JP2012079205A - Personal information anonymizing device and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To appropriately anonymize personal information of a person who uses a graph structure environment.SOLUTION: A personal information anonymizing device comprises storage means and anonymizing means. The storage means stores adjacent relation information including an adjacent relation information tuple for each location which is an adjacent relation showing which location is adjacent to which location among a finite number of multiple locations, and personal management information including a personal information tuple for each person which is personal information including identification information of a person and location information showing a location used by the person among the multiple locations. The anonymizing means anonymizes each personal information tuple by aggregating only the locations with an adjacent relation which the adjacent relation information shows so that a number of different persons corresponding to multiple anonymized personal information tuples including the same location aggregation becomes equal to or more than a prescribed threshold.

Description

  The present invention relates to computer technology for anonymizing personal information.

  Nowadays, with the accumulation of huge amounts of data related to individuals, privacy considerations are indispensable for companies that handle personal information. For business operators handling personal information, at least compliance with laws on the protection of personal information (hereinafter referred to as protection laws) and related laws and regulations are indispensable. The protection law requires management measures for the collection and use of personal information, and the specific measures are stipulated by the ministries' guidelines.

  One of the management measures defined by these guidelines is anonymization of personal information. For example, the Ministry of Health, Labor and Welfare requests that anonymization of personal information related to medical care be made anonymous unless there is a special need in providing information to a third party, presenting an academic conference, or reporting a medical accident. The Ministry of Economy, Trade and Industry also cited anonymization of personal information as a desirable measure when providing it to a third party.

  Personal information anonymization includes personal attributes such as name, address, and age, as well as GPS (Global Positioning System) information, which is the premise of LBS (Location Based Service), which is becoming popular, and electronic There is a need for anonymizing location information such as history (log entry / exit history in the case of railways) left as a log by a traffic ticket. This type of anonymization technique is described in Non-Patent Document 1, for example.

  In Non-Patent Document 1, when there are a large number of individual tuples (tuples composed of (time, position)), at least a predetermined number of individuals follow the same route by making the time and position ambiguous. A method for guaranteeing conversion to data is described. That is, the technique of Non-Patent Document 1 is a position information anonymization technique for a case where an arbitrary position can be taken like GPS data.

MENergiz, M. Atzori, and Y. Saygin, “Towards Trajectory Anonymization: AGeneralization-Based Approach,” Proceedings of the SIGSPATIAL ACM GIS 2008 International Workshop on Security and Privacy in GIS and LBS, California, pp.52-61, 2008 .

  There is a moving environment having a graph structure in which which position is adjacent to which position (hereinafter referred to as a graph structure environment). Examples of such a mobile environment include a railway (eg, position = station), a route bus (eg, position = stop), an airplane (position = airport), or a road network (eg, position = intersection).

  In a graph structure environment, adjacent positions are not necessarily closest in distance.

  For these reasons, when the position information anonymization technique (anonymization technique of Non-Patent Document 1) for a case that can take an arbitrary position is applied to anonymization of individual personal information using a graph structure environment, it is adjacent. Missing positions can be obscured by the same group. Therefore, it is not preferable from a practical viewpoint to apply the technique of Non-Patent Document 1 to anonymize personal information of individuals using a graph structure environment.

  Accordingly, an object of the present invention is to appropriately anonymize personal personal information using a graph structure environment.

  The personal information anonymization device includes a storage unit and an anonymization unit. The storage means includes adjacency information including an adjacency tuple representing an adjacency relation indicating which position is adjacent to which position of the finite number of positions, individual identification information, and the plurality of positions. Personal management information including a personal information tuple, which is personal information including positional information indicating the position used by the individual, is stored for each individual. The anonymization means aggregates only the positions in the adjacent relationship indicated by the adjacent relationship information so that the number of different individuals corresponding to a plurality of anonymized personal information tuples including the same position set is predetermined. Each personal information tuple is anonymized so as to be equal to or greater than the threshold.

  It is possible to appropriately anonymize the personal information of the user of the graph structure environment.

The structural example of the computer to which the personal information anonymization apparatus which concerns on Example 1 of this invention was applied is shown. FIG. 2A shows an example of the station adjacent structure table 131. FIG. 2B is a schematic diagram of the adjacency relationship represented by the table 131 shown in FIG. 2A. An example of the ticket gate entrance / exit table 132 which concerns on Example 1 is shown. An example of the minimum equivalence number information 134 which concerns on Example 1 is shown. An example of the anonymous ticket gate entrance / exit table 133 which concerns on Example 1 is shown. An example of the flow of the whole process which the computer 100 which concerns on Example 1 performs is shown. An example of a detailed flow of S601 in FIG. 6 is shown. An example of the detailed flow of S602 of FIG. 6 is shown. An example of the detailed flow of S803 of FIG. 8 is shown. 10A and 10B are explanatory diagrams of an example of the prediction disclosure risk according to the first embodiment. The structural example of the computer with which the personal information anonymization apparatus which concerns on Example 2 of this invention was applied is shown. FIG. 12A shows a configuration example of the route station adjacent structure table 1131. FIG. 12B is a schematic diagram of the route structure represented by the table 1131 shown in FIG. 12A. The example of an output of the route search part 1122 which concerns on Example 2 is shown. An example of the anonymous ticket gate entrance / exit table which concerns on Example 2 is shown. An example of the flow of the whole process which the computer 100 which concerns on Example 2 performs is shown. An example of the detailed flow of S1503 of FIG. 15 is shown. Another example of the detailed flow of S1503 of FIG. 15 is shown. FIG. 18A shows an example of a straight line structure. FIG. 18B shows an example of an annular route structure. FIG. 19A illustrates an example of a Hu-Tucker tree according to the second embodiment. FIG. 19B illustrates an example of usage frequency according to the second embodiment. An example of the detailed flow of S1703 in FIG. 17 is shown. The structural example of the computer with which the personal information anonymization apparatus which concerns on Example 3 of this invention was applied is shown. An example of the regular master table 2131 according to the third embodiment is shown. An example of the anonymous regular master table 2132 which concerns on Example 3 is shown. 14 shows an example of the overall flow of processing executed by the computer 100 according to the third embodiment. The structural example of the computer with which the personal information anonymization apparatus which concerns on Example 4 of this invention was applied is shown. An example of the output of the route search part 2522 which concerns on Example 4 is shown. An example of the flow of the whole process which the computer 100 which concerns on Example 4 performs is shown. An example of the detailed flow of S2702 of FIG. 27 is shown. Another example of the detailed flow of S2702 of FIG. 27 is shown.

  Hereinafter, some embodiments of the present invention will be described in detail with reference to the drawings.

  In the following description, various types of information may be described using the expression “xxx table”, but the various types of information may be expressed using a data structure other than a table. In order to show that it does not depend on the data structure, the “xxx table” can be called “xxx information”.

  In the following description, an ID (identifier) is used to specify an element, but a name or a number may be used as identification information instead of the ID.

  Further, in the following description, there is a case where a process is described by using a function that is exhibited when a “program” is executed by a processor (for example, a CPU (Central Processing Unit)) as a subject. Since the processing is performed using a storage resource (for example, a memory) and / or a communication interface device (for example, a communication port) as appropriate, the subject of processing may be a processor. The processor may include a hardware circuit that performs part or all of the processing performed by the processor. The computer program may be installed on each computer from a program source. The program source may be, for example, a program distribution server or a storage medium.

  Also, all the following embodiments relate to a technique for protecting personal information mainly in electronic form. In the first and second embodiments, the personal information to be anonymized is position information log data (movement log data) representing a position (a position where an adjacency relationship can be defined) in the graph structure environment. The position is, for example, a station in the case of a railway, a stop in the case of a bus, or a mesh in the case of meshed map information.

  In all the following examples, railway is taken as an example of the graph structure environment. In Examples 1 and 2 below, anonymization of personal information refers to a process of converting movement log data so that an information subject (user) cannot be uniquely identified. Re-encoding means replacing time information and position information included in the movement log data with a more ambiguous concept. In the following description, the term “station” is used for a single station as usual. Further, “station A or station B or station C” may be expressed as a set of stations such as “station {A, B, C}”.

  In the following description, “entrance / exit distinction method” and “entrance / exit distinction method” will be described. If each method has a different meaning, clearly indicate that fact. If the methods are not particularly distinguished, it means that both methods are common.

  FIG. 1 shows a configuration example of a computer to which a personal information anonymization apparatus according to Embodiment 1 of the present invention is applied.

  The computer 100 is an information processing apparatus, such as a PC (Personal Computer), a server, or a workstation. The computer 100 includes a CPU (Central Processing Unit) 101, a memory 102, a storage 103, an input device 104, an output device 105, and a communication device 106. All of these are connected to each other by an internal communication line 107 such as a bus.

  The storage 103 is, for example, a CD-R (Compact Disc Recordable), a DVD-RAM (Digital Versatile Disk Random Access Memory), a storage medium such as a silicon disk, a drive device for the storage medium, an HDD (Hard Disk Drive), or the like. The storage 103 stores a station adjacent structure table 131, a ticket gate entrance / exit table 132, an anonymous ticket gate entrance / exit table 133, minimum equivalence number information 134, and a program 151.

  The station adjacent structure table 131 stores information on which station is the next station to which station.

  The ticket gate entry / exit table 132 stores a history of personal location information (movement log data) that is left when a plurality of individuals use a ticket gate existing at a station.

  The anonymized ticket gate entrance / exit table 133 stores a result of anonymizing the movement log data included in the ticket gate entrance / exit table 132.

  The minimum equivalence number information 134 stores a threshold value.

  The program 151 is for realizing functions to be described later.

  The input device 104 is, for example, a keyboard, a mouse, a scanner, a microphone, or the like. The output device 105 is a display device, a printer, a speaker, or the like. The input device 104 and the output device may be integrated (for example, a touch panel display device).

  The communication device 106 is, for example, a LAN (Local Area Network) board or the like, and can be connected to a communication network (not shown).

  The CPU 101 loads the program 151 on the memory 102 and executes it, thereby realizing the time segmentation unit 121 and the position anonymization unit 122.

  The time interval unit 121 receives the ticket gate entrance / exit table 132 as an input, outputs a table obtained by converting time information included in the table into a time interval between two times including the time information, and outputs a position anonymization unit Pass to 122 input.

  The position anonymization unit 122 receives as input the table passed from the time segmentation unit 121, the station adjacent structure table 131, and the minimum equivalence number information 134. In the case of the entrance / exit non-distinguishing method, the position anonymization unit 122 causes the total number of people present at any station in any time interval to be 0 (or more than the value stored in the minimum equivalence number information 134). Re-encode the station. In the case of the entrance / exit distinction method, the position anonymization unit 122 determines that the total number of people who entered any station in any time section and the total number of people who left the station in any time section are 0 ( Alternatively, the station is re-encoded so that the value is equal to or greater than the value stored in the minimum equivalence number information 134. The position anonymization unit 122 stores the result obtained by re-encoding in the anonymous ticket gate entrance / exit table 133. Note that the position anonymization unit 122 may output the result obtained by the re-encoding via the output device 105.

  Next, details of each table described above will be described.

  FIG. 2A shows an example of the station adjacent structure table 131.

  The station adjacent structure table 131 has a plurality of records. Each record indicates which station is adjacent to which station. The table 131 in FIG. 2A represents a graph structure represented by the line structure 200 shown in FIG. 2B. In other words, the track structure 200 includes a position (node) 201 representing a station and an edge (link) 202 representing an adjacent relationship (track) between the station and the station, and each edge is stored in each record of the station adjacent structure table 131. Corresponding (that is, the record and the edge correspond one-to-one).

  In addition, the structure of the station adjacent structure table 131 is not restricted to the example shown to FIG. 2A. There are various expression formats in the graph structure, and any of them can be used as long as it can define the adjacent relationship between actual stations.

  FIG. 3 shows an example of the ticket gate entry / exit table 132.

The ticket gate entry / exit table 132 has a plurality of records. One record means that an individual has entered or left a certain station at a certain time. That is, the ticket gate entry / exit table 132 includes a record having the following information for each movement log:
(1) a user ID 301 which is an identifier of an individual related to the movement log,
(2) Station 302, which is an identifier of the station where the individual exists,
(3) a time 303 representing the time when an individual enters or leaves the station;
(4) Entrance / exit 304 indicating whether an individual has entered or left the station,
Have According to the example of FIG. 3, the individual with the user ID “2” enters the station “B” at 7:22:19 on May 12, 2010, moves to the station “H”, and from the station “H”. It turns out that he left the station at 7:42:11 and entered the station “H” again at 7:48:52 on the same day.

  The ticket gate entry / exit table 132 is updated at any time or periodically.

  The structure of the ticket gate entrance / exit table 132 is not limited to the example shown in FIG. For example, a table in which the user's entry and exit are set may be employed. However, a table that can be converted into a table representation format as shown in FIG. 3 is desirable. In addition, according to the example of FIG. 3, the ticket gate entry / exit history of the railway is adopted as the movement log. However, as described above, the movement log for an arbitrary position in the graph structure such as a bus stop or geographical information having a graph structure. Good to be acquired.

  FIG. 4 shows an example of the minimum equivalence number information 134.

  According to the example of FIG. 4, the minimum equivalence number 401 is five. The minimum equivalence number 401 is an entry / exit non-distinguishing method even if information (anonymized information) in which the number of individuals existing at any station in any time interval is 0 or the minimum equivalence number 401 or more is disclosed. A value that is considered difficult to uniquely identify an individual. Here, “exists” means that in this embodiment, entry or exit has been performed. In addition, it is important that it is the number of individuals, not the number of records existing in an arbitrary time section and an arbitrary station. In the case of the entrance / exit distinction method, the minimum equivalence number 401 is equal to 0 for the number of individuals who entered through a ticket gate at any station and the number of individuals who exited through a ticket gate at any time interval. Or even if information (anonymized information) having a minimum equivalence number of 401 or more is disclosed, it is a value considered that it is difficult to uniquely identify an individual.

  Note that the value of the minimum equivalence number 401 is not limited to five, and may be an arbitrary value. In this specification, the value of the minimum equivalence number 401 may be “k”. This is because the present embodiment relates to k-anonymization.

  FIG. 5 shows an example of the anonymous ticket gate entrance / exit table 133.

The anonymous ticket gate entrance / exit table 133 has a plurality of records. The information included in the record of the anonymous ticket gate entry / exit table 133 is information obtained by re-encoding (obscuring) the information included in the record of the ticket gate entry / exit table 132. A record in the anonymous ticket gate entry / exit table 133 (hereinafter, anonymous record) has a one-to-one correspondence with a record in the ticket gate entry / exit table 132 (hereinafter, normal record). That is, the nth normal record corresponds to the nth anonymous record (n is a natural number). Each record of the anonymous ticket gate entry / exit table 133 includes the following information:
(1) a user ID 501 representing an individual identifier;
(2) a station 502 representing the identifier of the station where the individual existed;
(3) a time interval 503 representing the time interval in which the individual was present at the station;
(4) Entrance / exit 304 indicating whether an individual has entered or left the station,
Have

  The user ID 501 in the nth anonymous record matches the user ID 301 in the nth normal record. In this embodiment, the user ID 501 and the user ID 301 are the same for the same individual. However, in order to improve anonymity, another user ID corresponding to the user ID 301 and the user ID 501 is one-to-one. It may be adopted.

  According to the station 502 of the second anonymous record, it can be seen that the individual “2” exists at the station “B” or the station “C”. According to the second normal record (see FIG. 3), it can be seen that the individual “2” exists at the station “B”, but the information “ B ”is re-encoded into information“ B, C ”represented by the station 502.

  The time section represented by the time section 503 in the nth anonymous record is a section including the time represented by the time 303 in the nth normal record.

  The entrance / exit 504 included in the nth anonymous record matches the entrance / exit 304 in the nth normal record.

The anonymous ticket gate entrance / exit table 133 must satisfy the following restriction (X) in the case of the entrance / exit non-distinguishing method.
(X) The number of different individuals (user IDs 501) corresponding to the combination of the same station 502 and time interval 503 is k or more (minimum equivalent number 401 or more).

On the other hand, the anonymous ticket gate entrance / exit table 133 must satisfy the following restriction (Y) in the case of the entrance / exit distinction method.
(Y) The number of different individuals (user IDs 501) corresponding to the combination of the same station 502, time interval 503, and entrance / exit 504 is k or more (minimum equivalent number 401 or more).

  The table 133 is a table generated by performing a series of processes shown in FIG.

  FIG. 6 shows an example of the overall flow of processing executed by the computer 100 according to the first embodiment.

  First, in step S <b> 601, the time interval unit 121 refers to the ticket gate entrance / exit table 132, re-encodes the time 303 into the time interval 503, and passes the time interval 503 to the position anonymization unit 122 as input.

Next, in S602, the position anonymization unit 122 performs the following processing:
(A) Refer to the output of the time segmenting unit 121 in S601, the station adjacent structure table 131, the ticket gate entrance / exit table 132, and the minimum equivalence number information 134.
(B) In the case of the entrance / exit non-distinguishing method, the number of different individuals corresponding to the tuple (record) including the combination of the same station 502 and time interval 503 to be stored in the anonymized ticket gate entrance table 133 Re-encode the station 302 so that is equal to or greater than k (minimum equivalent number 401).
(C) In the case of the entrance / exit distinction method, the tuple (record) corresponding to the combination of the same station 502, time interval 503 and entrance / exit 504 to be stored in the anonymized ticket gate entrance table 133 is different. Re-encode station 302 so that the number of individuals is k or more (minimum number of cases 401 or more).
(D) The station 502 (information obtained by re-encoding the station 302) according to the result of (b) or (c) above, and the corresponding user ID 501, time interval 503, and entrance / exit 504 are anonymous. Store in the ticket gate entrance / exit table 133,
I do.

  FIG. 7 shows an example of the detailed flow of S601 in FIG. Therefore, the subject of all the steps shown in FIG.

  First, the time segmentation unit 121 initializes B, which stores a record of a table to be finally output, to an empty set (no record) (S701).

  Next, the time segmentation unit 121 refers to the ticket gate entry / exit table 132, divides it into each day, and executes the following loop for each day. The entire record of the day to be executed is stored in D (S702).

  The time segmentation unit 121 sorts the records in D in order of time. The time segmentation unit 121 causes the time of j to be later than the time of i for the i-th record and the j (j> i) -th record (S703). Further, the time segmentation unit 121 initializes a table A for storing and editing records (S704).

  Next, the time segmentation unit 121 performs conditional branching depending on whether the number of records in D is smaller than N determined by the system (S705). Here, N is an integer value greater than or equal to k. N has a value such as 100,000, for example, and finally corresponds to the approximate number of records in each time interval.

  In S705, when the time segmenting unit 121 determines that the number of records in D is not smaller than N (S705: No), the time that any record in A has all the records in A (S706). For example, if the earliest time among the records in A is 10/05/12 07:22:23 and the latest time is 10/05/12 07:30:36, the time segmenting unit 121 , 10/05/12 07:22:23 to 10/05/12 07:30:36 time interval is calculated. Further, the time segmentation unit 121 adds all the records in A to B and initializes A (S707). In S706 and S707, none of the variables changes when executed for the first time.

  Next, the time segmentation unit 121 stores the first N records in D in A. In FIG. 7, D (N) means the first N cases of D. After storing N records in A, the time segmenting unit 121 deletes D (N) from D (S708).

  Further, the time segmenting unit 121 moves all records having the same time as the latest time among the records of A from A to A. The time segmentation unit 121 deletes the transferred record from D (S709). By this process, it is possible to prevent the time intervals of the processing result data of the time interval unit 121 from overlapping each other. After finishing the process of S709, it returns to the conditional branch of S705 again.

  If it is determined in S705 that the number of records in D is smaller than N (S705: Yes), first, all the records in D are added to A (S710). With this process, the processing result data of the time interval unit 121 can be at least N in any time interval.

  Subsequent S711 and S712 are exactly the same as S706 and S707, respectively.

  The time segmentation unit 121 performs the above loop processing for all the days, and finally outputs the table B to be input in S602 (S713) and ends the processing.

  In the example of FIG. 7, the number of records of each time interval is equalized by setting the approximate number of records of each time interval to N. This is to cope with a significant increase in the number of railway users in the commuting time zone and the return time zone, and the fact that the daytime railway usage is less than that in the time zone. By doing this, it is possible to generate highly useful data from the standpoint of using anonymous ticket gate entry / exit data, such as commuting hours, which are frequently used, without the time being so obscured compared to other times .

  Also, the method of leveling the number of records in the time interval is not limited to the method shown in FIG. For example, when there are t records per day, a method of dividing each time interval so as to have a record number of about t / L by specifying the division number L of the time interval in advance. Can also be used.

  FIG. 7 illustrates one method for leveling the number of records in each time interval. However, for example, the time interval may be divided by a fixed time such as every 15 minutes or every hour. For example, in the case of every 15 minutes, 07:23 is re-encoded from 07:15 to 07:30, and so on.

  FIG. 8 shows an example of a detailed flow of S602 in FIG. Therefore, the subject of all the steps shown in FIG.

  First, the position anonymization unit 122 initializes B, which stores the record of the table to be finally output, to an empty set (no record) (S801).

  Next, in the entrance / exit non-distinguishing method, the position anonymization unit 122 divides the record set passed as input from S601 into record sets having the same time interval using the data of the time interval possessed by each record. The following processing is performed on each divided record set D. In the entry / exit distinction method, the position anonymization unit 122 divides the record set into the record sets having the same time interval and the entry / exit tuple, and performs the following processing on each divided record set D (S802).

  First, the location anonymization unit 122 loads the station adjacent structure table 131 into the memory 102 (S803).

  Next, the position anonymization part 122 acquires the frequency of each station from D (S804). The frequency here means the total number of different user IDs associated with the same station.

  Next, the position anonymization unit 122 determines whether or not there is a station having a positive frequency and less than k (S805). Here, positive does not include 0.

  When it is determined in S805 that the frequency is positive and there are less than k stations (S805: Yes), the location anonymization unit 122 randomly selects one station X having a positive frequency and less than k stations. Select (S806).

  Next, the location anonymization unit 122 lists all of the stations adjacent to the station X from the table indicating the station adjacency relationship loaded into the memory 102 in S803 (or rewritten it in S810), and sets this set. It is set as CAND (S807). The CAND can be easily obtained from the table structure shown in FIG.

  Next, the location anonymization unit 122 selects one station Y from the CAND using an index determined by the system (S808). An example of this processing will be described in detail later with reference to FIG.

  Next, the position anonymization unit 122 re-encodes all X or Y cells appearing in D to {X, Y} (S809). {X, Y} indicates that station X or station Y was present. For convenience, the station {X, Y} will be referred to hereinafter.

  Next, the location anonymization unit 122 replaces all X and Y in the station adjacent structure table loaded into the memory in S803 with {X, Y}, and changes the frequency of {X, Y} to the frequency of the station X and the station Y. (S810). When the above processing is completed, the process returns to S805.

  If it is determined in S805 that there are no less than k stations with a positive frequency (S805: No), the location anonymization unit 122 adds all the records in D to B (S811), and Perform loop processing on record sets.

  When the above loop processing is finished for all the objects, the position anonymization unit 122 outputs B to the anonymous ticket gate entrance / exit table and finishes the processing (S812).

  In the example of FIG. 8, in S806, stations with a frequency of less than k are randomly selected, but selection may be performed using some index. For example, a method of selecting a station with the lowest frequency may be applied.

  FIG. 9 shows an example of a detailed flow of S803 in FIG. With reference to FIG. 9, an example of the operation in which the position anonymization unit 122 selects one station Y from the CAND in S808 will be described. In the example of FIG. 9, the station Y is returned with the frequency of each station included in CAND and CAND and the frequency of the station X as inputs.

  First, the position anonymization unit 122 initializes a variable a for storing an index to infinity, and initializes a variable Y for storing a station to be finally returned to a null value (S901).

  Next, the position anonymization unit 122 executes the following procedure for each station S in the CAND in order to search for a station in the CAND that has the smallest index when re-encoding with the station X (S902). .

The position anonymization unit 122 sets b as an index calculated by the following formula (S903).

  However, cnt (h) takes a station as an argument and represents the frequency of the station. The bottom of the log may be arbitrary as long as it is unified in the system. Generally, 2 is used as the bottom of the log. Also, 0log0 is 0. Equation 1 is an amount representing information entropy lost when the station X and the station S are re-encoded.

  Next, the position anonymization unit 122 determines whether or not a is larger than b (S904). If it is determined that a is larger than b, it means that a station candidate having a smaller index is found during re-encoding.

  If it is determined in S904 that a is greater than b (S904: Yes), the position anonymization unit 122 substitutes b for a and S for Y (S905).

  After completing the above loop processing, the position anonymization unit 122 returns the value of Y and ends the processing.

  According to the example of FIG. 9, the station having the smallest value of b among the plurality of stations adjacent to the station X is selected as the station Y. That the value of b is the smallest means that the information loss due to re-encoding is the smallest. This is based on the idea that the personal information of individuals using the station with the smallest number of users is more valuable than the personal information of individuals using the stations with the largest number of users. That is, according to the example of FIG. 9, it is possible to create the anonymous ticket gate entrance / exit table 133 with little information loss while realizing k-anonymization.

  In the example of FIG. 9, as described above, the lost information entropy is adopted as an index for selecting a re-encoding target, but it is not necessary to be limited to this. For example, the proximity of geographical distances may be used as an index, and how close the sum of usage frequencies (number of users) is to k may be used as an index.

  As described above, one feature of the computer 100 according to the present embodiment is that it has a method for making time a time interval and a position anonymization method for re-encoding only the adjacent station. When selecting a station to be re-encoded from a plurality of neighboring stations, some index is used. As described with reference to FIG. 9, if information entropy to be lost is used as an index, stations with low usage frequency are likely to be re-encoded, so that it is useful to avoid excessive re-encoding. An anonymous ticket gate entrance / exit table 133 having high characteristics can be generated.

  In addition, according to the present embodiment, personal information anonymization in consideration of getting on and off can be performed.

  In addition, in the example of operation | movement of FIGS. 6-9 which the computer 100 implement | achieves, anonymity may be broken by the following methods. If there is a station adjacency relationship as shown in FIG. 10A and you live near station B, refer to the ticket entry / exit history for a certain day, and the station that entered the ticket gate first and the ticket gate at the end In many cases, the stations that have exited are identically B. FIG. 10B is an example of anonymizing the ticket entry / exit history of the individual for one day with the example of the operation of FIGS. 6 to 9, but the attacker uses only the data of FIG. Therefore, by taking the product set of {A, B} and {B, C}, it can be predicted that the station used by the individual must be station B. This risk is referred to as a predicted disclosure risk, and is not a risk target to be avoided in the operations of FIGS. Therefore, an example of how to change the operation when it is desired to avoid this prediction disclosure risk is shown.

  First, in the operation example of FIG. 8, the position anonymization unit 122 does not perform the loop of S802 and sets D for all time interval records. In S804, the position anonymization unit 122 acquires both the station frequency in the all time section and the station frequency in the tuple (time section, station). Further, the condition determination in S805 is “There is a tuple with a frequency of less than k (time interval, station)”. In S806, a process of “obtaining one station X with a tuple with a frequency less than k (time interval, station) at random” is performed. Further, in the operation example of FIG. 9, the frequency of each station in the input CAND and the frequency of the station X are the station frequencies in all the time intervals acquired in S804.

  With the above change, if the station before anonymization is the same in all time sections, it can be re-encoded into the same station. For example, in the example of FIG. 10B, all are re-encoded to the stations {A, B, C}. Therefore, anonymization that avoids the above-described risk of predictive disclosure is possible.

  Embodiment 2 of the present invention will be described below. At that time, differences from the first embodiment will be mainly described, and description of common points with the first embodiment will be omitted or simplified. Specifically, for example, when describing the second embodiment, the same reference numerals are given to the same components as those in the first embodiment, and the description thereof is omitted. Further, the same operations as those in the first embodiment are denoted by the same reference numerals and the description thereof is omitted.

  The second embodiment is characterized in that a route that has actually entered and exited a ticket gate is stored by not performing re-encoding with a station on a different route.

  FIG. 11 shows a configuration example of a computer to which the personal information anonymization apparatus according to the second embodiment of the present invention is applied. In the following description, the “entrance / exit distinction method” and the “entry / exit distinction method” will be described as in the first embodiment. If there is a separate process for each method, this is clearly stated. Unless otherwise specified, it means that both methods are common.

  The CPU 101 loads the program 1151 on the memory 102 and executes it, thereby realizing the time segmentation unit 121, the position anonymization unit 1121, and the route search unit 1122.

  The route search unit 1122 takes the ticket gate entrance / exit table 132 as an input, sets the entrance time of each individual ticket gate, the tuple of the entrance station, the ticket exit time immediately after the individual, and the tuple of the exit station as a set. Calculate the route you got on and the route you got off at the exit station. The route search unit 1122 assigns and outputs this route to each record in the ticket gate entrance / exit table 132 and passes it to the input of the time segmentation unit 121. In order to realize the route search unit 1122, an existing route search technology (for example, a technology according to a route search service provided on the Web) can be used as it is.

  FIG. 13 shows an output example of the route search unit 1122.

From the ticket gate entrance / exit table 132 as shown in FIG. 3, the route search unit 1122 indicates that, for example, after the individual with the user ID “1” enters the station A at 2010/05/12 07:20:13, 2010/05/12
The information that the station G was left at 07:43:10 is acquired. And the route search part 1122 estimates the information of boarding on an alpha route and getting off on an alpha route using the existing route search technology. Further, the route search unit 1122 assigns and outputs this information to each record of entry and exit. An example of the output information is the information shown in FIG. The boarding route and the getting-off route may be different.

  The time segmentation unit 121 receives the output of the route search unit 1122 as an input, and outputs a table obtained by converting the time column of each record into a time interval as in the first embodiment, and the input of the position anonymization unit 1121 Pass to.

  The position anonymization unit 1121 receives as input the table passed from the time segmentation unit 121, the route station adjacent structure table 1131, and the minimum equivalence number information 134. In the case of the entrance / exit non-distinguishing method, the position anonymization unit 1121 re-codes the station so that the total number of people existing at any station on any time section and any route becomes 0 (or k or more). Turn into. In the case of the entrance / exit distinction method, the position anonymization unit 1121 includes the total number of people who entered any station on any route in any time section, and any station on any route in any time section. The station is re-encoded so that the total number of people leaving the station becomes 0 (or more than k). At this time, stations that perform re-encoding are limited to stations on the same route. The position anonymization unit 122 outputs the above result to the anonymous ticket gate entrance / exit table 133. FIG. 14 shows an example of the anonymized ticket gate entrance / exit table 133 generated by anonymization in the second embodiment, and it can be seen that all the original stations indicated by the anonymized station are the same route. Note that the information represented by the table 133 may be output via the output device 105.

  FIG. 12A shows a configuration example of the route station adjacent structure table 1131.

  The difference from the station adjacent structure table 131 shown in FIG. 2 is that the number of line columns indicating which line runs on the line connecting the stations is increased. In FIG. 12A, the route station adjacent structure table 1131 corresponds to the route structure 1200 shown in FIG. 12B. Specifically, according to the route station adjacent structure table 1131 shown in FIG. 12A, it can be seen that the route alpha is configured as A-B-C-J-K-G-L-M. It can be seen that beta is a circular line C-D-E-F-G-H-I-C. When different routes run between the same stations, for example, two records (N, O, gamma) and (N, O, delta), and two routes gamma and delta between station N and station O are used. Can show that is running.

  The structure of the route station adjacent structure table 1131 is not necessarily limited to the structure shown in FIG. 12A. There are various representation formats in the graph structure, and any of them can be used as long as it can define the adjacent relationship between the actual stations and the route that runs between them.

  Next, FIG. 15 illustrates an example of the overall flow of processing executed by the computer 100 according to the second embodiment.

  First, in S1501, the route search unit 1122 estimates the route of getting on or getting off of each record in the ticket gate entrance / exit table 132. Note that, as described above, this estimation may be performed using existing technology, and thus detailed description thereof is omitted. The route search unit 1122 outputs a table in which estimated route information (information indicating an estimated route of a station registered in each record) is added to each record of the ticket gate entrance / exit table 132.

  In step S1502, the time segmentation unit 121 receives the table output from the route search unit 1122 and converts the time column in the input table into a time interval. The details of S1502 are the same as those in the first embodiment except that the ticket gate entrance / exit table 132 is not acquired in S702 but the output of the route search unit 1122 is different.

Next, in S1503, the position anonymization unit 1121 performs the following processing:
(A) Refer to the output of the time segmentation unit 121, the route station adjacent structure table 1131, and the minimum equivalence number information 134.
(B) In the case of the entrance / exit non-distinguishing method, the number of different individuals corresponding to the tuple (record) including the combination of the same station 502 and time section 503 on the same route is more than k (minimum equivalent number 401 or more). Re-encode station 302 to
(C) In the case of the entrance / exit distinction method, the number of different individuals corresponding to tuples (records) including combinations of the same station 502, time interval 503 and entrance / exit 504 on the same route is equal to or greater than k (minimum number of cases) 401 or more), and re-encoding the station 302 so that
(D) The station 502 (information obtained by re-encoding the station 302) according to the result of (b) or (c) above, and the corresponding user ID 501, time interval 503, and entrance / exit 504 are anonymous. Store in the ticket gate entrance / exit table 133,
I do.

  FIG. 16 shows an example of a detailed flow of S1503 in FIG. The position anonymization part 1121 performs each step of FIG. Since the example shown in FIG. 16 is almost the same as the details of S602, only steps having different operations are given different step numbers and described.

  In S1601, in the entrance / exit non-distinguishing method, the position anonymization unit 1121 divides the record set passed as input from S1502 into record sets having the same time interval, and for each divided record set E, the following Perform loop processing. In the entry / exit distinction method, the position anonymization unit 1121 divides the record set into the same time interval and the entry / exit tuple, and performs the following loop processing on each divided record set E.

  In S1602, the position anonymization unit 1121 divides the record included in E for each route, and performs the subsequent loop processing on each record set D.

  In S1603, the position anonymization unit 1121 loads the station adjacent structure related to the route selected in S1602 from the route station adjacent structure table 1131 to the memory 102.

  As described above, if the processing example of FIG. 8 is changed, one processing example of S1503 can be realized.

  FIG. 17 shows another example of the detailed flow of S1503 of FIG. The position anonymization unit 1121 performs each step of FIG. In the example of FIG. 17, the same step number is assigned to the same step as in FIGS. 8 and 16. Steps different from those in FIGS. 8 and 16 will be mainly described.

  From the table shown in FIG. 12A, as the structure of the route, a straight line shown in FIG. 18A (a normal route that moves linearly with A-B-C-D-E) and a circular line shown in FIG. 18B (A-B -C-D-E-F-A and a circular line moving in a circular manner) are specified.

  The location anonymization unit 1121 generates a Hu-Tucker tree using the station adjacency relationship and the use frequency after acquiring the station adjacency relationship of the route being processed in S1603 and the use frequency of each station in S804. (S1701). As a method for constructing this code tree, for example, the method described in the document “DE Knuth,“ The Art of Computer Programming: Volume 3 Sorting and Searching, ”Addison-Wesley, pp. 439 to 444, 1973” can be adopted. it can. The Hu-Tucker tree is an algorithm for generating a binary tree that preserves the total order relation. In the case of the straight line shown in FIG. 18A, the position anonymization unit 1121 captures the entire order from the station at one end of the straight line to the station at the other end. The algorithm does not depend on which end is the first. For example, in the example of FIG. 18A, the order is A → B → C → D → E. In the case of the circular line shown in FIG. 18B, the order is not the entire order but the cyclic order. However, the Hu-Tucker tree construction algorithm only performs the adjacency determination, and can be executed without any problem. It is.

  Next, the position anonymization unit 1121 assigns a label and a frequency to each internal node of the configured Hu-Tucker tree (S1702). Specifically, for example, it is assumed that the label lists all the leaves (actual stations) as grandchildren. The frequency is the sum of the frequencies of all leaves that are grandchildren.

  FIG. 19A shows an example of the Hu-Tucker tree configured in S1701 and S1702.

  In FIG. 19A, a node 1901 indicated by a circle corresponds to a station, and a broken line in the drawing indicates a route structure of A-B-C-D-E. For example, when the frequency information as illustrated in FIG. 19B is acquired in S804, the structure of the Hu-Tucker tree is a tree as illustrated in FIG. 19A. A broken line directly connecting A, B, C, D, and E is not a tree branch. A node 1902 represented by a square is an internal node. When a label and a frequency are assigned to the internal node in S1702, for example, information {A, B, C} in which leaves corresponding to grandchildren are arranged like a node 1902 is used as a label, and the frequency of the leaves A, B, C is changed. The sum 10 is the frequency. In addition, as in {A, B, C, D, E}, an internal node that is most ambiguous and has the highest frequency when re-encoded is called a root.

  Next, the location anonymization unit 1121 determines which station is to be re-encoded to which internal node on the created Hu-Tucker tree (S1703), and the station of each record included in D is determined. Re-encoding is performed according to the correspondence (S1704). Specifically, for example, the position anonymization unit 1121 marks a node to be re-encoded in S1703, and re-encodes to a node marked to be re-encoded for the first time in S1704 by following the parent from the leaf. Turn into. If the leaf is a target for re-encoding, re-encoding is not performed.

  FIG. 20 shows an example of the detailed flow of S1703 in FIG. 17 (processing for determining re-encoding correspondence on the created Hu-Tucker tree). The position anonymization unit 1121 performs each step of FIG.

  First, the position anonymization unit 1121 initializes the stack S, and puts a node corresponding to the root of the input Hu-Tucker tree into S (S2001). A stack is a data structure similar to an array that allows operations called push and pop. Push is an operation that inserts data at the end of an array, and pop takes out the data at the end of the array and deletes it from the array. It is an operation.

  Next, the position anonymization unit 1121 determines whether or not S is empty (S2002). If S is empty (S2002: Yes), the process ends.

  If it is determined in S2002 that S is not empty (S2002: No), the position anonymization unit 1121 pops a node from S and sets this as n (S2003).

  Next, the position anonymization unit 1121 determines whether or not n is a leaf (S2004).

  If it is determined in S2004 that n is not a leaf (S2004: No), the position anonymization unit 1121 determines that both of the two children of n are the same as 0 or the minimum number of equivalences 401 or more, that is, k or more. It is determined whether or not it has a frequency (S2005).

  If it is determined in S2004 that n is a leaf (S2004: Yes), or if at least one child of n has a positive frequency less than k in S2005 (S2005: No), the position anonymization unit 1121 adds a flag to node n as a re-encoding target (S2007), and returns to the condition determination of S2002.

  In S2005, when the two children of n are both equal to 0 or have a frequency of k or more (S2005: Yes), the position anonymization unit 1121 sets all children of n having a positive frequency to S. Push (S2006) and return to the condition determination of S2002.

  As described above, one feature of the second embodiment is that the route on which the user gets on and the route on which the vehicle gets off are stored. Thus, even when analysis or route estimation is performed using the anonymous ticket gate entrance / exit data 133, it is possible to accurately estimate the route on which the vehicle has been boarded.

  The implementation method of S1503 shown in FIG. 17 uses a Hu-Tucker tree, and the Hu-Tucker tree arranges a low-frequency thing in a deep hierarchy of a tree and a high-frequency thing in a shallow hierarchy of a tree. Since it has characteristics, it can be expected that highly useful data that avoids excessive re-encoding can be generated.

  Note that the prediction disclosure risk described at the end of the first embodiment can also be avoided in the second embodiment by a similar process change.

  Embodiment 3 of the present invention will be described below. At that time, differences from the first embodiment will be mainly described, and description of common points with the first embodiment will be omitted or simplified. Specifically, for example, when describing the third embodiment, the same reference numerals are given to the same components as those in the first embodiment, and the description thereof is omitted. Further, the same operations as those in the first embodiment are denoted by the same reference numerals and the description thereof is omitted.

  In Example 3 (and Example 4 described later), the personal information to be anonymized is the personal information recorded in the master table of the commuter pass (for example, the node at one end and the other end of the section used by the user). Information including information representing a node).

  In Example 3, the anonymization of the commuter pass master table is performed. In the third embodiment, route information is not stored as in the second embodiment, and the same method as in the first embodiment is performed.

  FIG. 21 shows a configuration example of a computer to which the personal information anonymization apparatus according to the third embodiment of the present invention is applied.

  The CPU 101 implements the position anonymization unit 2121 by loading and executing the program 2151 on the memory 102.

  The position anonymization unit 2121 receives the station adjacent structure table 131, the regular master table 2131, and the minimum equivalence number information 134 as inputs. Further, the location anonymization unit 2121 uses a periodic master table 2131, which will be described later, at least as many people as the number k stored in the minimum equivalence number information 134 is used in any station that appears in the table. Then, the station is re-encoded and the result is output to the anonymous periodic master table 2132. Note that the position anonymization unit 2121 may output the processing result via the output device 105.

  FIG. 22 shows an example of the regular master table 2131.

  The regular master table 2131 has a plurality of records. Each record includes information of user ID 301, station 1 (2201), and station 2 (2202). One record means that the individual identified from the user ID 301 in the record has a commuter pass from the station represented by the station 1 (2201) to the station represented by the station 2 (2202). In the example of FIG. 22, an individual has only one commuter pass, but this is not necessarily the case. For example, each record of the regular master table 2131 may include information on a station m (m is an integer of 3 or more) as information indicating a passing station.

  Information in the above-mentioned regular master table 2131 is stored in advance.

  FIG. 23 shows an example of the anonymous periodic master table 2132.

  The anonymous regular master table 2132 is a table in which the regular master table 2131 is obscured. Records in the anonymous regular master table 2132 (hereinafter referred to as anonymous records) correspond one-to-one to records in the regular master table 2131 (hereinafter referred to as normal records).

  The user ID 501 in the nth anonymous record matches the user ID 301 in the nth normal record. In this embodiment, the user ID 501 and the user ID 301 are the same for the same individual. However, in order to improve anonymity, another user ID corresponding to the user ID 301 and the user ID 501 is one-to-one. It may be adopted.

  The station 1 (2301) of the nth anonymous record is information obtained by re-encoding the station 1 (2201) of the nth normal record, and the station 2 (2302) of the nth anonymous record is the nth record. The normal record station 2 (2202) is re-encoded information. Station 1 (2301) does not necessarily re-encode station 1 (2201), station 2 (2302) need not re-encode station 2 (2202), and station 1 (2301) The station 2 (2202) and the station 2 (2302) may re-encode the station 1 (2201). However, for the sake of simplicity of explanation, in this embodiment, it is assumed that the station 1 (2301) re-encodes the station 1 (2201), and the station 2 (2302) re-encodes the station 2 (2202).

  FIG. 24 illustrates an example of the overall flow of processing executed by the computer 100 according to the third embodiment. In the present embodiment, since the position anonymization unit 2121 only performs the anonymization process, FIG. 24 shows an example of the process flow of the position anonymization unit 2121. That is, the position anonymization unit 2121 performs each step shown in FIG. In FIG. 24, since there are many steps in common with FIG. 8, the same numbers are assigned to these steps, and description thereof is omitted here.

  In S2401, the location anonymization unit 2121 acquires the regular master table 2131 and sets it as D.

  In S2402, the position anonymization unit 2121 acquires the appearance frequency of each station from D. Here, the appearance frequency of each station refers to the total number of users whose station 1 (2201) or station 2 (2202) matches each station.

  In S2403, the position anonymization unit 2121 outputs B to the anonymous periodic master table 2132 and ends the process.

  As described above, one feature of the third embodiment is that, unlike the first and second embodiments, anonymization is performed on the commuter pass master table. Furthermore, there is a feature that re-encoding is always performed only with adjacent stations. The index used at that time can be the same as that of the first embodiment, and when information entropy is used as the index, a result having the properties described in the first embodiment can be obtained.

  Embodiment 4 of the present invention will be described below. Example 4 also anonymizes the commuter pass master table. In the fourth embodiment, a method of storing route information as performed in the second embodiment will be described. Hereinafter, when describing the fourth embodiment, the same reference numerals are given to the same configurations and operations as those of the first, second, and third embodiments, and the description thereof is omitted.

  FIG. 25 shows a configuration example of a computer to which the personal information anonymization apparatus according to the fourth embodiment of the present invention is applied.

  The CPU 101 loads a program 2551 on the memory 102 and executes it, thereby realizing a position anonymization unit 2551 and a route search unit 2522.

  The route search unit 2522 receives the regular master table 2131 as an input, calculates routes for getting on and off both stations from information on two stations indicating the regular section of each commuter pass holder, and records each regular master table 2131. The route is assigned to the output, and is passed to the input of the position anonymization unit 2521. In this case, the existing route search technology can be used as it is for realizing the route search unit 2522. Alternatively, if the commuter pass designates a route in advance, the information may be separately recorded in the storage 103 or stored in an external computer (not shown). In such a case, two routes to which two stations respectively belong may be estimated from the information.

  FIG. 26 shows an example of the output of the route search unit 2522.

  The route search unit 2522 refers to, for example, information possessing a period between the station A and the station G having the user ID 1 from the periodical master table 2131 shown in FIG. Information that the route is used and that the alpha route is used when getting on or off at the station G is estimated. Further, the route search unit 2522 gives this information in association with the stations of the station 1 and the station 2 and outputs them. In other words, the information output from the route search unit 2522 is a table in which route information is added to the regular master table 2131 (a table to which information representing routes estimated for each of the station 1 and the station 2 is added).

  The position anonymization unit 2521 receives the table passed from the route search unit 2522, the route station adjacent structure table 1131, and the minimum equivalence number information 134. Further, the location anonymization unit 2521 uses the regular master table 2131 so that at least any number of stations appearing in the table is used by at least the number k stored in the minimum equivalence number information 134. In addition, the station is re-encoded so that any station included as a set value in the re-encoded station is a station on the same route as the original station, and the result is output to the anonymous periodic master table 2132. Note that the position anonymization unit 2521 may output the processing result via the output device 105.

  FIG. 27 illustrates an example of the overall flow of processing executed by the computer 100 according to the fourth embodiment.

  First, the route search unit 2522 receives the regular master table 2131 as an input, estimates the use routes of the stations at both ends indicating the regular section, creates a table as shown in FIG. 26, and passes it to the location anonymization unit 2521 (S2701). ). Next, the position anonymization unit 2521 re-encodes the station to achieve anonymization (S2702).

  FIG. 28 shows an example of the detailed flow of S2702 of FIG. The position anonymization unit 2521 performs each step of FIG. Note that the same steps as those in FIG. 8 and FIG. The processing example of FIG. 28 is an example in which the processing example of S1503 shown in FIG.

  In S2801, the position anonymization unit 2521 sets E as the input table passed from the route search unit 2522 as the output of S2701.

  In S2802, the position anonymization unit 2521 enumerates each route included in E, and performs a loop process separately on each route. When the loop process is performed, a set of all stations on the route to be processed is D.

  In S2803, the position anonymization unit 2521 acquires the frequency of each station included in D from E. At this time, what is counted as the frequency of each station is the total number of users whose station 1 or station 2 matches each station. However, even if the stations are the same, those that use different routes (route information that can be acquired from E and routes that are different in the loop) are not counted.

  In S2804, the position anonymization unit 2521 converts the station X or station Y included in E on the route being processed in the loop into the station {X, Y}. Note that the station X and the station Y are stations on the route being processed and should be the same, so there is no need to convert the route.

  In S2805, the position anonymization unit 2521 deletes the station X and the station Y from D, and adds a station {X, Y} instead.

  In S2806, the position anonymization unit 2521 stores E in the anonymous periodic master table 2132. In this example, the column “Route 1” and the column “Route 2” are removed during storage.

  FIG. 29 shows another example of the detailed flow of S2702 of FIG. Note that all steps in FIG. 29 are the same as those in FIGS. 8, 16, 17, and 28, and the same numbers are assigned to these steps, and descriptions thereof are omitted. The processing example of FIG. 29 is an example in which the processing example of S1503 shown in FIG.

  As described above, one feature of the fourth embodiment is that, as in the third embodiment, the anonymization is performed on the commuter pass master table. The difference from the third embodiment is that the use route estimated from the station tuple included in the anonymous periodic master table after re-encoding matches the use route estimated from the data before re-encoding.

  As mentioned above, although several Example of this invention was described, these are illustrations for description of this invention, Comprising: It is not the meaning which limits the scope of the present invention only to these Examples. That is, the present invention can be implemented in various other forms. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. In addition, a part of the configuration of a certain embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of a certain embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

  100: Computer, 101: CPU, 102: Memory, 121: Time segmentation unit, 122: Location anonymization unit, 103: Storage, 131: Station adjacent structure table, 132: Ticket gate entry / exit table, 133: Anonymous ticket gate entry / exit Table: 134: minimum equivalence number information, 151: program, 104: input device, 105: output device, 106: communication device, 107: internal communication line, 1121: position anonymization unit, 1122: route search unit, 1131: route Station adjacent structure table, 1151: Program, 2121: Location anonymization unit, 2131: Regular master table, 2132: Anonymous regular master table, 2151: Program, 2521: Location anonymization unit, 2522: Route search unit, 2551: Program

Claims (13)

Adjacent relation information including adjacency tuples representing adjacency relations indicating which positions are adjacent to which of a finite number of plural positions, personal identification information, and the individual's use at the plural positions Storage means for storing personal management information including a personal information tuple for each individual, which is personal information including positional information indicating a position to be performed;
By aggregating only the positions in the adjacent relationship indicated by the adjacent relationship information, the number of different individuals corresponding to a plurality of anonymized personal information tuples including the same set of positions becomes a predetermined threshold or more. Thus, the personal information anonymization apparatus which has the anonymization means which anonymizes each personal information tuple. The personal information anonymization device according to claim 1,
Route estimation means for estimating a route to which the position represented by the position information in the personal information tuple belongs, for each personal information tuple;
Further comprising
The adjacency information includes information indicating a route including a link connecting a position and a position adjacent to the position for each adjacency,
The anonymization means anonymizes each personal information tuple so that the number of different individuals corresponding to a plurality of anonymized personal information tuples including the same position set on the same route is equal to or greater than a predetermined threshold. To
Personal information anonymization device. The personal information anonymization device according to claim 2,
The structure of each path represented by the adjacency information is either a linear structure or a ring structure,
The anonymization means anonymizes each personal information tuple using a binary tree generated by constructing a Hu-Tucker tree;
Personal information anonymization device. The personal information anonymization device according to claim 1 or 2,
The anonymization means sets the position where the number of individuals used is the smallest among two or more positions adjacent to the first position among the plurality of positions as the second position, and In anonymization, the first position and the second position are aggregated;
Personal information anonymization device. The personal information anonymization device according to claim 4,
The second position is (-X frequency) × log (X frequency / (X frequency + S frequency) among the aggregation candidates S that are two or more positions adjacent to the first position (X). Frequency))-S frequency × log (frequency of S / (frequency of X + frequency of S)) is the smallest position.
Personal information anonymization device. The personal information anonymization device according to any one of claims 1 to 5,
Each of the personal information tuples includes time information indicating the time of entering or leaving the used position.
A time sectioning means for obscuring the time represented by the time information of each personal information tuple into a time section;
Further comprising
Each anonymized personal information tuple contains information representing time intervals,
The anonymization means anonymizes each personal information tuple so that the number of different individuals corresponding to a plurality of anonymized personal information tuples including the same position set and time interval is equal to or greater than a predetermined threshold. To
Personal information anonymization device. The personal information anonymization device according to any one of claims 1 to 5,
Each of the personal information tuples includes entry / exit information that indicates whether the entry is to or from the location used.
The anonymization means anonymizes each personal information tuple so that the number of different individuals corresponding to a plurality of anonymized personal information tuples including the same location set and entrance / exit information is equal to or greater than a predetermined threshold. To
Personal information anonymization device. The personal information anonymization device according to claim 6,
Each of the personal information tuples includes entry / exit information that indicates whether the entry is to or from the location used.
The anonymization means is configured so that the number of different individuals corresponding to a plurality of anonymized personal information tuples including the same position set, time interval, and entrance / exit information is equal to or greater than a predetermined threshold. Anonymize tuples,
Personal information anonymization device. The personal information anonymization device according to claim 6 or 8,
The time segmenting means converts the time in each personal information tuple to a time interval so that the number of personal information tuples including information representing the time belonging to the time interval is substantially uniform in a plurality of time intervals. Vague,
Personal information anonymization device. The personal information anonymization device according to any one of claims 1 to 9,
The anonymization means anonymizes the individual information tuples so as to be the same position set for the same position included in the personal management information storage means.
Personal information anonymization device. The personal information anonymization device according to any one of claims 1 to 5,
Each personal information tuple includes, as position information, information representing two or more different positions,
For each of the two or more different positions, the anonymization means collects only the positions in the adjacent relationship indicated by the adjacent relationship information, thereby obtaining the same position set for each of the two or more different positions. Anonymizing each personal information tuple so that the number of different individuals corresponding to the plurality of anonymized personal information tuples included is greater than or equal to a predetermined threshold;
Personal information anonymization device. Refer to adjacency information including adjacency tuples representing adjacency relations indicating which positions are adjacent to which position of a finite number of positions, for each position,
Each of the personal information tuples in the personal management information including personal information tuples, which are personal information including personal identification information and position information indicating positions used by the individual at the plurality of positions, for each individual By aggregating only the positions in the adjacent relationship indicated by the information, the number of different individuals corresponding to a plurality of anonymized personal information tuples including the same position set is equal to or greater than a predetermined threshold. Anonymize,
Personal information anonymization method. With reference to adjacency information including adjacency tuples representing adjacency relations indicating which positions are adjacent to which positions of a finite number of positions, for each position,
Each of the personal information tuples in the personal management information including personal information tuples, which are personal information including personal identification information and position information indicating positions used by the individual at the plurality of positions, for each individual By aggregating only the positions in the adjacent relationship indicated by the information, the number of different individuals corresponding to a plurality of anonymized personal information tuples including the same position set is equal to or greater than a predetermined threshold. Anonymize,
A computer program that causes a computer to execute.

Images