Information processing device and information processing method

Abstract

An information processing device (10A) comprises: a data linkage processing unit (11) that executes processing related to aggregation, in which in-house data and third-party data are linked, without mutual disclosure of the in-house data and the third-party data with an information processing device (10B) of the third-party by adding noise; an error detection unit (12) that detects errors that occur in the processing related to aggregation; and a determination unit (13) that determines the error processing to be executed when an error is detected by the error detection unit (12), the error processing being determined on the basis of at least a preset determination index acquired during the processing related to aggregation.

Description

Information Processing Apparatus and Information Processing Method

[0001] The present disclosure relates to an information processing apparatus and an information processing method.

[0002] By utilizing data held by multiple enterprises (including various companies, organizations, groups, etc. here), creation of value that cannot be obtained from data held by a single enterprise can be expected. As one method of realizing data utilization among multiple enterprises, there is a method of performing aggregation processing that links the multiple data without mutually disclosing the data held by each of the multiple enterprises and outputting the aggregation result. At this time, differential privacy technology is known in which noise based on differential privacy criteria is added to the aggregation result to protect the privacy information of the output data (see Patent Document 1).

[0003] International Publication No. WO2022 / 254821

[0004] In the differential privacy technology as described above, there is a parameter that defines the magnitude of the added noise, an upper limit value of the parameter is set, and the upper limit value is referred to as a "privacy budget". When the aggregation result is output, the privacy budget is consumed each time, but as long as the total of the consumed portions is within the range of the privacy budget, the aggregation results of various aggregation processes can be output.

[0005] However, even when an error occurs, such as when an error occurs in a part of the aggregation processing or when the aggregation processing result is an abnormal value, once the aggregation processing result is output, the privacy budget is consumed, which has affected the overall plan regarding the consumption of the privacy budget. That is, there has been a problem that the privacy budget that can be used to obtain a correct aggregation result is wasted, and useful data (correct aggregation result) that should originally be obtained cannot be obtained.

[0006] The present disclosure has been made to solve the above problems, and aims to avoid wasteful consumption of the privacy budget and perform appropriate countermeasures when an error occurs.

[0007] The information processing device relating to this disclosure includes a data linkage processing unit that performs aggregation processing that links the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the other company's information processing device by adding noise; an error detection unit that detects errors that occur in the aggregation processing; and a determination unit that, when an error is detected by the error detection unit, determines the error processing to be performed based on at least predetermined determination indicators acquired during the aggregation processing.

[0008] According to this disclosure, it is possible to avoid wasting privacy budgets when errors occur and to take appropriate action.

[0009] This is a diagram illustrating the overall system configuration including the information processing device of the first embodiment. It is a diagram illustrating the processing flow and the data being processed. This is a flowchart showing an example of processing in the first embodiment. This is a flowchart showing another example of processing in the first embodiment. This is a diagram illustrating the overall system configuration including the information processing device of the second embodiment. It is a diagram illustrating the processing flow and the data being processed. This is a flowchart showing an example of processing in the second embodiment. This is a flowchart showing another example of processing in the second embodiment. This is a diagram showing an example of the hardware configuration of the information processing device.

[0010] The following describes various embodiments of the information processing device and information processing method related to this disclosure that perform so-called confidential cross-statistics, with reference to the drawings. In the following, as the first embodiment, an embodiment is described in which a process related to aggregating the data of one's own company and other companies in conjunction with the information processing device of another company is performed without mutual disclosure of the data by adding noise, and when an error is detected during the execution, an embodiment is described in which an error processing method to be performed is determined. Furthermore, as the second embodiment, an embodiment is described in which an error processing method to be performed is determined when an abnormality is detected in the processing result before adding noise in an aggregation process similar to the first embodiment.

[0011] [First Embodiment] As shown in Figure 1, the system in the first embodiment includes an information processing device 10A of company A and an information processing device 10B of company B, both of which are equipped with a plurality of functional units described later for realizing the functions related to this disclosure, and are collectively referred to as the information processing device 10. The system also includes a terminal 20A operated by an operator of company A who gives instructions and monitors the execution of processing by the information processing device 10A, and a terminal 20B operated by an operator of company B who gives instructions and monitors the execution of processing by the information processing device 10B.

[0012] The following describes the functional block configuration of the information processing device 10, using the configuration of information processing device 10A of company A as an example. To realize the functions related to this disclosure, the information processing device 10A includes a data linkage processing unit 11, an error detection unit 12, a judgment unit 13, and an input / output unit 14. Each functional unit will be described in order below.

[0013] The data linkage processing unit 11 is a functional unit that performs aggregation processing by linking the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the information processing unit 10B of another company by adding noise, in cooperation with the information processing unit 10B of another company. The above "aggregation processing" broadly includes de-identification processing, aggregation processing, and concealment processing. The data linkage processing unit 11 includes a de-identification processing unit 11A that performs de-identification processing (including anonymization processing, irreversible ID conversion, and encryption), an aggregation processing unit 11B that performs aggregation processing, and a concealment processing unit 11C that performs concealment processing by adding noise based on differential privacy standards. The "aggregation processing" is the same as processing in existing technologies and will be outlined in the processing description below.

[0014] The error detection unit 12 is a functional unit that detects errors that occur during the aggregation process. The error detection timing and judgment indicators used by the error detection unit 12 are as follows: Error detection timing: Judgment indicators at that time - During data input: Number / percentage of invalid format and missing data - During data matching: Number / percentage of IDs that can be matched - Before data output: Clearly abnormal statistical values ​​related to the aggregation results

[0015] The determination unit 13 is a functional unit that, when an error is detected by the error detection unit 12, determines the error processing to be executed based on at least the judgment indicators described above. In this embodiment, in addition to the judgment indicators, the determination unit 13 determines the error processing to be executed based on the recovery processing status related to the recovery process from the error (for example, the number of retries for the recovery process, the processing time elapsed, etc.). A detailed processing flow will be described later, but in this embodiment, three options are assumed for the error processing to be executed: (1) continue processing, (2) execute recovery processing, and (3) stop processing. For example, the determination is made as follows.

[0016] The judgment unit 13, for example, if the data loss rate, which is used as a judgment indicator, is less than a predetermined threshold (e.g., 1%), considers the impact of the error to be minor and decides to "(1) continue processing" as the error handling. On the other hand, if the data loss rate is equal to or greater than the threshold (e.g., 1%), the judgment unit 13 decides whether to "(2) execute recovery processing" or "(3) stop processing" depending on whether the number of recovery attempts, which is the recovery processing status at that time, has reached or exceeded a predetermined threshold (e.g., 3 times). That is, if the number of recovery attempts is less than the threshold (e.g., 3 times), the judgment unit 13 decides to "(2) execute recovery processing". If recovery is successful here, the waste of the privacy budget can be avoided. On the other hand, if the data loss rate does not fall below the threshold (e.g., 1%) even after repeating the recovery process a number of times equal to the threshold (e.g., 3 times), and the number of recovery attempts reaches or exceeds the threshold (e.g., 3 times), the judgment unit 13 decides to "(3) stop processing". By stopping processing when the likelihood of recovery is low in this way, the waste of the privacy budget can be avoided.

[0017] The input / output unit 14 is a functional unit that serves as an interface for sending and receiving various information and data with the terminal 20A.

[0018] The information processing device 10B of company B has a configuration similar to that of the information processing device 10A described above, and the data linkage processing unit 11 in each information processing device 10 is capable of sending and receiving various information and data to and from the other party's data linkage processing unit 11.

[0019] The following describes the processes executed in the information processing device 10, following the flowchart in Figure 3.

[0020] First, the data linkage processing units 11 of the information processing devices 10A and 10B cooperate with each other and perform the following processing related to aggregation of A company data and B company data (step S1 in Figure 3). The "processing related to aggregation" is, for example, the same as the technology described in Patent Document 1 of the prior art documents mentioned above, and broadly includes "de-identification processing," "aggregation processing," and "confidentiality processing." The processing of step S1 will be outlined below.

[0021] First, the deidentification processing units 11A of each information processing device 10A and 10B, in cooperation with the other party's deidentification processing unit 11A, execute existing deidentification processes (including anonymization processes (e.g., k-anonymization, l-diversity, t-approximation, etc.), irreversible transformation processes (e.g., ID hashing, etc.), and encryption processes) on their respective company data. In particular, during the encryption process, the deidentification processing unit 11A of information processing device 10A performs a first encryption on A company data based on A company's encryption key and keyed one-way commutative operations. Furthermore, it performs a second encryption on B company data received from information processing device 10B through the exchange of encryption results with information processing device 10B (i.e., B company data after the first encryption based on B company's encryption key and keyed one-way commutative operations) based on A company's encryption key and keyed one-way commutative operations. This generates B company data that has been double-encrypted using A company's encryption key and B company's encryption key. Furthermore, the anonymization processing unit 11A of the information processing device 10B also performs the same processing, generating double-encrypted data of company A using company A's encryption key and company B's encryption key, and the generated double-encrypted data of company A is transferred to the information processing device 10A.

[0022] In the encryption process described above, the "part corresponding to the user ID" and the "other parts" of the target data are executed separately. Furthermore, since both encryption processes are based on keyed, one-way, commutative arithmetic, it is possible to determine whether the double-encrypted data of Company A and the double-encrypted data of Company B belong to the same user based on the matching or mismatch of the bit sequences of the "part corresponding to the user ID" identified based on the data structure information shared in advance between the information processing devices 10A and 10B.

[0023] Next, the aggregation processing unit 11B of the information processing device 10A compares the double-encrypted A company data with the double-encrypted B company data and counts the number of data where the "part corresponding to the user ID" matches, thereby aggregating the number of target users. In the example shown in Figure 2, the number of data where the "part corresponding to the user ID" matches in the A company data and B company data (for example, the data with the ID "00000002" shown in bold in Figure 2) is counted to aggregate the number of target users (number of matching IDs), and the aggregation result "10,011" is obtained. Note that in Figure 2, for the sake of explanation, the content of the data being compared is shown in a way that makes it identifiable, but the data actually being compared is double-encrypted data.

[0024] Furthermore, the concealment processing unit 11C of the information processing device 10A performs concealment processing based on differential privacy on the aggregated results. Figure 2 shows an example in which concealment processing based on differential privacy is performed on the aggregated result "10,011", and the aggregated result "10,327" after noise is added is obtained.

[0025] Returning to Figure 3, the error detection unit 12 of the information processing device 10A then monitors the status of the aggregation process until the aggregation process described above is completed (steps S2 and S10). The timing of error detection by the error detection unit 12 at this time, and the judgment indicators at that time, are as described above.

[0026] When the error detection unit 12 detects an error that occurred during the execution of the aggregation process (YES in step S2), the decision unit 13 obtains the decision indicator at that time (during the execution of the process) (e.g., data loss rate) and the recovery process status related to the recovery process (e.g., number of retries, elapsed processing time) (step S3).

[0027] Then, the judgment unit 13 determines whether the data loss rate, as an example of a judgment indicator, is equal to or greater than a predetermined threshold (for example, 1%) (step S4). If the data loss rate is less than the threshold, it considers the impact of the error to be minor and determines that the error processing to be performed is "(1) Continue processing" (step S6), and continues the execution of the processing related to aggregation (step S1).

[0028] On the other hand, if the data loss rate in step S4 is above a threshold, the determination unit 13 considers the impact of the error to be significant and determines whether the number of recovery attempts as the recovery processing status at that point has reached a predetermined threshold (for example, 3 times) or more (step S5). If the determination in step S5 indicates that the number of recovery attempts is below the threshold, the determination unit 13 decides to "(2) execute recovery processing" as the error processing to be performed (step S8) and executes the predetermined recovery processing (step S9). On the other hand, if the determination in step S5 indicates that the number of recovery attempts is above the threshold, the determination unit 13 decides to "(3) stop processing" as the error processing (step S7).

[0029] In the flow described above, initially, the number of recovery attempts is "0," so it is determined to "(2) Execute recovery processing," and the recovery processing is executed. Subsequently, if the recovery processing reduces the judgment indicator (e.g., data loss rate) to below the threshold (e.g., 1%), it is determined to be NO in step S4, and it is determined to "(1) Continue processing," and the processing related to aggregation continues. If recovery from the error is successful in this way, the waste of the privacy budget can be avoided. On the other hand, if the judgment indicator (e.g., data loss rate) is still above the threshold even after repeating the recovery attempts a number of times equal to the threshold, it is determined to be YES in steps S4 and S5, and the judgment unit 13 determines to "(3) Stop processing" as the error processing to be executed (step S7). By deciding to stop processing when the likelihood of recovery is low in this way, the waste of the privacy budget can be avoided.

[0030] As described above, the first embodiment allows for the detection of errors that occur during the execution of aggregation-related processing, and enables appropriate error handling to be determined based on the judgment indicators and recovery processing status. This avoids the wasteful consumption of the privacy budget and allows for appropriate responses. In other words, by avoiding the output of processing results when an error occurs, recovery or processing stoppage can be performed without wasting the privacy budget. Furthermore, normal and useful aggregation results can be obtained by re-executing the processing after recovery.

[0031] The decision-making process by the decision unit 13 described above is not limited to the flow shown in Figure 3, and other patterns may also be adopted. For example, as shown in the flow in Figure 4, if the decision unit 13 determines to "(1) continue processing", it may display a prompt on the terminal 20A to ask the operator if this decision is correct, and if the operator determines it is OK, it may continue processing. Similarly, as shown in the flow in Figure 4, if the decision unit 13 determines to "(3) stop processing", it may display a prompt on the terminal 20A to ask the operator if this decision is correct, and if the operator determines it is OK, it may stop processing. Although the flow in Figure 4 shows an example where both the decision to "(1) continue processing" and the decision to "(3) stop processing" are confirmed with the operator, it is also possible to confirm only one of the above with the operator, or to further confirm the decision to "(2) execute recovery processing" with the operator.

[0032] As shown in the flowchart in Figure 4, by confirming with the operator whether the judgment result from the judgment unit 13 is appropriate, it is possible to take appropriate action considering specific requirements such as the importance of the aggregation process at that time and the importance of the target data.

[0033] [Second Embodiment] Next, as a second embodiment, we will describe an embodiment in which an error processing to be executed is determined when an abnormality is detected in the processing result before noise is added in the aggregation process similar to that of the first embodiment.

[0034] As shown in Figure 5, the system in the second embodiment, similar to the first embodiment (Figure 1), includes an information processing device 10A for company A, an information processing device 10B for company B, a terminal 20A operated by an operator of company A who gives instructions and monitors the execution of processing by the information processing device 10A, and a terminal 20B operated by an operator of company B who gives instructions and monitors the execution of processing by the information processing device 10B.

[0035] The information processing devices 10A and 10B are equipped with similar functional units for realizing the functions related to this disclosure and are collectively referred to as the information processing device 10. Hereinafter, the functional block configuration of the information processing device 10 will be described using the configuration of information processing device 10A of company A as an example. To realize the functions related to this disclosure, the information processing device 10A includes a data linkage processing unit 11, a result anomaly detection unit 15, a judgment unit 16, and an input / output unit 17. Each functional unit will be described in order below.

[0036] The functions and operations of the data linkage processing unit 11 are the same as those of the first embodiment described above, so redundant explanations will be omitted. Similar to the first embodiment, in order to perform processing related to aggregation (including de-identification processing, aggregation processing, and concealment processing), the data linkage processing unit 11 includes a de-identification processing unit 11A that performs de-identification processing (including anonymization processing, irreversible ID conversion, and encryption), an aggregation processing unit 11B that performs aggregation processing, and a concealment processing unit 11C that performs concealment processing that adds noise based on differential privacy standards.

[0037] The result anomaly detection unit 15 is a functional unit that detects anomalies in the processing results based on values ​​obtained from the processing results before noise is added in the aggregation process. Examples of "values ​​obtained from the processing results before noise is added" include (a) the processing results before noise is added themselves, (b) statistical values ​​of the processing results before noise is added, and (c) detection processing results obtained by adding a first noise for the purpose of anomaly detection to the processing results before noise is added or the statistical values ​​of said processing results. In the processing flows of Figures 7 and 8 described later, an example is explained in which the result anomaly detection unit 15 uses the above (c) detection processing results as "values ​​obtained from the processing results before noise is added" to perform anomaly detection.

[0038] The determination unit 16 is a functional unit that, when an anomaly is detected by the result anomaly detection unit 15, determines the error processing to be executed based on predetermined determination indicators (for example, the percentage of anomaly data described later) acquired during the aggregation process. In this embodiment, in addition to the determination indicators, the determination unit 16 determines the error processing to be executed based on the recovery processing status related to the recovery process from anomalies in the processing results (for example, the number of retries for the recovery process, the processing time elapsed, etc.). A detailed processing flow will be described later, but as in the first embodiment, three options are assumed for the error processing to be executed: (1) continue processing, (2) execute recovery processing, and (3) stop processing. For example, the determination is made as follows.

[0039] The judgment unit 16 determines, for example, if the percentage of abnormal data, which is used as a judgment indicator, is less than a predetermined threshold (e.g., 1%), that the impact of the error is minor and decides to "(1) continue processing" as the error handling. The above "abnormal data" refers, for example, to data (processing results) that are not within the range of "mean ± 3 × standard deviation" obtained from the mean and standard deviation of multiple processing results, and the "percentage of abnormal data" refers to the percentage of abnormal data in the total number of the above multiple processing results. On the other hand, if the percentage of abnormal data is equal to or greater than the threshold (e.g., 1%), the judgment unit 16 determines whether to "(2) execute recovery processing" or "(3) stop processing" depending on whether the number of recovery attempts as the recovery processing status at that time has reached or exceeded a predetermined threshold (e.g., 3 times). That is, if the number of recovery attempts is less than the threshold (e.g., 3 times), the judgment unit 16 determines to "(2) execute recovery processing". If recovery is successful here, the waste of the privacy budget can be avoided. On the other hand, if the recovery process is repeated a certain number of times (e.g., 3 times), but the percentage of abnormal data does not fall below the threshold (e.g., 1%), and the number of recovery attempts exceeds the threshold (e.g., 3 times), the determination unit 16 decides to "(3) Stop processing." By stopping the process when the likelihood of recovery is low in this way, the waste of the privacy budget can be avoided.

[0040] The input / output unit 17 is a functional unit that serves as an interface for sending and receiving various information and data with the terminal 20A, similar to the first embodiment.

[0041] The information processing apparatus 10B of Company B also has the same configuration as that of the above-described information processing apparatus 10A. The data communication processing unit 11 in each information processing apparatus 10 can mutually transmit and receive various pieces of information / data to and from the data communication processing unit 11 of the other party.

[0042] Hereinafter, the processing executed in the information processing apparatus 10 will be described with reference to the flowchart of FIG. 7.

[0043] First, the data communication processing units 11 of the information processing apparatuses 10A and 10B cooperate with each other and execute the de-identification processing and the encryption processing, which are the processing before noise addition, among the existing "processing related to aggregation" in which Company A data and Company B data are associated (step S11 in FIG. 7). The "processing related to aggregation" is the same processing as the technology described in Patent Document 1 of the above-described prior art document in the first embodiment, and repeated explanations regarding the "de-identification processing" and the "aggregation processing" are omitted here.

[0044] Next, the result abnormality detection unit 15 of the information processing apparatus 10A acquires, as the processing result before noise addition, "the number of cases where the IDs match after collating the double-encrypted Company A data and the double-encrypted Company B data" from the data communication processing unit 11 (step S12). The aggregation result obtained here is shown in FIG. 6 under the name of "pre-output data", and is an aggregation result collated and aggregated for each predetermined processing unit in the data of Company A and Company B. A plurality of aggregation results are acquired in step S12.

[0045] Next, the result abnormality detection unit 15 calculates a statistical value (such as an arithmetic mean value) of the acquired plurality of aggregation results (step S13). At this time, the statistical value is calculated for each unit obtained by grouping a plurality of aggregation results into a predetermined number. However, since no noise addition (privacy processing) based on the differential privacy standard is performed on the "statistical value of the aggregation result" obtained here, there is a risk of leading to privacy leakage. Therefore, the result abnormality detection unit 15 assigns noise (first noise) that satisfies the differential privacy standard for the purpose of abnormality detection to each of the calculated statistical values (step S14). Here, by setting the first noise to be added as relatively large noise, the consumption of the privacy budget is reduced. By step S14, a plurality of statistical values each with the first noise added are obtained as the processing results for detection.

[0046] Then, the result abnormality detection unit 15 determines whether the processing results for detection (a plurality of statistical values each with the first noise added) obtained in step S14 are normal as follows (step S15). For example, the result abnormality detection unit 15 calculates the average value and the standard deviation of the processing results for detection, determines whether each statistical value exists within the range of "average value ± 3 × standard deviation", and if all statistical values exist within the above range, determines that the processing results for detection are normal, and if at least one statistical value exists outside the above range, determines that the processing results for detection are abnormal.

[0047] If the result abnormality detection unit 15 determines in step S15 that the processing results for detection are normal (YES in step S15), the determination unit 16 instructs the privacy processing unit 11C of the data cooperation processing unit 11, and the privacy processing unit 11C re-adds noise (second noise) for the purpose of privacy processing and outputs the processing results from the input / output unit 17 (step S16). <00,00096>On the other hand, if the result abnormality detection unit 15 determines in step S15 that the processing results for detection are abnormal (NO in step S15), the determination unit 16 acquires the determination index (such as the ratio of abnormal data) and the recovery processing status regarding the recovery processing (such as the number of retries, the processing elapsed time, etc.) at that time (step S17).

[0049] The determination unit 16 then determines whether the percentage of abnormal data, which serves as a judgment indicator, is equal to or greater than a predetermined threshold (for example, 1%) (step S18). If the percentage of abnormal data is less than the threshold, it considers the impact of the error to be minor and determines that the error processing to be performed is "(1) Continue processing" (step S20). The determination unit 16 then instructs the data linkage processing unit 11 to the data concealment processing unit 11C, which then adds noise (second noise) for the purpose of concealment processing and outputs the processing result from the input / output unit 17 (step S16).

[0050] On the other hand, if the percentage of abnormal data in step S18 is above a threshold, the determination unit 16 considers the impact of the error to be significant and determines whether the number of recovery attempts as the recovery processing status at that point has reached a predetermined threshold (for example, 3 times) or more (step S19). If the determination in step S19 indicates that the number of recovery attempts is below the threshold, the determination unit 16 decides to "(2) execute recovery processing" as the error processing to be performed (step S22) and executes the recovery processing (step S23). On the other hand, if the determination in step S19 indicates that the number of recovery attempts is above the threshold, the determination unit 16 decides to "(3) stop processing" as the error processing (step S21).

[0051] In the flow described above, initially, the number of recovery attempts is "0," so it is determined to "(2) Execute recovery processing," and the recovery processing is executed. Subsequently, if the recovery processing causes the judgment indicator (e.g., the percentage of abnormal data) to fall below the threshold, it is determined to be NO in step S18, and it is determined to "(1) Continue processing," and the processing related to aggregation is executed. If recovery from the error is successful in this way, the waste of the privacy budget can be avoided. On the other hand, if the judgment indicator (e.g., the percentage of abnormal data) is still above the threshold even after repeating the recovery attempts a number of times equal to the threshold, it is determined to be YES in steps S18 and S19, and the judgment unit 16 determines to "(3) Stop processing" as the error processing to be executed (step S21). By deciding to stop processing when the likelihood of recovery is low in this way, the waste of the privacy budget can be avoided.

[0052] As described above, the embodiment allows for the detection of abnormalities in the processing results of the aggregation process, and enables appropriate error handling to be performed based on the judgment indicators and the recovery processing status. This avoids the wasteful consumption of the privacy budget and allows for appropriate responses. In other words, by avoiding the output of the processing results when an abnormality in the processing results is detected, recovery or processing stoppage can be performed without wasting the privacy budget. Furthermore, normal and useful aggregation results can be obtained by re-executing the processing after recovery.

[0053] The decision-making process by the decision unit 16 described above is not limited to the flow shown in Figure 7, and other patterns may also be adopted. For example, as shown in the flow shown in Figure 8, if the decision unit 16 determines to "(1) continue processing", it may display a prompt on the terminal 20A to ask the operator if this decision is correct, and if the operator determines it is OK, it may continue processing. Similarly, as shown in the flow shown in Figure 8, if the decision unit 16 determines to "(3) stop processing", it may display a prompt on the terminal 20A to ask the operator if this decision is correct, and if the operator determines it is OK, it may stop processing. Although the flow shown in Figure 8 shows an example where both the decision to "(1) continue processing" and the decision to "(3) stop processing" are confirmed with the operator, it is also possible to confirm only one of the above with the operator, or to further confirm the decision to "(2) execute recovery processing" with the operator.

[0054] As shown in the flowchart in Figure 8, by confirming with the operator whether the judgment result from the judgment unit 16 is appropriate, it is possible to take appropriate action considering specific requirements such as the importance of the aggregation process at that time and the importance of the target data.

[0055] The gist of this disclosure is found in the following [1] to

[10] . [1] An information processing device comprising: a data linkage processing unit that performs aggregation processing that links the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the other company's information processing device by adding noise; an error detection unit that detects errors that occur in the aggregation processing; and a determination unit that, when an error is detected by the error detection unit, determines the error processing to be performed based on at least predetermined determination indicators acquired during the aggregation processing. [2] The information processing device according to [1], wherein the error detection unit detects the error based on the determination indicators. [3] The information processing device according to [1] or [2], wherein the determination unit determines the error processing based on the determination indicators and the recovery processing status related to the recovery processing from the error. [4] An information processing device comprising: a data linkage processing unit that performs aggregation processing that links the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the other company's information processing device by adding noise; a result anomaly detection unit that detects anomalies in the processing results based on values ​​obtained from the processing results before adding noise in the aggregation processing; and a judgment unit that, when an anomaly is detected by the result anomaly detection unit, determines the error processing to be performed based on predetermined judgment indicators obtained during the aggregation processing. [5] The information processing device according to [4], wherein the result anomaly detection unit detects an anomaly in the processing results based on statistical values ​​of the processing results before adding noise. [6] The information processing device according to [4] or [5], wherein the result anomaly detection unit detects an anomaly in the processing results based on a detection processing result obtained by adding a first noise for the purpose of anomaly detection to the processing results before adding noise or statistical values ​​of the processing results. [7] The information processing apparatus according to [6], wherein if the result anomaly detection unit does not detect an anomaly in the processing result based on the detection processing result, the determination unit performs a process to add a second noise for the purpose of concealment processing, and outputs the processing result after the processing.[8] The information processing device according to any one of [4] to [7], wherein the determination unit determines the error processing based on the recovery processing status related to the recovery processing from an abnormality in the processing result, in addition to the determination indicators. [9] An information processing method comprising: a step of performing an aggregation process that links the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the other company's information processing device by adding noise; a step of the information processing device detecting an error that occurred in the aggregation process; and a step of the information processing device determining, if the error is detected, an error processing to be performed based on at least predetermined determination indicators obtained during the aggregation process.

[10] An information processing method comprising: a step of an information processing device performing an aggregation process that links the company's data and the other company's data without mutually disclosing the company's data and the other company's data with the other company's information processing device by adding noise; a step of the information processing device detecting an anomaly in the processing result based on a value obtained from the processing result before adding noise in the aggregation process; and a step of the information processing device determining, if an anomaly is detected, an error processing to be performed based on at least a predetermined judgment indicator acquired during the aggregation process.

[0056] [Explanation of terms, explanation of hardware configuration (Figure 9), etc.] The block diagram used in the description of the above embodiment shows functional units. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method of realizing each functional block is not particularly limited. That is, each functional block may be realized using one device that is physically or logically coupled, or it may be realized using two or more physically or logically separated devices that are directly or indirectly connected (for example, using wired, wireless, etc.). A functional block may be realized by combining the above one device or the above multiple devices with software.

[0057] Functions include, but are not limited to, judgment, decision, judgment, calculation, calculation, processing, derivation, investigation, exploration, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, assumption, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating (mapping), and assigning. For example, a functional block (configuration part) that enables transmission is called a transmitting unit or transmitter. As mentioned above, the method of implementation is not particularly limited.

[0058] For example, the information processing device in one embodiment of the present disclosure may function as a computer that performs the processing of the present disclosure. Figure 9 is a diagram showing an example of the hardware configuration of an information processing device 10 according to one embodiment of the present disclosure. The above-described information processing device 10 may be physically configured as a computer device including a processor 1001, memory 1002, storage 1003, communication device 1004, input device 1005, output device 1006, bus 1007, etc.

[0059] In the following explanation, the term "device" can be replaced with "circuit," "device," "unit," etc. The hardware configuration of the information processing device 10 may include one or more of the devices shown in the figure, or it may be configured to omit some of the devices.

[0060] Each function in the information processing device 10 is realized by loading predetermined software (programs) onto hardware such as the processor 1001 and memory 1002, which allows the processor 1001 to perform calculations, control communication by the communication device 1004, and control at least one of data reading and writing in the memory 1002 and storage 1003.

[0061] The processor 1001 controls the entire computer, for example, by running an operating system. The processor 1001 may be composed of a central processing unit (CPU) that includes interfaces with peripheral devices, control units, arithmetic units, registers, etc.

[0062] Furthermore, the processor 1001 reads programs (program code), software modules, data, etc., from at least one of the storage 1003 and the communication device 1004 into the memory 1002, and executes various processes accordingly. The program used is one that causes the computer to execute at least a part of the operations described in the above embodiment. Although it has been explained that the various processes are executed by one processor 1001, they may be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The program may also be transmitted from a network via a telecommunications line.

[0063] The memory 1002 is a computer-readable recording medium and may consist of at least one of the following: ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. The memory 1002 may also be called a register, cache, main memory, etc. The memory 1002 can store executable programs (program code), software modules, etc., for carrying out a wireless communication method according to one embodiment of the present disclosure.

[0064] The storage 1003 is a computer-readable recording medium and may consist of at least one of the following: an optical disc such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disc, a digital multipurpose disc, a Blu-ray® disc), a smart card, flash memory (e.g., a card, a stick, a key drive), a floppy® disk, a magnetic strip, etc. The storage 1003 may also be called an auxiliary storage device. The above-mentioned storage medium may be, for example, a database, server, or other suitable medium including at least one of the memory 1002 and the storage 1003.

[0065] The communication device 1004 is hardware (transceiver / receiver device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as a network device, network controller, network card, communication module, etc. The communication device 1004 may be configured to include, for example, a high-frequency switch, duplexer, filter, frequency synthesizer, etc., in order to implement at least one of frequency division duplex (FDD) and time division duplex (TDD).

[0066] The input device 1005 is an input device that accepts input from an external source (e.g., a keyboard, mouse, microphone, switch, button, sensor, etc.). The output device 1006 is an output device that outputs to an external source (e.g., a display, speaker, LED lamp, etc.). The input device 1005 and the output device 1006 may be configured as an integrated unit (e.g., a touch panel).

[0067] Furthermore, each device, such as the processor 1001 and memory 1002, is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or different buses may be configured for each device.

[0068] Furthermore, the information processing device 10 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), and an FPGA (Field Programmable Gate Array), and some or all of each functional block may be realized by such hardware. For example, the processor 1001 may be implemented using at least one of these hardware components.

[0069] The notification of information is not limited to the embodiments described herein and may be carried out by other means. For example, the notification of information may be carried out by physical layer signaling (e.g., DCI (Downlink Control Information), UCI (Uplink Control Information)), upper layer signaling (e.g., RRC (Radio Resource Control) signaling, MAC (Medium Access Control) signaling, broadcast information (MIB (Master Information Block), SIB (System Information Block))), other signals, or combinations thereof. RRC signaling may also be called RRC messages, and may be, for example, RRC Connection Setup messages, RRC Connection Reconfiguration messages, etc.

[0070] Each aspect / embodiment described in this disclosure refers to LTE (Long Term Evolution), LTE-A (LTE-Advanced), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), 6th generation mobile communication system (6G), xth generation mobile communication system (xG) (xG (where x is, for example, an integer or decimal)), FRA (Future Radio Access), NR (new Radio), New radio access (NX), Future generation radio access (FX), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, may apply to at least one system utilizing UWB (Ultra-WideBand), Bluetooth®, or other appropriate systems, and to next-generation systems extended, modified, generated, or defined based thereon. Alternatively, multiple systems may be applied in combination (e.g., a combination of at least one of LTE and LTE-A with 5G).

[0071] The processing procedures, sequences, flowcharts, etc., of each aspect / embodiment described in this disclosure may be reordered, provided they do not contradict each other. For example, the methods described in this disclosure present various step elements using exemplary order and are not limited to the specific order presented.

[0072] Input and output information may be stored in a specific location (e.g., memory) or managed using a management table. Input and output information may be overwritten, updated, or appended to. Output information may be deleted. Input information may be transmitted to other devices.

[0073] The determination may be made by a value represented by one bit (0 or 1), by a boolean value (true or false), or by a numerical comparison (for example, a comparison with a predetermined value).

[0074] Each aspect / embodiment described in this disclosure may be used individually, in combination, or switched between as needed during implementation. Furthermore, notification of specific information (e.g., notification that "X is") is not limited to explicit notification, but may also be implicit (e.g., by not providing such notification).

[0075] Although the present disclosure has been described in detail above, it will be clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the intent and scope of the present disclosure as defined by the claims. Therefore, the descriptions in the present disclosure are illustrative and not intended to be restrictive in any way.

[0076] Software should be broadly interpreted to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, execution threads, procedures, functions, and so on, whether they are called software, firmware, middleware, microcode, hardware description languages, or by any other name.

[0077] Furthermore, software, instructions, information, etc., may be transmitted and received via a transmission medium. For example, if software is transmitted from a website, server, or other remote source using at least one of wired technology (such as coaxial cable, fiber optic cable, twisted pair, or digital subscriber line (DSL)) and wireless technology (such as infrared or microwave), then at least one of these wired and wireless technologies is included in the definition of a transmission medium.

[0078] The information, signals, etc. described in this disclosure may be represented using any of the various different techniques. For example, the data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be referred to throughout the above description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

[0079] In addition, terms used in this disclosure and terms necessary for understanding this disclosure may be replaced with terms having the same or similar meanings. For example, at least one of the channel and symbol may be a signal (signaling). Also, a signal may be a message. Furthermore, a component carrier (CC) may be called a carrier frequency, cell, frequency carrier, etc.

[0080] The terms “system” and “network” as used in this disclosure are interchangeable.

[0081] Furthermore, the information, parameters, etc., described in this disclosure may be expressed using absolute values, relative values ​​from a given value, or other corresponding information. For example, wireless resources may be indicated by an index.

[0082] The names used for the parameters described above are not restrictive in any way. Furthermore, the formulas and other expressions using these parameters may differ from those expressly disclosed in this disclosure. Various channels (e.g., PUCCH, PDCCH, etc.) and information elements can be identified by any suitable name, and therefore, the various names assigned to these various channels and information elements are not restrictive in any way.

[0083] As used in this disclosure, the terms “determining” and “determining” may encompass a wide variety of actions. “Determining” may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, or inquiring (e.g., searching in a table, database, or other data structure), or ascertaining. “Determining” may also include receiving (e.g., receiving information), transmitting (e.g., sending information), inputting, outputting, or accessing (e.g., accessing data in memory). Furthermore, "judgment" and "decision" can include considering something as having been "judged" or "decided" after resolving, selecting, choosing, establishing, comparing, etc. In other words, "judgment" and "decision" can include considering something as having been "judged" or "decided" after some action. Also, "judgment (decision)" can be reinterpreted as "assuming," "expecting," or "considering."

[0084] In this disclosure, the phrase "based on" does not mean "based solely on" unless otherwise specified. In other words, the phrase "based on" means both "based solely on" and "based at least on."

[0085] Any reference to elements using the designations “first,” “second,” etc., as used in this disclosure does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient way to distinguish between two or more elements. Accordingly, references to the first and second elements do not imply that only two elements may be employed, or that the first element must precede the second element in any way.

[0086] Where the terms “include,” “including,” and variations thereof are used in this disclosure, these terms are intended to be inclusive, as is the term “comprising.” Furthermore, the term “or” as used in this disclosure is not intended to mean exclusive OR.

[0087] In this disclosure, if articles are added through translation, such as a, an, and the in English, this disclosure may include the fact that the noun following these articles is plural.

[0088] In this disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "combine" may be interpreted similarly to "different."

[0089] 10, 10A, 10B... Information processing device, 11... Data linkage processing unit, 11A... De-identification processing unit, 11B... Aggregation processing unit, 11C... Confidentiality processing unit, 12... Error detection unit, 13, 16... Decision unit, 14, 17... Input / output unit, 15... Result anomaly detection unit, 20A, 20B... Terminal, 1001... Processor, 1002... Memory, 1003... Storage, 1004... Communication device, 1005... Input device, 1006... Output device, 1007... Bus.

Claims

1. An information processing device comprising: a data linkage processing unit that performs aggregation processing linking the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the other company's information processing device by adding noise; an error detection unit that detects errors that occur in the aggregation processing; and a determination unit that, when an error is detected by the error detection unit, determines the error processing to be performed based on at least predetermined determination indicators acquired during the aggregation processing.

2. The information processing apparatus according to claim 1, wherein the error detection unit detects the error based on the judgment indicator.

3. The information processing apparatus according to claim 1, wherein the determination unit determines the error processing based on the recovery processing status related to the recovery processing from the error, in addition to the determination indicator.

4. An information processing device comprising: a data linkage processing unit that performs aggregation processing linking the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the other company's information processing device by adding noise; a result anomaly detection unit that detects anomalies in the processing results based on values ​​obtained from the processing results before noise is added in the aggregation processing; and a judgment unit that, when an anomaly is detected by the result anomaly detection unit, determines the error processing to be performed based on at least predetermined judgment indicators obtained during the aggregation processing.

5. The information processing apparatus according to claim 4, wherein the result anomaly detection unit detects an anomaly in the processing result based on the statistical value of the processing result before noise is applied.

6. The information processing apparatus according to claim 4, wherein the result anomaly detection unit detects an anomaly in the processing result based on a detection processing result obtained by adding a first noise for the purpose of anomaly detection to the processing result before noise addition or the statistical value of the processing result.

7. The information processing apparatus according to claim 6, wherein if the determination unit does not detect an anomaly in the processing result based on the detection processing result by the result anomaly detection unit, it performs a process to reapply a second noise for the purpose of concealment processing and outputs the processing result after said processing.

8. The information processing apparatus according to claim 4, wherein the determination unit determines the error processing based on the recovery processing status related to the recovery processing from an abnormality in the processing result, in addition to the determination indicator.

9. An information processing method comprising: a step of an information processing device performing an aggregation process that links the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the other company's information processing device by adding noise; a step of the information processing device detecting an error that occurred in the aggregation process; and a step of the information processing device determining, if an error is detected, what error processing should be performed based on at least predetermined judgment indicators obtained during the aggregation process.

10. An information processing method comprising: a step of an information processing device performing an aggregation process that links the company's data and the other company's data without mutual disclosure of the company's data and the other company's data with the other company's information processing device by adding noise; a step of the information processing device detecting an anomaly in the processing result based on a value obtained from the processing result before adding noise in the aggregation process; and a step of the information processing device determining, if the anomaly is detected, an error processing to be performed based on at least a predetermined judgment indicator obtained during the aggregation process.

Images