JP2013080525A - Processing program in secret tabulation system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a processing program in a secret tabulation system capable of eliminating leakage of secret processing according to order of desires of users.SOLUTION: Priority determination means 111 refers to a priority table 131 and determines an element with a low priority. Tolerance determination means 112 refers to a tolerance table 132 of the element, minimizes a secret level, and determines whether the element subject to processing is within the tolerance or not. When the element is within the tolerance, threshold determination means 113 refers to a threshold table 133 and determines whether or not the element exceeds the threshold in all tabulation items in the secret level. When the element exceeds the thresholds in all the tabulation items, management means 117 finishes the secret processing. When the element does not exceed any of all the tabulation items, the tolerance determination means 112 broadens the secret level of the element by one level. When the broadened item is within the tolerance, the threshold determination means 113 performs the determination processing.

Description

The present invention relates to a processing program in a secret counting system that performs secret processing from the viewpoint of protecting personal information when tabulating / analyzing on map information, and in particular retains personal position information with attributes such as age and category. The present invention relates to a processing program of a secret totaling system that can be effectively concealed so that an individual cannot be identified when totaling and analyzing in a state where the information is collected.

[Conventional technology]
Conventionally, when the location information of individuals on the map information is kept in the state that retains attributes such as age and category, and aggregated and analyzed in administrative boundaries and mesh units, individuals cannot be identified from the viewpoint of personal information protection It is necessary to perform some kind of concealment processing.

  For example, a method of deleting the position information of an individual who can be specified from the administrative boundary or the mesh, or a method of moving the position information of the specified individual to another administrative boundary or mesh is conceivable.

[Related technologies]
As a related technique, there is JP 2007-219635 “Information concealment method and personal information management and operation apparatus” (Applicant: Nippon Telegraph and Telephone Corporation) (Patent Document 1).
In this patent document 1, when the personal information protection operation apparatus receives an attribute disclosure request from a provider, it secretly calculates how much confidentiality is lost with respect to the user ID, and only the attribute information that can ensure confidentiality is given to the provider. It is disclosed.

Further, as a related technique, there is JP-A-2003-322531 “Navigation device” (Applicant: Alpine Corporation) (Patent Document 2).
This patent document 2 reads personal information registered in a memory of a mobile phone, specifies a display position based on a telephone number included in the personal information, and a specific image composed of a text image and a registered image included in the personal information. Is superimposed and displayed on a map image around the vehicle position.

JP 2007-219635 A JP 2003-322531 A

However, in the above-mentioned conventional confidential processing, if the personal location information is simply deleted, the statistical values will not match, or if the personal location information is moved to other administrative boundaries, etc. There was a problem that data could not be obtained.
Further, if the concealment process is performed manually, it is not efficient, and there is a problem that the concealment process is omitted and personal information cannot be sufficiently protected.

[Object of invention]
The present invention has been made in view of the above circumstances, and it is possible to calculate and analyze the position information of individuals on map information relatively accurately while retaining attribute information, and further eliminate the leakage of confidential processing. An object of the present invention is to provide a processing program in a concealed aggregation system.

The present invention for solving the problems of the above-described conventional example is a processing program in a concealment aggregation system that includes a control unit and a storage unit, and executes concealment processing of aggregation data when performing aggregation processing, As a means realized by the operation of the control unit , with reference to a priority table for setting priorities for a plurality of elements to be aggregated, stored in the storage unit, priority determining means for determining elements having a low priority; For the element , refer to an allowable range table that sets the allowable range at the concealment level stored in the storage unit , minimize the concealment level, and determine whether the processing target element is within the allowable range determining means, if it is within the allowable range, and stored in the storage unit, for each minimum unit of aggregation for each element to determine further whether to perform encryption processing of the aggregated data for each aggregation unit of the upper threshold Referring to threshold table for setting a threshold value determining means for determining whether or not exceeding the threshold value in all summary field in secrecy level, when exceeding the threshold value in all summary field Management means for terminating the concealment process, and when the allowable range determination means does not exceed the threshold value for any of the total items, the confidential level of the element is determined by referring to the allowable range table. 1 level is broadly defined, and it is determined whether or not the concealed level in the broad sense is within the allowable range for the element. It is determined whether or not the threshold value is exceeded, and when the threshold value is exceeded for all the total items, the concealment process is terminated by the management means.

According to the present invention, in the processing program of the secret totaling system, the allowable range determining means refers to the allowable range table, determines whether the confidential level is within the allowable range for the element, and determines the priority when it is not within the allowable range. The means refers to the priority order table to determine whether or not the priority order set for the next priority element is exceeded. If the priority order is not exceeded, the allowable range determination means , Refer to the allowable range table for the element, determine whether the element to be processed is within the allowable range by making the concealment level the lowest, and the priority set for the element of the next priority is exceeded Is characterized in that the management means terminates the process on the assumption that the concealment process has not been performed.

In the processing program of the above secret totaling system, the threshold value determining means refers to the threshold value table, determines whether or not all threshold items exceed the threshold value in the secret level, If any of the aggregate items does not exceed the threshold, the management means determines whether or not distributed processing is set, and if set, the distribution realized by the program operation of the control unit The process execution means performs distributed processing on the aggregated data, and the threshold value determination means determines again whether or not the threshold value has been exceeded for all the aggregate items at the confidentiality level.

In the processing program of the above secret totaling system, the threshold value determining means refers to the threshold value table, determines whether or not all threshold items exceed the threshold value in the secret level, When the threshold value is not exceeded in any of the total items, the management unit determines whether or not the erasure processing is set, and if it is set, the erasure realized by the program operation of the control unit. The process execution means performs an erasure process on the total data, and the threshold value determination means determines again whether or not the threshold values have been exceeded for all the total items at the confidentiality level.

According to the present invention, in the processing program of the secret totaling system, the distributed processing execution unit does not execute the distributed processing when the number of distributions is greater than a preset number, and the allowable range determination unit refers to the allowable range table. Then, the secret level of the element is broadened by one level, and it is determined whether or not the broadened secret level is within an allowable range for the element.

The present invention provides the processing program for the above-mentioned secret totaling system , in which the erasure process execution means does not execute the erasure process when the erasure ratio is higher than a preset ratio, and the allowable range determination means refers to the allowable range table. Then, the secret level of the element is broadened by one level, and it is determined whether or not the broadened secret level is within an allowable range for the element.

The present invention displays the map data stored in the storage unit on the display device as the means realized by the operation of the control unit in the processing program of the above-mentioned secret totaling system , and displays the aggregated data subjected to the confidential processing in an overlapping manner. It has a map information display means .

In the processing program of the above-mentioned secret totaling system , as a means realized by the operation of the control unit , when the secret processing is executed, the element and the secret level are used as a processing order table for the order in which the secret processing is executed. A processing order table generating means for generating, a processing order table changing means for changing the order of the generated processing order table, and a threshold value table for the element and the concealment level indicated by the order according to the order of the changed processing order table To determine whether or not the threshold value has been exceeded for all the aggregation items in the confidential level, and if the threshold value has not been exceeded for any of the aggregation items, Refer to the threshold value table for the rank element and secret level, and set the threshold value for all items in that secret level. And a process of determining ranking table execution unit or Etaka not, the management unit, if they exceed the threshold in any of all the summary field, characterized in that to terminate the security process.

According to the present invention, in the processing program of the secret totaling system, the processing order table generating means includes identification information indicating that the concealment process has been performed on the element and the concealment level that have been subjected to the concealment process in the processing order table. It is characterized by being granted.

According to the present invention, the priority determining means refers to the priority table to determine an element having a low priority, and the allowable range determining means refers to the allowable range table for the element and minimizes the level of secrecy. , It is determined whether or not the element to be processed is within the allowable range. When the management means exceeds the threshold value for all the total items, the concealment process is terminated, and the allowable range determination means sets the threshold value for any of the total items. If not, refer to the allowable range table, make the element's concealment level one level broad, determine whether the broad concealment level is within the allowable range for the element, and if it is within the allowable range Threshold judgment In in determining whether exceeds a threshold value in all summary field in secrecy level, when exceeding the threshold value in all summary field, concealment aggregation system processing program for terminating the security process by the management unit There is an effect that the confidential processing can be performed without omission according to the user's desired order.

According to the present invention, when the processing order table generating unit executes the concealment process, the processing order table changing unit generates the element and the concealment level as the processing order table for the order in which the concealment process is executed. The processing order table execution means changes the order of the processed processing order table, and refers to the threshold value table for the element and the confidential level indicated by the order according to the order of the changed processing order table. It is determined whether or not the threshold value has been exceeded for all the total items, and if the threshold value has not been exceeded for any of the total items, the next rank element and concealment level are determined in the processing order table. Referring to the threshold table, determine whether or not the threshold value has been exceeded for all the total items in the confidential level, and the management means If exceeds the threshold value at either, since the above secret aggregation system processing program to terminate the security process, the effect of readily available processing order previously performed.

1 is a schematic configuration diagram of a secret tabulation system according to an embodiment of the present invention. It is the schematic which shows a priority table. It is the schematic which shows a tolerance | permissible_range table. It is the schematic which shows the threshold value table in the case of a category. It is a figure which shows the outline | summary of the implementation means in this system. It is a figure which shows the processing flow of a secret tabulation logic. It is a figure of the example of a display which superimposed the mesh on the map. FIG. 7 shows customer information displayed in dots. It is a figure which shows the example of a display after performing a concealment process. It is a figure which shows a process order table.

Embodiments of the present invention will be described with reference to the drawings.
[Outline of the embodiment]
The secret tabulation system according to the embodiment of the present invention sets, for example, a priority, an allowable range, and a threshold for three elements of region, age, and category group. Concealment processing is terminated if all the aggregate items exceed the threshold at the level, and if any of the aggregate items does not exceed the threshold, the next secret level or next priority element is described above. Since the same processing is performed, the concealment processing can be realized without omission under specific conditions according to the user's desired order.
In the above description, three elements have been described. However, in the embodiment of the present invention, two elements or more are sufficient, and even four elements can be realized.

  In addition, the concealment aggregation system according to the embodiment of the present invention generates the processing order of the concealment processing performed last time in the processing order table, enables the order of the processing order table to be changed, and the contents of the changed processing order table According to the above, the confidential processing can be executed, and the processing order performed last time can be used.

[System configuration: Fig. 1]
A secret tabulation system (this system) according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is a schematic configuration diagram of a secret tabulation system according to an embodiment of the present invention.
As shown in FIG. 1, this system basically includes a processing device 1, a display device 2, and an input device 3.

The processing device 1 includes a control unit 11, a main memory 12, a storage unit 13, and an interface unit 14.
The control unit 11 reads the processing program stored in the storage unit 13 and loads it into the main memory 12 so that the processing can be executed. Details of the process will be described later.
The main memory 12 is a working memory that temporarily stores programs, data, and the like necessary for processing.

The storage unit 13 stores a processing program and stores various tables, data including map information (map data), and the like. Various means implemented by loading the processing program into the main memory 12 and various tables will be described later.
The interface unit 14 is an interface for connecting to the display device 2 and the input device 3.

[Overview of confidential aggregation logic]
Next, the secret totaling logic in this system will be described.
First, the “priority order”, “allowable range”, and “threshold value” are defined in the secret aggregation logic in the area information.
“Priority” designates which element such as region, age, category, etc. should be emphasized. Set a higher priority for the elements that you want to keep the secrecy level narrow.
The “allowable range” is used to specify a range of the secret level for analysis.
The “threshold value” sets an upper limit of a value that requires confidentiality. If the target is less than or equal to this value, the target is concealed.
Here, three elements will be described, but four or more elements are theoretically possible.

Here, the secret level will be described.
In the element “region”, the level of secrecy is set in a narrow to broad sense in the order of “No.”, “Block”, “Town”, “Large”, “City”, and “Prefecture”.
In addition, the element “region” is not divided into administrative districts as described above, but in the order of “x, y (point)”, “50 m mesh”, “100 m mesh”, “500 m mesh”, “1 km mesh”, “10 km mesh”. It may be set in a broad sense.

  In addition, in the element “age”, for example, a 5-year-old unit is narrowly defined as “0-5 years old”, “6-10 years old”, and a 10-year-old unit such as “0-10 years old” “11-20 years old” Furthermore, it is set so as to be broadly classified into categories such as “young” and “elderly”.

  In the element “category”, the categories “A1”, “A2”, “A3”, “B1”, “B2”, “C1”, “C2”, “C3”... Are narrowly defined, and “A1”, “A2”, “A3” are defined. Including categories “A”, “B1” “B2” including “B”, “C1” “C2” “C3” including “C”, “A” including “Group 1”, “B” “C” "Is set in a broad sense such as" Group 2 ".

Furthermore, distributed processing and erasure processing can be selectively set.
[Distribution / deletion processing]
The distribution / deletion process is set when priority is given to keeping the concealment level narrowly rather than faithfully collecting actual numerical values. However, although the secrecy level can be kept narrow, the total value of each element may not match.

The distributed processing uses “distribution rate changing logic”, “nearest neighbor weighted interpolation method”, or the like to distribute data to be concealed to blocks in other regions.
In the erasure process, data to be concealed is deleted within the block in the area.

The distribution rate changing logic is to distribute so that a concealment process is not further generated after the distribution as much as possible when the distribution is performed in consideration of the distribution rate in a place close to an area requiring concealment.
The nearest neighbor weighted interpolation method is a method of replacing the estimated value in consideration of surrounding data.

[Contents of confidential aggregation logic]
The secret aggregation processing logic first refers to the confidentiality level of the “allowable range” for the low priority element in the “priority” item, and whether the aggregation item in the confidentiality level exceeds the “threshold value”. If it exceeds, the concealment process is not performed. If it does not exceed, the concealment level is increased and it is determined whether the total item at the concealment level exceeds the “threshold value”.

When the “threshold value” is exceeded, the concealment process is stopped, the same process is performed for the element with the next lower “priority”, and finally the same process is performed for the element with the higher “priority order”.
Furthermore, if distributed processing or deletion processing is individually set for each element, distributed processing and deletion processing are executed for the set element.

[Table: Figures 2-4]
Various tables stored in the storage unit 13 will be described with reference to FIGS. 2 is a schematic diagram showing a priority table, FIG. 3 is a schematic diagram showing an allowable range table, and FIG. 4 is a schematic diagram showing a threshold table in the case of a category.

[Priority table: FIG. 2]
As shown in FIG. 2, the priority order table includes the priority order of the concealment process for each analysis ID (for example, analysis 1, analysis 2...) For each analysis identifier (ID) for each of the three elements of region, age, and category. Is set.

[Allowable range table: Fig. 3]
As shown in FIG. 3, in the allowable range table, (TO) is set from a low secret level to a high secret level (FROM) for each element of “region”, “age”, and “category”.
Note that an allowable range table may be set for each analysis ID.

[Threshold table: FIG. 4]
As shown in FIG. 4, the threshold value table includes a threshold value in the minimum unit of the total items, a threshold value in the next size unit, and a Threshold values are set in order in units of large total items, and the concealment process is continued if these threshold values are not exceeded, and the concealment process is stopped if they are exceeded.
FIG. 4 exemplarily shows a threshold value table for the element “category”.

[Distributed processing table]
The distributed processing table is provided for each element and stores information on whether to execute the distributed processing.
[Erase processing table]
The erasure process table is provided for each element, and stores information on whether or not to execute the erasure process.

[Realization means: FIG. 5]
In the present system, as the processing means realized by loading the processing program stored in the storage unit 13 into the main memory 12, as shown in FIG. 5, priority order determining means 111, allowable range determining means 112, There are threshold determination means 113, distributed processing execution means 114, erasure processing execution means 115, map information display means 116, and management means 117. FIG. 5 is a diagram showing an outline of the realization means in the present system.

  In addition, in order to make the explanation of each means easy to understand, reference numerals are also given to various tables, and a priority order table 131, an allowable range table 132, a threshold value table 133, a distributed processing table 134, and an erasure processing table 135 are provided. .

[Priority determination means 111]
The priority order determination unit 111 determines the priority order with reference to the priority order table 131 of FIG. The determined priority order is reported to the management means 117.
[Allowable range determining means 112]
The permissible range determining unit 112 refers to the permissible range table 132 in FIG. 3 and determines the concealment level for the corresponding element.
[Threshold determination means 113]
The threshold value determination unit 113 refers to the threshold value table 133 of FIG. 4 for the corresponding element, acquires the threshold value, determines whether or not the total item exceeds the threshold value, The result is reported to the management means 117.

[Distributed processing execution means 114]
The distributed processing execution unit 114 refers to the distributed processing table 134 for the corresponding element, and executes the distributed processing if the distributed processing is set.
Note that an upper limit value of the number of times of distribution is set in advance in the distributed processing table 134, and when the upper limit value is exceeded (when the number of times of distribution is greater than the upper limit value), the distributed processing execution unit 114 You may control not to perform a process.

[Erase processing execution means 115]
The erasure process execution means 115 refers to the erasure process table 135 for the corresponding element, and executes the erasure process if the erasure process is set.
An upper limit value of the erasure rate is set in advance in the erasure processing table 135, and when the upper limit value is exceeded (when the erasure rate becomes higher than the upper limit value), the erasure processing execution means 115 You may control not to perform a process.

[Map information display means 116]
The map information display means 116 displays the aggregated data that has been concealed on the display device 2 so as to overlap the map image information.
[Management means 117]
The management unit 117 receives a report from each unit, and further instructs each unit to perform next processing.
Specifically, the management unit 117 is intended to link each unit, determines whether there is an option for distributed processing or erasure processing, terminates the confidential processing normally, and could not execute the confidential processing. In some cases, the process to end the process is performed.

[Processing flow: Fig. 6]
The processing flow of the secret tabulation logic will be described with reference to FIG. FIG. 6 is a diagram showing a processing flow of the secret tabulation logic. In particular, FIG. 6 shows a processing flow of the secret aggregation logic in the area information.
As shown in FIG. 6, in the secret totaling logic, the priority order determination unit 111 determines the priority order of the three elements from the priority order table 131, determines the priority order as high, medium, and low. The concealment logic process is started from (S1).

  Next, the secrecy level of the current element is made the narrowest (S2). To narrow the secrecy level means that the permissible range determining unit 112 refers to the permissible range table 132 and minimizes the secrecy level for the element specified in the priority order table 131.

  Next, the allowable range determining unit 112 refers to the allowable range table 132 and determines whether or not the current element is within the allowable range (S3). If it is an allowable range (in the case of Yes), the threshold value determination means 113 refers to the threshold value table 133 and determines whether or not all items in the secrecy level have exceeded the threshold value (S4). ).

If all items exceed the threshold value (Yes), the management unit 117 ends the concealment logic (S5).
If any of the items does not exceed the threshold value in the determination process S4 (No), the management unit 117 determines whether the distributed process or the delete process is set as an option. (S6). The option process may be omitted.

  In the determination process S6, when distributed processing or deletion processing is set (in the case of Yes), the distributed processing execution unit 114 or the deletion processing execution unit 115 refers to the distributed processing table 134 or the deletion processing table 135 and performs the number of distributions. Is greater than a preset value, or it is determined whether the erasure rate is higher than a preset value (S7).

  When the number of distributions is not greater than a preset value, or when the erasure rate is not higher than a preset value (in the case of No), the distributed processing execution unit 114 or the erasure processing execution unit 115 performs the aggregate data distribution process. Alternatively, the erasure process is executed (S8), and the process returns to process S4.

  In the determination process S6, when the distribution process or the deletion process is not set (in the case of No), or when the number of distributions is larger than the preset value in the determination process S7, or the deletion ratio is higher than the preset value. In the case (Yes), the permissible range determining unit 112 sets the secrecy level of the current element in the permissible range table 132 in a broad sense (S9), and the process returns to the process S3.

  In the determination process S3, when the current element is not within the allowable range (No), the priority determining unit 111 refers to the priority table 131 and moves to the next priority element (S10).

Next, the priority order determination unit 111 refers to the priority order table 131 to determine whether or not the current element exceeds the priority order (high) setting (S11). (In the case of No), the process returns to the process S2.
Note that when returning to the process S2, since the process moves to the next priority element in the process S10, the process for narrowing the secrecy level for that element is performed.

When the priority order is exceeded in the determination process S11 (in the case of Yes), the management unit 117 ends the process of the concealment logic on the assumption that the concealment process could not be performed (S12).
In this way, the secret totaling logic process is performed.

Then, the map information display means displays the map information (map data) stored in the storage unit 13 on the display device 2 and displays the aggregated data subjected to the concealment processing by the above-described concealment aggregation logic superimposed on the map information. It is supposed to be.
Hereinafter, specific display examples will be described.

[Display screen 1: FIG. 7]
Next, a case where processing is performed using the secret aggregation logic will be described with reference to FIGS. FIG. 7 is a diagram of a display example in which meshes are superimposed on a map, FIG. 8 is a diagram in which customer information is displayed in dots in FIG. 7, and FIG. 9 is a display example after performing concealment processing. FIG.
FIG. 7 shows a display screen in which a 250 m mesh is superimposed on a map.

[Display screen 2: FIG. 8]
FIG. 8 shows customer information displayed in dots in the state of FIG.
Here, referring to FIG. 8, there may be only two customers in the 250 m mesh, and an individual may be identified.
Therefore, the concealment level is broadly defined by the concealment aggregation logic according to the present embodiment, and the aggregation is performed with a 500 m mesh.

[Display screen 3: FIG. 9]
FIG. 9 shows a display example in which FIG. 8 is displayed with a 500 m mesh.
As shown in FIG. 9, by counting with a 500 m mesh, the counting unit becomes coarse, but it is possible to make the individual unidentifiable.
As described above, the number of customers who cannot be identified by the 250 m mesh is set as a threshold value, for example, 4 people, and when there is a mesh that falls below the threshold value in the 250 m mesh, the level of secrecy is further broadened. In this way, the data is aggregated and displayed with a 500 m mesh.

[Additional technology: Fig. 10]
Next, a processing order table generating unit is provided as a processing unit that allows the control unit 11 to read the processing program stored in the storage unit 13 into the main memory 12 and execute it when the confidential processing according to the present embodiment is performed. And a processing order table changing means and a processing order table executing means.

[Processing order table generation means]
The processing order table generating means generates the order in which the concealment process is actually performed by using a table of elements and concealment levels.
[Processing order table: FIG. 10]
The processing order table generated by the processing order tail generating means will be described with reference to FIG. FIG. 10 is a diagram illustrating a processing order table.
As shown in FIG. 10, the processing order table stores the order of the elements executed by the concealment process and the concealment level. The order of processing, the element and the concealment level, and the concealment level of the element. Identification information indicating whether or not the concealment process has been performed, for example, an execution mark is given.

  In FIG. 10, since the execution mark is attached up to the element “age” of rank 3 and the level of confidentiality “level (1)”, the secrecy process has been performed. Although the process was scheduled to be performed, the threshold value was not exceeded, so the confidential process was not necessary, and the confidential process was not performed.

[Processing order table change means]
The processing order table changing means changes the order of the processing order table shown in FIG.
The rank change can be realized by changing the numbers in the rank column and executing sorting, or by specifying and moving a table row.
However, the threshold value is changed in the threshold value table.

[Processing order table execution means]
When the processing order table execution means confirms the change of the processing order table and then clicks (selects) the “execution processing” button on the screen, the processing order table executing means executes the concealment process according to the contents of the changed processing order table. ing.

  Specifically, the processing order table executing means refers to the threshold value table for the element and the confidential level indicated by the order in accordance with the order of the changed processing order table, and does not include all the total items in the confidential level. It is determined whether the threshold value has been exceeded. If any of the total items does not exceed the threshold value, refer to the threshold value table for the next rank element and concealment level after the processing order table. Then, it is determined whether or not the threshold value has been exceeded for all the total items in the secrecy level.

Then, when the management means exceeds the threshold value for all the total items, the concealment process is terminated.
If the concealment process is executed, a new process order table is generated.

As described above, by using the processing order table changing means and the processing order table executing means using the processing order table, it is possible to easily use the conditions once subjected to the concealment process again.
In addition, since the presence or absence of confidential processing is displayed as a mark in the processing order table, it is possible to know the execution process of the confidential processing, and the processing order can be newly changed with reference to the execution process. It can be made more useful.

[Effect of the embodiment]
According to this system, the location information of individuals on the map information is concealed by elements such as “age” and “category”, the concealment level, and the threshold value. Therefore, there is an effect that it is possible to calculate and analyze accurately and eliminate the leakage of confidential processing.

  In addition, according to the present system, there is an effect that by using the processing order table, it is possible to realize the concealment process according to the situation by utilizing the past concealment process contents.

INDUSTRIAL APPLICABILITY The present invention is suitable for a processing program in a secret totaling system that can aggregate and analyze individual position information on map information relatively accurately while retaining attribute information, and can eliminate the leakage of confidential processing. is there.

  DESCRIPTION OF SYMBOLS 1 ... Processing apparatus, 2 ... Display apparatus, 3 ... Input device, 11 ... Control part, 12 ... Main memory, 13 ... Memory | storage part, 14 ... Interface part, 111 ... priority order determining means, 112 ... allowable range determining means, 113 ... threshold value determining means, 114 ... distributed process executing means, 115 ... erasing process executing means, 116 ... map Information display means, 117 ... management means, 131 ... priority order table, 132 ... tolerance range table, 133 ... threshold value table, 134 ... distributed processing table, 135 ... erasure processing table

Claims (9)

A processing program in a concealment aggregation system that has a control unit and a storage unit and executes concealment processing of aggregation data when performing aggregation processing,
As means realized by the operation of the control unit,
Priority order determining means for referring to a priority table for setting priorities for a plurality of elements to be aggregated stored in the storage unit, and for determining elements having a low priority;
Permission for determining whether or not the element to be processed is within the allowable range by referring to the allowable range table that sets the allowable range at the concealment level, stored in the storage unit, with respect to the element. A range determination means;
If it is within the allowable range, a threshold value is set for determining whether to conceal the aggregated data for each minimum aggregation unit for each element and for each higher aggregation unit stored in the storage unit. Threshold value judging means for referring to the threshold value table to judge whether or not the threshold value is exceeded in all the total items in the secret level;
Management means for terminating the concealment process when a threshold is exceeded in all the total items,
When the allowable range determination means does not exceed a threshold value in any of the total items, the confidential level of the element is set to a broad level by referring to the allowable range table, and the confidentiality is defined in the broad sense. It is determined whether or not the level is within an allowable range for the element. If the level is within the allowable range, the threshold determination means determines whether or not the threshold has been exceeded for all the aggregate items at the confidential level. A processing program for a concealment aggregation system , characterized in that the concealment processing is terminated by the management means when a threshold value is exceeded for all the aggregation items. The allowable range determining means refers to the allowable range table to determine whether the confidentiality level is within the allowable range for the element, and when it is not within the allowable range, the priority determining means refers to the priority order table and determines the next priority. It is determined whether or not the priority set for the rank element is exceeded, and if the set priority is not exceeded, the allowable range determining means refers to the allowable range table for the element, It is determined whether or not the element to be processed is within an allowable range by setting the level of secrecy to the minimum. If the priority set for the next priority element is exceeded, the management means The processing program of the secret totaling system according to claim 1, wherein the processing is terminated as a result of not being performed. The threshold value judging means refers to the threshold value table to determine whether or not the threshold value is exceeded for all the total items in the confidentiality level, and the threshold value is exceeded for any one of the total items. If not, the management means determines whether or not distributed processing is set, and if set, the distributed processing execution means realized by the program operation of the control unit performs distributed processing on the aggregated data. 3. The processing program for a secret totaling system according to claim 1 or 2, wherein the threshold determination means determines again whether or not the threshold has been exceeded for all the total items in the secret level. . The threshold value judging means refers to the threshold value table to determine whether or not the threshold value is exceeded for all the total items in the confidentiality level, and the threshold value is exceeded for any one of the total items. If there is not, the management means determines whether or not the erasure process is set, and if it is set, the erasure process execution means realized by the program operation of the control unit performs the erasure process on the aggregated data. 3. The processing program for a secret totaling system according to claim 1 or 2, wherein the threshold determination means determines again whether or not the threshold has been exceeded for all the total items in the secret level. . When the distributed processing execution means does not execute the distributed processing when the number of times of distribution is greater than a preset number of times, the allowable range determining means refers to the allowable range table, and makes the concealment level of the element one level broad, 4. The processing program for a concealment counting system according to claim 3, wherein it is determined whether or not the concealment level defined in a broad sense is within an allowable range for the element. When the erasure processing execution means has a erasure ratio higher than a preset ratio, the erasure processing is not executed, and the allowable range determination means refers to the allowable range table, and makes the concealment level of the element one level broad, The processing program for a concealment counting system according to claim 4, wherein the concealment level defined in a broad sense determines whether the element is within an allowable range. The map information display means for displaying the map data stored in the storage unit on the display device and displaying the aggregated data that has been concealed as a means realized by the operation of the control unit. The processing program of the secret tabulation system according to any one of 1 to 6. As means realized by the operation of the control unit,
A processing order table generating means for generating an element and a concealment level as a processing order table for the order in which the concealment process is executed when the concealment process is executed;
Processing order table changing means for changing the order of the generated processing order table;
According to the order of the changed processing order table, refer to the threshold value table for the element and the confidential level indicated by the order, and determine whether or not the threshold value is exceeded in all the aggregate items in the confidential level, If any of the total items does not exceed the threshold value, refer to the threshold value table for the rank element and the secret level next to the processing order table, and Processing order table execution means for determining whether or not a threshold value has been exceeded in the summary item,
8. The processing program for a secret totaling system according to any one of claims 1 to 7, wherein the management unit terminates the confidential processing when all the total items exceed a threshold value. 9. The concealment according to claim 8, wherein the processing order table generating means assigns identification information indicating that concealment processing has been performed to an element and concealment level for which concealment processing has been performed in the processing order table. Processing program for the aggregation system.

Images