Advertisement distribution device, information providing system, advertisement distribution method, and recording medium

Abstract

In order to distribute advertisement content corresponding to the position of a user who uses an advertisement distribution service while protecting the privacy of the user, this advertisement distribution device comprises: an acquisition unit that acquires, from a terminal device used by the user who uses the advertisement distribution service, concealment data including concealed positional information of the terminal device; a search unit that searches a database for advertisement content corresponding to the concealed positional information of the terminal device by concealment information search processing; and a distribution unit that distributes, to the terminal device, advertisement data including the searched advertisement content.

Description

Ad delivery device, information provision system, ad delivery method, and recording medium

[0001] This disclosure relates to an advertising distribution device, an information provision system, an advertising distribution method, and a recording medium.

[0002] Geotargeting advertising is a method of delivering advertising content related to the user's location. In geotargeting advertising, it is essential to deliver advertising content that is highly relevant to the user.

[0003] Patent Document 1 discloses an advertising system aimed at delivering advertisements according to attribute information without the user being aware of it. The advertising system in Patent Document 1 determines the advertisement information to be delivered based on location attribute information corresponding to the access point to which the information terminal is connected. When the information terminal is successfully connected to the access point, the advertising system in Patent Document 1 displays the determined advertisement information on the screen of the information terminal.

[0004] Japanese Patent Publication No. 2018-022252

[0005] In the method described in Patent Document 1, privacy-related information such as the user's location and behavioral history is collected on the ad delivery server. With the method described in Patent Document 1, there is a possibility that information related to the user's privacy may be known to the ad delivery server, raising concerns that users may feel uncomfortable and refrain from using the advertising system. Therefore, it is necessary to deliver advertising content tailored to the user's location while protecting the user's privacy so as not to cause discomfort to the user.

[0006] The purpose of this disclosure is to provide an advertising distribution device, an information provision system, an advertising distribution method, and a recording medium that can deliver advertising content according to the user's location while protecting the privacy of users using the advertising distribution service.

[0007] An advertising distribution device according to one aspect of this disclosure includes: an acquisition unit that acquires confidential data, including location information of a concealed terminal device, from a terminal device used by a user of an advertising distribution service; a search unit that searches a database for advertising content corresponding to the location information of the concealed terminal device through confidential information retrieval processing; and a distribution unit that distributes advertising data, including the retrieved advertising content, to the terminal device.

[0008] In one aspect of the advertising delivery method of this disclosure, confidential data including the location information of a concealed terminal device is obtained from a terminal device used by a user of the advertising delivery service, advertising content corresponding to the location information of the concealed terminal device is searched from a database by a confidential information retrieval process, and advertising data including the searched advertising content is delivered to the terminal device.

[0009] A program in one aspect of this disclosure causes a computer to perform the following processes: acquire confidential data, including location information of a concealed terminal device, from a terminal device used by a user of an advertising distribution service; search a database for advertising content corresponding to the location information of the concealed terminal device through a confidential information retrieval process; and deliver advertising data, including the retrieved advertising content, to the terminal device.

[0010] This disclosure makes it possible to provide an advertising distribution device, an information provision system, an advertising distribution method, and a recording medium that can deliver advertising content according to the user's location while protecting the privacy of users using the advertising distribution service.

[0011] This is a conceptual diagram showing an example of an advertising distribution service provided by the information provision system in this disclosure. This is a block diagram showing an example of the configuration of the information provision system in this disclosure. This is a sequence diagram showing an overview of the data flow in the information provision system in this disclosure. This is an example of an advertising table stored in the database of the information provision system in this disclosure. This is an example of an advertising table stored in the database of the information provision system in this disclosure. This is an example of an advertising table stored in the database of the information provision system in this disclosure. This is an example of an advertising table stored in the database of the information provision system in this disclosure. This is a block diagram showing an example of the configuration of the anonymization device in this disclosure. This is a conceptual diagram showing an example of a user interface displayed on the screen of a terminal device on which the anonymization device in this disclosure is implemented. This is a conceptual diagram showing an example of a user interface displayed on the screen of a terminal device on which the anonymization device in this disclosure is implemented. This is a conceptual diagram showing an example of an example of a display of information provided by the information provision system in this disclosure. This is a conceptual diagram showing an example of an example of a display of information provided by the information provision system in this disclosure. This is a conceptual diagram showing an example of an example of a display of information provided by the information provision system in this disclosure. This is a conceptual diagram showing an example of an example of a display of information provided by the information provision system in this disclosure. This is a block diagram showing an example of an advertising distribution device in this disclosure. This is a flowchart illustrating an example of the anonymization process in this disclosure. This is a flowchart illustrating an example of the confidential information retrieval process in this disclosure. This is a conceptual diagram showing an example of an advertising distribution service provided by the information provision system in this disclosure. This is a block diagram illustrating an example of the configuration of the information provision system in this disclosure. This is a sequence diagram showing an overview of the data flow in the information provision system in this disclosure. This is a conceptual diagram illustrating an example of confidential information retrieval using secure computation by an anonymization device in this disclosure. This is a block diagram illustrating an example of the configuration of an anonymization device in this disclosure. This is a conceptual diagram showing an example of a user interface displayed on the screen of a terminal device on which the anonymization device is implemented in this disclosure.This is a block diagram showing an example of the configuration of an advertising distribution device in this disclosure. This is a flowchart illustrating an example of the anonymization process in this disclosure. This is a flowchart illustrating an example of the anonymized information retrieval process in this disclosure. This is a flowchart illustrating an example of the reconstruction process in this disclosure. This is a block diagram showing an example of the configuration of an advertising distribution device in this disclosure. This is a flowchart illustrating an example of the operation of an advertising distribution device in this disclosure. This is a block diagram showing an example of the hardware configuration that performs control and processing in this disclosure.

[0012] The embodiments for carrying out this disclosure will be described below with reference to the drawings. In this disclosure, the drawings used in the description of each embodiment are associated with one or more embodiments. Also, the elements included in each drawing may correspond to one or more embodiments. The embodiments described below have technically preferred limitations for carrying out this disclosure, but the scope of the disclosure is not limited thereto. In all the drawings used in the description of the embodiments below, the same parts are denoted by the same reference numerals unless there is a specific reason not to. In the embodiments below, repeated descriptions of similar configurations and operations may be omitted. The direction of the arrows in the drawings is an example of the flow of signals, data, etc., and does not limit the flow of signals, data, etc.

[0013] (First Embodiment) First, the information provision system in the first embodiment will be described with reference to the drawings. The information provision system provides the user with advertising content that corresponds to the user's location information. The information provision system provides the user with advertising content that corresponds to the location information when it acquires confidential data including the user's location information. There are no particular limitations on the format or content of the advertising content. For example, the advertising content may be provided in the form of video, images, text, audio, etc.

[0014] The information provision system uses Private Information Retrieval (PIR) to search a database containing location-based advertising content for advertising content tailored to the user's location. Private Information Retrieval is a type of secure computation protocol. In Private Information Retrieval, the user's (terminal device's) location information remains confidential while the process of searching for information based on the terminal device's location (PIR process) is executed. In the PIR process, first, the user's (terminal device's) location information, in its confidential state, is sent to the server as a query. The server searches the database using the user's (terminal device's) location information, in its confidential state, as a query. The server returns the search results, in their confidential state, to the user (terminal device). The search results are decrypted on the user's (terminal device's) side. In Private Information Retrieval, the server knows the contents of the data stored in the database, but does not know which data has been retrieved. Because Private Information Retrieval allows data to be retrieved without the server knowing what information the user accessed, user privacy is protected. For example, the information provision system can use the confidential information retrieval method disclosed in Non-Patent Document 1 (Non-Patent Document 1: M. Zhou, et al. “Piano: Extremely simple, single-server PIR with sublinear server computation,” Cryptology ePrint Archive, 2023).

[0015] (Configuration) Figure 1 is a conceptual diagram showing an example of an advertising distribution service provided by the information provision system in this disclosure. Figure 1 illustrates an advertising distribution server 120 managed by an advertiser providing the advertising distribution service. Figure 1 also illustrates a user viewing an advertisement distributed from the advertising distribution service. The user is moving around the city by riding in a vehicle such as a car or bicycle, or on foot. There are no particular limitations on the user's means of transportation.

[0016] An in-vehicle terminal is installed in the vehicle in which the user rides. For example, an in-vehicle terminal installed in a vehicle may be implemented by a terminal device such as a car navigation system capable of acquiring location information. The in-vehicle terminal may also be implemented by a terminal device such as a smartphone or tablet. For example, the in-vehicle terminal may be implemented by a terminal device used by a user who uses an advertising distribution service. Users riding bicycles or walking carry a mobile terminal. A mobile terminal is a terminal device such as a smartphone or tablet. A mobile terminal may be a device other than a smartphone or tablet, as long as it can transmit location information. In the following, in-vehicle terminals and mobile terminals that acquire the user's location information will be referred to as terminal devices. In the following, it will be assumed that the terminal devices have positioning functionality implemented.

[0017] The advertiser manages the ad delivery server 120. The ad delivery server 120 is a server device built in the cloud or a data center. The server device may be implemented by an information processing device such as a personal computer. The in-vehicle terminal, mobile terminal, and ad delivery server 120 are connected to a network NW such as the Internet via wireless or wired communication. The in-vehicle terminal, mobile terminal, and ad delivery server 120 are connected in a communicative manner via the network NW.

[0018] Figure 2 is a block diagram showing an example of the configuration of the information provision system in this disclosure. The information provision system 1 comprises an anonymization device 11, an advertising distribution device 12, and a database 13. The database 13 may be configured as an external system accessible from the information provision system 1. In Figure 2, the network interposed between the components is omitted.

[0019] Figure 3 is a sequence diagram illustrating the data flow in the information provision system described in this disclosure. In Figure 3, the processing of each component is represented in a simplified manner, and the data exchanged between components is clearly indicated. Details of the processing of each component will be described later.

[0020] The concealment device 11 is implemented in the terminal device 110 used by the user. For example, the concealment device 11 is implemented in the terminal device 110 in the form of an application. The concealment device 11 acquires the location information of the terminal device 110 via a positioning function implemented in the terminal device 110. For example, the positioning function measures the location of the terminal device 110 using a satellite positioning system such as GPS (Global Positioning System) or GNSS (Global Navigation Satellite System). The positioning function may also be configured to measure the location of the terminal device 110 using a positioning system other than a satellite positioning system.

[0021] The concealment device 11 performs a concealment process to conceal the location information of the terminal device 110 used by the user (process P11). The concealment device 11 conceals the location information using an arbitrary concealment method. The concealment device 11 transmits the concealed data, including the concealed location information, to the advertising distribution device 12 via the communication function of the terminal device 110. The timing of the transmission of the concealed data can be set arbitrarily. For example, the concealed data may be transmitted at a specific time set in advance. For example, the concealed data may be transmitted according to the location of the terminal device 110. The concealed data may also be configured to be transmitted in response to a user request. The concealed data may include supplementary information other than location information. For example, the supplementary information may include time information, attribute information, and preference information. Time information may include information about the time and time period in which the concealed data was transmitted. Attribute information may include information such as the user's gender, age, and occupation. Preference information may include information representing the user's preferences.

[0022] The ad distribution device 12 is implemented on the ad distribution server 120. The ad distribution device 12 receives confidential data, including the location information of users using the ad distribution service. The ad distribution device 12 performs confidential information retrieval processing to search for advertising content corresponding to the user's location information from the database 13 (processing P12). For example, the ad distribution device 12 searches for advertising content associated with the user's location. For example, the ad distribution device 12 searches for advertising content associated with the area containing the user's location. The ad distribution device 12 distributes the advertising data, including the retrieved advertising content, to the terminal device 110 on which the anonymization device 11 is implemented.

[0023] The advertising distribution device 12 uses Public Information Retrieval (PIR) to search for advertising content corresponding to the user's location from a database 13 that stores advertising content corresponding to the location information. For example, the advertising distribution device 12 can use the Public Information Retrieval method disclosed in Non-Patent Literature 1. In Public Information Retrieval, the advertiser can understand the contents of the data stored in the database 13, but cannot identify which data has been retrieved. In Public Information Retrieval, data can be retrieved without the user knowing what information they accessed, thus protecting the user's privacy.

[0024] Database 13 stores advertising content associated with locations within the service area of ​​the advertising distribution service. For example, the service area of ​​the advertising distribution service is divided into multiple sections. These sections may be fixed sections with pre-defined, unchanging boundaries, or they may be variable sections that can be redefined depending on the situation. For example, a section may be a variable section that can be redefined depending on the user's location and settings. Each of the multiple sections is assigned a section-specific identifier. Each of the multiple sections is associated with section-specific advertising content. For example, database 13 stores an advertising table containing at least one record in which advertising content is associated with each of the multiple sections.

[0025] Figure 4 shows an example of an advertising table stored in the database of the information provision system in this disclosure. The advertising table 131 consists of records to which advertising content is associated with each of several sections included in the service area of ​​the advertising distribution service. The multiple records included in the advertising table 131 are pre-registered in the database 13. For example, each of the several sections may be associated with advertising content related to cafes, restaurants, clothing stores, fishing tackle shops, etc. As an example, section A may be associated with advertising content for cafe a. For example, the advertising table may be configured so that records can be searched using a key that combines location information with supplementary information other than location information. For example, the supplementary information may include time information, attribute information, and preference information.

[0026] Figure 5 shows an example of an advertising table stored in the database of the information provision system in this disclosure. Advertising table 132 is an example in which time information is set as supplementary information. Advertising table 132 consists of records in which advertising content corresponding to the time of day is associated with each of the multiple sections included in the service area of ​​the advertising distribution service. In advertising table 132, advertising content is associated with each identifier (section / time of day) which is a combination of section and time of day. Advertising table 132 shows identifiers (section / time of day) which are a combination of an alphabet indicating the section and a number indicating the time of day. For example, time of day is classified as early morning, morning, azalea, noon, afternoon, evening, night, late night, etc. Characteristic advertising content corresponding to the time of day is associated with each of these time of day. For example, in the morning, advertising content for a coffee shop that serves breakfast is associated. For example, in the noon, advertising content for a restaurant that serves lunch is associated. For example, in the early afternoon, advertising content for a coffee shop that serves coffee and sweets is associated. For example, in the evening, advertising content for a bar that serves alcohol is associated. For example, during the noon time slot (A2) in section A, advertising content for restaurant a2, which serves lunch, will be associated.

[0027] Figure 6 shows an example of an advertising table stored in the database of the information provision system in this disclosure. Advertising table 133 is an example in which attribute information is set as supplementary information. Advertising table 133 consists of records in which advertising content corresponding to attributes is associated with each of the multiple sections included in the service area of ​​the advertising distribution service. In advertising table 133, advertising content is associated with each identifier (section / attribute) which is a combination of section and attribute. Advertising table 133 shows identifiers (section / attribute) which are a combination of uppercase letters indicating the section, lowercase letters indicating gender, and numbers indicating age group. For example, attributes are classified according to gender, age, etc. Characteristic advertising content corresponding to those attributes is associated with them. For example, a woman in her 20s in section A (Af20) is associated with advertising content for beauty salon a5 that caters to women in their 20s. For example, a man in his 60s in section A (Am60) is associated with advertising content for izakaya a6, which is popular with men in their 60s.

[0028] Figure 7 shows an example of an advertising table stored in the database of the information provision system in this disclosure. Advertising table 134 is an example in which preference information is set as supplementary information. Advertising table 134 consists of records in which advertising content according to preferences is associated with each of the multiple sections included in the service area of ​​the advertising distribution service. In advertising table 134, advertising content is associated with each identifier (section / preference) which is a combination of section and preference. Advertising table 134 shows identifiers (section / preference) which are a combination of uppercase letters indicating section and lowercase letters indicating preference. For example, preferences are classified according to hobbies, interests, tastes, inclinations, ideologies, lifestyles, etc. Characteristic advertising content corresponding to those preferences is associated with them. For example, a person (Am) in section A who enjoys music as a hobby is associated with advertising content from musical instrument store a3. For example, a person (Am) in section A who enjoys sports as a hobby is associated with advertising content from sporting goods store a8.

[0029] For example, multiple pieces of supplementary information can be combined with each other. For instance, combining attributes and preferences allows for the delivery of advertising content tailored to preferences based on gender and age. Furthermore, combining multiple preferences allows for the delivery of advertising content that better reflects the user's preferences. For example, there may be certain foods that are prohibited from being eaten for religious reasons. In such cases, the system can be configured to include religion as supplementary information and deliver advertising content that includes information about restaurants that serve food catering to people of that religion.

[0030] The data concealment device 11 receives advertising data distributed from the advertising distribution device 12 in accordance with the data to be concealed. The data concealment device 11 outputs the advertising content contained in the advertising data to the terminal device 110. For example, the data concealment device 11 displays videos, images, or text corresponding to the advertising content on the screen of the terminal device 110. For example, the data concealment device 11 outputs audio corresponding to the advertising content from the speaker of the terminal device 110.

[0031] Next, the components of the information provision system 1 will be explained individually. For example, the components of the information provision system 1 are realized by an information processing device such as a computer having a processor and memory. For example, the functions of the components of the information provision system 1 are realized by the processor executing a program stored in the memory of the computer.

[0032] [Anonymization Device] Figure 8 is a block diagram showing an example of the configuration of an anonymization device in this disclosure. The anonymization device 11 includes a location information acquisition unit 111, a storage unit 112, an anonymization unit 113, a communication unit 115, and an output unit 117.

[0033] The location information acquisition unit 111 acquires the location information of the user (terminal device 110) via the positioning function of the terminal device 110 on which the concealment device 11 is implemented. At the stage when the location information acquisition unit 111 acquires the location information, it has not been concealed.

[0034] The memory unit 112 stores the conditions for concealment. For example, the memory unit 112 stores conditions related to concealment methods such as encryption, masking, tokenization, simulation, and differential privacy. The memory unit 112 also stores conditions for reconstructing the concealed information. If there is no need to reconstruct the information, the conditions for reconstructing the concealed information do not need to be stored in the memory unit 112.

[0035] The concealment unit 113 conceals the acquired location information. The concealment unit 113 conceals the location information based on conditions stored in the storage unit 112. For example, the concealment unit 113 may be configured to identify a section containing the location information and to conceal the identified section. The concealment unit 113 may also be configured to conceal information other than location information.

[0036] The communication unit 115 transmits confidential data, including concealed location information, to the advertising distribution device 12. For example, the function of the communication unit 115 is realized by the communication function of the terminal device 110 on which the concealment device 11 is implemented.

[0037] Figure 9 is a conceptual diagram showing an example of a user interface displayed on the screen of a terminal device in which the anonymization device described in this disclosure is implemented. The screen of terminal device 110 displays a screen for setting the use of the advertising distribution service. The screen of terminal device 110 displays radio buttons for setting location-based advertising distribution. Depending on whether the radio button is selected ON or OFF, the setting is made as to whether or not to distribute advertisements. Below the radio button, a question is displayed that reads, "Do you want to change the settings?" Below the question, a button containing the word "Yes" is displayed to accept the setting change. When the ON radio button is selected and the button containing the word "Yes" is tapped, the terminal device 110's location information is set to be sent to the anonymization device 11. When the OFF radio button is selected and the button containing the word "Yes" is tapped, the terminal device 110's location information is set not to be sent to the anonymization device 11. In addition, the screen of terminal device 110 displays an explanation that reads, "The data provided will be processed securely using anonymized information retrieval." Furthermore, an icon is displayed on the screen of the terminal device 110 to guarantee that confidential information retrieval is being used. Users who read the explanation will understand that data including privacy-related data such as location information will be processed securely using confidential information retrieval. Note that the user interface in Figure 9 is just one example and is not limited to the user interface for setting up the use of the advertising distribution service.

[0038] FIG. 10 is a conceptual diagram showing an example of a user interface displayed on the screen of a terminal device in which the anonymization device according to the present disclosure is implemented. On the screen of the terminal device 110, a screen for requesting advertisement distribution by an advertisement distribution service is displayed. On the screen of the terminal device 110, a question sentence "Do you request advertisement distribution?" is displayed. Below the question sentence, a button including the character "Yes" for accepting setting changes is displayed. Here, it is assumed that when the button including the character "Yes" is tapped, the anonymization device 11 acquires the position information of the terminal device 110 and an anonymization process is executed. On the screen of the terminal device 110, an explanatory text "The provided data is securely processed using anonymized information search" and an icon guaranteeing that anonymized information search is used are displayed. A user who has confirmed the explanatory text and the icon can recognize that data including privacy-related data such as position information is securely processed using anonymized information search. Note that the user interface in FIG. 10 is an example and does not limit the user interface for setting the use of an advertisement distribution service.

[0039] Further, the communication unit 115 receives the advertisement data transmitted from the advertisement distribution device 12. The advertisement data includes advertisement content according to the user's position.

[0040] The output unit 117 outputs the advertisement content included in the advertisement data acquired from the advertisement distribution device 12 to the terminal device 110 in which the anonymization device 11 is implemented. For example, the output unit 117 causes a video, an image, or text corresponding to the advertisement content to be displayed on the screen of the terminal device 110. For example, the output unit 117 causes sound corresponding to the advertisement content to be output from the speaker of the terminal device 110.

[0041] FIG. 11 is a conceptual diagram showing an example of information provided by the information providing system in the present disclosure. On the screen of the terminal device 110, advertising content associated with the user's position is displayed. In the example of FIG. 11, the user can obtain information about services and products available at nearby stores by viewing the advertising content displayed on the screen of the terminal device 110. That is, in the example of FIG. 11, advertising content corresponding to the user's position information is distributed.

[0042] FIG. 12 is a conceptual diagram showing an example of information provided by the information providing system in the present disclosure. On the screen of the terminal device 110, advertising content associated with the user's position is displayed. Also, on the screen of the terminal device 110, a button for accepting a reservation for the store advertised by the advertising content is displayed. For example, when a button containing the word "Yes" is selected, a user interface of a reservation system for reserving that store is displayed. A reservation is made at the date and time desired by the user according to the user's operation in the user interface of the reservation system. In the example of FIG. 12, the user can not only obtain information about services and products available at nearby stores by viewing the advertising content displayed on the screen of the terminal device 110, but also reserve that store. That is, in the example of FIG. 12, the decision-making of the user who has viewed the advertising content is accepted.

[0043] FIG. 13 is a conceptual diagram showing an example of information provided by the information providing system in the present disclosure. On the screen of the terminal device 110, a map of the area including the position of the user (terminal device 110) is displayed. Also, on the map displayed on the screen of the terminal device 110, positions S1 to S6 associated with the advertising content distributed according to the user's position are clearly shown. In the example of FIG. 13, the user views the advertising content corresponding to those positions by selecting the positions S1 to S6 clearly shown on the screen of the terminal device 110. That is, in the example of FIG. 13, the user can select the advertising content that can be viewed around the user.

[0044] Figure 14 is a conceptual diagram showing an example of how information provided by the information provision system in this disclosure is displayed. Figure 14 is an example in which advertising content associated with a location is displayed according to the selection of one of the locations S1 to S6 on the map displayed on the screen of the terminal device 110 in the example of Figure 13. The advertising content may have already been delivered to the terminal device 110, or it may be configured to be delivered according to the user's selection. The screen of the terminal device 110 displays advertising content associated with the location selected by the user. In the example of Figure 14, the user can learn about services and products available at stores at the selected location by viewing the advertising content displayed on the screen of the terminal device 110. In other words, in the example of Figure 14, advertising content associated with the location selected by the user can be provided to the user.

[0045] Figure 15 is a conceptual diagram showing an example of how information provided by the information provision system in this disclosure is displayed. Figure 15 shows an example where incentives obtained by a user actually visiting a facility are displayed on the screen of the terminal device 110. In other words, Figure 15 shows an example where incentives are provided to a user according to their visit history to a specific location. The screen of the terminal device 110 displays incentives associated with the locations the user has visited. For example, the user is granted the right to purchase a product given to people who have visited a specific spot. The screen of the terminal device 110 also displays a button that accepts the exercise of the right to purchase the product. For example, if a button containing the word "yes" is selected, a screen for purchasing that product is displayed. In the example of Figure 15, the user can recognize the incentives obtained by having a visit history to a specific location by viewing the advertising content displayed on the screen of the terminal device 110. Furthermore, according to the example of Figure 15, it is possible to accept the user's request to use the incentives.

[0046] [Advertising Distribution Device] Figure 16 is a block diagram showing an example of the configuration of an advertising distribution device in this disclosure. The advertising distribution device 12 has an acquisition unit 121, a search unit 123, and a distribution unit 125.

[0047] The acquisition unit 121 acquires confidential data, including confidential location information, from the concealment device 11 implemented in the terminal device 110 used by a user of the advertising distribution service. The function of the acquisition unit 121 is realized by the communication interface of the advertising distribution server 120 on which the advertising distribution device 12 is implemented.

[0048] The search unit 123 searches the database 13 for advertising content corresponding to location information contained in the confidential data through confidential information retrieval processing. The search unit 123 searches the database 13, which stores advertising content corresponding to location information, for advertising content corresponding to the user's location information through confidential information retrieval (PIR). For example, the search unit 123 uses the confidential information retrieval method disclosed in Non-Patent Literature 1. For example, the search unit 123 searches for advertising content associated with the user's location. For example, the search unit 123 searches for advertising content associated with a section containing the user's location.

[0049] The distribution unit 125 distributes advertising data, including the searched advertising content, to the terminal device 110 on which the anonymization device 11 is implemented. The functions of the distribution unit 125 are realized by the communication interface of the advertising distribution server 120 on which the advertising distribution device 12 is implemented. The advertising data is transmitted to the terminal device 110 via the communication function of the advertising distribution server 120.

[0050] (Operation) Next, an example of the operation of the information provision system in this embodiment will be described with reference to the drawings. In the following, each process performed in the information provision system will be explained using a separate flowchart. The processes listed below are individual explanations of each process summarized in Figure 3.

[0051] [Anonymization Process] Figure 17 is a flowchart illustrating an example of the anonymization process in this disclosure. In the explanation of the process according to the flowchart in Figure 17, the components of the anonymization device 11 are considered the operating entities. The operating entity of the process according to the flowchart in Figure 17 may be the anonymization device 11. For example, the process according to the flowchart in Figure 17 is realized by a processor executing a program stored in the memory installed in the terminal device 110 on which the anonymization device 11 is implemented.

[0052] In Figure 17, first, the location information acquisition unit 111 acquires the location information of the terminal device 110 on which the concealment device 11 is installed, in response to a user request (step S111). For example, the location information acquisition unit 111 acquires location information in response to an operation via the user interface displayed on the screen of the terminal device 110 on which the concealment device 11 is installed.

[0053] Next, the anonymization unit 113 anonymizes the acquired location information (step S112). For example, the anonymization unit 113 may be configured to anonymize the area including the location of the location information. The anonymization unit 113 may also be configured to anonymize information other than location information.

[0054] Next, the communication unit 115 transmits confidential data, including concealed location information (step S113). The confidential data is transmitted to the advertising distribution server 120, which is equipped with the advertising distribution device 12, via the communication function of the terminal device 110, which is equipped with the concealment device 11. The confidential data transmitted to the advertising distribution server 120 is used to search for advertising content according to the location of the user (terminal device 110).

[0055] [Confidential Information Retrieval Process] Figure 18 is a flowchart illustrating an example of confidential information retrieval processing in this disclosure. In the explanation of the process according to the flowchart in Figure 18, the components of the advertising distribution device 12 are considered the operating entities. The operating entity of the process according to the flowchart in Figure 18 may be the advertising distribution device 12. For example, the process according to the flowchart in Figure 18 is realized by a processor executing a program stored in the memory of the advertising distribution server 120 on which the advertising distribution device 12 is implemented.

[0056] In Figure 18, first, the acquisition unit 121 acquires confidential data, including confidential location information, from the concealment device 11 implemented in the terminal device 110 used by a user of the advertising distribution service (step S121). The confidential data is acquired via the communication function of the advertising distribution server 120 on which the advertising distribution device 12 is implemented.

[0057] Next, the search unit 123 searches the database 13 for advertising content corresponding to the location information contained in the confidential data through confidential information retrieval processing (step S122).

[0058] Next, the distribution unit 125 distributes the advertising data, including the searched advertising content, to the terminal device 110 on which the anonymization device 11 is implemented (step S123). The advertising data is transmitted to the terminal device 110 via the communication function of the advertising distribution server 120 on which the advertising distribution device 12 is implemented.

[0059] As described above, the information provision system of this embodiment comprises a data concealment device, a database, and an advertising distribution device. The database stores advertising content corresponding to locations included in the service area of ​​the advertising distribution service. The data concealment device is implemented in a terminal device used by a user of the advertising distribution service. The data concealment device transmits concealed data, including the location information of the concealed terminal device, to the advertising distribution device. The advertising distribution device has an acquisition unit, a search unit, and a distribution unit. The acquisition unit acquires concealed data, including the location information of the concealed terminal device, from a terminal device used by a user of the advertising distribution service. The search unit searches the database for advertising content corresponding to the location information of the concealed terminal device through a concealed information search process. The distribution unit distributes advertising data, including the searched advertising content, to the terminal device.

[0060] In this embodiment, the confidential information retrieval process uses confidential location information to search for advertising content corresponding to that location. By using the confidential information retrieval process, advertisers cannot identify what the retrieved advertising content is. Therefore, according to the method of this embodiment, advertising content corresponding to the location information can be delivered while the location information remains confidential. In other words, according to this embodiment, advertising content corresponding to the user's location can be delivered while protecting the privacy of users using the advertising distribution service. Furthermore, according to this embodiment, the advertising content stored in the database does not need to be confidential, so processing is faster compared to when the advertising content is confidential.

[0061] In one embodiment of this system, the database stores an advertising table consisting of records in which advertising content is associated with each of several sections included in the service area of ​​the advertising distribution service. The search unit searches for advertising content associated with the section containing the location information of the concealed terminal device. According to this embodiment, by searching for advertising content associated with the section, advertising content can be accurately delivered according to the user's location.

[0062] In one embodiment of this system, supplementary information used for searching for advertising content is stored in the advertising table, associated with each of several sections. The acquisition unit acquires confidential data, including the supplementary information, from the terminal device. The search unit searches the database for advertising content corresponding to the section containing the location information of the confidential terminal device and the supplementary information, using confidential information retrieval processing. According to this embodiment, by using the supplementary information, more accurate advertising content can be provided to the user.

[0063] In one embodiment of this system, the advertising table stores records in which advertising content corresponding to a time of day is associated with each of several sections included in the service area of ​​the advertising distribution service. The acquisition unit acquires confidential data, including the time the confidential data was transmitted, from the terminal device. The search unit searches the database for advertising content corresponding to the section containing the location information of the confidential terminal device and the time of day including the time the confidential data was transmitted, using confidential information retrieval processing. According to this embodiment, advertising content tailored to the time of day can be provided to the user.

[0064] In one embodiment of this system, the advertising table stores records in which advertising content corresponding to attributes is associated with each of several sections included in the service area of ​​the advertising distribution service. The acquisition unit acquires confidential data, including user attributes, from the terminal device. The search unit searches the database for advertising content corresponding to the section containing the location information of the confidential terminal device and the user's attributes through confidential information retrieval processing. According to this embodiment, advertising content tailored to the user's attributes can be provided to the user.

[0065] The advertising table stores records where advertising content tailored to user preferences is associated with each of the multiple sections included in the advertising distribution service area. The acquisition unit acquires confidential data, including user preferences, from the terminal device. The search unit uses confidential information retrieval processing to search the database for advertising content that matches the section containing the location information of the confidential terminal device and the user's preferences. According to this embodiment, advertising content tailored to the user's preferences can be provided to the user.

[0066] In one embodiment of this system, the acquisition unit acquires confidential data transmitted according to the user's settings for the advertising distribution service. According to this embodiment, advertising content can be automatically delivered to the user at a timing corresponding to the distribution settings.

[0067] In one embodiment of this system, the acquisition unit acquires confidential data transmitted in response to a user's request. According to this embodiment, advertising content can be delivered to the user on demand at the time requested by the user.

[0068] In one embodiment of this design, the anonymization device displays the advertising content contained in the advertising data on the screen of the terminal device. According to this design, advertising content tailored to the user's location can be viewed through the screen of the terminal device used by that user.

[0069] In one embodiment of this design, the anonymization device displays a button on the terminal device's screen that accepts reservations for stores advertised with advertising content included in the advertising data. According to this design, users can directly access stores advertised with advertising content tailored to their location.

[0070] In one embodiment of this invention, the anonymization device displays a map on the terminal device screen that clearly indicates at least one location associated with the advertising content contained in the advertising data. According to this embodiment, by viewing the map displayed on the terminal device screen, the user can recognize that there is a location where the advertising content can be viewed.

[0071] In one embodiment of this system, the anonymization device displays advertising content corresponding to the selected location on the terminal device's screen, based on the selection of at least one location explicitly shown on the map. According to this embodiment, advertising content associated with the user's surrounding location can be delivered according to the user's decision.

[0072] (Second Embodiment) Next, the information provision system in the second embodiment will be described with reference to the drawings. This embodiment differs from the first embodiment in that secure computation is used in the confidential information retrieval. In this embodiment, an example is given in which homomorphic encryption secure computation is used.

[0073] The user's location information is provided to the information provision system in an encrypted state using a predetermined encryption method. In other words, the information provision system collects location information in an anonymized state. The information provision system identifies the advertising content associated with the location information while the location information is anonymized. The information provision system outputs advertising data, including advertising content associated with the location information of the mobile device, to the mobile device used by the user of the advertising distribution service.

[0074] In this embodiment, an example is given in which homomorphic encryption is used as the predetermined encryption method. For example, the method disclosed in Japanese Patent Application Publication No. 2024-63125 can be applied to this embodiment. Homomorphic encryption is an encryption method that allows data operations to be performed on the ciphertext. Because homomorphic encryption allows data processing to be performed while the data is encrypted, in addition to data communication and storage, it is attracting attention from the viewpoint of protecting privacy and preventing data leakage. Encryption methods other than homomorphic encryption may be used as long as data operations can be performed on the ciphertext.

[0075] In this embodiment, the user possesses an encryption key for encrypting information contained in confidential data transmitted from the user. The user also stores a decryption key for decrypting the encrypted data. The decryption key may be configured to be managed by a third party other than the user. The encryption key and decryption key possessed by the user correspond to private keys (confidential). For example, in this embodiment, homomorphic encryption of a single-key scheme is applied. For example, fully homomorphic encryption such as the BFV (Brakerski / Fan-Vercauteren) scheme or the BGV (Brakerski-Gentry-Vaikuntanathan) scheme can be applied. For example, the method of this embodiment is a homomorphic encryption of a multi-key scheme. For example, the method described in Non-Patent Document 2 (H. Chen et al. “Efficient Multi-Key Homomorphic Encryption with Packed Ciphertexts with Application to Oblivious Neural Network Inference,” Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019) can be applied.

[0076] (Configuration) Figure 19 is a conceptual diagram showing an example of an advertising distribution service provided by the information provision system in this disclosure. Figure 19 illustrates an advertising distribution server 220 managed by an advertiser providing the advertising distribution service. Figure 19 also illustrates a user viewing an advertisement distributed from the advertising distribution service. The user is moving around the city by riding in a vehicle such as a car or bicycle, or on foot. There are no particular limitations on the user's means of transportation. Figure 19 illustrates images of the encryption key and decryption key stored in the terminal device (described later) used by the user.

[0077] An in-vehicle terminal is installed in the vehicle in which the user rides. For example, an in-vehicle terminal installed in a vehicle may be implemented by a terminal device such as a car navigation system capable of acquiring location information. The in-vehicle terminal may also be implemented by a terminal device such as a smartphone or tablet. For example, the in-vehicle terminal may be implemented by a terminal device used by a user who uses an advertising distribution service. Users riding bicycles or walking carry a mobile terminal. A mobile terminal is a terminal device such as a smartphone or tablet. A mobile terminal may be a device other than a smartphone or tablet, as long as it can transmit location information. In the following, in-vehicle terminals and mobile terminals that acquire the user's location information will be referred to as terminal devices. In the following, it will be assumed that the terminal devices have positioning functionality implemented.

[0078] The advertiser manages the ad delivery server 220. The ad delivery server 220 is a server device built in the cloud or a data center. The server device may be implemented by an information processing device such as a personal computer. The in-vehicle terminal, mobile terminal, and ad delivery server 220 are connected to a network NW such as the Internet via wireless or wired communication. The in-vehicle terminal, mobile terminal, and ad delivery server 220 are connected in a communicative manner via the network NW.

[0079] Figure 20 is a block diagram showing an example of the configuration of the information provision system in this disclosure. The information provision system 2 comprises an anonymization device 21, an advertising distribution device 22, and a database 23. In Figure 20, the network intervening between the components is omitted.

[0080] Figure 21 is a sequence diagram illustrating the data flow in the information provision system described in this disclosure. In Figure 21, the processing of each component is represented in a simplified manner, and the data exchanged between components is clearly indicated. Details of the processing of each component will be described later.

[0081] The concealment device 21 is implemented in the terminal device 210 used by the user. For example, the concealment device 21 is implemented in the terminal device 210 in the form of an application. The concealment device 21 acquires the location information of the terminal device 210 via a positioning function implemented in the terminal device 210. For example, the positioning function measures the location of the terminal device 210 using a satellite positioning system such as GPS (Global Positioning System) or GNSS (Global Navigation Satellite System). The positioning function may also be configured to measure the location of the terminal device 210 using a positioning system other than a satellite positioning system.

[0082] The concealment device 21 performs a concealment process to conceal the location information of the terminal device 210 used by the user (process P21). The concealment device 21 conceals the location information by encryption using an encryption key stored in its own device. The concealment device 21 transmits the concealed data, including the concealed location information, to the advertising distribution device 22 via the communication function of the terminal device 210. For example, the concealed data is transmitted at a specific time set in advance. For example, the concealed data is transmitted according to the location of the terminal device 210. The concealed data may be configured to be transmitted in response to a user request. The concealed data may include supplementary information other than location information. For example, the supplementary information may include time information, attribute information, and preference information. Time information includes information about the time and time period in which the concealed data was transmitted. Attribute information includes information such as the user's gender, age, and occupation. Preference information includes information representing the user's preferences.

[0083] The ad distribution device 22 is implemented on the ad distribution server 220. The ad distribution device 22 receives confidential data, including the location information of users using the ad distribution service. The ad distribution device 22 searches for ad content corresponding to the user's location information from the database 23 using confidential information retrieval processing with secure computation (processing P22). For example, the ad distribution device 22 searches for ad content corresponding to the user's location information from the database 23 using confidential information retrieval processing with homomorphic encryption. For example, the ad distribution device 22 searches for ad content associated with the user's location. For example, the ad distribution device 22 searches for ad content associated with the area containing the user's location. The ad distribution device 22 distributes the ad data, including the retrieved ad content, to the terminal device 210 on which the anonymization device 21 is implemented. The ad data distributed from the ad distribution device 22 is encrypted using the encryption key stored in the anonymization device 21.

[0084] This embodiment demonstrates an example of handling data encrypted using a homomorphic encryption scheme. Using a homomorphic encryption scheme, encrypted data can be manipulated while remaining encrypted. In a homomorphic encryption scheme, any function can be manipulated by combining addition and multiplication. Examples of homomorphic encryption schemes include additive homomorphisms, multiplicative homomorphisms, somewhat homomorphisms, and fully homomorphic encryption. Additive homomorphisms are encryption schemes that allow addition to be performed on ciphertext. Examples of additive homomorphisms include Goldwasser-Micali encryption, Paillier encryption, Lifted-Elgamal encryption, BFV (Brakerski / Fan-Vercauteren) encryption, and Okamoto-Uchiyama encryption. Multiplicative homomorphisms are encryption schemes that allow multiplication to be performed on ciphertext. Examples of multiplicative homomorphisms include ElGamal encryption and RSA (Rivest-Shamir-Adleman) encryption. Partially homomorphic encryption is a type of encryption that allows addition and multiplication of ciphertext. Partially homomorphic encryption has limitations on the number of multiplication operations. Examples of partially homomorphic encryption include BGN (Boneh-Goh-Nissim) encryption and some lattice-based encryption methods. Fully homomorphic encryption is a type of encryption that allows addition and multiplication of ciphertext. An example of fully homomorphic encryption is Gentry's lattice-based encryption method.

[0085] Plain text m k and ciphertext C k These can be related as shown in Equation 1 below (where k is a natural number). (Mathematics 1) C k = Enc(m k) ... (1) Addition can be performed using additive homomorphism, somewhat homomorphism, or fully homomorphism as shown in equation 2 below. (Equation 2) Enc(m0) + Enc(m1) = Enc(m0 + m1) ... (2) A constant multiplication can be performed using multiplicative homomorphism, somewhat homomorphism, or fully homomorphism as shown in equation 3 below. (Equation 3) m0 * Enc(m1) = Enc(m0 * m1) ... (3) Note that equations 1 to 3 above are a schematic representation of homomorphic encryption and do not provide a detailed representation of homomorphic encryption. Known methods of calculation can be selected for homomorphic encryption. For example, Japanese Patent Application Publication No. 2024-63125 discloses a method for retrieving confidential information using homomorphic encryption.

[0086] Figure 22 is a conceptual diagram illustrating an example of secure information retrieval using secure computation in this disclosure. In the example in Figure 22, the security device 21 identifies a section including the location of the terminal device 210. The database 23 stores an advertising table containing advertising content corresponding to each of several sections included in the target area of ​​the advertising distribution service. For example, the advertising table contains advertising content m corresponding to section i. i The record contains (i is a natural number). The location of terminal device 210 is included in section i. The anonymization device 21 sets section i to 1 and sections other than section i to 0. The anonymization device 21 generates queries corresponding to each of the multiple sections by encrypting the numerical values ​​set in each section using the encryption key stored in its own device. The anonymization device 21 transmits the anonymized data containing the multiple generated queries to the advertising distribution device 22. The anonymization device 21 may be configured to compress the multiple generated queries into a single data file and transmit it to the advertising distribution device 22. The advertising distribution device 22 performs an anonymized information retrieval using homomorphic encryption with respect to the multiple queries that have been transmitted. For example, the advertising distribution device 22 performs the calculation of equation 4 below. (Equation 4) m1・Enc(0) + ... + m i ・Enc(1)+...=Enc(m i ) ... (4) As a result, the advertising content m of the encrypted section i i Enc(mi is searched. The advertisement distribution device 22 returns the encrypted advertisement content Enc(m i ) to the anonymization device 21. The anonymization device 21 uses the decryption key stored in its own device to decrypt the advertisement content Enc(m i ) into the advertisement content m i . According to this method, since the query is not decrypted in the advertisement distribution device 22, the position information on the user side is not known to the advertisement provider side.

[0087] The anonymization device 21 receives the advertisement data distributed from the advertisement distribution device 22 according to the anonymized data. The advertisement data received by the anonymization device 21 is encrypted using the encryption key stored in its own device. The anonymization device 21 reconstructs the advertisement content by decrypting the advertisement data using the decryption key stored in its own device. The anonymization device 21 outputs the reconstructed advertisement content to the terminal device 210. For example, the anonymization device 21 causes a video, an image, or text corresponding to the advertisement content to be displayed on the screen of the terminal device 210. For example, the anonymization device 21 causes a sound corresponding to the advertisement content to be output from the speaker of the terminal device 210.

[0088] Next, the components of the information providing system 2 will be described individually. For example, the components of the information providing system 2 are realized by an information processing device such as a computer having a processor and a memory. For example, the functions of the components of the information providing system 2 are realized by the processor executing a program stored in the memory of the computer.

[0089] [Anonymization Device] FIG. 23 is a block diagram showing an example of the configuration of the anonymization device in the present disclosure. The anonymization device 21 has a position information acquisition unit 211, a storage unit 212, an anonymization unit 213, a communication unit 215, a reconstruction unit 216, and an output unit 217. In FIG. 23, a state where the encryption key P and the decryption key K are stored in the anonymization device is shown.

[0090] The location information acquisition unit 211 acquires the location information of the user (terminal device 210) via the positioning function of the terminal device 210 on which the concealment device 21 is implemented. At the stage when the location information acquisition unit 211 acquires the location information, it has not been concealed.

[0091] The storage unit 212 stores the conditions for concealment and reconstruction. Specifically, the storage unit 212 stores the encryption key P and the decryption key K. The encryption key P and the decryption key K correspond to secret keys. Data encrypted with the encryption key P is decrypted using the decryption key K corresponding to the encryption key P.

[0092] The concealment unit 213 conceals location information by encryption using the encryption key P stored in the storage unit 212. For example, the concealment unit 213 may be configured to identify a section containing the location information and encrypt the identified section. For example, the concealment unit 213 may also be configured to encrypt private data other than location information. The concealment unit 213 generates confidential data containing encrypted location information. The concealment unit 213 may add information other than location information to the confidential data. Furthermore, the confidential data may include unencrypted data.

[0093] The communication unit 215 transmits confidential data, including concealed location information, to the advertising distribution device 22. For example, the function of the communication unit 215 is realized by the communication function of the terminal device 210 on which the concealment device 21 is implemented.

[0094] Figure 24 is a conceptual diagram showing an example of a user interface displayed on the screen of a terminal device on which the concealment device described in this disclosure is implemented. The screen of terminal device 210 displays a screen for setting the use of an advertising distribution service. The screen of terminal device 210 displays radio buttons for setting location-based advertising distribution. Depending on whether the radio button is selected ON or OFF, the setting is made as to whether or not to distribute advertisements. Below the radio button, a question is displayed that reads, "Do you want to change the settings?" Below the question, a button containing the word "Yes" is displayed to accept the setting change. When the ON radio button is selected and the button containing the word "Yes" is tapped, the terminal device 210's location information is set to be sent to the concealment device 21. When the OFF radio button is selected and the button containing the word "Yes" is tapped, the terminal device 210's location information is set not to be sent to the concealment device 21. The screen of terminal device 210 displays a statement that reads, "The data provided will be processed securely using confidential information retrieval and homomorphic encryption," along with an icon guaranteeing the use of confidential information retrieval and homomorphic encryption. Users who have seen the statement and icon will understand that data, including privacy-related data such as location information, will be processed securely using confidential information retrieval. Note that the user interface in Figure 24 is an example and is not limited to the user interface for setting up the use of the advertising distribution service.

[0095] Furthermore, the communication unit 215 receives advertising data transmitted from the advertising distribution device 22. The advertising data includes advertising content corresponding to the user's location. The received advertising data is encrypted using the encryption key P stored in the storage unit 212. The advertising data includes advertising content corresponding to the user's (terminal device 210) location information.

[0096] The reconstruction unit 216 uses the decryption key K to decrypt the advertising content from the advertising data encrypted with the encryption key P.

[0097] The output unit 217 outputs the decrypted advertising content to the terminal device 210 on which the concealment device 21 is installed. For example, the output unit 217 displays videos, images, or text corresponding to the advertising content on the screen of the terminal device 210. For example, the output unit 217 outputs audio corresponding to the advertising content from the speaker of the terminal device 210.

[0098] [Advertising Distribution Device] Figure 25 is a block diagram showing an example of the configuration of an advertising distribution device in this disclosure. The advertising distribution device 22 has an acquisition unit 221, a search unit 223, and a distribution unit 225.

[0099] The acquisition unit 221 acquires confidential data from the anonymization device 21 implemented in the terminal device 210 used by a user of the advertising distribution service. The confidential data includes encrypted location information. The function of the acquisition unit 221 is realized by the communication interface of the advertising distribution server 220 on which the advertising distribution device 22 is implemented.

[0100] The search unit 223 searches the database 23 for advertising content corresponding to location information contained in the confidential data by performing confidential information retrieval processing using secure computation. For example, the search unit 223 searches for advertising content corresponding to the user's location information from the database 23, which stores advertising content corresponding to location information, by performing confidential information retrieval (PIR) using homomorphic encryption. For example, the search unit 223 searches for advertising content associated with the user's location using the method disclosed in Japanese Patent Application Publication No. 2024-63125.

[0101] The distribution unit 225 outputs encrypted advertising data. The functions of the distribution unit 225 are realized by the communication interface of the advertising distribution server 220 on which the advertising distribution device 22 is implemented. The encrypted advertising data is transmitted to the anonymization device 21 via the communication function of the advertising distribution server 220.

[0102] (Operation) Next, an example of the operation of the information provision system in this embodiment will be described with reference to the drawings. In the following, each process performed in the information provision system will be explained using a separate flowchart. The processes listed below are individual explanations of each process summarized in Figure 21.

[0103] [Anonymization Process] Figure 26 is a flowchart illustrating an example of the anonymization process in this disclosure. In the explanation of the process according to the flowchart in Figure 26, the components of the anonymization device 21 are considered the operating entities. The operating entity of the process according to the flowchart in Figure 26 may be the anonymization device 21. For example, the process according to the flowchart in Figure 26 is realized by a processor executing a program stored in the memory installed in the terminal device 210 on which the anonymization device 21 is implemented.

[0104] In Figure 26, first, the location information acquisition unit 211 acquires the location information of the terminal device 210 on which the concealment device 21 is installed, in response to a user request (step S211). For example, the location information acquisition unit 211 acquires location information in response to an operation via the user interface displayed on the screen of the terminal device 210 on which the concealment device 21 is installed.

[0105] Next, the concealment unit 213 conceals the acquired location information by encryption using the encryption key stored in the storage unit 212 (step S212). For example, the concealment unit 213 may be configured to identify a section containing the location information and encrypt the identified section.

[0106] Next, the communication unit 215 transmits confidential data, including concealed location information, to the terminal device 210 (step S213). The confidential data is transmitted to the advertising distribution server 220, which is equipped with the advertising distribution device 22, via the communication function of the terminal device 210, which is equipped with the concealment device 21. The confidential data transmitted to the advertising distribution server 220 is used to search for advertising content according to the location of the user (terminal device 210).

[0107] [Confidential Information Retrieval Process] Figure 27 is a flowchart illustrating an example of confidential information retrieval processing in this disclosure. In the explanation of the process according to the flowchart in Figure 27, the components of the advertising distribution device 22 are considered the operating entities. The operating entity of the process according to the flowchart in Figure 27 may be the advertising distribution device 22. For example, the process according to the flowchart in Figure 27 is realized by a processor executing a program stored in the memory of the advertising distribution server 220 on which the advertising distribution device 22 is implemented.

[0108] In Figure 27, first, the acquisition unit 221 acquires confidential data, including confidential location information, from the concealment device 21 implemented in the terminal device 210 used by a user of the advertising distribution service (step S221). The confidential data includes encrypted location information. The confidential data is acquired via the communication function of the advertising distribution server 220 on which the advertising distribution device 22 is implemented.

[0109] Next, the search unit 223 searches the database 23 for advertising content corresponding to the location information contained in the confidential data using a secure computation method (step S222).

[0110] Next, the distribution unit 225 distributes the advertising data, including the searched advertising content, to the terminal device 210 on which the anonymization device 21 is implemented (step S223). The advertising data is encrypted using the encryption key stored in the anonymization device 21, which is the source of the anonymized data. The advertising data is transmitted to the terminal device 210 via the communication function of the advertising distribution server 220 on which the advertising distribution device 22 is implemented.

[0111] [Reconstruction Process] Figure 28 is a flowchart illustrating an example of the reconstruction process in this disclosure. In the explanation of the process according to the flowchart in Figure 28, the components of the concealment device 21 are considered the operating entities. The operating entity of the process according to the flowchart in Figure 28 may be the concealment device 21. For example, the process according to the flowchart in Figure 28 is realized by a processor executing a program stored in the memory of a terminal device 210 on which the concealment device 21 is implemented.

[0112] In Figure 28, first, the communication unit 215 receives advertising data transmitted from the advertising distribution device 22 (step S231). The advertising data is acquired via the communication function of the terminal device 210 on which the anonymization device 21 is implemented. The advertising data includes advertising content corresponding to the user's location. The received advertising data is encrypted using the encryption key P stored in the storage unit 212. The advertising data includes advertising content corresponding to the user's (terminal device 210) location information.

[0113] Next, the reconstruction unit 216 reconstructs the advertising content by decrypting the advertising data encrypted with the encryption key P using the decryption key K (step S232).

[0114] The output unit 217 outputs the advertising content included in the advertising data acquired from the advertising distribution device 22 to the terminal device 210 on which the anonymization device 21 is installed (step S233). For example, the output unit 217 displays a video, image, or text corresponding to the advertising content on the screen of the terminal device 210. For example, the output unit 217 outputs audio corresponding to the advertising content from the speaker of the terminal device 210.

[0115] As described above, the information provision system of this embodiment comprises a data concealment device, a database, and an advertising distribution device. The database stores advertising content corresponding to locations included in the service area of ​​the advertising distribution service. The data concealment device is implemented in a terminal device used by a user of the advertising distribution service. The data concealment device encrypts the terminal device's location information using a non-public encryption key. The data concealment device transmits the encrypted data, including the terminal device's location information, to the advertising distribution device. The advertising distribution device has an acquisition unit, a search unit, and a distribution unit. The acquisition unit acquires encrypted data, including the terminal device's location information, from a terminal device used by a user of the advertising distribution service. The search unit searches the database for advertising content corresponding to the encrypted terminal device's location information using a secure computation method for searching for encrypted information. The distribution unit distributes the advertising data, including the encrypted advertising content, to the terminal device. The data concealment device receives the advertising data, including the encrypted advertising content, distributed from the advertising distribution device. The data concealment device decrypts the advertising content using a decryption key corresponding to the encryption key. The data concealment device outputs the decrypted advertising content to the terminal device.

[0116] In this embodiment, a secure information retrieval process using secure computation is used to retrieve user location information obtained in an encrypted state, and then searches for advertising content corresponding to that user's location. By using a secure information retrieval process using secure computation, the advertiser cannot identify what the retrieved advertising content is. Therefore, according to the method of this embodiment, advertising content corresponding to the user's location information can be delivered while the user's location information remains confidential. In other words, according to this embodiment, advertising content corresponding to the user's location can be delivered while more reliably protecting the privacy of users using the advertising distribution service. Furthermore, according to this embodiment, the advertising content stored in the database does not need to be confidential, so processing is faster compared to when the advertising content is confidential.

[0117] In one embodiment of this system, the search unit performs an operation using a homomorphic encryption scheme as a secure computation. According to this embodiment, by using a homomorphic encryption scheme, advertising content tailored to the user's location can be delivered to the user without the advertiser knowing what kind of advertising content was delivered.

[0118] In one embodiment of this system, the database stores an advertising table containing advertising content corresponding to each of several sections included in the target area of ​​the advertising distribution service. The anonymization device sets the section containing the terminal device's location to 1 and the section not containing the terminal device's location to 0. The anonymization device generates queries corresponding to each of the multiple sections by encrypting the numerical values ​​set for each of the multiple sections using an encryption key stored in the device. The anonymization device transmits the anonymized data, including the generated queries, to the advertising distribution device. The advertising distribution device performs an anonymized information retrieval using homomorphic encryption for the transmitted queries and retrieves the advertising content for the section containing the terminal device's location in an encrypted state. The advertising distribution device returns the encrypted advertising content to the anonymization device. The anonymization device retrieves the encrypted advertising content. The anonymization device decrypts the encrypted advertising content using a decryption key stored in the device. According to this embodiment, by performing an anonymized information retrieval using homomorphic encryption, it is possible to deliver advertising content to users according to their location without the advertiser knowing what kind of advertising content was delivered.

[0119] (Third Embodiment) Next, the advertising distribution device in the third embodiment will be described with reference to the drawings. The advertising distribution device in this embodiment is a simplified configuration of the advertising distribution device provided in the information provision system in the first and second embodiments. For example, the functions of the components provided in the advertising distribution device in this embodiment are realized by the functions of the components provided in the advertising distribution devices according to the first and second embodiments. In addition, the search method in this embodiment can be realized by the processor executing a program stored in memory.

[0120] (Configuration) Figure 29 is a block diagram showing an example of the configuration of an advertising distribution device in this disclosure. The advertising distribution device 32 comprises an acquisition unit 321, a search unit 323, and a distribution unit 325.

[0121] The acquisition unit 321 acquires confidential data, including the location information of the concealed terminal device, from the terminal device used by a user of the advertising distribution service. The search unit 323 searches the database 33 for advertising content corresponding to the location information of the concealed terminal device through confidential information retrieval processing. The distribution unit 325 distributes the advertising data, including the retrieved advertising content, to the terminal device.

[0122] (Operation) Figure 30 is a flowchart illustrating an example of the operation (advertising delivery method) of the advertising delivery device in this disclosure. In explaining the process according to the flowchart in Figure 30, the components of the advertising delivery device 32 will be described as the operating entities. The operating entity of the process according to the flowchart in Figure 30 may be the advertising delivery device 32.

[0123] In Figure 30, first, the acquisition unit 321 acquires confidential data, including the location information of the concealed terminal device, from the terminal device used by the user of the advertising distribution service (step S321).

[0124] Next, the search unit 323 searches the database 33 for advertising content corresponding to the location information of the concealed terminal device through a concealed information retrieval process (step S322).

[0125] Next, the distribution unit 325 distributes advertising data, including the searched advertising content, to the terminal device (step S323).

[0126] In this embodiment, the confidential information retrieval process uses encrypted user location information to search for advertising content appropriate to the user's location. Because secure computation is used, the method of this embodiment allows for the delivery of advertising content appropriate to the user's location information while keeping that information confidential. In other words, this embodiment allows for the delivery of advertising content appropriate to the user's location while protecting the privacy of users of the advertising distribution service.

[0127] (Hardware) Next, the hardware configuration for performing the control and processing described in this disclosure will be explained with reference to the drawings. Figure 31 is a block diagram showing an example of a hardware configuration for performing the control and processing described in this disclosure. Here, an information processing device 90 (computer) is shown as an example of a hardware configuration. The information processing device in Figure 31 is an example configuration for performing the control and processing described in this disclosure and does not limit the scope of this disclosure.

[0128] As shown in Figure 31, the information processing device 90 includes a processor 91, memory 92, auxiliary storage device 93, input / output interface 95, and communication interface 96. In Figure 31, interface is abbreviated as I / F (Interface). The information processing device 90 may include at least one or more of the processor 91, memory 92, auxiliary storage device 93, input / output interface 95, and communication interface 96. The processor 91, memory 92, auxiliary storage device 93, input / output interface 95, and communication interface 96 are connected to each other via a bus 98 so that they can communicate data. In addition, the processor 91, memory 92, auxiliary storage device 93, and input / output interface 95 are connected to a network such as the Internet or an intranet via the communication interface 96.

[0129] The processor 91 loads a program (instruction) stored in an auxiliary storage device 93 or the like into memory 92. For example, the program is a software program for executing the control and processing described in this disclosure. The processor 91 executes the program loaded into memory 92. By executing the program, the processor 91 performs the control and processing described in this disclosure. The processor 91 may be composed of a single piece of hardware or of multiple pieces of hardware.

[0130] Memory 92 is a storage device having an area where a program is loaded. The processor 91 loads the program stored in the auxiliary storage device 93 or the like into memory 92. Memory 92 can be implemented using volatile memory such as DRAM (Dynamic Random Access Memory). Alternatively, non-volatile memory such as MRAM (Magnetoresistive Random Access Memory) may be used as memory 92. Memory 92 may be composed of a single piece of hardware or multiple pieces of hardware.

[0131] The auxiliary storage device 93 stores various data, such as programs. For example, the auxiliary storage device 93 can be implemented by a local disk such as a hard disk or flash memory. The auxiliary storage device 93 may be configured by a single piece of hardware or by multiple pieces of hardware. The auxiliary storage device 93 may also be configured as external hardware. It is also possible to configure the system to store various data in memory 92 and omit the auxiliary storage device 93.

[0132] The input / output interface 95 is an interface for connecting the information processing device 90 to peripheral devices based on standards and specifications. The communication interface 96 is an interface for connecting to external systems and devices via a network such as the Internet or an intranet, based on standards and specifications. The input / output interface 95 may be composed of a single piece of hardware or multiple pieces of hardware. The input / output interface 95 and the communication interface 96 may be common as interfaces for connecting to external devices.

[0133] The information processing device 90 may be connected to input devices such as a keyboard, mouse, or touch panel, as needed. These input devices are used to input information and settings. When a touch panel is used as an input device, the screen with touch panel functionality becomes the interface. The processor 91 and the input devices are connected via an input / output interface 95.

[0134] The information processing device 90 may be equipped with a display device for displaying information. If a display device is provided, the information processing device 90 is equipped with a display control device (not shown) for controlling the display of the display device. The information processing device 90 and the display device are connected via an input / output interface 95.

[0135] The information processing device 90 may be equipped with a drive device. The drive device mediates between the processor 91 and the recording medium (program recording medium) by reading data and programs stored on the recording medium and writing the processing results of the information processing device 90 to the recording medium. The information processing device 90 and the drive device are connected via an input / output interface 95.

[0136] The above is an example of a hardware configuration that enables the control and processing described in this disclosure. The hardware configuration in Figure 31 is an example of a hardware configuration that executes the control and processing described in this disclosure, and does not limit the scope of this disclosure. Programs that cause a computer to execute the control and processing described in this disclosure are also included in the scope of this disclosure.

[0137] A program recording medium that stores a program for performing the processing in this embodiment is also included in the scope of the present invention. For example, the program recording medium is a computer-readable, non-transient recording medium. The recording medium can be implemented as an optical recording medium such as a CD (Compact Disc) or a DVD (Digital Versatile Disc). The recording medium may also be implemented as a semiconductor recording medium such as a USB (Universal Serial Bus) memory or an SD (Secure Digital) card. Furthermore, the recording medium may be implemented as a magnetic recording medium such as a flexible disk, or other recording media.

[0138] The components in this disclosure may be combined in any way. The components in this disclosure may be implemented by software. The components in this disclosure may be implemented by circuitry.

[0139] Although the present disclosure has been described above with reference to embodiments, the present disclosure is not limited to the embodiments described above. Various modifications to the structure and details of the present disclosure can be made as can be understood by those skilled in the art within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0140] Some or all of the above embodiments may also be described as follows, but are not limited to the following. In the following appendices, the dependent items of each category may also be dependent on other categories. The descriptions included in the following appendices have significance as a basis for amendment. (Appendix 1) An advertising distribution device comprising: an acquisition unit that acquires confidential data, including confidential location information of a terminal device, from a terminal device used by a user of the advertising distribution service; a search unit that searches a database for advertising content corresponding to the confidential location information of the terminal device by confidential information retrieval processing; and a distribution unit that distributes advertising data including the retrieved advertising content to the terminal device. (Appendix 2) The advertising distribution device according to Appendix 1, wherein the database stores an advertising table composed of records in which the advertising content is associated with each of a plurality of sections included in the service area of ​​the advertising distribution service, and the search unit searches for the advertising content associated with the section in which the location of the confidential location information of the terminal device is included. (Note 3) The advertising distribution device according to Note 2, wherein the advertising table stores supplemental information used for searching for the advertising content, associated with each of the multiple sections, the acquisition unit acquires the confidential data including the supplemental information from the terminal device, and the search unit searches the database for the section containing the location of the confidentialized terminal device's location information and the advertising content corresponding to the supplemental information by the confidential information search process. (Note 4) The advertising table stores records associated with the advertising content according to the time of day for each of the multiple sections included in the service area of ​​the advertising distribution service, the acquisition unit acquires the confidential data including the time the confidential data was transmitted from the terminal device, and the search unit searches the database for the section containing the location of the confidentialized terminal device's location information and the advertising content corresponding to the time of day the confidential data was transmitted by the confidential information search process.(Note 5) The advertising distribution device according to Note 3, wherein the advertising table stores records associated with advertising content according to attributes for each of the multiple sections included in the service area of ​​the advertising distribution service, the acquisition unit acquires the confidential data including the user's attributes from the terminal device, and the search unit searches the database for advertising content according to the user's attributes and the section containing the location of the confidentialized terminal device's location information, through the confidential information search process. (Note 6) The advertising distribution device according to Note 3, wherein the advertising table stores records associated with advertising content according to preferences for each of the multiple sections included in the service area of ​​the advertising distribution service, the acquisition unit acquires the confidential data including the user's preferences from the terminal device, and the search unit searches the database for advertising content according to the user's preferences and the section containing the location of the confidentialized terminal device's location information, through the confidential information search process. (Note 7) The advertising distribution device according to Note 1, wherein the acquisition unit acquires the confidential data transmitted in accordance with the user's settings for the advertising distribution service. (Note 8) The advertising distribution device according to Note 1, wherein the acquisition unit acquires the confidential data transmitted in accordance with the user's request. (Note 9) The advertising distribution device according to Note 1, wherein the acquisition unit acquires the confidential data, including the location information of the terminal device encrypted using a non-public encryption key; the search unit searches the database for the advertising content corresponding to the encrypted location information of the terminal device by confidential information search processing using secure computation; and the distribution unit distributes the advertising data, including the encrypted advertising content, to the terminal device. (Note 10) The advertising distribution device according to Note 9, wherein the search unit performs an operation using a homomorphic encryption scheme as the secure computation.(Note 11) An information provision system comprising: an advertising distribution device as described in Note 1; a database storing advertising content corresponding to a location included in the service area of ​​the advertising distribution service; and a concealment device implemented in the terminal device used by a user of the advertising distribution service, which transmits concealed data including the location information of the terminal device to the advertising distribution device. (Note 12) The information provision system according to Note 11, wherein the anonymization device encrypts the location information of the terminal device using a non-public encryption key, transmits the anonymized data including the encrypted location information of the terminal device to the advertising distribution device, the advertising distribution device obtains the anonymized data including the location information of the terminal device encrypted with the encryption key, searches the database for advertising content corresponding to the encrypted location information of the terminal device by an anonymized information retrieval process using secure computation, and distributes the advertising data including the encrypted advertising content to the terminal device, the anonymization device receives the advertising data including the encrypted advertising content distributed from the advertising distribution device, decrypts the advertising content using a decryption key corresponding to the encryption key, and outputs the decrypted advertising content to the terminal device. (Note 13) The information provision system according to Note 12, wherein the advertising distribution device performs an operation using a homomorphic encryption scheme as the secure computation.(Note 14) The information provision system according to Note 13, wherein the database stores an advertising table containing advertising content corresponding to each of a plurality of sections included in the target area of ​​the advertising distribution service, the anonymization device sets 1 for the section including the location of the terminal device, sets 0 for the section not including the location of the terminal device, generates queries corresponding to each of the plurality of sections by encrypting the numerical values ​​set for each of the plurality of sections using the encryption key stored in the device, transmits the anonymized data containing the plurality of generated queries to the advertising distribution device, the advertising distribution device performs an anonymized information search using homomorphic encryption with respect to the plurality of queries that have been transmitted, retrieves the advertising content in the section including the location of the terminal device in an encrypted state, returns the encrypted advertising content to the anonymization device, and the anonymization device obtains the encrypted advertising content and decrypts the encrypted advertising content using the decryption key stored in the device. (Note 15) The information provision system according to any one of Notes 11 to 14, wherein the anonymization device displays the advertising content included in the advertising data on the screen of the terminal device. (Note 16) The information provision system according to Note 15, wherein the anonymization device displays a button on the screen of the terminal device that accepts reservations for stores advertised with the advertising content included in the advertising data. (Note 17) The information provision system according to any one of Notes 11 to 14, wherein the anonymization device displays a map on the screen of the terminal device that clearly indicates at least one location associated with the advertising content included in the advertising data. (Note 18) The information provision system according to Note 17, wherein the anonymization device displays the advertising content corresponding to the selected location on the screen of the terminal device, in accordance with the selection of at least one location indicated on the map.(Note 19) An advertising distribution method comprising: a computer obtaining confidential data, including the location information of a terminal device, which has been made confidential, from a terminal device used by a user of an advertising distribution service; searching a database for advertising content corresponding to the location information of the terminal device, which has been made confidential, through a confidential information retrieval process; and distributing advertising data, including the retrieved advertising content, to the terminal device. (Note 20) A program that causes a computer to perform the following processes: obtaining confidential data, including the location information of a terminal device, which has been made confidential, from a terminal device used by a user of an advertising distribution service; searching a database for advertising content corresponding to the location information of the terminal device, which has been made confidential, through a confidential information retrieval process; and distributing advertising data, including the retrieved advertising content, to the terminal device. Furthermore, some or all of the configurations described in Notes 2 to 18, which are subordinate to Note 1 above, may also be subordinate to Notes 19 and 20 in the same way as Notes 2 to 18. Furthermore, not limited to Appendix 1, Appendix 19, and Appendix 20, within the scope of the embodiments described above, some or all of the configurations described in the appendices may be made subordinate to various hardware, software, various recording means for recording software, or systems.

[0141] 1. Information Provision System 11, 21. Confidentiality Device 12, 22, 32. Advertising Distribution Device 13, 23, 33. Database 110, 210. Terminal Device 111, 211. Location Information Acquisition Unit 112, 212. Storage Unit 113, 213. Confidentiality Unit 115, 215. Communication Unit 116, 216. Reconstruction Unit 117, 217. Output Unit 120, 220. Advertising Distribution Server 121, 221, 321. Acquisition Unit 123, 223, 323. Search Unit 125, 225, 325. Distribution Unit

Claims

1. An advertising distribution device comprising: an acquisition unit that acquires confidential data, including the location information of a terminal device, which has been made confidential, from a terminal device used by a user of an advertising distribution service; a search unit that searches a database for advertising content corresponding to the location information of the terminal device, which has been made confidential, by performing a confidential information search process; and a distribution unit that distributes advertising data, including the searched advertising content, to the terminal device.

2. The advertising distribution device according to claim 1, wherein the database stores an advertising table consisting of records in which the advertising content is associated with each of a plurality of parcels included in the service area of ​​the advertising distribution service, and the search unit searches for the advertising content associated with the parcel that contains the location of the concealed location information of the terminal device.

3. The advertising distribution device according to claim 2, wherein the advertising table stores supplementary information used for searching for advertising content, associated with each of the plurality of sections, the acquisition unit acquires the confidential data including the supplementary information from the terminal device, and the search unit searches the database for the section containing the location of the confidentialized location information of the terminal device and the advertising content corresponding to the supplementary information by the confidential information search process.

4. The advertising distribution device according to claim 3, wherein the advertising table stores records associated with advertising content corresponding to a time period for each of the plurality of parcels included in the service area of ​​the advertising distribution service, the acquisition unit acquires the confidential data including the time the confidential data was transmitted from the terminal device, and the search unit searches the database for advertising content corresponding to the parcel containing the location of the confidentialized terminal device location information and the time period including the time the confidential data was transmitted, by the confidential information search process.

5. The advertising distribution apparatus according to claim 3, wherein the advertising table stores records associated with advertising content according to attributes for each of the plurality of parcels included in the service area of ​​the advertising distribution service, the acquisition unit acquires the confidential data including the user's attributes from the terminal device, and the search unit searches the database for advertising content corresponding to the parcel containing the location of the confidentialized location information of the terminal device and the user's attributes by the confidential information search process.

6. The advertising distribution device according to claim 3, wherein the advertising table stores records associated with advertising content according to preferences for each of the plurality of parcels included in the service area of ​​the advertising distribution service, the acquisition unit acquires the confidential data including the user's preferences from the terminal device, and the search unit searches the database for advertising content according to the confidential information search process, which includes the parcel containing the location of the confidentialized location information of the terminal device and the user's preferences.

7. The advertising distribution device according to claim 1, wherein the acquisition unit acquires the confidential data transmitted in accordance with the user's settings for the advertising distribution service.

8. The advertising distribution device according to claim 1, wherein the acquisition unit acquires the confidential data transmitted in response to the user's request.

9. The advertising distribution device according to claim 1, wherein the acquisition unit acquires the confidential data including the location information of the terminal device encrypted using a non-public encryption key; the search unit searches the database for the advertising content corresponding to the encrypted location information of the terminal device by confidential information retrieval processing using secure computation; and the distribution unit distributes the advertising data including the encrypted advertising content to the terminal device.

10. The advertising distribution device according to claim 9, wherein the search unit performs an operation using a homomorphic encryption scheme as the secure computation.

11. An information provision system comprising: an advertising distribution device according to claim 1; a database storing advertising content corresponding to a location included in the service area of ​​the advertising distribution service; and a concealment device implemented in the terminal device used by a user of the advertising distribution service, which transmits concealed data including the location information of the terminal device to the advertising distribution device.

12. The information provision system according to claim 11, wherein the anonymization device encrypts the location information of the terminal device using a non-public encryption key, transmits the anonymized data including the encrypted location information of the terminal device to the advertising distribution device, the advertising distribution device obtains the anonymized data including the location information of the terminal device encrypted with the encryption key, searches the database for advertising content corresponding to the encrypted location information of the terminal device by an anonymized information retrieval process using secure computation, distributes the advertising data including the encrypted advertising content to the terminal device, the anonymization device receives the advertising data including the encrypted advertising content distributed from the advertising distribution device, decrypts the advertising content using a decryption key corresponding to the encryption key, and outputs the decrypted advertising content to the terminal device.

13. The information provision system according to claim 12, wherein the advertising distribution device performs an operation using a homomorphic encryption scheme as the secure computation.

14. The information provision system according to claim 13, wherein the database stores an advertising table containing advertising content corresponding to each of a plurality of sections included in the target area of ​​the advertising distribution service, the anonymization device sets 1 for the section including the location of the terminal device, sets 0 for the section not including the location of the terminal device, generates queries corresponding to each of the plurality of sections by encrypting the numerical values ​​set for each of the plurality of sections using the encryption key stored in the device, transmits the anonymized data containing the plurality of generated queries to the advertising distribution device, the advertising distribution device performs an anonymized information search using homomorphic encryption with respect to the plurality of transmitted queries to retrieve the advertising content in the section including the location of the terminal device in an encrypted state, returns the encrypted advertising content to the anonymization device, and the anonymization device obtains the encrypted advertising content and decrypts the encrypted advertising content using the decryption key stored in the device.

15. The information provision system according to any one of claims 11 to 14, wherein the anonymization device displays the advertising content contained in the advertising data on the screen of the terminal device.

16. The information provision system according to claim 15, wherein the anonymization device displays a button on the screen of the terminal device that accepts reservations for stores advertised in the advertising content included in the advertising data.

17. The information provision system according to any one of claims 11 to 14, wherein the anonymization device causes the terminal device to display a map on the screen of the terminal device showing at least one location associated with the advertising content contained in the advertising data.

18. The information provision system according to claim 17, wherein the anonymization device displays the advertising content corresponding to the selected location on the screen of the terminal device, in accordance with the selection of at least one location indicated on the map.

19. An advertising distribution method comprising: a computer obtaining confidential data, including the location information of a terminal device that has been concealed, from a terminal device used by a user of an advertising distribution service; searching a database for advertising content corresponding to the location information of the terminal device through a confidential information retrieval process; and distributing advertising data, including the retrieved advertising content, to the terminal device.

20. A computer-readable non-transient recording medium on which a program is recorded that causes a computer to perform the following processes: a process of acquiring confidential data, including the location information of a terminal device, which has been made confidential, from a terminal device used by a user of an advertising distribution service; a process of searching a database for advertising content corresponding to the location information of the terminal device, which has been made confidential, by a confidential information retrieval process; and a process of delivering advertising data, including the retrieved advertising content, to the terminal device.

Images