Information linkage device and information linkage method

Abstract

According to the present disclosure, it is possible to provide an information linkage device capable of easily acquiring highly accurate statistical information including a number related to a user who is the user of a movable body and who has not moved to a visiting place by the movable body. An information linkage device 1 according to the present disclosure comprises a movable body information processing device 20 and a terminal information processing device 40 that execute de-identification processing on first movable body information to generate second movable body information, and execute de-identification processing on first terminal information to generate second terminal information. At least one of the movable body information processing device 20 and the terminal information processing device 40 includes a first analysis unit 24 that acquires the second movable body information and the second terminal information and compares the second movable body information and the second terminal information against each other, and then, on the basis of information that the identifier of the user of a vehicle 3 matches the identifier of the user of a terminal 5, generates statistical information including an aggregated number of users U2 who are capable of driving the vehicle 3 and who have not moved to a visiting place V by the vehicle 3.

Description

Information sharing device and information sharing method

[0001] One aspect of the present disclosure relates to an information sharing device and an information sharing method.

[0002] Conventionally, a technique for acquiring information indicating the tendency of visit locations by vehicle type has been disclosed. For example, Patent Document 1 discloses an information processing apparatus that acquires first information including vehicle information and location information regarding the visit location of a vehicle, and executes acquiring tendency information indicating the tendency of the visit locations of vehicles classified by vehicle type based on the vehicle information.

[0003] Japanese Unexamined Patent Application Publication No. 2021-163430

[0004] By the way, depending on the visit location of a user such as a store or a facility, for example, based on the number of users who visited by means other than a specific moving body, a maintenance plan for improving the convenience of users of the specific moving body or other moving bodies may be established. Thus, there is a need to acquire statistical information such as the number of users who are users of a moving body and did not move to the visit location using the moving body.

[0005] Therefore, an object of the present disclosure is to provide an information sharing device and an information sharing method that can easily acquire accurate statistical information including the number of users who are users of a moving body and did not move to the visit location using the moving body.

[0006] The information sharing device disclosed herein includes a mobile information processing device that acquires first mobile information including data of multiple combinations of the location visited by a user using a mobile device and the identifier of the user of the mobile device, and a terminal information processing device that acquires first terminal information including data of multiple combinations of the location visited by a terminal and the identifier of the user of the terminal. The mobile information processing device and the terminal information processing device each perform an anonymization process on the first mobile information to generate second mobile information, and each perform an anonymization process on the first terminal information to generate second terminal information. At least one of the mobile information processing device and the terminal information processing device acquires the second mobile information and the second terminal information, matches the second mobile information and the second terminal information, and has an analysis unit that generates statistical information including the number of users of terminals that are able to use a mobile device, have moved to a location, and have not moved to a location using a mobile device, based on information where the identifier of the user of the mobile device that has undergone an anonymization process matches the identifier of the user of the terminal that has undergone an anonymization process.

[0007] According to one aspect of this disclosure, accurate statistical information can be easily obtained, including the number of users who use a mobile device but did not use that device to travel to a destination.

[0008] Figure 1 is a diagram illustrating the outline of the information sharing method in this embodiment. Figure 2 is a functional block diagram showing the configuration of an information sharing device according to one embodiment of the present disclosure. Figure 3(a) is a diagram showing an example of first mobile information. Figure 3(b) is a diagram showing an example of first terminal information. Figure 4(a) is a diagram showing an example of mobile intermediate information. Figure 3(b) is a diagram showing an example of terminal intermediate information. Figure 5(a) is a diagram showing an example of second mobile information. Figure 5(b) is a diagram showing an example of second terminal information. Figures 6(a), 6(b), and 6(c) are diagrams showing examples of statistical information generated by the analysis unit. Figure 7 is a diagram showing an example of statistical information generated by the decoding process of the analysis unit. Figure 8 is a sequence diagram showing an example of processing included in the information sharing method according to this embodiment. Figure 9(a) is an example of second terminal information generated by the analysis unit according to a modified example. Figure 9(b) is an example of statistical information generated by the analysis unit according to a modified example. Figure 10(a) is a diagram showing an example of first mobile information according to a modified example. Figure 10(b) shows an example of first terminal information relating to a modified example. Figure 11(a) shows an example of statistical information relating to a modified example. Figure 11(b) shows an example of statistical information relating to a modified example. Figure 12 shows an example of the hardware configuration of an apparatus according to one embodiment of the present disclosure.

[0009] Embodiments of this disclosure will be described with reference to the attached drawings. Where possible, the same parts will be denoted by the same reference numerals, and redundant descriptions will be omitted.

[0010] Figure 1 is a diagram illustrating the overview of the information sharing method in this embodiment. As shown in Figure 1, the information sharing device 1 is a system that generates statistical information regarding the movement of users U1, U2, and U3 who move from base locations B1, B2, and B3 to predetermined destination locations V using a mobile device. The vehicle 3 shown in Figure 1 is an example of a mobile device. "Using a mobile device" includes "driving the vehicle 3 (driving and moving)." Examples of other mobile devices will be described later. The information sharing device 1 generates statistical information based on information regarding the destination locations V of the user driving the vehicle 3 and information regarding the destination locations V of the user who owns the terminal 5. The statistical information in this embodiment includes at least one of aggregated information, intermediate aggregated information, and detailed statistical information. Details will be described later.

[0011] Users U1 and U2 are examples of users who are capable of driving vehicle 3 and who own terminal 5. Users U1 and U2 can choose whether or not to use vehicle 3 to travel from base location to destination V. In the example shown in Figure 1, user U1 drives vehicle 3 from base location B1 to destination V, while user U2 travels from base location B2 to destination V without using (driving) vehicle 3. Details of the base location and destination V will be described later. Users U1 and U2 do not have to be owners of vehicle 3; they may be users who are capable of driving vehicle 3 lent to them by another user. In other words, vehicle 3 is a means of transport that users can use at their own discretion. Vehicle 3 includes passenger cars, motorcycles, tricycles, etc., and is not limited to the type of vehicle.

[0012] User U3 is an example of a user who owns terminal 5 and whose vehicle 3 is inoperable. User U3 being inoperable means that user U3 does not own vehicle 3, or that user U3 has not been lent vehicle 3 by another user. User U3 travels from base location B3 to destination V without using vehicle 3. Traveling without using vehicle 3 includes traveling using means of transportation other than the user's owned vehicle 3, or traveling without using means of transportation. Traveling without using vehicle 3 includes traveling on foot, by bus, train, taxi, etc. Note that users U1, U2, and U3 may each be one or more.

[0013] Each of the reference areas B1, B2, and B3 is an area that serves as a starting point for movement for each of the users U1, U2, and U3. Each of the reference areas B1, B2, and B3 is an area having a predetermined size. Each of the reference areas B1, B2, and B3 is an area from which users U1, U2, and U3 can start using a mobile vehicle. Each of the reference areas B1, B2, and B3 includes the place where users U1, U2, and U3 reside or stay. Each of the reference areas B1, B2, and B3 may include a boarding / alighting area accessible from the place where users U1, U2, and U3 reside or stay, and where a predetermined mobile vehicle can be used. In the example of this embodiment, each of the reference areas B1, B2, and B3 includes a parking lot accessible on foot or by bicycle from the place where users U1, U2, and U3 reside or stay, and where vehicle 3 can be used. Each of the reference areas B1, B2, and B3 is an area that has a building from which users U1, U2, and U3 can reside or stay. "Stay" includes remaining within a specified area for a specified period of time or longer. Each of the reference areas B1 and B2 is an area with a parking space where users U1 and U2 can park their vehicles 3. In the example shown in Figure 1, each of the reference areas B1, B2, and B3 may include one or more areas.

[0014] A visit location V is an area of ​​a predetermined size that a user can visit. A visit location V may include a boarding / alighting area that is accessible to a mobile vehicle and where a user can use a predetermined mobile vehicle. The size of a visit location V is, for example, the same as that of reference sites B1, B2, and B3. Reference sites B1, B2, B3 and a visit location V each have one or more meshes from a plurality of meshes set at predetermined intervals in the area accessible to the user. The sizes of reference sites B1, B2, B3 and a visit location V may be different. A visit location V may include, for example, a store or facility that a user can use. The number of visit locations V is not limited.

[0015] Vehicle 3 is a mobile object capable of moving from reference points B1 and B2 to destination V. Vehicle 3 includes passenger cars, motorcycles, bicycles, electric vehicles, etc. The type of vehicle 3 is not limited. Vehicle 3 is connected to the mobile object information server 10 so as to be able to communicate with it. The mobile object information server 10 is connected to the mobile object information processing device 20 so as to be able to communicate with it. Vehicle 3 has a configuration that allows it to acquire location information, for example. Vehicle 3 transmits first mobile object information to the mobile object information server 10, which includes a user ID that is an identifier of the user driving Vehicle 3, the acquired location information, and the time when the location information was acquired.

[0016] The user ID for vehicle 3 is information that uniquely identifies a user who is able to drive (own) vehicle 3. The user ID for vehicle 3 includes, for example, at least one of the following: name, address, date of birth, telephone number, email address, and combinations thereof. The first mobile information may further include first mobile attribute information (an example of attribute information) that indicates attributes of the user of vehicle 3. The first mobile attribute information is information that can identify a user who is able to drive (own) vehicle 3. The first mobile attribute information includes information that represents characteristics of the user who owns vehicle 3, such as gender and age. The first mobile attribute information may also include information about the user ID for vehicle 3.

[0017] The location information acquired by vehicle 3 may be information acquired by GPS (Global Positioning System). The location information of vehicle 3 may be, for example, a mesh code representing one mesh among a user-movable area divided by multiple meshes (grids). The location information of vehicle 3 may also be coordinates expressed in latitude and longitude. The first mobile information includes data of multiple combinations of location information of places visited by the user driving vehicle 3 and user ID (an example of an identifier for the user of vehicle 3). The first mobile information includes location information acquired by vehicle 3, including location information of reference sites B1, B2, and B3, and location information of the location of vehicle 3 as described later.

[0018] Terminal 5 is, for example, a device such as a personal computer, smartphone, tablet, feature phone, server device, or game console. Terminal 5 is, for example, a device used by a user who intends to use an application. In this embodiment, terminal 5 is, for example, a smartphone. Although only one terminal per user is shown in Figure 1, each user in the information sharing device 1 may own two or more terminals 5 of any number. At least one of users U1, U2, and U3 does not have to be the owner of terminal 5, and may be a user who can operate terminal 5 lent to them by another user. Terminal 5 is an item that a user carries (possesses) when moving.

[0019] Terminal 5 is connected to the terminal information server 30 in a communication-enabled manner. Terminal 5 is connected to the terminal information server 30 in a communication-enabled manner. The terminal information server 30 is connected to the terminal information processing device 40 in a communication-enabled manner. The terminal information server 30 may be, for example, a server located at a base station that manages the communication of terminal 5. The terminal information server 30 manages first terminal information as location information (an example of location information) related to terminal 5. The first terminal information includes, for example, information indicating which area terminal 5 is located in. The first terminal information includes, for example, a user ID which is an identifier of the user who owns terminal 5, acquired location information, and the time when the location information was acquired.

[0020] The user ID for terminal 5 is information that uniquely identifies the user who owns terminal 5. The user ID for terminal 5 includes, for example, name, address, date of birth, telephone number, email address, and at least one combination thereof. The user ID for terminal 5 includes information corresponding to the user ID for vehicle 3. For example, the user ID for terminal 5 is information of the same format (type) as the user ID for vehicle 3. Hereinafter, the user ID for vehicle 3 and the user ID for terminal 5 will simply be referred to as "user ID". The first terminal information may include first terminal attribute information (an example of attribute information) that indicates the attributes of the user of terminal 5. The first terminal attribute information is information that uniquely identifies the user who owns (uses) terminal 5. The first terminal attribute information includes information that indicates the characteristics of the user who owns terminal 5, such as gender and age. The first terminal attribute information may also include information on the user ID for terminal 5.

[0021] The location information of terminal 5 may be information included in the area location information acquired by the terminal information server 30 (base station). Terminal 5 may have a configuration that allows it to acquire location information, for example. In this case, the location information of terminal 5 may be information acquired by GPS. Terminal 5 may transmit the first terminal information to the terminal information server 30. The location information of terminal 5 may be, for example, a mesh code representing one mesh in an area that the user can move through, which is divided into multiple meshes (cells). The location information of terminal 5 may also be coordinates expressed in latitude and longitude. For example, the location information of vehicle 3 and the location information of terminal 5 have the same resolution and are unified. The first terminal information includes data of multiple combinations of location information of places visited by the user who owns (uses) terminal 5 and user ID (an example of an identifier for the user of terminal 5).

[0022] In the information sharing device 1 of this embodiment, users U1, U2, and U3 each move from reference locations B1, B2, and B3 to the destination location V while possessing the terminal 5.

[0023] Figure 2 is a functional block diagram showing the configuration of an information sharing device according to one embodiment of the present disclosure. The information sharing device 1 includes a mobile information processing device 20 and a terminal information processing device 40 configured to communicate with each other via a network NW including a wireless communication network and a fixed communication network. The information sharing device 1 may also include a vehicle 3, a terminal 5, a mobile information server 10, and a terminal information server 30.

[0024] The mobile information processing device 20 and the terminal information processing device 40 perform deidentification and encryption processing on the first mobile information to generate second mobile information. The mobile information processing device 20 and the terminal information processing device 40 perform deidentification and encryption processing on the first terminal information to generate second terminal information. At least one of the mobile information processing device 20 and the terminal information processing device 40 constitutes a device for generating statistical information. The statistical information includes the number of users for the vehicle 3 and the terminal 5.

[0025] The mobile information processing device 20 is connected to the mobile information server 10 in a communicative manner. The mobile information processing device 20 includes a first acquisition unit 21, a first identification unit 22, a first generation unit 23, and a first output unit 25. In this embodiment, the mobile information processing device 20 also includes a first analysis unit 24. The first acquisition unit 21 acquires first mobile information from the mobile information server 10. The first acquisition unit 21 acquires terminal intermediate information and second mobile information, described later, from the terminal information processing device 40.

[0026] The first identification unit 22 identifies the location of the user's vehicle 3 based on the location information of the vehicle 3 included in the first mobile information acquired by the first acquisition unit 21. This location includes, for example, a destination V and reference points B1 and B2. When user U1 is driving the vehicle 3, user U1 can move to, for example, a destination V that is far from reference point B1. Therefore, the first identification unit 22 can identify the user's destination V by identifying the location of the vehicle 3 other than reference point B1.

[0027] The destinations visited by a user driving vehicle 3, as identified by the first identification unit 22, include the location of user U1's vehicle 3, which is located at a predetermined distance or more from the reference point B1 of user U1's vehicle 3 and where the user has stayed for a predetermined time or longer. The destinations visited by a user driving vehicle 3, as identified by the first identification unit 22, include the location of user U1's vehicle 3, which is located at a predetermined distance or more from the reference point B1 of user U1's vehicle 3 and where the user has stayed for a predetermined time or longer. The "predetermined distance" mentioned above is set in advance to be greater than, for example, the distance from user U1's reference point B1 to an area outside of the reference point B1. The "determined distance" mentioned above refers to a state in which, for example, the mesh code to which the reference point B1 belongs and the mesh code of the location of vehicle 3 are different. The "stay for a predetermined time or longer" mentioned above includes the vehicle 3 being stopped or parked in an area indicated by the same mesh code for a predetermined time or longer. The "predetermined time" is greater than the minimum time estimated to take for user U1 to visit destination V and take action at destination V. The "predetermined time" may be set for each visited location V. Figure 3(a) shows an example of the first mobile information. The first mobile information shown in Figure 3(a) includes the user ID during the predetermined time period, the location information of the reference site, and the location information of the vehicle 3. Although not shown in Figure 3(a), the first mobile information also includes data, for example, the time when the location information of the vehicle 3's location was acquired or the predetermined time when the location information of the location was acquired. The first identification unit 22 identifies that when the location of the vehicle 3 is in a mesh code different from the mesh code to which the reference site B1 belongs, the user U1 who owns the vehicle 3 has driven the vehicle 3 to the visited location V of that location. The first identification unit 22 modifies the first mobile information to include the user ID and the mesh code corresponding to the visited location for the user ID.If the user IDs in Figure 3(a) corresponding to user U1 are "090-1111-1111", "090-3333-3333", and "090-5555-5555", the mesh code indicated by the location information of the reference site and the mesh code indicated by the location information of the vehicle 3's location are different. Therefore, it is determined that each user U1 with user IDs "090-1111-1111", "090-3333-3333", and "090-5555-5555" has used vehicle 3 to travel to the destination corresponding to the location of vehicle 3.

[0028] Furthermore, the first identification unit 22 identifies the location of the vehicle 3 owned by user U2, who owns the vehicle 3 but does not drive it, based on the location information of the vehicle 3 included in the first mobile information acquired by the first acquisition unit 21. The location of the vehicle 3 owned by a user who does not drive the vehicle 3, as identified by the first identification unit 22, includes a location within a predetermined distance from the reference site B2 of the user (U2)'s vehicle 3. That is, when the vehicle 3 is located at the same location as the reference site B2, the first identification unit 22 identifies that user U2, who owns the vehicle 3, has not driven the vehicle 3 to the destination V (i.e., the vehicle 3 is parked at the reference site B2). The first identification unit 22 generates information indicating that user U2 does not have a destination V.

[0029] The first identification unit 22 may modify the first mobile information to include information with a blank mesh code corresponding to the visited location V for the user ID, and the user ID. If the user IDs in Figure 3(a) corresponding to user U2 are "090-2222-2222" and "090-4444-4444", the mesh code indicated by the location information of the reference site and the mesh code indicated by the location information of the vehicle 3's location are the same, so it is determined that each user U2 with user IDs "090-2222-2222" and "090-4444-4444" has not moved to the visited location V using the vehicle 3. In this case, as shown in Figure 3(a), the first identification unit 22 generates information with a blank mesh code for the visited location, assuming that user U2 does not have a visited location V. The first identification unit 22 may modify the first mobile information to include information with the user ID and the mesh code corresponding to the reference site for the user ID.

[0030] Furthermore, if the first mobile information acquired by the first acquisition unit 21 specifies a visited location V for a user ID, the mobile information processing device 20 does not need to have a first identification unit 22. The visited location V specified by the first identification unit 22 may include a location that is a predetermined distance or more away from the vehicle 3's base location B1 and where the vehicle 3 has stopped driving (engine has been turned off).

[0031] The first generation unit 23 generates mobile intermediate information by performing an anonymization process on the first mobile information. For example, the first generation unit 23 generates mobile intermediate information by performing an irreversible transformation process and an encryption process as an anonymization process on the first mobile information. The mobile intermediate information includes ID intermediate information (related to the mobile) and visited location intermediate information. In detail, the first generation unit 23 performs an irreversible transformation process to convert the first mobile information to a user ID as an irreversible transformation process. The irreversible transformation process includes a hashing process. The first generation unit 23 performs a hashing process using a hash function that has been shared in advance between the mobile information processing device 20 and the terminal information processing device 40.

[0032] The first generation unit 23 assigns a salt (random number) to the user ID and generates an anonymized hash using a one-way function. The first generation unit 23 performs an irreversible transformation process so that the user ID contained in the first mobile information cannot be restored (decoded). After performing the hashing process on the user ID, the first generation unit 23 discards the salt used in the hashing process. Note that the irreversible transformation process is not limited to hashing. Further processes to anonymize the data may be used, such as k-anonymization, l-diversity, t-approximation, etc., or a combination of two or more methods may be used.

[0033] The first generation unit 23 performs encryption processing to protect the privacy of personal information. Specifically, the first generation unit 23 generates anonymized data corresponding to user IDs that satisfy the conditions that personal information that may be included in a user ID must satisfy in order to extract a user ID. For example, as encryption processing, the first generation unit 23 generates ID intermediate information by encrypting the anonymized hash indicating the user ID, which has been hashed by irreversible change processing, using a mobile encryption key. For example, as encryption processing, the first generation unit 23 generates visited location intermediate information by encrypting the mesh code indicating the visited location using a mobile encryption key. Details of the mobile encryption key will be described later. For example, in the encryption processing, the first generation unit 23 uses a mobile encryption key to prevent the restoration (decryption) of the user ID and visited location V included in the first mobile information.

[0034] Here, an example of generating ID intermediate information, which is generated by performing an unidentification process on the user ID in the first generation unit 23, will be explained using Figure 4(a). Figure 4(a) is a diagram showing an example of mobile intermediate information. In an example that includes the telephone number "090-1111-1111" corresponding to the "user ID", hashing is performed using a salt to convert the user ID into a hash value, and then the salt is discarded. As a result, the "user ID" is converted into the hash value "a12f7d91". Furthermore, the hash value corresponding to the user ID is encrypted using the mobile encryption key A for the user ID held by the mobile information processing device 20. As a result, ID intermediate information is generated. Note that ID intermediate information relating to terminal 5, which is generated by performing an encryption process on the user ID relating to terminal 5 as described later, is also generated in the second generation unit 43 using the same method as described above.

[0035] An example of generating intermediate information for a visited location, which is generated by performing encryption processing on the visited location V in the first generation unit 23, will be described. In the example including the mesh code "5339-1234-1" corresponding to "visited location V", the information is encrypted using the mobile encryption key a for visited locations (location information) held by the mobile information processing device 20. This generates the intermediate information for the visited location. The intermediate location information, which will be described later, is also generated in the second generation unit 43 using the same method as described above.

[0036] In this way, the first generation unit 23 generates ID intermediate information, which is deidentified data corresponding to the user ID, by performing irreversible transformation processing and encryption processing. The first generation unit 23 also generates visited location intermediate information, which is encrypted data corresponding to the mesh code of the visited location V, by performing encryption processing. As shown in Figure 4(a), the first generation unit 23 generates mobile body intermediate information by associating the visited location V corresponding to the user ID in the first mobile body information with the ID intermediate information after deidentification processing and the visited location intermediate information after encryption processing. That is, the mobile body intermediate information includes data that combines the ID intermediate information, the visited location intermediate information, and the estimated time when the visited location V corresponding to the visited location intermediate information was visited. Although not shown in Figure 4(a), the same encryption processing as described above may also be performed on the "estimated time when the visited location V was visited". The first generation unit 23 also performs encryption processing on the terminal intermediate information transmitted from the terminal information processing device 40, which will be described later, using the same method as described above. An example of the processing performed by the first generation unit 23 on terminal intermediate information will be described later.

[0037] The first analysis unit 24 acquires the second mobile information and the second terminal information, matches the second mobile information and the second terminal information, and generates aggregated information (an example of statistical information) that includes the number of users U2 who are capable of driving vehicle 3 and are users of terminal 5 who did not travel to destination V in vehicle 3, based on the information where the user identifier of vehicle 3 and the user identifier of terminal 5 match. The first analysis unit 24 also performs a decoding process on the aggregated information to generate aggregated intermediate information (an example of statistical information). Details will be described later.

[0038] The first output unit 25 transmits (outputs) the mobile intermediate information generated by the first generation unit 23 to the terminal information processing device 40. The first output unit 25 may store at least one of the first mobile information and the mobile intermediate information in the storage unit (not shown) of the mobile information processing device 20. The first output unit 25 may also transmit (output) the second terminal information, described later, generated by the first generation unit 23 to the terminal information processing device 40. The first output unit 25 may also store the second terminal information in the storage unit (not shown) of the mobile information processing device 20. The first output unit 25 may also transmit (output) the aggregated intermediate information generated by the first analysis unit 24 to the terminal information processing device 40. The first output unit 25 may also store the aggregated information and the aggregated intermediate information in the storage unit (not shown) of the mobile information processing device 20.

[0039] The terminal information processing device 40 is connected to the terminal information server 30 in a communication manner. The terminal information processing device 40 includes a second acquisition unit 41, a second identification unit 42, a second generation unit 43, and a second output unit 45. In this embodiment, the terminal information processing device 40 also includes a second analysis unit 44.

[0040] The second acquisition unit 41 acquires first terminal information from the terminal information server 30. The second acquisition unit 41 also acquires mobile intermediate information and aggregated intermediate information from the mobile information processing device 20. Note that the second mobile information has undergone deidentification processing, including encryption processing using the mobile encryption keys A and a possessed by the mobile information processing device 20. Therefore, the terminal information processing device 40, which does not possess the mobile encryption keys A and a, cannot acquire user ID and attribute information regarding the user who owns the vehicle 3.

[0041] The second identification unit 42 identifies the visited locations of each user U1, U2, and U3 based on the location information of the terminal 5 included in the first terminal information acquired by the second acquisition unit 41. In this embodiment, a method for identifying visited locations in a terminal 5 from which location information can be continuously acquired will be described. The location information and visited locations of each user U1, U2, and U3 identified by the second identification unit 42 include the location of the terminal 5 owned by each user U1, U2, and U3 within a predetermined time range. The predetermined time range is a time interval set in advance by the administrator of the terminal information processing device 40, the statistical information analyst, etc. Therefore, the second identification unit 42 uses the average location of the terminal 5 within the predetermined time range as the visited location. That is, even if users U1, U2, and U3 are moving, the second identification unit 42 may identify the area along the path they are traveling in as a visited location. The second identification unit 42 may also identify reference locations B1, B2, and B3 as places to visit, even if users U1, U2, and U3 are staying at reference locations B1, B2, and B3.

[0042] The second identification unit 42 may include the location of terminals 5 that are located at a predetermined distance or more from the reference locations B2 and B3 of each user U2 and U3, and where they have stayed for a predetermined time or longer. The second identification unit 42 may identify the user's visited locations of terminals 5 using the same method as the first identification unit 22 of the mobile information processing device 20. However, if the first terminal information acquired by the second acquisition unit 41 identifies the visited location V for the user ID, the terminal information processing device 40 does not need to have the second identification unit 42. In other words, since the mobile information matched with the terminal information identifies the user's visited location, the second identification unit 42 in the terminal information processing device 40 does not need to identify the user's visited location.

[0043] Figure 3(b) is a diagram showing an example of the first terminal information. The first terminal information shown in Figure 3(b) includes the user ID in a predetermined time period and the position information of terminal 5. Although not shown in Figure 3(b), the first terminal information includes, for example, data related to the time when the position information of terminal 5 is acquired or a predetermined time when the position information is acquired. The first terminal information may include the position information of the reference location, like the first moving body information shown in Figure 3(a). In this case, the second specifying unit 42 may specify the position information of the visiting location of the user of terminal 5 by the same method as the first specifying unit 22.

[0044] The second generating unit 43 executes anonymization processing on the first terminal information to generate terminal intermediate information. The second generating unit 43, for example, executes irreversible conversion processing and encryption processing as anonymization processing on the first terminal information to generate terminal intermediate information. The terminal intermediate information includes ID intermediate information and position intermediate information (related to the terminal). The second generating unit 43 executes irreversible conversion processing to the user ID as irreversible conversion processing. The second generating unit 43 executes hashing processing using a hash function shared in advance between the moving body information processing device 20 and the terminal information processing device 40.

[0045] The second generating unit 43, for example, as encryption processing, generates terminal intermediate information by encrypting the anonymized hash indicating the user ID on which hashing processing has been completed by irreversible conversion processing using a terminal encryption key. Details of the terminal encryption key will be described later. The second generating unit 43 generates, as terminal intermediate information, data of a combination of ID intermediate information, position intermediate information, and the time estimated to have acquired the position information corresponding to the position intermediate information.

[0046] Figure 4(b) is a diagram showing an example of terminal intermediate information. As shown in Figure 4(b), in an example including the phone number "090-1111-1111" corresponding to the user ID, a hashing process is executed using a salt to convert the user ID into a hash value, and then the salt is discarded. As a result, the "user ID" is converted into the hash value "a12f7d91". Further, the hash value corresponding to the user ID is encrypted by the terminal encryption key B for the user ID held by the terminal information processing device 40. Thereby, ID intermediate information is generated.

[0047] Also, in an example including the mesh code "5339-1234-1" corresponding to the "location information", it is encrypted by the terminal encryption key b for the visited location (location information) held by the terminal information processing device 40. Thereby, location intermediate information is generated. Thus, similar to the first generation unit 23, the second generation unit 43 can execute an irreversible conversion process and an encryption process for the user ID and an encryption process for the location information. Note that the same anonymization process as described above may also be executed for the "time estimated to have obtained the location information corresponding to the location intermediate information".

[0048] Also, the first generation unit 23 executes an encryption process on the mobile body intermediate information transmitted from the terminal information processing device 40 in the same manner as described above. An example of the processing of the second generation unit 43 for the mobile body intermediate information will be described later. The above description using the "first mobile body information", "second mobile body information", "first mobile body attribute information", "second mobile body attribute information", "visited location conversion information", "mobile body information processing device 20", and "first generation unit 23" in the anonymization process may be read as an explanation in the terminal information processing device 40 by replacing them with the "first terminal information", "second terminal information", "first terminal attribute information", "second terminal attribute information", "location conversion information", "terminal information processing device 40", and "second generation unit 43", respectively.

[0049] The second output unit 45 transmits (outputs) the terminal intermediate information generated by the second generation unit 43 to the mobile information processing device 20. The second output unit 45 may store at least one of the first terminal information and the terminal intermediate information in the storage unit (not shown) of the terminal information processing device 40. The second output unit 45 may also transmit (output) the second mobile information, described later, generated by the second generation unit 43 to the mobile information processing device 20. The second output unit 45 may also store the second mobile information in the storage unit (not shown) of the terminal information processing device 40.

[0050] Here, the details of the encryption keys will be explained again with reference to Figures 4(a), 4(b), 5(a), and 5(b). Figure 5(a) is a diagram showing an example of second mobile information generated by the terminal information processing device. Figure 5(b) is a diagram showing an example of second terminal information generated by the mobile information processing device. The first generation unit 23 and the second generation unit 43 are functional units that, in cooperation with the mobile information processing device 20 and the terminal information processing device 40 as follows, generate double-encrypted anonymized data after double encryption using the mobile encryption keys A,a (self-encryption keys) held by the mobile information processing device 20 and the terminal encryption keys B,b (other-party encryption keys) held by the terminal information processing device 40. Specifically, the first generation unit 23 performs an irreversible transformation process on the user ID of the first mobile information acquired by the first acquisition unit 21 of the mobile information processing device 20, and performs a first encryption process based on the mobile encryption keys A and a of the mobile information processing device 20 and keyed one-way commutative operations on each of the user ID and the visited location of the first mobile information after the irreversible transformation process has been performed, thereby generating mobile intermediate information (see Figure 4(a)). The second generation unit 43 performs an irreversible transformation process on the user ID of the first terminal information acquired by the second acquisition unit 41 of the terminal information processing device 40, and performs a first encryption process based on the terminal encryption keys B and b of the terminal information processing device 40 and keyed one-way commutative operations on each of the user ID and the location information of the first terminal information after the irreversible transformation process has been performed, thereby generating terminal intermediate information (see Figure 4(b)).

[0051] The second generation unit 43 performs a second encryption process on the mobile intermediate information transmitted from the first generation unit 23 (first output unit 25) based on the terminal encryption keys B and b of the terminal information processing device 40 and keyed one-way commutative operations, thereby generating second mobile information. For example, the second generation unit 43 encrypts the hash value "a12f7d91", which corresponds to the user ID included in the mobile intermediate information and is encrypted with the mobile encryption key A, using the terminal encryption key B for the user ID. For example, the second generation unit 43 encrypts the "visited location", which is encrypted with the mobile encryption key a, using the terminal encryption key b for the visited location (location information). As a result, the second generation unit 43 generates second mobile information including the converted user ID, which is the hash value of the user ID encrypted with the encryption keys A and B for the user ID, and the visited location conversion information, which is the mesh code of the visited location encrypted with the encryption key for the visited location (location information) (see Figure 5(a)). The first generation unit 23 performs a second encryption process on the terminal intermediate information transmitted from the second generation unit 43 (second output unit 45) based on the mobile encryption keys A and a of the mobile information processing device 20 and keyed one-way commutative operations, thereby generating second terminal information. The first generation unit 23 generates second terminal information by encrypting the terminal intermediate information as described by the second generation unit 43 above. That is, the first generation unit 23 may perform a process in which the terms "mobile intermediate information," "visited location conversion information," "mobile encryption key A," "mobile encryption key a," "terminal encryption key B," and "terminal encryption key b" in the second encryption process of the second generation unit 43 described above are replaced with the terms "terminal intermediate information," "location conversion information," "terminal encryption key B," "terminal encryption key b," "mobile encryption key A," and "mobile encryption key a" respectively (see Figure 5(b)).

[0052] In this way, the first mobile entity information and the first terminal information are encrypted with their own encryption keys, and mobile entity intermediate information and terminal intermediate information are generated. The mobile entity intermediate information and terminal intermediate information are exchanged between the mobile entity information processing device 20 and the terminal information processing device 40, and the mobile entity intermediate information and terminal intermediate information are encrypted with the other party's encryption key, and second mobile entity information and second terminal information are generated. That is, the second mobile entity information and second terminal information are double-encrypted anonymized data.

[0053] Furthermore, the encryption processing of the anonymized data by the first generation unit 23 and the second generation unit 43 is performed separately for the "part corresponding to the user ID," the "part corresponding to personal information (attribute information)," and the "part corresponding to the visited location (location information)" in the anonymized data. In this embodiment, as described above, the mobile encryption key A and terminal encryption key B, which are encryption keys for the user ID, are used for the "part corresponding to the user ID," and the mobile encryption key a and terminal encryption key b for the visited location are used for the "part corresponding to personal information (attribute information)" and the "place visited location (location information)." Different encryption keys are used for mobile encryption key A and mobile encryption key a, and different encryption keys are used for terminal encryption key B and terminal encryption key b.

[0054] In the encryption described above, the de-identified data (mobile intermediate information and terminal intermediate information) exchanged between the mobile information processing device 20 and the terminal information processing device 40 after the first encryption is encrypted based on the other party's encryption key, which is not revealed to the device itself. Therefore, the device itself (for example, the mobile information processing device 20) cannot decrypt the de-identified data (the terminal intermediate information exchanged between the two parties) and cannot recognize the contents of the de-identified data (terminal intermediate information, etc.). Similarly, the other party's device (for example, the terminal information processing device 40) cannot decrypt the de-identified data (mobile intermediate information exchanged between the two parties) obtained through the exchange after the first encryption and cannot recognize the contents of the de-identified data (mobile intermediate information, etc.).

[0055] Thus, the first generation unit 23 and the second generation unit 43 can generate double-encrypted data using a self-encryption key and a counterparty encryption key without disclosing to the terminal information processing device 40 either the personal information in the unencrypted first mobile information held by the mobile information processing device 20 or the self-encryption key. Furthermore, for information that can identify an individual, such as a user ID, double-encrypted deidentified data can be generated. In addition, the first generation unit 23 and the second generation unit 43 can generate double-encrypted data and double-encrypted deidentified data using a self-encryption key and a counterparty encryption key without disclosing to the mobile information processing device 20 either the personal information in the unencrypted first terminal information held by the terminal information processing device 40 or the self-encryption key.

[0056] Furthermore, since both encryption processes are based on keyed, one-way, commutative arithmetic, it is possible to determine whether the two double-encrypted deidentified data sets generated in the mobile information processing device 20 and the terminal information processing device 40 correspond to the user data of the same user based on the matching or mismatch of the bit sequences of the user ID (user ID) corresponding portion, which is identified based on the structural information of the user data shared in advance between the mobile information processing device 20 and the terminal information processing device 40. Although the first generation unit 23 and the second generation unit 43 have been described as sending and receiving deidentified data, the first output unit 25 and the second output unit 45 may also send and receive deidentified data. In addition, the generation unit (first generation unit 23 in this embodiment) in a device (mobile information processing device 20 in this embodiment) equipped with a first analysis unit 24 that generates aggregated information and intermediate aggregated information does not need to transmit the second terminal information to a device (terminal information processing device 40 in this embodiment) that is not equipped with a first analysis unit 24. This reduces the amount of data transmitted and received.

[0057] The second analysis unit 44 generates detailed statistical information (an example of statistical information) based on the aggregated intermediate information generated by the first analysis unit 24. The second analysis unit 44 performs a decoding process on the aggregated intermediate information to generate detailed statistical information. The details of the functions of the first analysis unit 24 and the second analysis unit 44, as well as the details of the aggregated information, aggregated intermediate information, and detailed statistical information, will be described below.

[0058] The first analysis unit 24 matches the user ID of the second mobile information and the user ID of the second terminal information, which are deidentified data that have undergone irreversible change processing and encryption processing, respectively. For example, the first analysis unit 24 generates aggregated information that includes at least one of the first number of users, the second number of users, and the third number of users, as described later. The aggregated information includes the number of users corresponding to each mesh code (visited location conversion information) in a state where the mesh code is encrypted with the mobile encryption key a and the terminal encryption key b. For example, the first analysis unit 24 generates aggregated intermediate information by decrypting the aggregated information. The aggregated intermediate information includes the number of users corresponding to each mesh code (decrypted location information) in a state where the mesh code is encrypted with the terminal encryption key b. For example, the second analysis unit 44 generates statistical detailed information based on the aggregated intermediate information. The statistical detailed information includes the number of users corresponding to each mesh code (visited location V) in a state where the mesh code is not encrypted.

[0059] "The user ID for vehicle 3 and the user ID for terminal 5 match" means that the converted user ID of the second mobile information and the converted user ID of the second terminal information contain the same type of information. For example, if each of the converted user IDs contains information in which the telephone number has been de-identified, it means that all the characters and numbers match. For example, if each of the second mobile attribute information and the second terminal attribute information contains information in which the name and date of birth have been de-identified, it means that all the strings match.

[0060] Here, since the encryption of the user ID is performed on user IDs that have undergone the same hashing process using the mobile encryption key a and terminal encryption key b for the user ID, identical user IDs will result in user IDs (converted user IDs) that have undergone the same deidentification process, and thus the converted user IDs can be matched. The first analysis unit 24 matches the second mobile information and the second terminal information to extract information in which the user ID related to the vehicle 3 and the user ID related to the terminal 5 match, and extracts the visited location V indicated by the second mobile information and the visited location V (location information) indicated by the second terminal information.

[0061] The first analysis unit 24 determines, for example, that if the converted user ID in the second mobile information corresponding to a certain visited location V during a certain time period matches the converted user ID in the second terminal information corresponding to that visited location V during the same time period, it determines, based on the second mobile information and the second terminal information, that there is a user U1 who traveled to the visited location V by driving vehicle 3. The first analysis unit 24 aggregates the number of combinations in which the converted user ID in the second mobile information corresponding to a certain visited location V matches the converted user ID in the second terminal information corresponding to that visited location V, as the first number of users U1 who drive vehicle 3 and visit the visited location V while having a terminal 5.

[0062] For example, if the first analysis unit 24 detects a converted user ID in the second mobile information for a certain time period and a converted user ID in the second terminal information, and the visited location V corresponding to the converted user ID in the second mobile information does not match the visited location V corresponding to the converted user ID in the second terminal information, it determines, based on the second mobile information and the second terminal information, that there is a user U2 who traveled to the visited location V without driving the vehicle 3. For example, the first analysis unit 24 counts the number of combinations in which the converted user ID in the second terminal information corresponding to a certain visited location V matches the converted user ID in the second mobile information corresponding to a reference location B2 that is not the visited location V, as the number of second users related to user U2 who visits the visited location V without driving the vehicle 3 and while possessing a terminal 5. For example, the first analysis unit 24 may aggregate the number of combinations in which the converted user ID in the second terminal information corresponding to a certain visit location V matches the converted user ID in the second mobile information corresponding to a blank space, as the second number of users U2 who visit visit location V without driving the vehicle 3 and while possessing the terminal 5. In other words, the second number of users is the aggregated number of users of terminal 5 who are capable of driving the vehicle 3 and who did not travel to visit location V in the vehicle 3.

[0063] For example, if the converted user ID in the second terminal information does not correspond to the converted user ID in the second mobile information, but there is a converted user ID in the second terminal information corresponding to a certain visited location V during a certain time period, the first analysis unit 24 determines, based on the second mobile information and the second terminal information, that there is a user U3 who traveled to the visited location V without owning a vehicle 3. The first analysis unit 24 aggregates the converted user ID in the second terminal information that does not match the converted user ID in the second mobile information and corresponds to a certain visited location V as the third number of users related to user U3 who does not own a vehicle 3, does not drive a vehicle 3, and has a terminal 5 with them.

[0064] Referring to Figure 6, a specific example of aggregated information generated by the first analysis unit 24 will be explained. Figure 6 is a diagram showing an example of statistical information generated by the analysis unit. Figures 6(a), 6(b), and 6(c) are diagrams showing an example of statistical information (an example of aggregated information) generated by the first analysis unit 24. In the examples shown in Figures 6(a), 6(b), and 6(c), the aggregated information includes, for example, first aggregated information, second aggregated information, and third aggregated information. The first analysis unit 24 may output at least a portion of the third aggregated information as aggregated information.

[0065] The first aggregated information shown in Figure 6(a) includes the first number of users. The first aggregated information is information generated by the second analysis unit 44. The first aggregated information includes, for example, the first number of users for each location conversion information. The first analysis unit 24 aggregates the number of users who are driving vehicle 3 to visit location V in the second mobile information for each location conversion information. That is, the first analysis unit 24 aggregates the number of users who are driving vehicle 3 to visit location V for each encrypted location V. In the second mobile information shown in Figure 5, one user with user ID "a12f7d91" in the second mobile information visited mesh code "5339-1234-1", which is one of the visited locations V, and two users with user IDs "a12f7d93" and "a12f7d95" in the second mobile information visited mesh code "5339-1234-2", which is another of the visited locations V. Based on this information, as shown in Figure 6, the first analysis unit 24 analyzes that the number of first users for mesh codes "5339-1234-1" and "5339-1234-2" is "1" and "2" in the first aggregated information.

[0066] The second aggregated information shown in Figure 6 includes the number of terminal users, which is the number of users who visit a destination V while possessing terminal 5. The second aggregated information is information generated by the first analysis unit 24. The second aggregated information includes, for example, the number of terminal users for each destination conversion information. In the second terminal information, the first analysis unit 24 aggregates the number of users who visit a destination V while possessing terminal 5 for each destination conversion information. That is, the first analysis unit 24 aggregates the number of users who visit a destination V while possessing terminal 5 for each encrypted destination V. In the second terminal information shown in Figure 5, six users, whose user IDs in the second terminal information correspond to "a12f7d91", "a12f7d92", "a12f7d94", "a12f7d96", "a12f7d97", and "a12f7d98", visited mesh code "5339-1234-1", which is one of the visited locations V. Three users, whose user IDs in the second terminal information correspond to "a12f7d93", "a12f7d95", and "a12f7d99", visited mesh code "5339-1234-2", which is one of the visited locations V. Based on this information, as shown in Figure 6, the first analysis unit 24 analyzes that the number of terminal users for "5339-1234-1" and "5339-1234-2" corresponding to the mesh codes in the second aggregated information is "6" and "3".

[0067] The first analysis unit 24 identifies users who are not driving vehicle 3 during a predetermined time period in the second mobile information. Based on the second mobile information shown in Figure 5, the first analysis unit 24 identifies users whose user IDs in the second mobile information correspond to "a12f7d92" and "a12f7d94" as users who are not driving vehicle 3. The first analysis unit 24 then aggregates the number of users who are not driving vehicle 3 for each visited location V visited by the user in the second mobile information.

[0068] The first analysis unit 24 identifies that, among "a12f7d92" and "a12f7d94," who were identified in the second terminal information as users not driving vehicle 3, two users corresponding to "a12f7d92" and "a12f7d94" visited mesh code "5339-1234-1," which is one of the encrypted visited locations V in the visited location conversion information, and aggregates the number of people who visited visited location V, "2," as the second number of users for visited location V. The first analysis unit 24 identifies that, among "a12f7d92" and "a12f7d94," who were identified in the second terminal information as users not driving vehicle 3, zero users visited mesh code "5339-1234-2," which is one of the encrypted visited locations V in the visited location conversion information, and aggregates the number of people who visited visited location V, "0," as the second number of users for visited location V.

[0069] The first analysis unit 24 calculates the number of third users based on the number of first users, the number of second users, and the number of terminal users. The first analysis unit 24 calculates the number of third users for each mesh code of the visited location V corresponding to the visited location conversion information. The second mobile information does not show the number of users who do not own a vehicle 3. Therefore, the first analysis unit 24 calculates the number of third users by subtracting the sum of the number of first users and the number of second users from the number of terminal users.

[0070] The first analysis unit 24 calculates the number of third users for mesh code "5339-1234-1", which is one of the encrypted visited locations V in the visited location conversion information, as 3 by subtracting the total of 3 users (1 first user and 2 second users) from the total of 6 terminal users. The second analysis unit 44 calculates the number of third users for mesh code "5339-1234-2", which is one of the encrypted visited locations V in the visited location conversion information, as 1 by subtracting the total of 2 users (2 first users and 0 second users) from the total of 3 terminal users.

[0071] As shown in Figure 6, the first aggregated information, the second aggregated information, and the third aggregated information each include the visited location conversion information and the number aggregated for each of the visited location conversion information. In this way, the first analysis unit 24 generates statistical information that does not include hashed data, such as the number of people for each mesh code of visited location V corresponding to the visited location conversion information. In Figures 5 and 6, an example was shown in which the first analysis unit 24 generated statistical information for a certain period of time, but the first analysis unit 24 may also generate statistical information by aggregating the number of data for each mesh code of visited location V over a predetermined period such as one day, one week, one month, or one year.

[0072] The method for generating aggregated information, intermediate aggregated information, and detailed statistical information will be explained with reference to Figure 7. Figure 7 is a diagram showing an example of statistical information generated by the decryption process of the analysis unit. The first analysis unit 24 generates intermediate aggregated information by decrypting the aggregated information. The mobile information processing device 20 possesses a mobile encryption key a, which is its own encryption key, and can generate a decryption key for said encryption key a. The first analysis unit 24 generates decrypted location information in a state encrypted by the terminal encryption key b by performing a decryption process on the visited location conversion information encrypted by the mobile encryption key a and the terminal encryption key b using the decryption key. In Figure 7, the decrypted intermediate aggregated information is shown for the third aggregated information, which is an example of aggregated information.

[0073] Furthermore, the first analysis unit 24 may perform a concealment process that adds noise to the aggregated information or intermediate aggregated information based on differential privacy as a concealment process. For example, before outputting the intermediate aggregated information to the terminal information processing device 40, the first analysis unit 24 may perform a concealment process that adds noise encrypted with a public key or the like to the first user count, second user count, and third user count of the aggregated information or intermediate aggregated information. The aggregated information and intermediate aggregated information on which the concealment process has been performed is an example of analysis information.

[0074] The first output unit 25 outputs the aggregated intermediate information to the terminal information processing device 40. The second acquisition unit 41 acquires the aggregated intermediate information. The second analysis unit 44 generates detailed statistical information by decrypting the aggregated intermediate information. Since the terminal information processing device 40 possesses the terminal encryption key b, which is its own encryption key, it can generate a decryption key for the encryption key b. The second analysis unit 44 generates unencrypted visited locations (location information) by performing a decryption process on the decrypted location information encrypted with the terminal encryption key b using the decryption key. Figure 7 shows a third statistical information, which is an example of detailed statistical information obtained by decrypting the aggregated intermediate information. The detailed statistical information may include at least one of the first statistical information obtained by decrypting the first aggregate information, the second statistical information obtained by decrypting the second aggregate information, and the third statistical information obtained by decrypting the third aggregate information.

[0075] The second analysis unit 44 may generate analysis information including information about the vehicle 3 at the visited location V based on detailed statistical information (an example of statistical information). The second analysis unit 44 determines, for example, whether the difference, which is the value obtained by subtracting the second number of users from the first number of users, is greater than or equal to a predetermined number. If the difference is greater than or equal to a predetermined number, for example, it may occur when many users drive their vehicles to visit the visited location V because they can easily enter the parking lot near the visited location V. If the difference is greater than or equal to a predetermined number, the second analysis unit 44 determines that the visited location V is a place that is easy for users to visit by driving their vehicles 3. Based on this determination result, the second analysis unit 44 may generate analysis information including maintenance information for the visited location V. For example, based on this determination result, the second analysis unit 44 may generate analysis information including maintenance information such as the operation of a shuttle bus in case it is desired to increase the number of users using transportation other than vehicles 3.

[0076] The second analysis unit 44 determines, for example, whether the difference, which is the value obtained by subtracting the number of first data points from the number of second data points, is greater than or equal to a predetermined number. If the difference is greater than or equal to a predetermined number, for example, this may occur when the parking lot near the destination V is frequently crowded and many users avoid the time it takes to enter the parking lot. If the difference is greater than or equal to a predetermined number, the second analysis unit 44 determines that the destination V is a place that is difficult for users to visit by driving vehicle 3. Based on this determination, the second analysis unit 44 may generate analysis information that includes maintenance information, such as increasing the number of parking spaces for vehicle 3, as part of a policy to promote the use of vehicle 3. Based on this determination, the second analysis unit 44 may also generate analysis information that includes maintenance information, such as operating a shuttle bus, to support users who use transportation other than vehicle 3.

[0077] The second analysis unit 44 determines, for example, whether the ratio of the sum of the number of second and third data points to the number of first data points is greater than or equal to a predetermined percentage. If the ratio is greater than or equal to the predetermined percentage, the second analysis unit 44 determines that the destination V is an easily accessible place for young or elderly users who do not own a vehicle 3. Based on this determination, the second analysis unit 44 may generate analysis information including maintenance information for the destination V. For example, based on this determination, the second analysis unit 44 may generate analysis information including maintenance information including changes to the facility's content configuration.

[0078] The first analysis unit 24 and the second analysis unit 44 may perform concealment processing on statistical information to generate concealed analysis information. If the first analysis unit 24 does not perform concealment processing, the second analysis unit 44 may encrypt the statistical details. The second analysis unit 44 may, as concealment processing, add noise to the statistical details based on differential privacy, decrypt them, and obtain the analysis information. Concealment processing includes, for example, concealment processing based on differential privacy. Therefore, it is possible to apply a general concealment processing method such as concealment processing based on differential privacy, without requiring the application of special concealment processing, thereby improving the ease of implementing concealment processing.

[0079] The second output unit 45 outputs at least one of statistical information and analysis information. The second output unit 45 may, for example, output statistical information and then output analysis information or not. The second output unit 45 may display at least one of the statistical information and analysis information on a display device (not shown). The second output unit 45 may store at least one of the first terminal information, second terminal information, statistical information, and analysis information in the storage unit (not shown) of the terminal information processing device 40. The second output unit 45 may output at least one of the statistical information and analysis information to the mobile information processing device 20.

[0080] Next, the information sharing method MT executed by the information sharing device 1 according to this embodiment will be explained using the sequence diagram in Figure 8. Figure 5 is a sequence diagram showing an example of the processing included in the information sharing method according to this embodiment. In the example shown in Figure 5, the information sharing method MT includes steps S11 to S18 processed by the mobile information processing device 20 and steps S21 to S28 processed by the terminal information processing device 40.

[0081] As shown in Figure 8, first, in the mobile information processing device 20, as step S11, the first acquisition unit 21 acquires first mobile information from the mobile information server 10. The first acquisition unit 21 may acquire first mobile information detected within a predetermined time interval. The first acquisition unit 21 may acquire first mobile information detected at predetermined time intervals.

[0082] Next, in step S12 of the mobile information processing device 20, the first identification unit 22 identifies the location of the mobile object owned by the user based on the location information of the vehicle 3 included in the first mobile information acquired by the first acquisition unit 21. For example, the first identification unit 22 identifies the location of the vehicle 3 as either the visited location V or the reference location B2.

[0083] Next, in the mobile information processing device 20, as step S13, the first generation unit 23 generates mobile intermediate information by performing an unidentification process on the first mobile information. In this unidentification process, the first generation unit 23 generates ID intermediate information by performing an unidentification process on the user ID in the first mobile information, which includes an irreversible conversion process and encryption using encryption key A, and generates visited location intermediate information by performing an encryption process on the visited location in the first mobile information, which includes encryption using encryption key a.

[0084] Next, in step S14 of the mobile information processing device 20, the first output unit 25 outputs the mobile intermediate information generated by the first generation unit 23 to the terminal information processing device 40.

[0085] Furthermore, in the terminal information processing device 40, as step S21, the second acquisition unit 41 acquires first terminal information from the terminal information server 30. The second acquisition unit 41 may acquire first terminal information detected within a predetermined time interval. The second acquisition unit 41 may acquire first terminal information detected at predetermined time intervals.

[0086] Next, in the terminal information processing device 40, as step S22, the second identification unit 42 identifies the location of the user who owns the terminal 5 based on the location information of the terminal 5 included in the first terminal information acquired by the second acquisition unit 41.

[0087] Next, in the terminal information processing device 40, as step S23, the second generation unit 43 generates terminal intermediate information by performing an anonymization process on the first terminal information. In this anonymization process, the second generation unit 43 generates ID intermediate information by performing an anonymization process on the user ID in the first terminal information, which includes an irreversible conversion process and encryption using encryption key B, and generates location intermediate information by performing an encryption process on the location information in the first terminal information, which includes encryption using encryption key b.

[0088] Next, in the terminal information processing device 40, as step S24, the second output unit 45 outputs the terminal intermediate information generated by the second generation unit 43 to the mobile information processing device 20. Each of steps S21 to S24 performed in the terminal information processing device 40 can be performed at any time regardless of the timing of each of steps S11 to S24 performed in the mobile information processing device 20.

[0089] After step S24 is performed, in step S15, the mobile information processing device 20, the first acquisition unit 21 acquires terminal intermediate information from the terminal information processing device 40. The first generation unit 23 generates second terminal information by performing encryption processing on the terminal intermediate information generated by the second generation unit 43. In this encryption processing, the first generation unit 23 performs encryption processing with encryption key A on the ID intermediate information within the terminal intermediate information to generate a converted user ID, and performs encryption processing with encryption key a on the location intermediate information within the terminal intermediate information to generate location conversion information.

[0090] After step S14 is performed, in step S25, the terminal information processing device 40, the second acquisition unit 41 acquires mobile intermediate information from the mobile information processing device 20. The second generation unit 43 generates second mobile information by performing encryption processing on the mobile intermediate information generated by the first generation unit 23. In this encryption processing, the second generation unit 43 performs encryption processing with encryption key B on the ID intermediate information within the mobile intermediate information to generate a converted user ID, and performs encryption processing with encryption key a on the visited location intermediate information within the mobile intermediate information to generate visited location converted information.

[0091] After step S25 is performed, in step S26, the terminal information processing device 40 outputs the second mobile information generated by the second generation unit 43 to the mobile information processing device 20.

[0092] After steps S15 and S26 are performed, in step S16, the mobile information processing device 20, the first acquisition unit 21 acquires second mobile information from the terminal information processing device 40. The first analysis unit 24 generates aggregated information based on the second mobile information and the second terminal information. The first analysis unit 24 acquires the second mobile information and the second terminal information, matches the second mobile information and the second terminal information, and generates aggregated information that includes the number of users U2 who are capable of driving vehicle 3 and are users of terminal 5 who did not move to destination V in vehicle 3, based on the information where the user ID for vehicle 3 and the user ID for terminal 5 match. The first analysis unit 24 generates aggregated information that includes, for example, the number of first users, the number of second users and the number of third users. The first analysis unit 24 performs concealment processing on the aggregated information.

[0093] After step S16 is performed, in step S17, the mobile information processing device 20, the first analysis unit 24 performs a decryption process on the mobile encryption key a for the aggregated information encrypted with the mobile encryption key a and the terminal encryption key b, and generates an intermediate aggregated information.

[0094] After step S17 is performed, in step S18, the terminal information processing device 40 outputs the aggregated intermediate information generated by the first analysis unit 24 to the terminal information processing device 40.

[0095] After step S18 is performed, in step S27, the terminal information processing device 40, the second acquisition unit 41 acquires aggregated intermediate information from the mobile information processing device 20. The second analysis unit 44 generates aggregated information based on the aggregated intermediate information. The second analysis unit 44 performs a decryption process on the terminal encryption key b for the aggregated intermediate information which is encrypted with the terminal encryption key b, and generates statistical detailed information. The second analysis unit 44 may also generate analysis information based on the statistical information.

[0096] After step S27 is performed, in step S28, the terminal information processing device 40 outputs statistical information generated by the second analysis unit 44 via the second output unit 45. The second output unit 45 may, for example, display the statistical information on a display device (not shown) or store the statistical information in a storage unit (memory device) (not shown). The information linkage method MT is terminated when the second output unit 45 outputs the statistical information.

[0097] Next, the effects and advantages of the information linkage device 1 and information linkage method according to this embodiment will be described in comparison with the prior art. Conventionally, depending on the location visited by users, such as a store or facility, it is sometimes possible to create a maintenance plan to improve convenience for users who use a predetermined mobile vehicle or other mobile vehicles, based on the number of users who visited by means other than a predetermined mobile vehicle. Thus, there is a need to obtain statistical information such as the number of users who are users of a mobile vehicle but did not travel to the visited location by that mobile vehicle.

[0098] Furthermore, technologies for estimating the mode of transportation based on terminal trajectory data acquired by GPS have been known for some time. However, because it may not be possible to clearly distinguish between users who travel using their own vehicles and users who travel using public transportation such as trains, buses, and taxis, the accuracy of estimating the number of users using vehicles may be low. Similarly, because it may not be possible to clearly distinguish between users who travel using a specific mode of transportation and users who travel using other modes of transportation, the accuracy of estimating the number of users using that specific mode of transportation may be low. For this reason, the statistical information regarding vehicles and other modes of transportation may also have low statistical accuracy.

[0099] In the information linkage device 1 and information linkage method MT of this embodiment, the first acquisition unit 21 of the mobile information processing device 20 acquires first mobile information. The second acquisition unit 41 of the terminal information processing device 40 acquires first terminal information. The first generation unit 23 of the mobile information processing device 20 and the second generation unit 43 of the terminal information processing device 40 perform deidentification processing on the first mobile information to generate second mobile information (steps S13, S25), and the first generation unit 23 of the mobile information processing device 20 and the second generation unit 43 of the terminal information processing device 40 perform deidentification processing on the first terminal information to generate second terminal information (steps S23, S15). In this embodiment, the first acquisition unit 21 of the mobile information processing device 20 acquires second mobile information (step S26), and the first analysis unit 24 matches the second mobile information with the second terminal information and generates aggregated information (an example of statistical information) having a second data count that includes the number of users U2 who are capable of driving the vehicle 3, who have moved to the destination V, and who are users of terminal 5 who did not drive the vehicle 3 to the destination V, based on the information that the identifier of user U1 of the vehicle 3 and the identifier of user U2 of terminal 5 match (step S16).

[0100] In this case, the mobile information processing device 20 acquires second mobile information, which has undergone deidentification processing on the first mobile information, and second terminal information, which has undergone deidentification processing on the first terminal information. Since deidentification processing, including encryption processing, is performed in the terminal information processing device 40, the administrator of the mobile information processing device 20 cannot extract attribute information such as the user ID of a user that may be included in the first terminal information based on the second terminal information. For this reason, the terminal information processing device 40 can output to the mobile information processing device 20, which is a different device from the terminal information processing device 40, after appropriately protecting privacy by deidentifying the first terminal information, which includes location information of the terminal 5. Furthermore, since deidentification processing is also performed on the first mobile information to generate second mobile information, the administrator of the terminal information processing device 40 cannot extract attribute information such as the user ID of a user that may be included in the first mobile information based on the second mobile information. Therefore, the mobile information processing device 20 can output the first mobile information, including the visited locations related to vehicle 3, to a terminal information processing device 40, which is a different device from the mobile information processing device 20, after appropriately protecting the privacy of the first mobile information. By de-identifying the first mobile information and the first terminal information, the second mobile information and the second terminal information can be appropriately matched. However, with only the second mobile information, if user U2, who owns vehicle 3, does not drive vehicle 3, it is unclear which visited location V user U2 went to. Also, with only the second terminal information, as described above, it is not possible to accurately estimate whether users U1, U2, and U3 used vehicle 3 to travel. However, since the mobile information processing device 20 of this embodiment can generate aggregated information based on the second mobile information and the second terminal information, it can generate aggregated information including the number of users (second user count) who own vehicle 3 but did not drive vehicle 3 to travel to visited location V. Aggregated information is an example of statistical information. While the terminal information processing device 40 alone may not be able to provide highly accurate estimations, as in the example of this embodiment, by collecting information (location information) about the visited location from both the mobile information processing device 20 and the terminal information processing device 40, highly accurate statistical information can be obtained.Therefore, the information sharing device 1 can easily obtain accurate statistical information, including the number of users of vehicle 3 who did not drive vehicle 3 to destination V.

[0101] Furthermore, in the information sharing device 1 according to this embodiment, the statistical information may include a first number of users related to user U1 who drives vehicle 3 and owns terminal 5, and a second number of users related to user U2 who does not drive vehicle 3 but owns terminal 5. In this case, the information sharing device 1 can accurately extract whether or not vehicle 3 is being driven. In addition, since the information sharing device 1 can output statistical information that allows comparison between the first number of users and the second number of users, it can appropriately support the planning of maintenance plans for visited locations V.

[0102] Furthermore, in the information sharing device 1 according to this embodiment, the visited location V of user U1 who drives the vehicle 3 (uses a mobile body) includes the location of the vehicle 3 at a predetermined distance or more from the vehicle 3's base location B1 and where it has stayed for a predetermined time or longer, and the location information (visited location V) of users U1, U2, and U3 who own terminals 5 may include the location of terminals 5 within a predetermined time range. In this case, the information sharing device 1 can appropriately estimate the visited locations of the vehicle 3. Also, even if terminal 5 acquires location information constantly (or at regular intervals), the information sharing device 1 can identify the location information of terminal 5 according to the time range. As a result, if second terminal attribute information and second mobile body attribute information are detected for a certain time period, and the visited location V corresponding to the second terminal attribute information does not match the visited location V corresponding to the second mobile body attribute information, the information sharing device 1 can accurately determine, based on the second mobile body information and second terminal information, that there is a user U2 who traveled to the visited location V without driving the vehicle 3. In other words, the information sharing device 1 can accurately calculate statistical information that includes a second number of users, which is an aggregate of user U2.

[0103] Furthermore, in the information sharing device 1 according to this embodiment, the mobile information processing device 20 transmits the mobile intermediate information generated by performing irreversible transformation and encryption processing as deidentification processing on the first mobile information to the terminal information processing device 40, the terminal information processing device 40 performs irreversible transformation and encryption processing as deidentification processing on the first terminal information and transmits the generated terminal intermediate information to the mobile information processing device 20, the mobile information processing device 20 acquires the terminal intermediate information transmitted from the terminal information processing device 40 and performs encryption processing as deidentification processing on the acquired terminal intermediate information to generate second terminal information, and the terminal information processing device 40 acquires the mobile intermediate information transmitted from the mobile information processing device 20 and performs encryption processing as deidentification processing on the acquired mobile intermediate information to generate second mobile information. In this case, the terminal information processing device 40, which is another device, can output the second mobile information relating to the visited location V relating to the vehicle 3, after more appropriately protecting the privacy of the first mobile attribute information. Furthermore, irreversible transformation and encryption processing are also performed on the first terminal attribute information, enabling proper matching of the second mobile entity information and the second terminal information.

[0104] Furthermore, in the information sharing device 1 according to this embodiment, the irreversible transformation process performed in the mobile information processing device 20 and the terminal information processing device 40 may include hashing. In this case, the application of a special irreversible transformation process is unnecessary, and a general irreversible transformation process such as hashing can be applied, allowing the information sharing device 1 to easily perform irreversible transformation processing.

[0105] Furthermore, in the information sharing device 1 according to this embodiment, the mobile information processing device 20 and the terminal information processing device 40 may discard the salt used in the hashing process after performing a hashing process on the user ID (an example of an identifier). In this case, by discarding the salt used in the hashing process, the mobile information processing device 20 and the terminal information processing device 40 can reduce the possibility of restoring (decrypting) the user ID and appropriately protect privacy.

[0106] Furthermore, in the information sharing device 1 according to this embodiment, the second analysis unit 44 may generate statistical information that does not include hashed data, which is data that does not contain personal information, from the aggregated results. In this case, the statistical information does not include, for example, the converted user ID, which is hashed data, so that the user ID is not disclosed. This makes it possible to use statistical results related to mobile devices and terminals in the statistical information, while also appropriately protecting privacy.

[0107] Furthermore, in the information sharing device 1 according to this embodiment, the second analysis unit 44 may perform confidentiality processing on statistical information to generate confidential analysis information. In this case, by performing confidentiality processing on the analysis information as well, the contents of the data handled by the mobile information processing device 20 and the terminal information processing device 40 can be appropriately protected.

[0108] The information sharing device 1 may employ the following configuration. For example, in the information sharing device 1, at least one of the first mobile information and the first terminal information may include attribute information indicating attributes related to the user of the vehicle 3 or the user of the terminal 5, and the second analysis unit 44 may generate statistical information that includes classification information classified according to the attributes included in the attribute information based on the attribute information.

[0109] The first terminal information may include, for example, attribute information such as name, gender, and date of birth. In this modified example, the attribute information includes gender. The second generation unit 43 generates second terminal information that includes attribute information on which encryption processing similar to that for the visited location in the above embodiment has been performed on gender. Figure 9 shows an example of the second terminal information and statistical information generated by the analysis unit according to the modified example.

[0110] Figure 9(a) shows an example of second terminal information generated by the analysis unit relating to the modified example. As shown in Figure 9(a), the second terminal information includes a converted user ID in which the user ID has been de-identified, a visited location converted information in which the visited location has been encrypted, and attribute information that has been encrypted. The second terminal information may further include the time when the location information of the visited location was measured (acquired). In the example shown in Figure 9(a), the second terminal information includes second terminal attribute information for a predetermined time period, visited location converted information, and gender information that has been encrypted. The second terminal information includes, for example, information such as "a12f7d91", "a12f7d92", "a12f7d93", "a12f7d94", "a12f7d95", "a12f7d96", "a12f7d97", "a12f7d98", and "a12f7d99" as second terminal attribute information, in which de-identification processing is performed on the user ID to indicate that each user is different from the others. The second terminal information includes, for example, encrypted information such as a mesh code as location conversion information. The second terminal information also includes, for example, encrypted information such as "male" and "female" indicating gender as attribute information. Although not shown in Figure 9(a), if a user with a terminal is moving during a predetermined time period, multiple locations V may be shown for the same second terminal attribute information.

[0111] Figure 9(b) shows a third statistical information, which is an example of statistical information generated by the analysis unit according to the modified example. As shown in Figure 9(b), the first analysis unit 24 generates statistical information that includes classification information classified according to gender as attributes included in the attribute information. The first analysis unit 24 performs the same processing as the first analysis unit 24 in the above-described embodiment and calculates the first number of users, the second number of users, and the third number of users. Based on the attributes for each user ID in the second terminal information, the first analysis unit 24 calculates the first number of users, the second number of users, and the third number of users for each gender and mesh code.

[0112] The first analysis unit 24 classifies the number of first users "3" for the mesh code "5339-1234-1" corresponding to the visited location conversion information, based on the second terminal information, according to the attribute gender. The first analysis unit 24 calculates the number of "males" in the "number of first users" for the mesh code "5339-1234-1" corresponding to the visited location conversion information as "1". The first analysis unit 24 calculates the number of "females" in the "number of first users" for the mesh code "5339-1234-1" corresponding to the visited location conversion information as "0". The first analysis unit 24 calculates the number of "males" in the "number of first users" for the mesh code "5339-1234-2" corresponding to the visited location conversion information as "1". The first analysis unit 24 calculates the number of "women" in the "Number of First Users" for the mesh code "5339-1234-2" corresponding to the visited location conversion information by setting it to "1".

[0113] The first analysis unit 24 calculates the number of "males" in the "second user count" for the mesh code "5339-1234-1" corresponding to the visited location conversion information as "1". The first analysis unit 24 calculates the number of "females" in the "second user count" for the mesh code "5339-1234-1" corresponding to the visited location conversion information as "1". The first analysis unit 24 calculates the number of "males" in the "second user count" for the mesh code "5339-1234-2" corresponding to the visited location conversion information as "0". The first analysis unit 24 calculates the number of "females" in the "second user count" for the mesh code "5339-1234-2" corresponding to the visited location conversion information as "0".

[0114] The first analysis unit 24 calculates the number of "males" in the "number of third users" for the mesh code "5339-1234-1" corresponding to the visited location conversion information as "1". The first analysis unit 24 calculates the number of "females" in the "number of third users" for the mesh code "5339-1234-1" corresponding to the visited location conversion information as "2". The first analysis unit 24 calculates the number of "males" in the "number of third users" for the mesh code "5339-1234-2" corresponding to the visited location conversion information as "1". The first analysis unit 24 calculates the number of "females" in the "number of third users" for the mesh code "5339-1234-2" corresponding to the visited location conversion information as "0".

[0115] Furthermore, although the above embodiments used a vehicle as an example of a moving object, the moving object is not limited to a vehicle. The moving object may also be public transportation. Here, public transportation includes means of transport that can be used simultaneously or at different times by a specific user and other users. Public transportation includes, for example, objects that a specific user can move without the specific user controlling its movement, but which are controlled by other users. Public transportation may include, for example, buses, taxis, trains, ships, and aircraft. Public transportation may or may not have a regular operating schedule. There is no limitation on whether or not a fare is paid on public transportation.

[0116] The following explanation uses air travel (aircraft) as an example of public transportation. The user travels to a reference airport, which is a reference point airport. The reference airport may be, for example, the airport closest in distance or with the shortest travel time from the user's current location, or it may be a frequently used airport entered by the user. The user boards an air flight from the reference airport and travels to the arrival airport by air flight. The mobile information processing device in the modified example is a device (server) of an organization (e.g., an airline) that operates air flights. The mobile information processing device obtains first mobile information from the mobile information server. The first mobile information is, for example, airline member information or information regarding the use of air flights. Figure 10(a) is a diagram showing an example of first mobile information in the modified example. As shown in Figure 10(a), the first mobile information includes data of multiple combinations of the arrival airport (place of visit) of a user who is a member of an airline and the user ID (identifier) ​​of the user who is a member of the airline.

[0117] Figure 10(a) shows the first mobile entity information after the location of the arrival airport (e.g., the city or town where it is located) has been identified. The first mobile entity information before the identification of the city or town where the arrival airport is located may include, for example, a user ID, location information of a reference airport which is the base location, and location information of the arrival airport, similar to the first mobile entity information in Figure 3(a). The first identification unit of the mobile entity information processing device identifies the city or town where the arrival airport is located based on the information of the arrival airport. The first mobile entity information shown in Figure 10(a) shows the user's arrival airport within a predetermined time range, which is different from the reference airport, as the destination. In the first mobile entity information after the location of the arrival airport has been identified, a blank "Destination" field indicates, for example, that the user did not use air travel within the predetermined time range or that the use of air travel was not completed within the predetermined time range. In other words, in the first mobile entity information after the location of the arrival airport has been identified, a blank "Destination" field indicates that, in relation to the information of the reference airport, there is no information about the arrival airport within the predetermined time range.

[0118] Figure 10(b) shows an example of first terminal information according to a modified example. As shown in Figure 10(a), the first terminal information according to the modified example includes data of multiple combinations of user ID and location information, similar to the embodiment described above. Figure 10(b) shows first mobile information that identifies the municipality where the user is located. The second acquisition unit 41 acquires data of multiple combinations of user ID and municipality as location information. Alternatively, the second acquisition unit 41 may acquire area information, and the second identification unit 42 may identify the user's municipality based on the area information.

[0119] The mobile information processing device and the terminal information processing device generate second mobile information and second terminal information by performing the deidentification process of the above embodiment on the first mobile information and first terminal information according to the above modification. The first analysis unit matches the second mobile information and the second terminal information and generates aggregated information based on the information where the user ID of the user of the air travel service on which the deidentification process was performed matches the user ID of the user of the terminal on which the deidentification process was performed.

[0120] Figure 11(a) shows an example of statistical information related to a modified example. Figure 11(b) shows an example of statistical information related to a modified example. The aggregated information (an example of statistical information) includes the number of users of terminals that are available for air travel, have traveled to the destination, and did not travel to the destination using air travel. For example, the first analysis unit calculates the number of users who visited the destination by air travel among the airline members for the destination city / town, based on the information where the encrypted destination city / town, town, and village included in the second mobile information and the second terminal information match. In this case, the first analysis unit calculates the number of users by aggregating the number of user IDs for each destination city / town, town, and village in the destination city / town, town, village village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village, village,

[0121] The first analysis unit calculates the number of users who visited the municipality where the arrival airport is located, based on the information where the encrypted municipality of the arrival airport included in the second mobile information and the second terminal information matches, as the second user count. In this case, the first analysis unit calculates the second user count by aggregating the number of user IDs for each municipality where the arrival airport field is blank in the first mobile information (second mobile information).

[0122] The first analysis unit may calculate the percentage of visits by air to each of the municipalities as aggregated information, based on the number of first and second users. The first analysis unit generates the visit ratio shown in Figure 11(b) by dividing the number of airline members who visited the municipality of the arrival airport by air, and expressing the result as a percentage. The first and second analysis units decode the data using the same method as in the above-described embodiment to generate the detailed statistical information (an example of statistical information) shown in Figures 11(a) and 11(b). As in the above-described embodiment, the second analysis unit may generate analysis information based on the detailed statistical information.

[0123] As shown in the modified example above, even when the use of the mobile body is the use of public transportation, the terminal information processing device can generate aggregated information based on the second mobile body information and the second terminal information. Therefore, it can generate aggregated information that includes the number of users (second user count) who were located in a place where the mobile body could be used but did not use the mobile body to travel to destination V. Thus, the information sharing device can easily obtain accurate statistical information (aggregated information) that includes the number of users of the mobile body who did not use the mobile body to travel to the destination.

[0124] Furthermore, in the above embodiment, the user ID for vehicle 3 (information that uniquely identifies the user) and the user ID for terminal 5 (information that uniquely identifies the user) may be different, and some attribute information may not be included. In this case, the device equipped with the first analysis unit 24 may be converted so that the user ID for vehicle 3 and the user ID for terminal 5 match. In the above embodiment, in the terminal information processing device 40 equipped with the first analysis unit 24, the second generation unit 43 processes the format (type) of the user ID included in the first terminal information to match the format (type) of the user ID. For example, if the user ID is information represented by a telephone number, and the user ID is information represented by a name and date of birth, the second generation unit 43 searches for the telephone number corresponding to the name and date of birth of the user ID from the attribute information, and replaces the user ID in the first terminal information from the information represented by a name and date of birth to the information represented by the telephone number. As a result, the terminal information processing device 40 matches the second mobile information with the second terminal information and generates statistical information based on the information where the second mobile information and the second terminal information match.

[0125] In the above-described embodiment, a configuration was described in which the mobile information processing device 20 has a first analysis unit 24 and the terminal information processing device 40 has a second analysis unit 44, but the invention is not limited to the above example. It is sufficient that at least one of the mobile information processing device 20 and the terminal information processing device 40 has the first analysis unit 24. The terminal information processing device 40 may also have the first analysis unit 24. The mobile information processing device 20 may also have a second analysis unit 44. In this case, the second output unit 45 outputs (transmits) the second terminal information to the terminal information processing device 40. Both the mobile information processing device 20 and the terminal information processing device 40 may be equipped with a functional unit capable of executing the processing performed by the first analysis unit 24.

[0126] The location information of vehicle 3 (mobile body) and the location information of terminal 5 do not have to have the same resolution. For example, the higher the resolution of the location information, the more digits there are in the mesh code. If the resolution of the location information of the first mobile body information is higher than the resolution of the location information of the first terminal information, the first identification unit 22 of the mobile body information processing device 20 may reduce the number of digits in the mesh code of the first mobile body information and unify it to the number of digits in the mesh code of the location information of the first terminal information (unify the resolution). If the resolution of the location information of the first terminal information is higher than the resolution of the location information of the first mobile body information, the second identification unit 42 of the terminal information processing device 40 may reduce the number of digits in the mesh code of the first terminal information and unify it to the number of digits in the mesh code of the location information of the first mobile body information (unify the resolution).

[0127] The statistical information may include data other than the number of first users, second users, and third users. For example, the statistical information may include ratios calculated based on the number of first users, second users, and third users.

[0128] [About this disclosure] The information sharing device 1 and information sharing method MT disclosed herein have the following configuration.

[0129] [1] An information linkage device comprising: a mobile information processing device that acquires first mobile information including data of multiple combinations of the location visited by a user using a mobile body and the identifier of the user of the mobile body; and a terminal information processing device that acquires first terminal information including data of multiple combinations of the location information of a user who owns a terminal and the identifier of the user of the terminal, wherein the mobile information processing device and the terminal information processing device each perform an anonymization process on the first mobile information to generate second mobile information, and each perform an anonymization process on the first terminal information to generate second terminal information, and at least one of the mobile information processing device and the terminal information processing device acquires the second mobile information and the second terminal information, matches the second mobile information and the second terminal information and generates statistical information including the number of users of the terminal that are able to use the mobile body, have moved to the visited location, and have not moved to the visited location using the mobile body, based on information that the identifier of the user of the mobile body on which the anonymization process has been performed matches the identifier of the user of the terminal on which the anonymization process has been performed.

[0130] [2] The statistical information includes a first number of users who use the mobile device and own the terminal, and a second number of users who do not use the mobile device and own the terminal. The information sharing device as described in [1] above.

[0131] [3] The information sharing device according to [1] or [2] above, wherein the visited locations of a user using the mobile body include the location of the mobile body at a predetermined distance or more from the base location of the mobile body and where the user stayed for a predetermined time or longer, and the location information of a user who owns the terminal includes the location of the terminal within a predetermined time interval.

[0132] [4] The information linkage device according to any one of [1] to [3] above, wherein at least one of the first mobile information and the first terminal information includes attribute information indicating attributes relating to the user of the mobile or the user of the terminal, and the analysis unit generates the statistical information including classification information classified according to the attributes included in the attribute information based on the attribute information.

[0133] [5] The information linkage device according to any one of the above items [1] to [4], wherein the analysis unit performs confidentiality processing on the statistical information to generate confidential analysis information.

[0134] [6] The information linkage device according to any one of [1] to [5] above, wherein the mobile information processing device transmits mobile intermediate information generated by performing an irreversible transformation process and an encryption process as the deidentification process on the first mobile information to the terminal information processing device, the terminal information processing device performs an irreversible transformation process and an encryption process as the deidentification process on the first terminal information and transmits the generated terminal intermediate information to the mobile information processing device, the mobile information processing device acquires the terminal intermediate information transmitted from the terminal information processing device and performs an encryption process as the deidentification process on the acquired terminal intermediate information to generate the second terminal information, and the terminal information processing device acquires the mobile intermediate information transmitted from the mobile information processing device and performs an encryption process as the deidentification process on the acquired mobile intermediate information to generate the second mobile information.

[0135] [7] The information linkage device described in [6] above, wherein the irreversible transformation process performed in the mobile information processing device and the terminal information processing device includes a hashing process.

[0136] [8] The information linking device according to any one of [1] to [7] above, wherein the first mobile information includes data of multiple combinations of the destination of a user driving a vehicle and the identifier of the user of the vehicle, and the statistical information includes the number of users of the terminal who are capable of driving the vehicle, have moved to the destination, and have not driven the vehicle to the destination, based on information obtained by matching the second mobile information and the second terminal information and finding a match between the identifier of the user of the vehicle on which the deidentification process has been performed and the identifier of the user of the terminal on which the deidentification process has been performed.

[0137] [9] The information linking device according to any one of [1] to [7] above, wherein the first mobile information includes data of multiple combinations of the places visited by users using public transportation and the identifiers of the users of said public transportation, and the statistical information includes a count of users of said terminal who are able to use public transportation, have moved to the places visited, and have not moved to the places visited using public transportation, based on information obtained by matching the second mobile information and the second terminal information and finding a match between the identifier of the public transportation user on which the deidentification process has been performed and the identifier of the terminal user on which the deidentification process has been performed.

[0138]

[10] An information linkage method comprising: a step of acquiring first mobile information in a mobile information processing device, which includes data of multiple combinations of the location visited by a user using a mobile device and the identifier of the user of the mobile device; a step of acquiring first terminal information in a terminal information processing device, which includes data of multiple combinations of the location information of a user who owns a terminal and the identifier of the user of the terminal; a step of generating second mobile information by performing an anonymization process on the first mobile information in the mobile information processing device and the terminal information processing device, respectively; a step of generating second terminal information by performing an anonymization process on the first terminal information in the mobile information processing device and the terminal information processing device, respectively; and a step of matching the second mobile information and the second terminal information to generate statistical information in at least one of the mobile information processing device and the terminal information processing device, which includes a total number of terminal users who are users of the mobile device, have moved to the visited location, and have not moved to the visited location using the mobile device, based on information that the identifier of the user of the mobile device on which the anonymization process has been performed matches the identifier of the user of the terminal on which the anonymization process has been performed.

[0139] [Definitions of Terms, etc.] The block diagrams used in the description of the above embodiments show functional units. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method of realizing each functional block is not particularly limited. That is, each functional block may be realized using one device that is physically or logically coupled, or it may be realized using two or more physically or logically separated devices that are directly or indirectly connected (for example, using wired, wireless, etc.). A functional block may be realized by combining the above one device or the above multiple devices with software.

[0140] Functions include, but are not limited to, judgment, decision, determination, calculation, calculation, processing, derivation, investigation, exploration, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, assumption, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating (mapping), and assigning. For example, a functional block (configuration part) that enables transmission is called a transmitting unit or transmitter. In all cases, as mentioned above, the method of implementation is not particularly limited.

[0141] For example, the information sharing device 1 in one embodiment of the present disclosure may function as a computer that performs processing to determine whether or not there has been a change in the hobbies and preferences of the present disclosure. Figure 12 is a diagram showing an example of the hardware configuration of the information sharing device 1 according to one embodiment of the present disclosure. The above-described information sharing device 1 may be physically configured as a computer device including a processor 1001, memory 1002, storage 1003, communication device 1004, input device 1005, output device 1006, bus 1007, etc.

[0142] In the following explanation, the term "device" can be replaced with "circuit," "device," "unit," etc. The hardware configuration of the information sharing device 1 may include one or more of the devices shown in the figure, or it may be configured to omit some of the devices.

[0143] Each function in the information sharing device 1 is realized by loading predetermined software (programs) onto hardware such as the processor 1001 and memory 1002, which allows the processor 1001 to perform calculations, control communication by the communication device 1004, and control at least one of the reading and writing of data in the memory 1002 and storage 1003.

[0144] The processor 1001 controls the entire computer, for example, by running an operating system. The processor 1001 may be composed of a central processing unit (CPU) that includes interfaces with peripheral devices, control devices, arithmetic units, registers, etc. For example, the first acquisition unit 21, first identification unit 22, first generation unit 23, first analysis unit 24, second acquisition unit 41, second identification unit 42, second generation unit 43, and second analysis unit 44 described above may be implemented by the processor 1001.

[0145] Furthermore, the processor 1001 reads programs (program code), software modules, data, etc., from at least one of the storage 1003 and the communication device 1004 into the memory 1002 and executes various processes accordingly. The program used is one that causes the computer to execute at least a part of the operations described in the above embodiment. For example, the first acquisition unit 21, the first identification unit 22, the first generation unit 23, the first analysis unit 24, the second acquisition unit 41, the second identification unit 42, the second generation unit 43, and the second analysis unit 44 may be stored in the memory 1002 and implemented by a control program that operates on the processor 1001, and other functional blocks may be implemented in the same way. The above-described various processes have been explained as being executed by one processor 1001, but they may be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The program may also be transmitted from a network via a telecommunications line.

[0146] The memory 1002 is a computer-readable recording medium and may consist of at least one of the following: ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. The memory 1002 may also be called a register, cache, main memory, etc. The memory 1002 can store executable programs (program code), software modules, etc., for carrying out a method according to one embodiment of the present disclosure.

[0147] The storage 1003 is a computer-readable recording medium and may consist of at least one of the following: an optical disc such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disc, a digital multipurpose disc, a Blu-ray® disc), a smart card, flash memory (e.g., a card, a stick, a key drive), a floppy® disk, a magnetic strip, etc. The storage 1003 may also be called an auxiliary storage device. The above-mentioned storage medium may be, for example, a database, server, or other suitable medium including at least one of memory 1002 and storage 1003.

[0148] The communication device 1004 is hardware (transmitting / receiving device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as a network device, network controller, network card, communication module, etc. The communication device 1004 may be configured to include high-frequency switches, duplexers, filters, frequency synthesizers, etc., in order to implement at least one of frequency division duplex (FDD) and time division duplex (TDD). For example, the first acquisition unit 21, first output unit 25, second acquisition unit 41 and second output unit 45 described above may be implemented by the communication device 1004. The communication device 1004 may be implemented with physically or logically separated transmitting and receiving units.

[0149] The input device 1005 is an input device that accepts input from an external source (e.g., a keyboard, mouse, microphone, switch, button, sensor, etc.). The output device 1006 is an output device that outputs to an external source (e.g., a display, speaker, LED lamp, etc.). The input device 1005 and the output device 1006 may be configured as an integrated unit (e.g., a touch panel).

[0150] Furthermore, each device, such as the processor 1001 and the memory 1002, is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or different buses may be configured for each device.

[0151] Furthermore, the information sharing device 1 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), and an FPGA (Field Programmable Gate Array), and some or all of each functional block may be realized by such hardware. For example, the processor 1001 may be implemented using at least one of these hardware components.

[0152] Information notification is not limited to the embodiments described herein and may be carried out by other means. For example, information notification may be carried out by physical layer signaling (e.g., DCI (Downlink Control Information), UCI (Uplink Control Information)), upper layer signaling (e.g., RRC (Radio Resource Control) signaling, MAC (Medium Access Control) signaling, broadcast information (MIB (Master Information Block), SIB (System Information Block))), other signals, or combinations thereof. RRC signaling may also be called RRC messages, and may be, for example, RRC Connection Setup messages, RRC Connection Reconfiguration messages, etc.

[0153] The processing procedures, sequences, flowcharts, etc., of each aspect / embodiment described in this disclosure may be reordered, provided they do not contradict each other. For example, the methods described in this disclosure present various step elements using exemplary order and are not limited to the specific order presented.

[0154] Input and output information may be stored in a specific location (e.g., memory) or managed using a management table. Input and output information may be overwritten, updated, or appended to. Output information may be deleted. Input information may be transmitted to other devices.

[0155] The determination may be made by a value represented by one bit (0 or 1), by a boolean value (true or false), or by a numerical comparison (for example, a comparison with a predetermined value).

[0156] Each aspect / embodiment described in this disclosure may be used individually, in combination, or switched between as needed during implementation. Furthermore, notification of specific information (e.g., notification that "X is") is not limited to explicit notification, but may also be implicit (e.g., by not providing such notification).

[0157] Although the present disclosure has been described in detail above, it will be clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the intent and scope of the present disclosure as defined by the claims. Accordingly, the descriptions in the present disclosure are illustrative and not intended to be restrictive in any way.

[0158] Software should be broadly interpreted to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, execution threads, procedures, functions, and so on, whether they are called software, firmware, middleware, microcode, hardware description languages, or by any other name.

[0159] Furthermore, software, instructions, information, etc., may be transmitted and received via a transmission medium. For example, if software is transmitted from a website, server, or other remote source using at least one of wired technologies (such as coaxial cable, fiber optic cable, twisted pair, or digital subscriber line (DSL)) and wireless technologies (such as infrared or microwave), then at least one of these wired and wireless technologies is included in the definition of a transmission medium.

[0160] The information, signals, etc. described in this disclosure may be represented using any of the various different techniques. For example, the data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be referred to throughout the above description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

[0161] In addition, terms used in this disclosure and terms necessary for understanding this disclosure may be replaced with terms having the same or similar meanings. For example, at least one of the channel and symbol may be a signal (signaling). Also, a signal may be a message. Furthermore, a component carrier (CC) may be called a carrier frequency, cell, frequency carrier, etc.

[0162] Furthermore, the information, parameters, etc., described in this disclosure may be expressed using absolute values, relative values ​​from a given value, or other corresponding information. For example, wireless resources may be indicated by an index.

[0163] The names used for the parameters described above are not restrictive in any way. Furthermore, the formulas and other expressions using these parameters may differ from those expressly disclosed in this disclosure. Various channels (e.g., PUCCH, PDCCH, etc.) and information elements can be identified by any suitable name, and therefore, the various names assigned to these various channels and information elements are not restrictive in any way.

[0164] In this disclosure, terms such as "Mobile Station (MS)," "user terminal," "User Equipment (UE)," and "terminal" may be used interchangeably.

[0165] A mobile station may also be referred to by those skilled in the art as a subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, or some other appropriate term.

[0166] As used in this disclosure, the terms “determining” and “determining” may encompass a wide variety of actions. “Determining” may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, or inquiring (e.g., searching in a table, database, or other data structure), or ascertaining. “Determining” may also include, for example, receiving (e.g., receiving information), transmitting (e.g., sending information), inputting, outputting, or accessing (e.g., accessing data in memory). Furthermore, "judgment" and "decision" can include considering something as having been "judged" or "decided" after resolving, selecting, choosing, establishing, comparing, etc. In other words, "judgment" and "decision" can include considering something as having been "judged" or "decided" after some action. Also, "judgment (decision)" can be reinterpreted as "assuming," "expecting," or "considering."

[0167] The terms “connected,” “coupled,” or any variation thereof, mean any direct or indirect connection or coupling between two or more elements, and may include the presence of one or more intermediate elements between two elements that are “connected” or “coupled” with each other. The coupling or connection between elements may be physical, logical, or a combination thereof. For example, “connection” may be reinterpreted as “access.” As used in this disclosure, two elements may be considered to be “connected” or “coupled” with each other using at least one of one or more wires, cables, and printed electrical connections, and, in some non-limiting and non-exclusive examples, electromagnetic energy having wavelengths in the radio frequency domain, microwave domain, and optical (both visible and invisible) domain.

[0168] In this disclosure, the phrase "based on" does not mean "based solely on" unless otherwise specified. In other words, the phrase "based on" means both "based solely on" and "based at least on."

[0169] Any reference to elements using designations such as “first,” “second,” etc., as used in this disclosure does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient way to distinguish between two or more elements. Accordingly, references to first and second elements do not imply that only two elements may be employed, or that the first element must precede the second element in any way.

[0170] Where the terms “include,” “including,” and their variations are used in this disclosure, these terms are intended to be inclusive, as is the term “comprising.” Furthermore, the term “or” as used in this disclosure is not intended to be exclusive OR.

[0171] In this disclosure, if articles are added by translation, such as a, an, and the in English, this disclosure may include the fact that the noun following these articles is plural.

[0172] In this disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "combine" may be interpreted similarly to "different."

[0173] 1... Information linkage device, 3... Vehicle (an example of a mobile object), 5... Terminal, 10... Mobile object information server, 20... Mobile object information processing device, 21... First acquisition unit, 22... First identification unit, 23... First generation unit, 24... First analysis unit, 25... First output unit, 30... Terminal information server, 40... Terminal information processing device, 41... Second acquisition unit, 42... Second identification unit, 43... Second generation unit, 44... Second analysis unit, 45... Second output unit, 1001... Processor, 1002... Memory, 1003... Storage, 1004... Communication device, 1005... Input device, 1006... Output device, 1007... Bus, B1, B2, B3... Reference point, MT... Information linkage method, U1, U2, U3... User, V... Visiting location.

Claims

1. An information linkage device comprising: a mobile information processing device that acquires first mobile information including data of multiple combinations of the location visited by a user using a mobile body and the identifier of the user of the mobile body; and a terminal information processing device that acquires first terminal information including data of multiple combinations of the location information of a user who owns a terminal and the identifier of the user of the terminal, wherein the mobile information processing device and the terminal information processing device each perform an anonymization process on the first mobile information to generate second mobile information and each perform an anonymization process on the first terminal information to generate second terminal information, and at least one of the mobile information processing device and the terminal information processing device acquires the second mobile information and the second terminal information, matches the second mobile information and the second terminal information and generates statistical information including the number of users of the terminal who are able to use the mobile body, have moved to the visited location, and have not moved to the visited location using the mobile body, based on information where the identifier of the user of the mobile body on which the anonymization process has been performed matches the identifier of the user of the terminal on which the anonymization process has been performed.

2. The statistical information includes a first number of users who use the mobile device and own the terminal, and a second number of users who do not use the mobile device but own the terminal. The information sharing device according to claim 1.

3. The information sharing device according to claim 1, wherein the visited locations of a user utilizing the mobile body include the location of the mobile body at a predetermined distance or more from the reference location of the mobile body and where the user stayed for a predetermined time or longer, and the location information of a user owning the terminal includes the location of the terminal within a predetermined time interval.

4. The information linkage device according to claim 1, wherein at least one of the first mobile information and the first terminal information includes attribute information indicating attributes relating to the user of the mobile or the user of the terminal, and the analysis unit generates statistical information including classification information classified according to the attributes included in the attribute information based on the attribute information.

5. The information linkage device according to claim 1, wherein the analysis unit performs confidentiality processing on the statistical information to generate confidential analysis information.

6. The information linkage device according to claim 1, wherein the mobile information processing device transmits to the terminal information processing device the mobile information processing device the mobile information processing device has generated mobile intermediate information by performing an irreversible transformation process and an encryption process as the deidentification process on the first mobile information; the terminal information processing device transmits to the mobile information processing device the terminal intermediate information generated by performing an irreversible transformation process and an encryption process as the deidentification process on the first terminal information; the mobile information processing device acquires the terminal intermediate information transmitted from the terminal information processing device and generates the second terminal information by performing an encryption process as the deidentification process on the acquired terminal intermediate information; and the terminal information processing device acquires the mobile intermediate information transmitted from the mobile information processing device and generates the second mobile information by performing an encryption process as the deidentification process on the acquired mobile intermediate information.

7. The information linkage device according to claim 6, wherein the irreversible transformation process performed in the mobile information processing device and the terminal information processing device includes a hashing process.

8. The information linkage device according to claim 1, wherein the first mobile information includes data of multiple combinations of the destinations visited by the user driving the vehicle and the identifier of the user of the vehicle, and the statistical information includes a count of users of the terminal who are capable of driving the vehicle, have moved to the destinations, and have not driven the vehicle to the destinations, based on information obtained by matching the second mobile information and the second terminal information and finding a match between the identifier of the user of the vehicle on which the deidentification process has been performed and the identifier of the user of the terminal on which the deidentification process has been performed.

9. The information linkage device according to claim 1, wherein the first mobile information includes data of multiple combinations of the location visited by a user using public transportation and the identifier of the user of said public transportation, and the statistical information includes a count of users of the terminal who are able to use public transportation, have moved to the location visited, and have not moved to the location visited using public transportation, based on information obtained by matching the second mobile information and the second terminal information and finding a match between the identifier of the user of said public transportation who has undergone the deidentification process and the identifier of the user of said terminal who has undergone the deidentification process.

10. Steps to acquire first mobile information in a mobile information processing device, which includes data of multiple combinations of the location visited by a user using a mobile device and the identifier of the user of the mobile device; Steps to acquire first terminal information in a terminal information processing device, which includes data of multiple combinations of the location information of a user who owns a terminal and the identifier of the user of the terminal; Steps to generate second mobile information by performing an anonymization process on the first mobile information in the mobile information processing device and the terminal information processing device, respectively; Steps to generate second terminal information by performing an anonymization process on the first terminal information in the mobile information processing device and the terminal information processing device, respectively; Steps to match the second mobile information and the second terminal information and generate statistical information in at least one of the mobile information processing device and the terminal information processing device, which includes a total number of terminal users who are users of the mobile device, who have moved to the visited location, and who have not moved to the visited location using the mobile device, based on information where the identifier of the user of the mobile device on which the anonymization process has been performed matches the identifier of the user of the terminal on which the anonymization process has been performed. Information sharing methods, including those mentioned above.

Images