Information processing device and privacy protection data linkage system

Abstract

An information processing device (10) holds user data including user IDs and attribute information relating to users, and comprises: an encryption unit (11) that encrypts user IDs in user data to be aggregated on the basis of a self-cypher key held by the device itself and a keyed one-way commutative operation, and encrypts the attribute information in the user data by a homomorphic encryption scheme capable of aggregation processing, thereby generating encrypted user data of the user data; an aggregation processing unit (12) that counts the number of encrypted user data sharing the attribute information, thereby generating encrypted aggregated data; and a concealment processing unit (13) that executes concealment processing on the generated encrypted aggregated data, thereby generating encrypted statistical information.

Description

Information processing device and privacy protection data linkage system

[0001] The present disclosure relates to an information processing device and a privacy-protecting data linkage system.

[0002] When performing statistical analysis or the like on user data that should be kept secret and that is managed in a database in information processing devices (devices that broadly include computers, servers, etc., hereinafter referred to as "devices") of multiple organizations, some measures must be taken from the perspective of privacy protection. As an example of such measures, a technology is known in which a system configuration has an interface that can simultaneously handle data that should be kept secret and data that may be disclosed, and the two types of data are integrated while keeping the data that should be kept secret concealed (see Patent Document 1 listed below).

[0003] JP 2011-081301 A

[0004] However, the technology of Patent Document 1 requires the selection of data to be kept confidential from the input user data, and does not anticipate a case where the user data does not contain data that may be disclosed, i.e., a case where the entire input user data is to be kept confidential. In this respect, there is room for improvement.

[0005] Furthermore, even in the case of information processing devices of a single organization, for example, when performing statistical analysis on user data that includes information about users that should be kept confidential (hereinafter referred to as "attribute information"), it is desirable to prevent the leakage of information that should be kept confidential and eliminate the risk of privacy violations by generating statistical information that excludes correspondence with individuals.

[0006] The present disclosure aims to prevent the leakage of confidential information and eliminate the risk of privacy violations by generating statistical information that excludes correspondence with individuals.

[0007] The information processing device according to the present disclosure is an information processing device that holds user data including a user ID and attribute information about the user, and generates statistical information about target users. The information processing device includes an encryption unit that encrypts the user ID in the user data to be aggregated based on a self-encrypting key and a keyed one-way commutative operation held by the device, and encrypts the attribute information in the user data to be aggregated using a homomorphic encryption method that enables aggregation processing, thereby generating encrypted user data for the user data to be aggregated; an aggregation processing unit that generates encrypted aggregated data by counting the number of encrypted user data that have common attribute information for the encrypted user data generated by the encryption unit; and a confidentiality processing unit that performs confidentiality processing on the encrypted aggregated data generated by the aggregation processing unit, thereby generating encrypted statistical information.

[0008] In the information processing device, the encryption unit encrypts the user ID in the user data to be aggregated based on a self-encryption key and a keyed one-way commutative operation stored in the device, and encrypts the attribute information in the user data using a homomorphic encryption method that enables aggregation processing, thereby generating encrypted user data for the user data to be aggregated. The encryption of the user ID and the encryption of the attribute information can be performed in any order. The aggregation processing unit then generates encrypted aggregated data by counting the number of encrypted user data pieces that share common attribute information for the encrypted user data generated by the encryption unit. The counting is performed, for example, by categorizing multiple records constituting the encrypted user data expressed as binary values ​​based on corresponding parts of the attribute information and vertically summing the values ​​(between the same bits in a bit string) for each category. Furthermore, the anonymization processing unit performs anonymization processing on the generated encrypted aggregated data to generate encrypted statistical information. As a result, by generating statistical information that excludes correspondence with individuals, it is possible to prevent the leakage of information that should be confidential and eliminate the risk of privacy violations.

[0009] According to the present disclosure, by generating statistical information that excludes correspondence with individuals, it is possible to prevent the leakage of information that should be kept secret and eliminate the risk of privacy violations.

[0010] 1 is a configuration diagram of an information processing device according to a first embodiment; FIG. 2 is a flow diagram showing processing executed in the information processing device according to the first embodiment; (a) is a diagram for explaining input of user data, (b) is a diagram for explaining encryption of a user ID, and (c) is a diagram for explaining encryption of attribute information; (a) is a diagram for explaining counting processing, (b) is a diagram for explaining confidentiality processing, and (c) is a diagram for explaining decryption processing; FIG. 3 is a configuration diagram of a privacy protection data linkage system according to a second embodiment; FIG. 4 is a flow diagram showing processing executed in the privacy protection data linkage system according to the second embodiment; (a) is a diagram for explaining input of user data, and (b) is a diagram for explaining anonymization processing; (a) is a diagram for explaining irreversible ID conversion; (b) is a diagram for explaining encryption of an ID; (a) is a diagram for explaining encryption of attribute information, and (b) is a diagram for explaining transmission and reception of an encrypted ID; (b) is a diagram for explaining re-encryption of an ID; (c) is a diagram for explaining data matching; (d) is a diagram for explaining counting processing; (d) is a diagram for explaining confidentiality processing; and (c) is a diagram for explaining decryption processing; FIG. 4 is a diagram showing a modified configuration of the information processing device according to the first embodiment; and FIG. 5 is a diagram showing a modified configuration of the privacy protection data linkage system according to the second embodiment. Fig. 19 is a diagram showing another modified example of the configuration of the privacy protection data linkage system according to the second embodiment. Fig. 20 is a diagram showing a modified example of the configuration of the privacy protection data linkage system in which attribute information is not a required requirement and user data including at least a user ID is the target of aggregation. Fig. 21 is a flow diagram showing processing executed in the privacy protection data linkage system of Fig. 19. Fig. 22 is a diagram showing an example of the hardware configuration of an information processing device.

[0011] Various embodiments according to the present disclosure will be described below with reference to the drawings. Hereinafter, as a first embodiment, an embodiment will be described in which an information processing device of a single organization targets user data including attribute information to be kept secret and generates statistical information in which correspondence with individuals is excluded. As a second embodiment, an embodiment will be described in which, in a privacy-preserving data linkage system having multiple devices that hold user data including user IDs and attribute information about users, one of the multiple devices links with a counterpart device to generate statistical information in which correspondence with individuals is excluded.

[0012] 1, an information processing device 10 in the first embodiment includes an encryption unit 11, a counting unit 12, and a concealment unit 13 as the minimum components required for generating statistical information from which correspondence with individuals has been excluded, and further includes a decryption unit 14 as a component for restoring the generated statistical information. The functions of each unit will be described below.

[0013] The encryption unit 11 is a functional unit that acquires user data including a user ID and user attribute information from an external device, encrypts the user ID in the user data to be aggregated based on a self-encryption key and a keyed one-way commutative operation held by the encryption unit 11 itself, and encrypts the attribute information in the user data to be aggregated using a homomorphic encryption method that enables aggregation processing, thereby generating encrypted user data for the user data to be aggregated. The encryption unit 11 includes an ID encryption unit 11A that has the function of encrypting the user ID, and an attribute information encryption unit 11B that has the function of encrypting the attribute information. Note that the encryption of the user ID and the encryption of the attribute information can be performed in any order, and the order is arbitrary.

[0014] The counting unit 12 is a functional unit that generates encrypted counted data by counting the number of encrypted user data pieces that have common attribute information among the encrypted user data pieces generated by the encryption unit 11. The counting method will be described later.

[0015] The confidentiality processing unit 13 is a functional unit that performs confidentiality processing on the encrypted aggregated data generated by the aggregation processing unit 12, and generates encrypted statistical information.

[0016] The decryption unit 14 is a functional unit that decrypts the encrypted statistical information generated by the confidentiality processing unit 13 based on a decryption method corresponding to the encryption by the encryption unit 11, and outputs the obtained statistical information to an external device.

[0017] Next, the processing executed in the information processing device 10 will be described with reference to FIGS. 2, 3(a) to 3(c), and 4(a) to 4(c).

[0018] First, the user data to be counted is input to the encryption unit 11 (step S1 in Fig. 2). As shown in Fig. 3(a), the input user data includes a user ID and attribute information related to the user, for example, a telephone number is used as the user ID, and information such as gender, age, and purchase frequency is used as the attribute information.

[0019] Next, as shown in FIG. 3(b), the ID encryption section 11A in the encryption section 11 encrypts the user ID in the user data with a secret key a prepared in advance to obtain ID-encrypted data (step S2).

[0020] Next, as shown in FIG. 3(c), the attribute information encryption unit 11B in the encryption unit 11 encrypts the attribute information in the ID encrypted data with a secret key A prepared in advance to obtain encrypted user data (step S3).

[0021] 4(a), the counting unit 12 generates encrypted aggregated data by counting the number of encrypted user data pieces that share common attribute information among the encrypted user data pieces generated by the encryption unit 11 (step S4). The counting here is performed, for example, by categorizing multiple records constituting the encrypted user data represented by binary values ​​according to corresponding parts of the attribute information, and then calculating the sum of the same bits in the bit string vertically for each category. After the encrypted aggregated data is generated, the user ID is no longer needed, so the counting unit 12 deletes the user ID and generates encrypted aggregated data.

[0022] Next, as shown in Fig. 4(b), the anonymization processing unit 13 performs an anonymization process on the encrypted aggregated data generated by the aggregation processing unit 12 to generate encrypted statistical information (step S5). For example, Fig. 4(b) shows an example in which noise is added to the aggregation results in the encrypted aggregated data to generate encrypted statistical information including the aggregation results to which noise has been added. In this way, "encrypted statistical information" is generated as statistical information from which the correspondence with individuals has been excluded.

[0023] Furthermore, as shown in Figure 4 (c), the decryption unit 14 decrypts the encrypted statistical information generated by the confidentiality processing unit 13 using a decryption method corresponding to the encryption by the encryption unit 11, and outputs the obtained plaintext statistical information to an external device (step S6).

[0024] According to the first embodiment described above, "encrypted statistical information" is generated as statistical information that excludes correspondence with individuals, so that a single information processing device 10 can prevent the leakage of attribute information that should be kept confidential and eliminate the risk of privacy violations.

[0025] (Second embodiment) Next, as a second embodiment, an embodiment will be described in which, in a privacy-protecting data linkage system having multiple devices that hold user data including a user ID and attribute information about the user, statistical information in which correspondence with individuals is excluded is generated by linking one of the multiple devices with a counterpart device.

[0026] As shown in Figure 5, the privacy protection data linkage system 1 in the second embodiment has a "Company A's device" (hereinafter referred to as "device 20A") as one device and a "Company B's device" (hereinafter referred to as "device 20B") as the other device.

[0027] The device 20A includes an anonymization processing unit 21, an ID irreversible conversion unit 22, an encryption unit 23, a data transmission / reception unit 24, a data matching unit 25, a counting processing unit 26, and a confidentiality processing unit 27, while the device 20B includes an anonymization processing unit 21, an ID irreversible conversion unit 22, an encryption unit 23, a data transmission / reception unit 24, and a decryption unit 28. The function of each unit will be described below.

[0028] The anonymization processing unit 21 is a functional unit that executes processing for privacy protection of attribute information on user data held by the device itself prior to encryption of the user ID, and is provided in common with devices 20A and 20B. Note that, as the privacy protection, for example, one or more of k-anonymization, l-diversity, and t-approximation are adopted, and an example of k-anonymization among the above will be described later.

[0029] The ID irreversible conversion unit 22 is a functional unit that performs an irreversible conversion process to convert user data stored in its own device into a user ID prior to encrypting the user ID, and is provided in common with the devices 20A and 20B. Note that the irreversible conversion process includes a hashing process, and after the ID irreversible conversion unit 22 hashs the user ID, it discards the salt used in the hashing process.

[0030] The encryption unit 23 provided in the device 20A is a functional unit that has the function of generating encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encryption key and a keyed one-way commutative operation held by the device itself, and includes an ID encryption unit 23A that performs this functional operation.

[0031] In contrast, the encryption unit 23 provided in device 20B is a functional unit that encrypts the user ID in the user data to be aggregated based on a self-encryption key and a keyed one-way commutative operation held by its own device, and encrypts the attribute information in the user data to be aggregated using a homomorphic encryption method that enables aggregation processing, thereby generating encrypted user data for the user data to be aggregated, and includes an ID encryption unit 23A that has the function of encrypting the user ID, and an attribute information encryption unit 23B that has the function of encrypting the attribute information. Note that the encryption of the user ID and the encryption of the attribute information can be performed in any order, and the order is arbitrary.

[0032] The data transmission / reception unit 24 is a functional unit that transmits and receives encrypted user data, and is provided in common to the devices 20A and 20B.

[0033] The data matching unit 25 is a functional unit provided in the device 20A that matches the encrypted user data of the device 20A generated by the encryption unit 23 of the device 20A with the encrypted user data of the device 20B as the counterpart device based on the user ID corresponding portion identified based on the structural information of the predetermined user data.

[0034] The counting unit 26 is a functional unit provided in the device 20A that generates encrypted counted data for the target user by counting the number of encrypted user data pieces whose user ID corresponding portions match as a result of matching by the data matching unit 25. The counting method will be described later.

[0035] The confidentiality processing unit 27 is a functional unit that performs confidentiality processing on the encrypted aggregated data generated by the aggregation processing unit 26 to generate encrypted statistical information, and is provided in the device 20A.

[0036] The decryption unit 28 is a functional unit that decrypts the encrypted statistical information transmitted from the device 20A based on a decryption method corresponding to the encryption by the attribute information encryption unit 23B, and outputs the obtained statistical information to an external device, and is provided in the device 20B.

[0037] Next, the processing executed in the privacy protection data linkage system 1 will be described with reference to FIGS.

[0038] First, in each of devices 20A and 20B, user data to be aggregated is input to anonymization processing unit 21 (steps A1 and B1 in FIG. 6). As shown in FIG. 7(a), the user data of company A input here includes a user ID and attribute information related to the user, for example, a telephone number is used as the user ID, and example attribute information includes gender, age, and purchase frequency. Similarly, the user data of company B input includes a user ID and attribute information related to the user, for example, a telephone number is used as the user ID, and example attribute information includes travel distance estimated from location information.

[0039] Next, as shown in FIG. 7B, in each of devices 20A and 20B, the anonymization processor 21 performs an anonymization process on the user data held by the device as a process for protecting privacy of attribute information (steps A2 and B2). Here, k-anonymization is exemplified, which converts user data so that k or more pieces of user data with the same attribute information exist within the target user data (satisfying k-anonymity), thereby reducing the probability of identifying an individual to 1 / k or less. For example, by k-anonymization where k = 2, attribute information (travel distance estimated from location information) in the user data of Company B is converted into attribute information of 10 km, so that two or more pieces of user data with the same attribute information (travel distance = 10 km) exist.

[0040] 8, in each of devices 20A and 20B, the ID irreversible conversion unit 22 performs an irreversible conversion process to convert the user data stored in the device into a user ID (steps A3 and B3). Specifically, the ID irreversible conversion unit 22 performs a hashing process on the user ID (here, a telephone number is used as an example), and then discards the salt used in the hashing process.

[0041] 9, in device 20A, ID encryption unit 23A encrypts the de-identified hash (the portion of the user data corresponding to the user ID) with a pre-prepared private key a to obtain ID-encrypted data for company A (step A4). Similarly, in device 20B, ID encryption unit 23A encrypts the de-identified hash (the portion of the user data corresponding to the user ID) with a pre-prepared private key b to obtain ID-encrypted data for company B (step B4).

[0042] Next, as shown in Figure 10(a), in device 20B, the attribute information encryption unit 23B encrypts the attribute information in the ID-encrypted data of Company B obtained in step B4 with a pre-prepared secret key B using a homomorphic encryption method capable of aggregation processing, thereby generating encrypted user data of Company B (step B5).

[0043] 10(b), in device 20A, the data transmitter / receiver 24 transmits the encrypted ID of company A included in the encrypted ID data of company A obtained in step A4 to the data transmitter / receiver 24 of device 20B (step A5). Also, in device 20B, the data transmitter / receiver 24 transmits the encrypted user data of company B obtained in step B5 (i.e., data including the encrypted ID and encrypted attribute information of company B) to the data transmitter / receiver 24 of device 20A (step B6).

[0044] 11 , in device 20A, ID encryption unit 23A re-encrypts, with private key a, the encrypted ID of company B included in the encrypted user data of company B transmitted from device 20B in step B6, to obtain the encrypted ID of company B encrypted with both private keys a and b (step A6). Similarly, in device 20B, ID encryption unit 23A re-encrypts, with private key b, the encrypted ID of company A transmitted from device 20A in step A5, to obtain the encrypted ID of company A encrypted with both private keys a and b (step B7). Then, in device 20B, data transmission / reception unit 24 transmits the "encrypted ID of company A encrypted with both private keys a and b" obtained in step B7 to device 20A (step B8), and the data transmission / reception unit 24 of device 20A receives the encrypted ID of company A (step A7).

[0045] Next, as shown in Fig. 12, in device 20A, the data matching unit 25 replaces the "encrypted ID encrypted with private key a" in the "encrypted ID data of company A" obtained by ID encryption in step A4 with the "encrypted ID of company A encrypted with both private keys a and b" received in step A7, thereby obtaining the encrypted user data of company A shown in the upper left of Fig. 12. The data matching unit 25 also replaces the "encrypted ID of company B encrypted with private key b" in the "encrypted user data of company B" received in step A5 with the "encrypted ID of company B encrypted with both private keys a and b" obtained by re-encryption in step A6, thereby obtaining the encrypted user data of company B shown in the upper right of Fig. 12. Then, the data matching unit 25 matches the encrypted user data of company A with the encrypted user data of company B using the "encrypted ID of company A encrypted with both private keys a and b" and the "encrypted ID of company B encrypted with both private keys a and b" as keys (step A8). Here, if "Company A's encrypted ID encrypted with both private keys a and b" and "Company B's encrypted ID encrypted with both private keys a and b" match, the attribute information in Company A's encrypted user data and the encrypted attribute information in Company B's encrypted user data are combined into a single record in the encrypted matching data, and after the combination, "Company A's encrypted ID encrypted with both private keys a and b" and "Company B's encrypted ID encrypted with both private keys a and b" are deleted. This results in encrypted matching data, shown in the lower part of Figure 12, which includes Company A's unencrypted attribute information and Company B's encrypted attribute information. Here, because Company B's attribute information is encrypted, Company A cannot know its contents, and the encrypted matching data is generated without revealing to Company A the contents of the attribute information that should be kept secret from Company B.

[0046] Next, as shown in Fig. 13, in device 20A, tallying processor 26 performs the following tallying process on the encrypted matching data (step A9). As mentioned above, the attribute information in Company B's ID encrypted data is encrypted in step B5 with secret key B, which is prepared in advance, using a homomorphic encryption method that enables tallying processes. Therefore, in reality, each attribute information included in the encrypted matching data in Fig. 13 is configured using binary values ​​whose format (bit string arrangement) is predetermined, and for "gender," as an example, it is determined that if the first and second bits in the encrypted matching data are "10," it indicates "male," and if they are "01," it indicates "female." Furthermore, the "travel distance" encrypted with private key B is, for example, defined as "10 km" if the Pth bit from the beginning of the encrypted matching data is "1," "20 km" if the (P+1)th bit is "1," and "30 km" if the (P+2)th bit is "1." For example, in a record in which the Pth bit in the bit string representing "travel distance" is "1," all bits other than the Pth bit in the bit string representing "travel distance" are set to "0." In this case, because Company A does not know private key B, it cannot grasp the actual content of the "travel distance" (e.g., 10 km, 20 km, etc.) as described above, and can only grasp it as a simple bit string. Based on the above, the counting unit 26 performs the following counting process, for example.

[0047] First, the aggregation processing unit 26 categorizes the multiple records that make up the encrypted matched data based on the attribute information (unencrypted gender, age, and purchase frequency) of Company A. That is, the multiple records that make up the encrypted matched data are divided into multiple categories, such as a category of "male, 20s, high frequency," a category of "male, 20s, low frequency," a category of "male, 30s, high frequency," a category of "male, 30s, low frequency," and so on.

[0048] Next, the aggregation processing unit 26 performs aggregation processing for each category by vertically summing (the same bits in the bit string) multiple records that belong to that category and are represented by binary values. Note that the attribute information of Company B, represented by binary values, is encrypted using an encryption method with homomorphic encryption characteristics, so the sum can be calculated even in the encrypted state. This results in the number of records for each category in which the Pth bit is "1" (i.e., the aggregation result for a travel distance of 10 km), the number of records in which the (P+1)th bit is "1" (i.e., the aggregation result for a travel distance of 20 km), the number of records in which the (P+2)th bit is "1" (i.e., the aggregation result for a travel distance of 30 km), and so on.

[0049] Furthermore, the counting processing unit 26 obtains encrypted aggregated data by converting the encrypted aggregated data, which is the categorized encrypted matching data plus the aggregated data for each category, into the organized data format shown in the lower part of Fig. 13. In the counting processing of step A9 as described above, Company A does not know private key B, and therefore cannot grasp the actual content (10 km, 20 km, etc.) of "distance traveled," which is Company B's attribute information, and this makes it possible to prevent the actual content of Company B's attribute information from being leaked to Company A.

[0050] 14, in the device 20A, the confidentiality processing unit 27 performs the following confidentiality processing on the encrypted aggregated data generated by the aggregation processing unit 26 to generate encrypted statistical information (step A10). For example, the confidentiality processing unit 27 generates noise using an operational key B' (a type of public key) of company B and applies the generated noise to the encrypted aggregated data to generate encrypted statistical information. Note that the above operational key B' corresponds to the private key B and is assumed to have been shared in advance by company B with company A.

[0051] Then, the data transmitter / receiver 24 in the device 20A transmits the encrypted statistical information generated in step A10 to the device 20B (step A11), and the data transmitter / receiver 24 in the device 20B receives the encrypted statistical information (step B9).

[0052] Furthermore, in device 20B, the received encrypted statistical information is sent to the decryption unit 28, and the decryption unit 28 in device 20B, which knows private key B, decrypts the encrypted statistical information and outputs the obtained statistical information as appropriate (step B10), as shown in Fig. 15. For example, the statistical information may be displayed or printed out by a predetermined operation by the operator of device 20B.

[0053] According to the embodiment of the present disclosure described above, by linking company A's device 20A and company B's device 20B, statistical information that excludes correspondence with individuals can be generated without disclosing attribute information or private keys that should be kept secret to other devices.

[0054] Both device 20A and device 20B are equipped with an ID irreversible conversion unit 22 that performs an irreversible conversion process to a user ID on the user data held by their own device prior to encrypting the user ID, thereby improving the effectiveness of de-identification. Furthermore, because the irreversible conversion process includes a hashing process, the application of a special irreversible conversion process is unnecessary, and a general irreversible conversion process known as hashing can be applied, improving ease of implementation. Furthermore, after performing the hashing process on the user ID, the ID irreversible conversion unit 22 discards the salt used in the hashing process. By discarding the salt used in the hashing process in this way, it is possible to ensure that the data cannot be restored.

[0055] Both device 20A and device 20B are equipped with an anonymization processing unit 21 that performs processing for privacy protection of attribute information on user data held by the respective devices prior to encryption of the user ID, thereby improving the effectiveness of de-identification. Furthermore, since the privacy protection includes at least one of k-anonymization, l-diversity, and t-closeness, the application of special privacy protection is unnecessary and general privacy protection such as k-anonymization, l-diversity, and t-closeness can be applied, thereby improving ease of implementation.

[0056] Furthermore, the confidentiality processing performed by the confidentiality processing unit 27 includes confidentiality processing based on differential privacy. Therefore, it is not necessary to apply a special confidentiality processing, and it is possible to apply a general confidentiality processing, namely, confidentiality processing based on differential privacy, thereby improving ease of implementation.

[0057] The data transmitter / receiver 24 of the device 20A transmits the encrypted statistical information generated by the confidentiality processing unit 27 to the data transmitter / receiver 24 of the device 20B, and the decryption unit 28 of the device 20B decrypts the encrypted statistical information based on a decryption method corresponding to the encryption by the encryption unit 23. In this way, the encrypted statistical information can be restored to plaintext statistical information.

[0058] (Modifications) Various modifications of the first and second embodiments will be described below in order.

[0059] (Variation 1) FIG. 16 shows a configuration of an information processing device 10 according to the first embodiment, which is capable of generating encrypted statistical information in cooperation with another information processing device having the same configuration. As shown in FIG. 16, the information processing device 10 according to Variation 1 further includes a data transmission / reception unit 15 and a data matching unit 16 in addition to the configuration of FIG. 1 according to the first embodiment. The data transmission / reception unit 15, like the data transmission / reception unit 24 described in the second embodiment, is a functional unit that transmits and receives encrypted user data to and from another device. The data matching unit 16, like the data matching unit 25 described in the second embodiment, is a functional unit that matches the encrypted user data of its own device generated by the encryption unit 11 of its own device with the encrypted user data of another device received from the other device based on a user ID corresponding portion identified based on predetermined structural information of the user data.

[0060] 16, in each of the devices of company A and company B, the encryption unit 11 encrypts the user data it holds with its own device's key, the data transmission / reception unit 15 exchanges the encrypted user data between the devices of company A and company B, and the encryption unit 11 then doubly encrypts the user data received from the other device with its own device's key.The data transmission / reception unit 15 of the device of company B then transmits the doubly encrypted user data of the device of company A to the device of company A.

[0061] In the device of company A, the data matching unit 16 matches the doubly encrypted user data of the device of company A with the doubly encrypted user data of the device of company B based on the user ID corresponding portion specified based on predetermined structural information of the user data, and the counting unit 12 counts the number of encrypted user data whose user ID corresponding portion matches as a result of the matching by the data matching unit 16, thereby generating encrypted counted data for the target user, and the confidentiality processing unit 13 performs confidentiality processing on the encrypted counted data to generate encrypted statistical information. The generated encrypted statistical information is sent from the data transmission / reception unit 15 of the device of company A to the data transmission / reception unit 15 of the device of company B, and the decryption unit 14 of the device of company B decrypts the encrypted statistical information and can output the obtained statistical information as appropriate.

[0062] According to the above-described first modification, when devices having the same configuration as shown in Fig. 16 exist in multiple organizations, it becomes possible to generate statistical information using data from two or more parties through secure matching and confidentiality processing. Note that the configuration of Fig. 16 may further include both or either of the anonymization processing unit 21 and the ID irreversible conversion unit 22 described in the second embodiment, in which case the effectiveness of de-identification can be improved.

[0063] (Variation 2) Fig. 17 shows a variation of the configuration of the privacy protection data linkage system according to the second embodiment. As shown in Fig. 17, the privacy protection data linkage system 1 according to Variation 2 is configured such that, in the configuration of Fig. 5 according to the second embodiment, each of the devices 20A and 20B does not include the anonymization processing unit 21, as indicated by the dashed lines.

[0064] The anonymization processing unit 21 is a functional unit that performs processing to protect privacy of attribute information on user data held by the device itself prior to encrypting the user ID. While the inclusion of the anonymization processing unit 21 in each device 20A, 20B can strengthen privacy protection, it is not a mandatory requirement. Therefore, as shown in Figure 17, a simple configuration in which each of devices 20A, 20B does not include the anonymization processing unit 21 is also permitted, and the privacy protection data linkage system 1 can be configured with fewer configuration requirements.

[0065] (Variation 3) Fig. 18 shows another variation of the configuration of the privacy protection data linkage system according to the second embodiment. As shown in Fig. 18, the privacy protection data linkage system 1 according to Variation 3 is configured such that, in the configuration of Fig. 5 according to the second embodiment, each of the devices 20A and 20B does not include the anonymization processing unit 21 and the ID irreversible conversion unit 22, as indicated by the dashed lines.

[0066] The ID irreversible conversion unit 22 is a functional unit that performs an irreversible conversion process to a user ID on user data held by the device itself prior to encrypting the user ID. Having the ID irreversible conversion unit 22 in each device 20A, 20B can strengthen privacy protection, but is not a required feature. Therefore, as shown in Figure 18, a simple configuration is also permitted in which each of devices 20A, 20B does not include the ID irreversible conversion unit 22 in addition to the anonymization processing unit 21, and the privacy protection data linkage system 1 can be configured with even fewer components than the second modification.

[0067] (Variation 4) In the above embodiment, the process of counting user data including both user IDs and attribute information has been described, but attribute information may not be a required requirement, and user data including at least user IDs may be counted. Below, an example will be described in which such user data is counted, and Company A and Company B work together to count the number of people (number of users) who can be matched using user IDs as a key.

[0068] 19 , in the privacy-preserving data linkage system 1 according to the fourth modification, each of the devices 20A and 20B includes an ID encryption unit 23A that generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a private encryption key and a keyed one-way commutative operation held by the device itself, and a data transmission / reception unit 24 that transmits and receives the encrypted user data. The device 20A further includes a data matching unit 25 that matches the encrypted user data of the device itself (device 20A) generated by the ID encryption unit 23A with the encrypted user data of the other device (device 20B) received by the data transmission / reception unit 24 based on a user ID corresponding portion identified based on predetermined structural information of the user data, and a counting unit 26 that generates encrypted aggregated data for the target user by counting the number of encrypted user data whose user ID corresponding portions match as a result of the matching by the data matching unit 25. Note that FIG. 19 shows the minimum necessary configuration, and it goes without saying that the devices 20A and 20B may include configurations other than those described above.

[0069] The privacy-preserving data linkage system 1 according to the fourth modification executes the process shown in Fig. 20. The process shown in Fig. 20 corresponds to a part of the process shown in Fig. 6 described in the second embodiment, and the same step numbers are used for corresponding processes between Fig. 20 and Fig. 6. Although redundant detailed description will be omitted here, up to steps A6 and B7, an encrypted ID of company A encrypted with both company A's private key a and company B's private key b, and an encrypted ID of company B encrypted with both private keys a and b, are obtained without disclosing the contents of the user data to the other party. Then, the data matching unit 25 of the device 20A matches the encrypted ID of company A with the encrypted ID of company B (step A8), and the counting unit 26 counts the number of encrypted user data whose user ID corresponding portions match as a result of the matching, thereby obtaining the number of matched users (number of users) as a counting result (step A9). In this way, in a process in which attribute information is not a required requirement and user data including at least a user ID is counted, the number of people who match (number of users) can be obtained as the count result without disclosing the contents of the user data to the other party.

[0070] The gist of the present disclosure lies in the following [1] to

[10] : [1] An information processing device that holds user data including a user ID and attribute information about the user, and generates statistical information about target users, comprising: an encryption unit that encrypts the user ID in user data to be aggregated based on a private encryption key held by the information processing device and a keyed one-way commutative operation, and encrypts the attribute information in the user data to be aggregated by a homomorphic encryption method capable of aggregation processing, thereby generating encrypted user data for the user data to be aggregated, an aggregation processing unit that generates encrypted aggregated data by counting the number of encrypted user data that have common attribute information for the encrypted user data generated by the encryption unit, and a concealment processing unit that performs concealment processing on the encrypted aggregated data generated by the concealment processing unit, thereby generating encrypted statistical information. [2] The information processing device is an information processing device that generates statistical information regarding the target user in cooperation with a counterpart device, and further includes: a data transmission / reception unit that transmits and receives the encrypted user data between the counterpart device and the counterpart device; and a data matching unit that matches the encrypted user data of its own device generated by the encryption unit with the encrypted user data of the counterpart device received by the data transmission / reception unit based on a user ID corresponding portion identified based on predetermined structural information of the user data, and the aggregation processing unit generates encrypted aggregated data regarding the target user by counting the number of encrypted user data whose user ID corresponding portion matches as a result of the matching by the data matching unit.[3] An information processing device that holds user data including a user ID and generates statistical information about target users in cooperation with a counterpart device, comprising: an ID encryption unit that generates encrypted user data about the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a private encryption key held by its own device and a keyed one-way commutative operation; a data transmission / reception unit that transmits and receives the encrypted user data to and from the counterpart device; a data matching unit that matches the encrypted user data of its own device generated by the ID encryption unit with the encrypted user data of the counterpart device received by the data transmission / reception unit based on a user ID corresponding portion identified based on predetermined structural information of the user data; and a counting processing unit that generates encrypted aggregated data about the target users by counting the number of encrypted user data whose user ID corresponding portion matches as a result of the matching by the data matching unit.[4] A privacy-preserving data linkage system having a plurality of devices that hold user data including user IDs and attribute information about users, and that generates statistical information about target users by linking one of the plurality of devices with a counterpart device, wherein the one device comprises an ID encryption unit that generates encrypted user data for the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encryption key and a keyed one-way commutative operation held by its own device, and the counterpart device comprises an encryption unit that encrypts the user ID in the user data to be aggregated based on a self-encryption key and a keyed one-way commutative operation held by its own device, and encrypts the attribute information in the user data to be aggregated by a homomorphic encryption method that is capable of aggregation processing, to generate encrypted user data for the user data to be aggregated, and the one device and the counterpart device further comprise data transmission / reception units that transmit and receive the encrypted user data, and the one device: a data matching unit that matches the encrypted user data of the target device generated by the encryption unit with the encrypted user data of the target device received by the data transmission / reception unit based on a user ID corresponding portion specified based on predetermined user data structure information; a counting unit that generates encrypted aggregated data for the target user by counting the number of encrypted user data whose user ID corresponding portions match as a result of the matching by the data matching unit; and a concealment unit that performs concealment processing on the encrypted aggregated data generated by the counting unit to generate encrypted statistical information. [5] The privacy-protected data link system described in [4], wherein the one device and the other device further include an anonymization unit that performs processing for privacy protection of the attribute information on the user data held by their own devices prior to encrypting the user ID. [6] The privacy-protected data link system described in [5], wherein the privacy protection includes at least one of k-anonymization, l-diversity, and t-approximation.[7] The privacy-protected data link system according to any one of [4] to [6], wherein the confidentiality processing includes confidentiality processing based on differential privacy. [8] The privacy-protected data link system according to any one of [4] to [7], wherein the data transmitter and receiver unit of the one device transmits the encrypted statistical information generated by the confidentiality processing unit to the data transmitter and receiver unit of the other device, and the other device further includes a decryption unit that decrypts the encrypted statistical information received by the data transmitter and receiver unit of the other device based on a decryption method corresponding to the encryption by the encryption unit. [9] A privacy-protected data linkage system having a plurality of devices that hold user data including a user ID, and that generates statistical information about a target user through cooperation between one of the plurality of devices and a counterpart device, wherein the one device and the counterpart device each comprise: an ID encryption unit that generates encrypted user data about the user data to be aggregated by encrypting the user ID in the user data to be aggregated based on a self-encryption key and a keyed one-way commutative operation held by the own device; and a data transmission and reception unit that transmits and receives the encrypted user data, and the one device further comprises: a data matching unit that matches the encrypted user data of its own device generated by the ID encryption unit with the encrypted user data of the counterpart device received by the data transmission and reception unit based on a user ID corresponding portion identified based on predetermined structural information of the user data, and an aggregation processing unit that generates encrypted aggregated data about the target user by counting the number of encrypted user data whose user ID corresponding portion matches as a result of the matching by the data matching unit.

[10] The privacy protection data link system according to any one of [4] to [9], wherein the one device and the other device further include an ID irreversible conversion unit that performs an irreversible conversion process to the user ID on user data held by the respective devices prior to encryption of the user ID.

[11] The privacy protection data link system according to

[10] , wherein the irreversible conversion process includes a hashing process.

[12] The privacy-preserving data linkage system according to

[11] , wherein the ID irreversible conversion unit discards the salt used in the hashing process after performing the hashing process on the user ID.

[0071] (Explanation of terms, explanation of hardware configuration (Figure 21), etc.) Note that the block diagrams used in the explanation of the above embodiments show functional blocks. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method of realizing each functional block is not particularly limited. That is, each functional block may be realized using one device that is physically or logically coupled, or may be realized using two or more devices that are physically or logically separated and connected directly or indirectly (for example, using wires, wirelessly, etc.) and these multiple devices. A functional block may be realized by combining software with the one device or the multiple devices.

[0072] Functions include, but are not limited to, judgment, determination, judgment, calculation, computation, processing, derivation, investigation, search, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, consideration, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, and assignment. For example, a functional block (component) that performs transmission is called a transmitting unit or transmitter. As mentioned above, there are no particular limitations on how these functions are implemented.

[0073] For example, the information processing device 10 in this embodiment may function as a computer that executes the processing of the present disclosure. Fig. 21 is a diagram showing an example of the hardware configuration of the information processing device 10. The above-mentioned information processing device 10 may be physically configured as a computer device including a processor 1001, a memory 1002, a storage 1003, a communication device 1004, an input device 1005, an output device 1006, a bus 1007, etc. The devices 20A and 20B in Fig. 5 may also have the same configuration as the information processing device 10.

[0074] In the following description, the term "apparatus" can be interpreted as a circuit, a device, a unit, etc. The hardware configuration of the information processing device 10 may be configured to include one or more of the apparatuses shown in the drawings, or may be configured to exclude some of the apparatuses.

[0075] Each function of the information processing device 10 is realized by loading specified software (programs) onto hardware such as the processor 1001 and memory 1002, causing the processor 1001 to perform calculations, control communication via the communication device 1004, and control at least one of reading and writing data in the memory 1002 and storage 1003.

[0076] The processor 1001 controls the entire computer by running, for example, an operating system, and may be configured as a central processing unit (CPU) including an interface with peripheral devices, a control device, an arithmetic unit, a register, etc.

[0077] The processor 1001 also reads programs (program codes), software modules, data, etc. from at least one of the storage 1003 and the communication device 1004 into the memory 1002 and executes various processes in accordance with these. The programs used are those that cause a computer to execute at least some of the operations described in the above-described embodiments. While the above-described various processes have been described as being executed by one processor 1001, they may be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The programs may be transmitted from a network via a telecommunications line.

[0078] The memory 1002 is a computer-readable recording medium and may be configured by, for example, at least one of a read-only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a random access memory (RAM), etc. The memory 1002 may also be called a register, a cache, a main memory (primary storage device), etc. The memory 1002 can store executable programs (program codes), software modules, etc. for implementing a wireless communication method according to an embodiment of the present disclosure.

[0079] Storage 1003 is a computer-readable recording medium, and may be composed of at least one of, for example, an optical disk such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disk, a digital versatile disk, a Blu-ray (registered trademark) disk), a smart card, a flash memory (e.g., a card, a stick, a key drive), a floppy (registered trademark) disk, a magnetic strip, etc. Storage 1003 may also be referred to as an auxiliary storage device. The above-mentioned storage medium may be, for example, a database, a server, or other appropriate medium including at least one of memory 1002 and storage 1003.

[0080] The communication device 1004 is hardware (transmission / reception device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as, for example, a network device, a network controller, a network card, a communication module, etc. The communication device 1004 may be configured to include a high-frequency switch, a duplexer, a filter, a frequency synthesizer, etc. to realize at least one of frequency division duplex (FDD) and time division duplex (TDD).

[0081] The input device 1005 is an input device (e.g., a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc.) that receives input from the outside. The output device 1006 is an output device (e.g., a display, a speaker, an LED lamp, etc.) that outputs to the outside. The input device 1005 and the output device 1006 may be integrated into one device (e.g., a touch panel).

[0082] Furthermore, each device, such as the processor 1001 and the memory 1002, is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or may be configured using different buses between each device.

[0083] The information processing device 10 may also be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA), and some or all of the functional blocks may be realized by the hardware. For example, the processor 1001 may be implemented using at least one of these pieces of hardware.

[0084] The notification of information is not limited to the aspects / embodiments described in the present disclosure and may be performed using other methods. For example, the notification of information may be performed by physical layer signaling (e.g., Downlink Control Information (DCI) and Uplink Control Information (UCI)), higher layer signaling (e.g., Radio Resource Control (RRC) signaling, Medium Access Control (MAC) signaling, broadcast information (Master Information Block (MIB) and System Information Block (SIB))), other signals, or a combination thereof. Furthermore, the RRC signaling may be referred to as an RRC message, and may be, for example, an RRC Connection Setup message, an RRC Connection Reconfiguration message, or the like.

[0085] Each aspect / embodiment described in the present disclosure may be implemented using any of the following standards: LTE (Long Term Evolution), LTE-Advanced (LTE-A), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), 6th generation mobile communication system (6G), xth generation mobile communication system (xG) (xG (x is, for example, an integer or a decimal number)), FRA (Future Radio Access), NR (new Radio), New radio access (NX), Future generation radio access (FX), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.17 (WiMAX (registered trademark)), IEEE 802.19 (WiMAX (registered trademark)), IEEE 802.20 (WiMAX (registered trademark)), IEEE 802.21 (Wi-Fi (registered trademark)), IEEE 802.22 (WiMAX (registered trademark)), IEEE 802.23 (WiMAX (registered trademark)), IEEE 802.24 (WiMAX (registered trademark)), IEEE 802.25 (WiMAX (registered trademark)), IEEE 802.26 (WiMAX (registered trademark)), IEEE 802.27 (WiMAX (registered trademark)), IEEE 802.28 (WiMAX (registered trademark)), IEEE 802.29 (WiMAX (registered trademark)), IEEE 802.30 (WiMAX (registered trademark)), IEEE 802.31 (Wi-Fi (registered trademark)), IEEE 802.32 (WiMAX (registered trademark)), IEEE 802.33 (WiMAX (registered trademark)), IEEE 802.34 ( The present invention may be applied to at least one of systems using 802.20, UWB (Ultra-Wide Band), Bluetooth (registered trademark), or other suitable systems, and next-generation systems that are extended, modified, created, or defined based on these systems. The present invention may also be applied to a combination of multiple systems (e.g., a combination of LTE and / or LTE-A with 5G).

[0086] The order of the procedures, sequences, flowcharts, etc. of each aspect / embodiment described in this disclosure may be changed unless it is consistent. For example, the methods described in this disclosure present elements of various steps using an example order, and are not limited to the particular order presented.

[0087] Input and output information may be stored in a specific location (for example, memory) or may be managed using a management table. Input and output information may be overwritten, updated, or added to. Output information may be deleted. Input information may be transmitted to another device.

[0088] The determination may be made based on a value represented by one bit (0 or 1), a Boolean value (true or false), or a numerical comparison (e.g., comparison with a predetermined value).

[0089] The aspects / embodiments described in this disclosure may be used alone, in combination, or switched depending on the implementation. Notification of predetermined information (e.g., notification that "X is true") is not limited to explicit notification, but may be implicit (e.g., not notifying the predetermined information).

[0090] Although the present disclosure has been described in detail above, it is clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the spirit and scope of the present disclosure as defined by the claims. Therefore, the description of the present disclosure is intended to be illustrative and does not have any limiting meaning on the present disclosure.

[0091] Software shall be construed broadly to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

[0092] Software, instructions, information, etc. may also be transmitted or received over a transmission medium. For example, if software is transmitted from a website, server, or other remote source using wired technologies (such as coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL)), and / or wireless technologies (such as infrared, microwave), then these wired and / or wireless technologies are included within the definition of transmission media.

[0093] The information, signals, etc. described in this disclosure may be represented using any of a variety of different technologies. For example, data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be referred to throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

[0094] Note that terms described in this disclosure and terms necessary for understanding this disclosure may be replaced with terms having the same or similar meanings. For example, at least one of a communication channel and a symbol may be a signal (signaling). Furthermore, a signal may be a message. Furthermore, a component carrier (CC) may be called a carrier frequency, a cell, a frequency carrier, etc.

[0095] As used in this disclosure, the terms "system" and "network" are used interchangeably.

[0096] Furthermore, the information, parameters, etc. described in the present disclosure may be expressed using absolute values, may be expressed using relative values ​​from a predetermined value, or may be expressed using other corresponding information. For example, a radio resource may be indicated by an index.

[0097] The names used for the above-described parameters are not intended to be limiting in any way. Furthermore, the mathematical expressions using these parameters may differ from those explicitly disclosed in this disclosure. The various communication channels (e.g., PUCCH, PDCCH, etc.) and information elements may be identified by any suitable names, and therefore the various names assigned to these various communication channels and information elements are not intended to be limiting in any way.

[0098] As used in this disclosure, the terms "determining" and "determining" may encompass a wide variety of actions. "Determining" and "determining" may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, inquiring (e.g., searching in a table, database, or other data structure), ascertaining, and the like. "Determining" and "determining" may also include receiving (e.g., receiving information), transmitting (e.g., sending information), input, output, accessing (e.g., accessing data in memory), and the like. Furthermore, "judgment" and "decision" can include regarding resolving, selecting, choosing, establishing, comparing, etc. as having been "judged" or "decided." In other words, "judgment" and "decision" can include regarding some action as having been "judged" or "decided." Furthermore, "judgment (decision)" can be interpreted as "assuming," "expecting," "considering," etc.

[0099] As used in this disclosure, the phrase "based on" does not mean "based only on," unless expressly stated otherwise. In other words, the phrase "based on" means both "based only on" and "based at least on."

[0100] As used in this disclosure, any reference to an element using a designation such as "first," "second," etc. does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient method of distinguishing between two or more elements. Thus, a reference to a first and a second element does not imply that only two elements may be employed or that the first element must in some way precede the second element.

[0101] When the terms "include," "including," and variations thereof are used in this disclosure, these terms are intended to be inclusive, similar to the term "comprising." Furthermore, when the term "or" is used in this disclosure, it is not intended to be an exclusive or.

[0102] In this disclosure, where articles are added by translation, such as a, an, and the in English, the disclosure may include that the nouns following these articles are in the plural form.

[0103] In the present disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "coupled" may also be interpreted in the same way as "different."

[0104] 1...Privacy protection data linkage system, 10...Information processing device, 11...Encryption unit, 11A...ID encryption unit, 11B...Attribute information encryption unit, 12...Counting processing unit, 13...Confidentiality processing unit, 14...Decryption unit, 15...Data transmission / reception unit, 16...Data matching unit, 20A, 20B...Information processing device, 21...Anonymization processing unit, 22...ID irreversible conversion unit, 23...Encryption unit, 23A...ID encryption unit, 23B...Attribute information encryption unit, 24...Data transmission / reception unit, 25...Data matching unit, 26...Counting processing unit, 27...Confidentiality processing unit, 28...Decryption unit, 1001...Processor, 1002...Memory, 1003...Storage, 1004...Communication device, 1005...Input device, 1006...Output device, 1007...Bus.

Claims

1. an encryption unit that acquires user data including a user ID and attribute information related to a user, encrypts the user ID with a private encryption key held in the device itself, and encrypts the attribute information using a homomorphic encryption method to generate encrypted user data; a counting unit that counts the number of the encrypted user data having the same attribute information; An information processing device comprising:

2. The information processing device includes: a data transmission / reception unit for transmitting and receiving the encrypted user data between the device and a counterpart device; a data matching unit that matches the encrypted user data of the own device generated by the encryption unit with the encrypted user data of the other device received by the data transmission / reception unit; Further equipped with the tallying unit counts the number of encrypted user data pieces whose portions corresponding to the user IDs match as a result of the matching by the data matching unit; The information processing device according to claim 1 .

3. The data matching unit performs matching based on a portion corresponding to the user ID, which is specified based on predetermined structure information of the user data. The information processing device according to claim 2 .

4. an ID encryption unit that acquires user data including a user ID and encrypts the user ID with a private encryption key held by the device to generate encrypted user data; a data transmission / reception unit for transmitting and receiving the encrypted user data between the device and a counterpart device; a data matching unit that matches the encrypted user data of the own device generated by the ID encryption unit with the encrypted user data of the other device received by the data transmission / reception unit; a counting unit that counts the number of encrypted user data pieces that match the portion corresponding to the user ID as a result of the matching by the data matching unit; An information processing device comprising:

5. The data matching unit performs matching based on a portion corresponding to the user ID, which is specified based on predetermined structure information of the user data. The information processing device according to claim 4.

6. a plurality of devices each holding user data including a user ID and attribute information relating to the user; one of the plurality of devices includes an ID encryption unit that encrypts the user ID with a private encryption key held by the device to generate encrypted user data; a counterpart device among the plurality of devices includes an encryption unit that encrypts the user ID with a private encryption key held by the counterpart device, and encrypts the attribute information by a homomorphic encryption method to generate encrypted user data; The one device and the other device further include a data transmission / reception unit for transmitting and receiving the encrypted user data, The one device is a data matching unit that matches the encrypted user data of the one device generated by the ID encryption unit with the encrypted user data of the other device received by the data transmission / reception unit; a counting unit that counts the number of encrypted user data pieces that match the portion corresponding to the user ID as a result of the matching by the data matching unit; Further comprising: Privacy-preserving data linkage system.

7. The one device and the other device an anonymization processing unit that performs a process for protecting privacy of the attribute information on the user data held by the own device prior to encryption of the user ID; Further comprising: The privacy-preserving data linkage system according to claim 6.

8. The one device further includes a concealment processing unit that performs concealment processing on encrypted aggregated data obtained by counting by the aggregation processing unit to generate encrypted statistical information, The data transmission / reception unit of the one device transmits the encrypted statistical information generated by the confidentiality processing unit to the data transmission / reception unit of the other device; the counterpart device further includes a decryption unit that decrypts the encrypted statistical information received by the data transmission / reception unit of the counterpart device based on a decryption method corresponding to the encryption by the encryption unit; The privacy-preserving data linkage system according to claim 6.

9. The one device and the other device an ID irreversible conversion unit that performs an irreversible conversion process to convert user data held in its own device into the user ID prior to encryption of the user ID; Further comprising: The privacy-preserving data linkage system according to claim 6.

10. The irreversible conversion process includes a hashing process. The privacy-preserving data linkage system according to claim 9.

11. After performing a hashing process on the user ID, the ID irreversible conversion unit discards the salt used in the hashing process. The privacy-preserving data linkage system according to claim 10.

12. a plurality of devices for holding user data including a user ID; One of the plurality of devices and a counterpart device, an ID encryption unit that encrypts the user ID with a local encryption key held by the device itself to generate encrypted user data; a data transmission / reception unit for transmitting and receiving the encrypted user data; Equipped with The one device is a data matching unit that matches the encrypted user data of the own device generated by the ID encryption unit with the encrypted user data of the other device received by the data transmission / reception unit; a counting unit that counts the number of encrypted user data pieces that match the portion corresponding to the user ID as a result of the matching by the data matching unit; Further comprising: Privacy-preserving data linkage system.