Confidential Data Anonymization via Candidate Merging

Solution Overview

Problem

Existing information management techniques face challenges in maintaining data precision while ensuring anonymity, as they either reduce data precision excessively or require users to recognize and exclude dummy data, and can lead to individual member identification when abstracting data.

Innovation Solution

An information management apparatus and method that includes a confidential data storing section, a receiving section, a searching section, an anonymizing section, and a transmitting section, which extracts and anonymizes data based on search conditions to generate transmission data that maintains data precision and anonymity by merging candidate data with anonymized data of the same kind, preventing individual identification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data abstraction processing is performed to ensure anonymity, then individual identification is prevented, but data precision is reduced

Engineering Contradiction:

ImproveanonymityVSAvoiddata precision

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent applies partial action by performing abstraction processing only on specific data elements that require anonymization, rather than abstracting all data. The system selectively abstracts data based on anonymity requirements while preserving precision in other data elements, thus achieving anonymity without excessive loss of data precision.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent implements local quality by applying different processing levels to different data elements. Some data elements undergo abstraction processing to ensure anonymity, while other elements maintain their original precision. This localized approach allows the system to achieve anonymity where needed without compromising overall data precision.

Inventive Principle:

Principle #3Local quality

2Reliability

If dummy data is added to protect privacy, then anonymity is improved, but users must recognize and exclude dummy data for analysis

Engineering Contradiction:

ImproveanonymityVSAvoidease of analysis

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent extracts and removes dummy data from the dataset before providing it to users for analysis. By taking out the dummy data that would interfere with analysis, the system maintains anonymity protection while eliminating the need for users to manually identify and exclude dummy data, thus improving ease of operation.

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If all confidential data is anonymized, then anonymity is ensured, but data precision is excessively reduced

Engineering Contradiction:

ImproveanonymityVSAvoiddata precision

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent applies partial action by performing abstraction processing only on specific data elements that require anonymization, rather than abstracting all data. The system selectively abstracts data based on anonymity requirements while preserving precision in other data elements, thus achieving anonymity without excessive loss of data precision.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent implements local quality by applying different processing levels to different data elements. Some data elements undergo abstraction processing to ensure anonymity, while other elements maintain their original precision. This localized approach allows the system to achieve anonymity where needed without compromising overall data precision.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS8938433B2Information management apparatus, information management method, and information control program

Publication Date: 2015.01.20 NEC CORP

AI summary

An information management apparatus includes: a confidential data storing section configured to store a plurality of individual identifies (IDs) and data which is related to each of the plurality of individual IDs as confidential data. A receiving section is configured to receive a first search condition used to acquire desired confidential data to be transmitted from a first service providing unit. A searching section is configured to extract first candidate data which matches to the first search condition from the confidential data storing section. A transmission record storing section is configured to store a plurality of anonymized data which has been already transmitted to the first service providing unit. An anonymizing section is configured to generate first transmission data by carrying out processing to contain said first candidate data and the first data of the plurality of anonymized data based on first data which has data of a same kind as the first candidate data. A transmitting section is configured to transmit the first transmission data to the first service providing unit.