to a user of the first service, and the domain data storage unit 21 is a functional unit that stores domain data that defines possible values ​​for the first attribute information. Similarly, the user data storage unit 23 of the second device 20B is a functional unit that stores second user data including a second user ID and second attribute information related to a user of the second service, and the domain data storage unit 21 is a functional unit that stores domain data that defines possible values ​​for the second attribute information.

[0057] The tally image generation unit 22 included in both the first device 20A and the second device 20B generates a tally image that lists all combinations of the first attribute information and the second attribute information based on first domain data that defines the possible values ​​of the first attribute information and second domain data that defines the possible values ​​of the second attribute information, and shares the tally image with the second device 20B.

[0058] The first encryption unit 24 is a functional unit that encrypts the first user ID with the user ID private key of the first device and the first attribute information with the attribute information private key of the first device, respectively, and transmits the encrypted first user data including the first user ID and first attribute information to the second device 20B, and also receives the encrypted second user ID from the second device 20B, in which the second user ID is encrypted with the user ID private key of the second device 20B, encrypts the encrypted second user ID with the user ID private key of the first device 20A, and transmits it to the second device 20B.

[0059] The second encryption unit 25 is a functional unit that further encrypts the first user ID encrypted by the first encryption unit 24 with the private key for the user ID of the first device with the private key for the user ID of the second device 20B, encrypts the second user ID with the private key for the user ID of the second device 20B, transmits the encrypted second user ID to the first device 20A, and obtains the second user ID that has been further encrypted with the private key for the user ID of the first device 20A by the first device 20A.

[0060] The matching unit 26 is a functional unit that matches the first user ID and the second user ID, both of which are encrypted with the private key for the user ID of the first device 20A and the private key for the user ID of the second device 20B, to match the first user data encrypted by the first encryption unit 24 with the second user data.

[0061] The aggregation processing unit 27 is a functional unit that categorizes the matched data based on the unencrypted second attribute information in the second user data, aggregates the categorized matched data for all combinations described in the aggregation image, and obtains aggregated data including aggregation results for each combination of encrypted first attribute information and unencrypted second attribute information.

[0062] The confidentiality processing unit 28 is a functional unit that performs confidentiality processing on the aggregated data obtained by the aggregation processing unit 27 by adding noise generated based on the disclosed computational key of the first device 20A to the aggregated data. Here, the aggregated data after adding noise satisfies differential privacy. In addition, as the type of noise, for example, a Laplace mechanism, a Gaussian mechanism, an exponential mechanism, or the like can be adopted. The same applies to "noise" described in the following embodiments.

[0063] The decryption unit 29 is a functional unit that decrypts the aggregated data that has been subjected to the confidentiality processing based on the published calculation key of the first device 20A and the private key for attribute information of the first device 20A, and obtains aggregated data that includes the confidential aggregated results after decryption for each combination of the decrypted first attribute information and the unencrypted second attribute information.

[0064] In the privacy protection data aggregation system 1 configured as above, the process shown in FIG. 11 is executed.

[0065] First, in the first device (also referred to as the device of company A) 20A, the first user data stored in the user data storage unit 23 and the domain data stored in the domain data storage unit 21 are read and acquired so that they can be executed in subsequent processing (step S11A). As illustrated in FIG. 12(a), the first user data includes a user ID (ID Ａ ), departure point, and arrival point, and the above domain data includes possible values ​​for "departure point" (Haneda, Naha, Fukuoka, ...) and possible values ​​for "arrival point" (Haneda, Naha, Fukuoka, ...). Airport names are used for "departure point" and "arrival point" in the first user data and domain data related to the first device (Company A's device). Meanwhile, in the second device (also referred to as Company B's device) 20B, second user data held by the user data holding unit 23 and domain data held by the domain data holding unit 21 are acquired so that subsequent processing can be performed (step S11B). As illustrated in FIG. 12(b), the second user data includes a user ID (ID Ｂ), departure point, arrival point, and means of transportation, and the above domain data includes possible values ​​for "departure point" (Haneda, Naha, Fukuoka, ...), possible values ​​for "arrival point" (Haneda, Naha, Fukuoka, ...), and possible values ​​for "transportation means" (airplane, bullet train, car, ...). Prefecture names are used for "departure point" and "arrival point" in the second user data and domain data related to the second device (company B's device).

[0066] Next, the tally image generating units 22 of the first and second devices cooperate with each other to generate a tally image as shown in Fig. 13, which lists all combinations of the first attribute information and the second attribute information, based on the first domain data that defines the possible values ​​of the first attribute information and the second domain data that defines the possible values ​​of the second attribute information. As shown in Fig. 13, the tally image includes all combinations of the first attribute information (Company A's "departure point" and "arrival point") and the second attribute information (Company B's "departure point", "arrival point", and "transportation method"), and a "tally result" column is provided for each combination.

[0067] Next, the first encryption unit 24 of the first device (device of company A) 20A encrypts the first user ID in the first user data as shown in FIG. Ａ The first attribute information (point of departure, point of arrival) is encrypted with Company A's private key a, and the first attribute information (point of departure, point of arrival) is encrypted with Company A's private key A, and the encrypted first user data is sent to the second encryption unit 25 of the second device (Company B's device) 20B (step S13).

[0068] Next, the second encryption unit 25 of the second device (device of company B) 20B encrypts the first user ID in the encrypted first user data sent as shown in FIG. Ａ is further encrypted with the secret key b of company B (step S14), and the second user ID in the second user data is Ｂ is encrypted with the secret key b of Company B, and the encrypted second user ID Ｂ to the first encryption unit 24 of the first device (device of company A) 20A (step S15).

[0069] Next, the first encryption unit 24 of the first device (device of company A) 20A encrypts the second user ID after encryption as shown in FIG.Ｂ is further encrypted with the secret key a of company A, and the encrypted second user ID Ｂ The encrypted second user ID received by the second encryption unit 25 of the second device (device of company B) 20B is sent to the second encryption unit 25 of the second device (device of company B) 20B (step S16). Ｂ is transferred to the abutting section 26.

[0070] Then, the matching unit 26 of the second device (device of company B) 20B receives the encrypted second user ID as shown in FIG. Ｂ and the encrypted first user ID. Ａ The first user data including the first and second user IDs encrypted with the private keys a and b is matched with the first user data including the first and second user IDs (step S17), and matched data is obtained. The matched data obtained here includes a combination of first and second user data with matching IDs, and includes first attribute information (departure point, arrival point) encrypted with the private key A of company A and unencrypted second attribute information (departure point, arrival point, means of transportation), as shown in FIG. 17. The matched data is transferred to the aggregation processing unit 27.

[0071] Next, the tabulation processing unit 27 of the second device (company B's device) 20B categorizes the matched data according to whether or not the unencrypted second attribute information (company B's attribute information) is common, as shown in Fig. 18 (step S18), and further tabulates the categorized matched data by category to generate tabulated data, as shown in Fig. 19 (step S19). Here, as shown in Fig. 18, the "departure point, arrival point, mode of transportation" in the second attribute information is categorized into "Chiba, Okinawa, airplane" data and "Tokyo, Osaka, Shinkansen" data. Of these, the "Chiba, Okinawa, airplane" data contains the same bit string, and it can be determined that the first attribute information is the same because the first attribute information (Narita, Naha) is encrypted with company A's private key A, so its content is unknown. Therefore, the tabulation result is "2." On the other hand, as for the data of "Tokyo, Osaka, Shinkansen", the first attribute information is encrypted with the secret key A of company A, and therefore the content of the information is unknown, but depending on whether the bit strings are the same, the data of which first attribute information is "Haneda, Itami" and the data of which first attribute information is "Haneda, Kansai International" are tallied separately, and the data of which first attribute information is "Haneda, Itami" is given an aggregated result of "2", and the data of which first attribute information is "Haneda, Kansai International" is given an aggregated result of "1". Furthermore, in this embodiment, the aggregated results are encrypted with the computation key of company A, which is a type of public key.

[0072] The processing of steps S18 and S19 described above is performed on all combinations of first attribute information and second attribute information included in the aggregation image of Figure 13, so all combinations that exist structurally, even if they do not exist in the user data, are included in the aggregation without omission, thereby avoiding the occurrence of non-structural zeros (combinations that exist structurally but are not output).

[0073] Next, the confidentiality processing unit 28 of the second device (Company B's device) 20B performs confidentiality processing (for example, adding noise generated by Company B using Company A's calculation key as shown in Figure 20) on the aggregated data, and sends the aggregated data after confidentiality processing to the decryption unit 29 of the first device (Company A's device) 20A (step S20).

[0074] Then, the decryption unit 29 of the first device (company A's device) 20A decrypts the transmitted anonymized aggregated data and outputs it as plaintext statistical information shown on the right side of Fig. 21 (step S21). At this time, the first attribute information included in the anonymized aggregated data is encrypted with company A's private key A, but the decryption unit 29 can use its own private key A and therefore can decrypt the first attribute information. Furthermore, the aggregated results included in the anonymized aggregated data are encrypted with company A's computation key, but the decryption unit 29 can use its own computation key and therefore can decrypt the aggregated results.

[0075] According to the fifth embodiment described above, processing such as aggregation is performed on all combinations of first attribute information and second attribute information, so that all combinations that exist structurally, even if they do not exist in the user data, are included in the aggregation without omission, making it possible to avoid the occurrence of non-structural zeros (combinations that exist structurally but are not output), and to prevent unintended disclosure due to non-structural zeros. [Sixth Embodiment] In the sixth embodiment, in addition to the fifth embodiment that prevents unintended disclosure due to non-structural zeros, a form is described in which structural zero combinations are excluded from the confidentiality processing and the aggregation result is fixed to zero, thereby preventing a situation in which the aggregation result of combinations of structural zeros becomes a non-zero value and the usefulness of the aggregation result (statistical information) is reduced.

[0076] The functional block configuration of the privacy-preserving data aggregation system 1 of the sixth embodiment is similar to the configuration shown in Fig. 10, and therefore a duplicated description will be omitted. However, among the functional units shown in Fig. 10, the tally image generation unit 22 is characterized in that it generates a flagged list in which non-existent combinations (i.e., structurally zero combinations) among the combinations described in the tally image are flagged based on the generated tally image, and the anonymization processing unit 28 is characterized in that it references the flagged list, fixes the tally results for flagged combinations in the aggregate data to zero, and performs anonymization processing on combinations in the aggregate data that are not flagged.

[0077] First, referring to Fig. 22, we will explain the patterns that result in structural zeros in the user data of companies A and B. As shown in Fig. 22, there are four patterns that result in structural zeros: the following patterns (1) to (4).

[0078] Pattern (1) is a pattern in which the attribute information of the data of Company A (or Company B) is the same, such as a pattern in which the "point of departure" and "point of arrival" in the attribute information of Company A are both "Haneda Airport." Note that in the table of Figure 22, "*" indicates an arbitrary value, and if the "point of departure" and "point of arrival" in the attribute information of Company A are both "Haneda Airport," then it falls under pattern (1) regardless of the value of Company B's attribute information.

[0079] Pattern (2) is a pattern in which the attribute information of Company A (or Company B) is different, but the combination does not exist. For example, in Company A's attribute information, the "departure point" is "Haneda Airport" and the "arrival point" is "Narita Airport," a combination that does not exist.

[0080] Pattern (3) is a pattern in which the attribute information "departure point" related to "departure point" in Company A's data is the same as the attribute information "arrival point" in Company B's data, for example, a pattern in which "departure point" in Company A's attribute information and "arrival point" in Company B's attribute information are both "Haneda Airport." In other words, while Company A's attribute information and Company B's attribute information can exist independently, combining them results in a combination that does not exist.

[0081] Pattern (4) is a pattern in which the attribute information "Point of departure" related to "Point of departure" in Company A's data and the attribute information related to "Point of arrival" in Company B's data are different, but are a combination that does not exist, for example, a pattern in which the "Point of departure" in Company A's attribute information is "Haneda Airport" and the "Point of arrival" in Company B's attribute information is "Tokyo", a combination that does not exist. Similar to pattern (3) above, this is a pattern in which the attribute information of Company A and the attribute information of Company B can exist independently, but when combined, they become a combination that does not exist.

[0082] The privacy protection data aggregation system 1 of the sixth embodiment executes the process shown in Fig. 23. In Fig. 23, the same processes as those of the fifth embodiment (Fig. 11) are assigned the same step numbers, and detailed descriptions thereof will be omitted.

[0083] First, the first user data and domain data of Company A's device 20A and the second user data and domain data of Company B's device 20B are acquired so that they can be used in subsequent processing (steps S11A and S11B). The tally image generation units 22 of the first and second devices cooperate to generate and share a tally image, such as that shown in FIG. 13, which lists all combinations of first attribute information and second attribute information (step S12). Furthermore, by inputting structural zero patterns into the tally image on both sides, a flagged list with a structural zero flag, such as that shown in FIG. 24, is generated (step S12A). FIG. 24 illustrates an example of a flagged list in a format in which a column for "structural zero flag" has been added to the tally image. While FIG. 24 lists only data with a structural zero flag of "1," it goes without saying that the flag will be "0" for any combination of attribute information that does not have a structural zero.

[0084] 23 are executed in the same manner as in the fifth embodiment, and the tallying unit 27 of the device 20B of company B tally, for each category, the user data (matched data) categorized based on the attribute information of company B (step S19). Here, for example, a flagged list as shown in Fig. 25 is used to obtain tally results for each combination in the flagged list, and furthermore, tally data encrypted with the published computation key of company A is obtained.

[0085] Then, as shown in Fig. 26, the encryption processing unit 28 of company B's device 20B refers to the flagged list, fixes the aggregation results for combinations flagged "1" in the aggregated data to zero, and performs encryption processing (adding noise generated by company B using company A's computation key) for combinations not flagged in the aggregated data, and sends the encrypted aggregated data to the decryption unit 29 of the first device (company A's device) 20A (step S20A). Furthermore, the decryption unit 29 of the first device (company A's device) 20A decrypts the encrypted aggregated data that has been sent, and outputs it as plaintext statistical information shown on the right side of Fig. 27 (step S21).

[0086] According to the sixth embodiment described above, the counting results for combinations flagged with "1" in the flagged list (combinations that can become structural zeros) are output without being concealed and fixed to zero, thereby preventing the counting results for non-existent combinations from being concealed and becoming non-zero, thereby preventing a situation in which the usefulness of the counting results (statistical information) is reduced. Also, as in the fifth embodiment, all combinations that exist structurally, even if they do not exist in the user data, are included in the counting without omission, thereby avoiding the occurrence of non-structural zeros (combinations that exist structurally but are not output), and preventing unintended disclosure due to non-structural zeros.

[0087] In the sixth embodiment, an example was shown in which the aggregation results for combinations flagged with "1" in the flagged list (combinations that can become structural zero) were fixed to zero and output, but instead, a form may be adopted in which the aggregation results for combinations flagged with "1" are not output.

[0088] [Seventh embodiment] In the seventh embodiment, in addition to the fifth embodiment which prevents unintended disclosure due to non-structural zeros, a form will be described in which structural zero combinations are excluded from the aggregation process and are not included in the aggregated data, thereby preventing a situation in which the aggregation result of structural zero combinations becomes a non-zero value due to subsequent confidentiality processing, thereby reducing the usefulness of the aggregation result (statistical information).

[0089] The functional block configuration of the privacy-preserving data aggregation system 1 of the seventh embodiment is similar to the configuration shown in Fig. 10, and therefore a duplicated description will be omitted. However, among the functional units shown in Fig. 10, the aggregate image generation unit 22 is characterized in that it generates a flagged list in which non-existent combinations (i.e., structurally zero combinations) among the combinations listed in the aggregate image are flagged based on an aggregate image listing all combinations of first attribute information and second attribute information, and the aggregation processing unit 27 refers to the flagged list and aggregates user data for combinations that are not flagged.

[0090] The privacy protection data aggregation system 1 of the seventh embodiment executes the process shown in Fig. 28. In Fig. 28, the same processes as those of the fifth embodiment (Fig. 11) are assigned the same step numbers, and detailed descriptions thereof will be omitted.

[0091] First, the first user data and domain data of Company A's device 20A and the second user data and domain data of Company B's device 20B are obtained so that they can be executed in subsequent processing (steps S11A and S11B). As in the sixth embodiment, an aggregate image such as that shown in Figure 13, which lists all combinations of first attribute information and second attribute information, is generated and shared (step S12). By inputting a structural zero pattern into the aggregate image, a flagged list with a structural zero flag attached, as shown in Figure 24, is generated (step S12A).

[0092] Thereafter, steps S13 to S18 in Fig. 23 are executed in the same manner as in the fifth embodiment, and furthermore, the tabulation processing unit 27 of the device 20B of company B tabulates the user data (matched data) categorized based on the attribute information of company B for each category. At this time, as shown in Fig. 29, flagged combinations are excluded from the tabulation, and the user data is tabulated for combinations that are not flagged (step S19A). In Fig. 29, combinations that are excluded from the tabulation are crossed out.

[0093] Thereafter, as shown in Fig. 30, the encryption processing unit 28 of the device 20B of company B performs encryption processing (here, adding noise generated by company B using the operation key of company A) on the aggregated data (here, aggregated data from which structural zeros have already been removed), and sends the aggregated data after encryption processing to the decryption unit 29 of the first device (device of company A) 20A (step S20). Furthermore, the decryption unit 29 of the first device (device of company A) 20A decrypts the encrypted aggregated data that has been sent, and outputs it as plaintext statistical information shown on the right side of Fig. 31 (step S21).

[0094] According to the seventh embodiment described above, combinations flagged with "1" in the flagged list (combinations that can become structural zeros) are not counted and are not included in the counting results, so that it is possible to prevent a situation in which the counting results of non-existent combinations are concealed and become non-zero values, reducing the usefulness of the counting results (statistical information). Also, as in the fifth embodiment, all combinations that exist structurally, even if they do not exist in the user data, are counted without omission, so it is possible to avoid a situation in which non-structural zeros (combinations that exist structurally but are not output) occur, and it is possible to prevent unintended disclosure due to non-structural zeros.

[0095] In the seventh embodiment, an example was shown in which the aggregation results for combinations flagged with "1" in the flagged list (combinations that can become structurally zero) are not output, but instead, a form may be adopted in which the aggregation results for combinations flagged with "1" are fixed to zero and output.

[0096] [Eighth Embodiment] In the eighth embodiment, in addition to the fifth embodiment that prevents unintended disclosure due to non-structural zeros, a form will be described in which the aggregation targets are narrowed down based on an aggregation target list from which non-existent combinations are excluded, and then aggregation processing is performed, thereby preventing a situation in which the aggregation result of a combination of structural zeros becomes a non-zero value due to subsequent confidentiality processing, thereby reducing the usefulness of the aggregation result (statistical information).

[0097] The functional block configuration of the privacy-preserving data aggregation system 1 of the eighth embodiment is similar to the configuration shown in Fig. 10, and therefore a duplicated description will be omitted. However, among the functional units shown in Fig. 10, the aggregation image generation unit 22 is characterized in that it generates an aggregation target list that lists combinations that are not present in the generated aggregation image, and the aggregation processing unit 27 is characterized in that it refers to the aggregation target list and aggregates user data for the combinations included in the aggregation target list.

[0098] The privacy protection data aggregation system 1 of the eighth embodiment executes the process shown in Fig. 32. In Fig. 32, the same processes as those of the fifth embodiment (Fig. 11) are assigned the same step numbers, and detailed descriptions thereof will be omitted.

[0099] First, the first user data and domain data of Company A's device 20A and the second user data and domain data of Company B's device 20B are acquired so that they can be executed in subsequent processing (steps S11A and S11B). As in the sixth and seventh embodiments, an aggregate image such as that shown in Figure 13, which lists all combinations of first attribute information and second attribute information, is generated and shared (step S12).

[0100] Then, the tally image generation unit 22 generates a tally target list, as illustrated in the lower left of Figure 33, which lists combinations described in the generated tally image, excluding combinations that do not exist (step S12B).

[0101] Thereafter, steps S13 to S18 in Figure 23 are executed in the same manner as in the fifth embodiment, and further, the aggregation processing unit 27 of Company B's device 20B refers to the aggregation target list, as shown in Figure 33, and for the combinations listed in the aggregation target list, aggregates the user data (matched data) categorized based on Company B's attribute information by category, and generates aggregated data (step S19B).

[0102] Thereafter, the encryption processing unit 28 of the device 20B of company B performs encryption processing (here, adding noise generated by company B using the operation key of company A) on the aggregated data (here, aggregated data from which structural zeros have already been removed) and sends the aggregated data after the encryption processing to the decryption unit 29 of the first device (device of company A) 20A (step S20). Furthermore, the decryption unit 29 of the first device (device of company A) 20A decrypts the encrypted aggregated data that has been sent and outputs it as plaintext statistical information (step S21).

[0103] According to the eighth embodiment described above, only the combinations listed in the aggregation target list, from which non-existent combinations have been removed, are counted, so that the aggregation results of non-existent combinations (combinations that could result in structural zeros) are concealed and become non-zero values, preventing a situation in which the usefulness of the aggregation results (statistical information) is reduced. Also, as in the fifth embodiment, all structurally existing combinations, even if they do not exist in the user data, are counted without omission, so that it is possible to avoid a situation in which non-structural zeros (combinations that exist structurally but are not output) occur, and it is possible to prevent unintended disclosure due to non-structural zeros.

[0104] In the eighth embodiment, an example was shown in which the aggregation results for combinations that are listed in the aggregation image but are not in the aggregation target list (combinations that could result in structural zero) are not output, but instead, a form may be adopted in which the aggregation results for the above combinations are fixed to zero and output.

[0105] (Explanation of terms, explanation of hardware configuration (Figure 34), etc.) Note that the block diagrams used to explain the above embodiments and variant examples show functional blocks. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method for realizing each functional block is not particularly limited. That is, each functional block may be realized using a single device that is physically or logically coupled, or may be realized using multiple devices by connecting two or more physically or logically separated devices directly or indirectly (for example, using wires, wirelessly, etc.). A functional block may be realized by combining software with the single device or multiple devices.

[0106] Functions include, but are not limited to, judgment, determination, assessment, calculation, computation, processing, derivation, investigation, search, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, consideration, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, and assignment. For example, a functional block (component) that performs transmission is called a transmitting unit or transmitter. As mentioned above, there are no particular limitations on how these functions are implemented.

[0107] For example, the privacy protection data aggregation device according to an embodiment of the present disclosure may function as a computer that performs the processing of this embodiment. Fig. 34 is a diagram illustrating an example hardware configuration of a privacy protection data aggregation device 10 according to an embodiment of the present disclosure. The privacy protection data aggregation device 10 described above may be physically configured as a computer device including a processor 1001, a memory 1002, a storage 1003, a communication device 1004, an input device 1005, an output device 1006, a bus 1007, and the like. The first device 20A and the second device 20B shown in Fig. 10 may also be configured similarly to the privacy protection data aggregation device 10.

[0108] In the following description, the term "apparatus" can be read as a circuit, a device, a unit, etc. The hardware configuration of the privacy-preserving data aggregation apparatus 10 may be configured to include one or more of the devices shown in the figure, or may be configured to exclude some of the devices.

[0109] Each function of the privacy protection data aggregation device 10 is realized by loading specified software (programs) onto hardware such as the processor 1001 and memory 1002, causing the processor 1001 to perform calculations, control communication via the communication device 1004, and control at least one of reading and writing data in the memory 1002 and storage 1003.

[0110] The processor 1001 controls the entire computer by running, for example, an operating system, and may be configured as a central processing unit (CPU) including an interface with peripheral devices, a control device, an arithmetic unit, a register, etc.

[0111] The processor 1001 also reads programs (program codes), software modules, data, etc. from at least one of the storage 1003 and the communication device 1004 into the memory 1002 and executes various processes in accordance with these. The programs used are those that cause a computer to execute at least some of the operations described in the above-described embodiments. While the above-described various processes have been described as being executed by one processor 1001, they may be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The programs may be transmitted from a network via a telecommunications line.

[0112] The memory 1002 is a computer-readable recording medium and may be configured by, for example, at least one of a read-only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a random access memory (RAM), etc. The memory 1002 may also be called a register, a cache, a main memory (primary storage device), etc. The memory 1002 can store executable programs (program codes), software modules, etc. for implementing a wireless communication method according to an embodiment of the present disclosure.

[0113] Storage 1003 is a computer-readable recording medium, and may be composed of at least one of, for example, an optical disk such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disk, a digital versatile disk, a Blu-ray (registered trademark) disk), a smart card, a flash memory (e.g., a card, a stick, a key drive), a floppy (registered trademark) disk, a magnetic strip, etc. Storage 1003 may also be referred to as an auxiliary storage device. The above-mentioned storage medium may be, for example, a database including at least one of memory 1002 and storage 1003, or other appropriate medium.

[0114] The communication device 1004 is hardware (transmission / reception device) for communicating between computers via at least one of a wired network and a wireless network, and is also called, for example, a network device, a network controller, a network card, or a communication module.

[0115] The input device 1005 is an input device (e.g., a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc.) that accepts input from the outside. The output device 1006 is an output device (e.g., a display, a speaker, an LED lamp, etc.) that performs output to the outside. The input device 1005 and the output device 1006 may be integrated (e.g., a touch panel). Furthermore, each device, such as the processor 1001 and the memory 1002, is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or may be configured using different buses for each device.

[0116] The aspects / embodiments described in this disclosure may be used alone, in combination, or switched depending on the implementation. Notification of predetermined information (e.g., notification that "X is true") is not limited to explicit notification, but may be implicit (e.g., not notifying the predetermined information).

[0117] Although the present disclosure has been described in detail above, it is clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the spirit and scope of the present disclosure as defined by the claims. Therefore, the description of the present disclosure is intended to be illustrative and does not have any limiting meaning on the present disclosure.

[0118] The order of the procedures, sequences, flowcharts, etc. of each aspect / embodiment described in this disclosure may be changed unless it is consistent. For example, the methods described in this disclosure present elements of various steps using an example order, and are not limited to the particular order presented.

[0119] Input and output information may be stored in a specific location (for example, memory) or may be managed using a management table. Input and output information may be overwritten, updated, or added to. Output information may be deleted. Input information may be transmitted to another device.

[0120] As used in this disclosure, the phrase "based on" does not mean "based only on," unless expressly stated otherwise. In other words, the phrase "based on" means both "based only on" and "based at least on."

[0121] When the terms "include," "including," and variations thereof are used in this disclosure, these terms are intended to be inclusive, similar to the term "comprising." Furthermore, when the term "or" is used in this disclosure, it is not intended to be an exclusive or.

[0122] In this disclosure, where articles are added by translation, such as a, an, and the in English, the disclosure may include that the nouns following these articles are in the plural form.

[0123] In the present disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "coupled" may also be interpreted in the same way as "different."

[0124] 1...Privacy protection data aggregation system, 10...Privacy protection data aggregation device, 11...User data storage unit, 12...Domain data storage unit, 13...Attribute information encryption unit, 14...Aggregation processing unit, 15...Confidentiality processing unit, 16...Decryption unit, 20A...First device, 20B...Second device, 21...Domain data storage unit, 22...Aggregation image generation unit, 23...User data storage unit, 24...First encryption unit, 25...Second encryption unit, 26...Matching unit, 27...Aggregation processing unit, 28...Confidentiality processing unit, 29...Decryption unit, 1001...Processor, 1002...Memory, 1003...Storage, 1004...Communication device, 1005...Input device, 1006...Output device, 1007...Bus.

Claims

1. an attribute information encryption unit that encrypts a plurality of pieces of attribute information included in user data; an aggregation processing unit that aggregates user data whose attribute information has been encrypted by the attribute information encryption unit for all combinations of possible values ​​of the plurality of pieces of attribute information, and obtains aggregated data including an aggregation result and the encrypted attribute information; a concealment processing unit that performs concealment processing on the tabulated data obtained by the tabulation processing unit; A privacy-preserving data aggregation device comprising:

2. The confidentiality processing unit includes: among all combinations of values ​​that can be taken by the plurality of pieces of attribute information, a counting result of a combination that does not exist is fixed to zero, and a confidentiality process is performed on combinations other than the combination that does not exist. The privacy-preserving data aggregation device according to claim 1 .

3. The tallying unit includes: aggregating the user data for all combinations of values ​​that can be taken by the plurality of pieces of attribute information, except for combinations that do not exist; The privacy-preserving data aggregation device according to claim 1 .

4. The tallying unit includes: aggregating the user data for combinations excluding non-existent combinations from all combinations of values ​​that can be taken by the plurality of pieces of attribute information; The privacy-preserving data aggregation device according to claim 1 .

5. A first device holds first user data including a first user ID and first attribute information related to a user of a first service, and a second device holds second user data including a second user ID and second attribute information related to a user of a second service, The first device and the second device an aggregate image generating unit that generates an aggregate image describing all combinations of the first attribute information and the second attribute information based on possible values ​​of the first attribute information and possible values ​​of the second attribute information, and shares the generated aggregate image between the first device and the second device; Including, The first device is a first encryption unit that encrypts first user data including the first user ID and the first attribute information and transmits the first user data to the second device, and also encrypts the encrypted second user ID received from the second device and transmits the encrypted second user ID to the second device; Including, The second device is a second encryption unit that encrypts the second user ID, transmits the encrypted second user ID to the first device, and acquires the encrypted second user ID from the first device; a matching unit that matches the first user data encrypted by the first encryption unit with the second user data; a counting processing unit that categorizes matched data based on unencrypted second attribute information in the second user data, and tallies the categorized matched data for all combinations listed in the tabulation image to obtain tabulated data; A privacy-preserving data aggregation system, including:

6. The second device is a concealment processing unit that fixes a compilation result for a combination that does not exist among the combinations described in the compilation image to zero, and performs concealment processing on combinations other than the combinations that do not exist in the compilation data; Further comprising: The privacy-preserving data aggregation system of claim 5.

7. the tallying unit tallying the matched data for combinations other than non-existent combinations among the combinations described in the tallying image; The privacy-preserving data aggregation system of claim 5.

8. the tabulation processing unit tabulates the matched data for combinations excluding non-existent combinations from the combinations described in the tabulation image; The privacy-preserving data aggregation system of claim 5.

9. The first encryption unit encrypting the first user ID with a private key for user ID of the first device and the first attribute information with a private key for attribute information of the first device, and transmitting first user data including the encrypted first user ID and the first attribute information to the second device; receiving an encrypted second user ID obtained by encrypting the second user ID with a private key for a user ID of the second device from the second device, encrypting the encrypted second user ID with a private key for a user ID of the first device, and transmitting the encrypted second user ID to the second device; The privacy-preserving data aggregation system of claim 5.

10. The butt portion is a first user ID and a second user ID encrypted with a private key for a user ID of the first device and a private key for a user ID of the second device are compared to each other, thereby matching the first user data encrypted by the first encryption unit with the second user data; The privacy-preserving data aggregation system of claim 5.