JP2015090617A - Anonymized data generation method, device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To anonymize data including a numerical attribute value so as to provide appropriate analysis precision.SOLUTION: An anonymized data generation method includes: (A) extracting a group of data blocks included in one mesh element of a plurality of kinds of meshes, including a non-grouped first data block and having frequency distribution of confidential attribute values meeting a predetermined condition from among a plurality of data blocks regarding each of the plurality of kinds of meshes in a space spread with numerical attributes in the plurality of data blocks stored in a data storage unit and each including the confidential attribute value and the numerical attribute value; and (B) substituting the numerical attribute value of the data block belonging to the group with a numerical attribute value regarding the group.

Description

  The present technology relates to information anonymization technology.

  There is a case where it is desired to disclose or provide a group of records including numerical attribute values collected from a plurality of information providers, with the information provider identifier (hereinafter simply referred to as ID) of each record kept secret. At this time, even if the ID is deleted and disclosed or provided, there is a case where another person can estimate the information provider for a record having a characteristic numerical attribute value.

  For example, suppose that a collector of personal location data provides location data to an analyst without the information provider knowing. Here, a service provider for location data may be used as a collector, and a cloud service provider or a secondary data user (for example, a population density survey company) may be used as an analyst.

  Here, it is assumed that the position data collected by the collector is as shown in FIG. In the example of FIG. 1, each record includes a row number, ID, X (latitude), and Y (longitude). Here, each record represents position data of any one of A, B, and C, and there are 7 records in total. That is, a record with the same ID may appear multiple times. The ID may be a personal user ID or a measurement device ID. It may also be the ID of the organization to which it belongs.

  When the data shown in FIG. 1 is plotted on a map, it is as shown in FIG. 2, for example. An analyst can use the data as shown in FIGS. 1 and 2 for analysis. For example, it can be seen that people are gathering around the A and B homes.

  However, for example, there may be a situation in which the collector has a contract with the information provider not to provide data to others unless anonymizing. An information provider may desire anonymization for reasons such as not wanting to know other than the collector where he was at a specific time.

  On the other hand, the analyst may not use the information provider information such as ID. This is because an analysis like a population density survey can be performed without knowing who the location data provider is.

  In such a case, the collector may anonymize the data in FIG. 1 to make it difficult to estimate the information provider.

  As a simple anonymization method by a collector, there is a method of deleting an ID. Even if the analyst looks at the data from which the ID has been deleted from FIG. 1, it is not possible to know which record is who's data. However, there is a problem that there is a record that can estimate the information provider from the position data.

  If the data from which the ID is deleted from FIG. 1 is plotted on the map as shown in FIG. 2, for example, it will be understood that the position data (X, Y) = (6, 2) of the first record is in A's home. That is, even an analyst who can only see data from which the ID has been deleted can estimate that the information provider of the first record is A, and is not sufficiently anonymized. Similarly, anonymization is insufficient except for the seventh record.

  As a conventional technique, there is a method of grasping a plurality of predetermined numerical ranges without overlapping as a group and converting a group of records into each statistical value.

  In this prior art, a region is meshed based on latitude and longitude, and a statistical value for a group of records in each mesh element is calculated and disclosed or provided.

  As the statistical value, the number of records for each mesh element is used, for example, “3 records for mesh element M1”. Alternatively, the ID of each record may be deleted and the position may be converted to the center point of the mesh element.

  For example, consider a case where each record in FIG. 1 is grouped and converted by a mesh element having a side of “5”. In this case, for example, (X, Y) = ([5, 10), [0, 5)) is one mesh element, that is, a group. If this mesh element is named M10, only the first record is classified as M10 in FIG. Accordingly, it is disclosed that “there is one record in the mesh M10”, or the first record is converted into (X, Y) = (7.5, 2.5) (center point of M10) and disclosed.

  In this prior art, there is no problem in anonymity if the mesh size is sufficiently large, but there is a problem that anonymity is threatened if the mesh size is reduced. For example, if the mesh element M10 is included in the site of the A house (for example, the site of the A house is (X, Y) = ([2, 10], [0, 6]), etc.) The information provider of the record classified into the mesh element M10 can be estimated as A. The smaller the mesh size, the higher the possibility that the mesh element is included in an area where only a specific ID can exist.

  On the other hand, as the mesh size is increased, the degree of generalization of the position is increased, and there is a problem that the analysis accuracy by the analyst is greatly adversely affected. For example, in a statistical survey, a mesh element having a side of about 1 km may be used. However, as long as only the result is used, it is generally not possible to produce an analysis result regarding a region more detailed than 1 km unit.

  As described above, this conventional technique has a problem that the mesh size must be sufficiently increased in order to ensure anonymity, and the analysis accuracy is greatly adversely affected.

  As another conventional technique for generating a group, k or more records are included in a range less than the size d with respect to predetermined values d and k, and do not overlap another range. There is a technique for adjusting the position of the range and grouping based on the range.

  This prior art is based on record groups having different IDs as target data, and in that case, proper anonymity is ensured, but for data in which multiple records with the same ID can exist as shown in FIG. However, there is a problem that sufficient anonymity cannot be secured.

  For example, by applying a part of this prior art, each record of FIG. 1 is a rectangle (d = (5, 5)) with a side less than “5” and includes three or more (k = 3) records. Consider the case of grouping. In this case, for example, a rectangle R43 including records {1, 2, 3}: (X, Y) = ([2, 6], [2, 4]) and a rectangle R49 including records {4, 5, 6}. : (X, Y) = ([2, 6], [8, 10]) Two groups are created. However, as in the example described above, there is a possibility that a rectangle is included in an area where only a specific ID can exist. For example, when the rectangle R43 is included in the premises of the house A, it can be estimated that the information provider of the record {1, 2, 3} classified into the rectangle R43 is A.

  In general, a technique that can handle a group of records having a plurality of records with the same ID as shown in FIG. For example, particularly when the organization is an information provider, the same ID (ie, organization ID) may be recorded in the data of a plurality of measuring devices. In addition, by allowing the existence of a plurality of records having the same ID, it becomes possible to analyze many records at once, and improvement in analysis accuracy can be expected. However, this conventional technique has a problem that anonymity can be ensured only with special target data, and there are few scenes that can be applied.

  Further, as another conventional technique for grouping, there is a technique for making there are 1 or more types of confidential attribute values such as IDs (that is, satisfying l-diversity) in each group. This prior art has a problem that it is difficult to make a group within a range smaller than a predetermined size. If the size cannot be within a predetermined range, there is a problem that the accuracy of analysis is greatly adversely affected.

O. Abul, F. Bonchi, and M. Nanni.Never Walk Alone: Uncertainty for Anonymity in Moving Objects Databases.In Proceedings of the 24th International Conference on Data Engineering, ICDE 2008, pp.376-385 (2008). A. Machanavajjhala, J. Gehrke, D. Kifer, M. Venkitasubramaniam. L-Diversity: Privacy Beyond k-Anonymity. ACM Transactions on Knowledge Discovery from Data, Vol. 1, Issue 1, Article No. 3, 2007.

  Therefore, the objective of this technique is to provide the technique for enabling the anonymization of the data containing a numerical attribute value so that appropriate analysis precision can be taken out according to one side surface.

  The anonymized data generation method according to the present invention includes (A) a plurality of types of spaces in a space spanned by each numerical attribute in a plurality of data blocks that are stored in a data storage unit and each include a confidential attribute value and a numerical attribute value. For each mesh, data that includes a first data block that is included in one mesh element of the mesh and that has not been grouped among a plurality of data blocks, and whose frequency distribution of confidential attribute values satisfies a predetermined condition A process of extracting a group of blocks and (B) replacing a numerical attribute value of a data block belonging to the group with a numerical attribute value for the group.

  According to one aspect, data including numerical attribute values can be anonymized so that appropriate analysis accuracy can be obtained.

FIG. 1 is a diagram illustrating an example of data. FIG. 2 is a diagram illustrating an example of superposition of data and other data. FIG. 3 is a diagram illustrating a configuration example of the information processing apparatus according to the present embodiment. FIG. 4 is a diagram illustrating an example of data stored in the first data storage unit. FIG. 5 is a diagram showing a processing flow in the present embodiment. FIG. 6 is a diagram illustrating a processing flow of mesh generation processing. FIG. 7 is a diagram illustrating a state where two types of meshes are generated. FIG. 8 is a diagram illustrating the variation of the reference points of the mesh. FIG. 9 is a diagram illustrating overlapping of mesh elements of a plurality of types of meshes. FIG. 10 is a diagram illustrating a process flow of the group generation process. FIG. 11 is a diagram illustrating an example of the classification result for the first mesh. FIG. 12 is a diagram illustrating a process flow of the record group Rs extraction process. FIG. 13 is a diagram illustrating a processing flow of the exclusion process. FIG. 14 is a diagram illustrating an example of a frequency distribution table generated in the exclusion process. FIG. 15 is a diagram illustrating an example of a frequency distribution table generated in the exclusion process. FIG. 16 is a diagram illustrating an example of a frequency distribution table generated in the exclusion process. FIG. 17 is a diagram illustrating an example of a frequency distribution table generated in the exclusion process. FIG. 18 is a diagram illustrating an example of a frequency distribution table generated in the exclusion process. FIG. 19 is a diagram illustrating an example of a frequency distribution table generated in the exclusion process. FIG. 20 is a diagram illustrating a process flow of the record group Rs extraction process. FIG. 21 is a diagram illustrating a processing flow of transferable record extraction processing. FIG. 22 is a diagram illustrating an example of a frequency distribution table generated in the extraction process. FIG. 23 is a diagram illustrating an example of a frequency distribution table generated in the extraction process. FIG. 24 is a diagram illustrating an example of a frequency distribution table generated in the extraction process. FIG. 25 is a diagram illustrating an example of a frequency distribution table generated in the extraction process. FIG. 26 is a diagram illustrating an example of a frequency distribution table generated in the extraction process. FIG. 27 is a diagram illustrating an example of a mesh-group association table. FIG. 28 is a diagram illustrating an example of a group data table for distinguishing between records that cannot be transferred and records that cannot be transferred. FIG. 29 is a diagram illustrating an example of a correspondence table between row numbers and group IDs. FIG. 30 is a diagram illustrating an example of a mesh / group association table. FIG. 31 is a diagram illustrating an example of a group data table for distinguishing between records that cannot be transferred and records that cannot be transferred. FIG. 32 is a diagram illustrating an example of a correspondence table between row numbers and group IDs. FIG. 33 is a diagram illustrating an example of the classification result for the second mesh. FIG. 34 is a diagram illustrating an example of a mesh / group association table. FIG. 35 is a diagram illustrating an example of a group data table for distinguishing between a record that can be transferred and a record that cannot be transferred. FIG. 36 is a diagram illustrating an example of a correspondence table between row numbers and group IDs. FIG. 37 is a diagram illustrating an example of the classification result for the third mesh. FIG. 38 is a diagram illustrating an example of a result of the grouping process. FIG. 39 is a diagram illustrating an example of the processing result. FIG. 40 is a functional block diagram of a computer.

  FIG. 3 shows a functional block diagram of the information processing apparatus 100 according to the embodiment of the present invention. The information processing apparatus 100 includes a first data storage unit 110, a setting data storage unit 120, a grouping processing unit 130, a second data storage unit 140, an anonymization processing unit 150, and a third data storage unit 160. , An output unit 170, a mesh generation unit 180, and a fourth data storage unit 190.

  The first data storage unit 110 stores data before anonymization as shown in FIG. 4, for example. In the example of FIG. 4, each record (also referred to as a data block) includes an ID, X (latitude), Y (longitude), and speed. Line numbers are given for the following explanation.

  The setting data storage unit 120 is stored in the first data storage unit 110 and the number x of mesh types to be generated, the size d of the mesh elements, the condition for the frequency distribution (also referred to as a frequency distribution pattern), and the like. In the stored data, a confidential attribute (for example, an ID attribute; also called a sensitive attribute) and a numerical attribute (for example, position data including latitude X and longitude Y) are stored. The frequency distribution pattern includes a minimum kind number l and an attenuation rate a. The minimum kind number l is an integer of 2 or more, and the attenuation rate a is a positive real number of 1 or less. For example, a frequency distribution pattern in which the nth frequency is a times greater than the (n−1) th frequency in the descending order of frequencies for one type of ID is set as a condition.

  The grouping processing unit 130 performs processing for grouping the record groups stored in the first data storage unit 110 using the data stored in the setting data storage unit 120 and the fourth data storage unit 190, The processing result is stored in the second data storage unit 140. The anonymization processing unit 150 performs processing for converting the numerical attribute values of the records belonging to each group based on the grouping result, and stores the processing result in the third data storage unit 160. The output unit 170 outputs the data stored in the third data storage unit 160 to another computer, a display device, a printing device, or the like.

  The mesh generation unit 180 generates mesh data according to the number of types of meshes x stored in the setting data storage unit 120 and the size d of the mesh elements, and stores the generated mesh data in the fourth data storage unit 190.

  The size d of the mesh element is a positive numeric string representing the length of the side of the mesh element in the space spanned by each numeric attribute. For example, if the numerical attribute is two-dimensional (X, Y), d = (6, 6) is set.

  The number of mesh types x is a natural number. For example, if six different meshes are used, x = 6. In this embodiment, the mesh is an n-dimensional rectangular mesh (n is the number of numerical attributes). The mesh includes a plurality of mesh elements, and the boundary (also referred to as a wall) between the mesh elements is a side if 2D, a plane if 3D, and a hyperplane if 4D or more. Become. In general, the mesh is not limited to a rectangle, such as a triangular mesh or a hexagonal mesh, as long as it conforms to a rule that can immediately calculate which mesh element corresponds to the value of a numerical attribute.

  Next, processing contents of the information processing apparatus 100 will be described with reference to FIGS.

  The mesh generation unit 180 executes mesh generation processing, and stores the generated mesh data in the fourth data storage unit 190 (FIG. 5: step S1). The mesh generation process will be described with reference to FIGS.

  First, the mesh generation unit 180 generates an empty list M of meshes (FIG. 6: Step S11). Further, the mesh generation unit 180 adds the origin (0, 0) to the list M (step S13). First, it is assumed that a mesh in which the length of one side of the mesh element is “1” is generated. Therefore, in the subsequent processing, a mesh in which the range of each dimension for the reference point falls within [0, 1) is added to the list M.

  Then, the mesh generation unit 180 determines whether or not the number of types of meshes | M | included in the list M has reached the designated number of types x (step S15). If it is immediately after step S13, | M | = 1, for example, if x = 6, this condition is not satisfied.

  If the condition of step S15 is not satisfied, the mesh generation unit 180 selects a point P ′ that maximizes the distance from the nearest boundary among the boundaries of each mesh belonging to the list M (step S19).

In the present embodiment, points (also referred to as reference points) corresponding to the number of mesh types | M | included in the list M are generated. That is, c = ceil (log ₂ (| M | +1)) (ceil is a ceiling function), and a point (2 ^−c , 2 ^−c ) is used as a base point, and [0, 1) has a width 2 ⁻ Generate points fluctuated by ^{c + 1} . At first, since | M | = 1, c = 1. Therefore, only (1/2, 1/2) is generated.

  Further, the mesh generation unit 180 adds, to the list M, a mesh at a point where the distance from the closest lattice point among the lattice points of each mesh belonging to the list M is the largest among the selected points P ′ (step S21). ). Initially, a mesh whose reference point is (1/2, 1/2) is added to the list M. Then, the process returns to step S15.

  In this state, a mesh as shown in FIG. 7 is generated. The side length of the mesh element is still “1”.

  In step S15, when the number of mesh types | M | included in the list M reaches the specified number of types x, the mesh generation unit 180 sets each mesh from the size d of the mesh elements, The data is stored in the fourth data storage unit 190 (step S23). The process then returns to the caller process.

  In the example described above, when | M | = 2 and the process proceeds to step S19, c = 2 is obtained, so that P = {(1/4/4), (1/4, 3/4). , (3/4, 1/4), (3/4, 3/4)} are generated. At this stage, since each point has the same distance from the lattice point of each mesh included in the list M, in step S21, one of the points, for example, p = (1/4, 1/4) is selected and the list is selected. Add to M. That is, M = {(0, 0), (1/2, 1/2), (1/4, 1/4)}.

  Further, when | M | = 3 and then the process proceeds to step S19, c = 2 remains. Therefore, the same P as before is generated, but (3/4, 1/4) and (1/4, 3/4) are placed on the side of the mesh of (1/4, 1/4). , (3/4, 3/4) which is farther than that is adopted. Also in step S21, p = (3/4, 3/4) is selected and added to the list M. That is, M = {(0, 0), (1/2, 1/2), (1/4, 1/4), (3/4, 3/4)}.

Further, when | M | = 4 and the process proceeds to step S19, c = 3, so that P = {(1/8, 1/8), (1/8, 3/8),. . . , (3/8, 1/8), (3/8, 3/8),. . . , (7/8, 7/8)} is generated. Among the points included in P, p (1/8, 5/8) which is one of the points having the maximum distance from the closest point among the mesh points of each mesh in the list M is added to the list M. Note that the distance to the nearest grid point is the maximum, for example, the Euclidean distance to the nearest grid point is the maximum, and if it is the same, the Euclidean distance to the next nearest grid point is the maximum, and so on. Determine by comparing the distance to each grid point. For example, the distance from (1/4, 1/4), which is one of the closest points of the point (1/8, 5/8), is 10 ^1/2 / 8, but (1/8, The distance from the nearest point (1/4, 1/4) of 3/8) is 2 ^1/2 / 8, and the latter point having a short distance is not adopted. Then, M = {(0, 0), (1/2, 1/2), (1/4, 1/4), (3/4, 3/4), (1/8, 5/8) }.

  Further, when | M | = 5 and the process proceeds to step S19, c = 3 remains. If the same processing is performed, (5/8, 1/8) is selected, and M = {(0, 0), (1/2, 1/2), (1/4, 1/4), ( 3/4, 3/4), (1/8, 5/8), (5/8, 1/8)}. Here, | M | = x = 6, and the following mesh reference point is generated from d = (6, 6). M = {(0,0), (3,3), (3/2, 3/2), (9/2, 9/2), (3/4, 15/4), (15/4, 3/4)}. Then, the process returns to the caller process.

  In the processing flow of FIG. 6, the meshes are generated by shifting so as not to share the boundary of the meshes. By generating meshes by shifting in this way, grouping is performed in units of fixed mesh elements in the grouping process described below, but various groupings are possible.

  Note that the reference points described above vary as shown in FIG. Since a two-dimensional rectangular grid is used, it can be seen from this figure that the meshes are generated with a slight shift. The numbers in the figure indicate the generation order. FIG. 9 shows an actual mesh overlapping state. Here, the mesh elements of the mesh generated sixth are shown one by one, but the boundaries of the mesh elements are not shared.

  Note that the processing flow of FIG. 6 can also be said to be processing in which a mesh farthest from the meshes included in the list M is added to the list M. The definition of the farthest position is as follows.

  That is, when the list M and the two meshes m1 and m2 are input, -1 is obtained when M to m2 is farther than m1, 1 is given when m1 is farther than m2, and m1 and m2 are given. For the same distance, a function cmp (M, m1, m2): {-1, 0, 1} that returns 0 is prepared, and the set F of the farthest meshes is F = {m | ∀m ′, It is defined by cmp (M, m, m ′) ≧ 0}.

For example, when the processes of steps S19 and S21 in the process flow of FIG. 6 are applied to cmp (M, m1, m2), the following is obtained.
1. When the distance between an arbitrary boundary (side) of each of m1 and m2 and the nearest boundary among the boundaries of each mesh of list M is d1 and d2, -1 is returned if d1 <d2, and if d1> d2, Returns 1.
2. When d1 and d2 are distances between the reference points of m1 and m2 and the first closest vertex among the mesh points of each mesh included in the list M, -1 is returned if d1 <d2, and d1> d2 Returns 1 if.
3. Otherwise, as in 2, compare the distance with the second closest grid point to determine whether the condition is met, and then compare the distance with the ... M | It is repeatedly determined that the condition is met, and -1 or 1 is returned when the condition is met.
4). Otherwise 0 is returned.

  What is necessary is just to obtain | require F by such a function cmp, and to select the mesh from which the reference point is the closest to the origin.

  Returning to the description of the processing flow of FIG. 5, the grouping processing unit 130 stores the records stored in the first data storage unit 110 in the fourth data storage unit 190 and the setting data storage unit 120. The group generation process is executed in accordance with the stored data (step S3). The group generation process will be described with reference to FIGS.

  First, the grouping processing unit 130 identifies one unprocessed mesh m from the list M in the fourth data storage unit 190 (FIG. 10: step S31). Then, the grouping processing unit 130 classifies the record group stored in the first data storage unit 110 by the mesh element of the identified mesh m (step S33).

  Specifically, a mesh element identifier (ID) is calculated for each record, and a correspondence table between IDs and row numbers is generated. For example, the mesh element ID is calculated as floor ((numerical attribute-m) / d). The floor is a floor function. For example, the record of the line number “8” in FIG. 4 is (X, Y) = (6, 5), and m = (0, 0), d = (6, 6), so (floor (( 6-0) / 6), floor ((5-0) / 6)) = (1, 0) is the mesh element ID.

  When the above processing is performed, classification as shown in FIG. 11 is performed. In the example of FIG. 11, each record is classified into three mesh elements.

  Next, the grouping processing unit 130 identifies one unprocessed mesh element s from among the mesh elements including the record (step S35). For example, the mesh element with the mesh element ID (0, 0) is specified.

  Then, the grouping processing unit 130 extracts a record Ra other than the record registered in the second data storage unit 140 as a record that cannot be transferred in the identified mesh element s (step S37). In the first case, there is no record registered as a record that cannot be transferred. However, if there is a record registered as a record that cannot be transferred in the process described below, the record Ra is specified by excluding the record. In the first example, Ra = {1, 2, 3, 4, 5, 6, 7}.

  Thereafter, the grouping processing unit 130 executes a record group Rs extraction process (step S39). The record group Rs extraction process will be described with reference to FIGS. When this process ends, the process proceeds to the process of FIG.

  First, the grouping processing unit 130 generates a frequency distribution for the record Ra, and determines whether the record Ra includes one or more types of ID attribute values (step S133). When the record Ra does not include one or more types of ID attribute values, the grouping processing unit 130 sets the record group Rs to be empty (step S138). Then, the process returns to the caller. If the ID attribute value of one or more types is not included, grouping cannot be performed, and the process returns to the caller process.

  On the other hand, when the record Ra includes one or more ID attribute values, the grouping processing unit 130 determines whether the frequency distribution for the record Ra satisfies the condition a (= attenuation rate) in the frequency distribution pattern. (Step S134). It is assumed that l = 3 and a = 0.5 are set. Arranged in descending order of frequency, the n-th frequency is a condition that the a-1 of the (n-1) -th frequency is 0.5 or more. For example, when a frequency distribution of {B: 2, A: 1, C: 1} is obtained, this condition is satisfied.

  The reason why the attenuation factor a is used is not to form a group in which the bias of the frequency distribution is too large, that is, to improve safety. The attenuation rate a is a condition for preventing groups having a frequency distribution that is too biased even if there are 1 or more types. For example, consider a range including records in which the frequency distribution is {A: 100, C: 1} (A means 100 and C means 1). Since this range includes two types of IDs, this range is not included in an area where only one specific ID can exist. However, 99% or more of the frequencies are A, and there is a possibility that most of this range is an area where only A can exist. If this is the case, disclosing this range is problematic because it is easy to estimate that most records in this range have been provided by A.

  When the frequency distribution for the record Ra satisfies the condition in the frequency distribution pattern, the grouping processing unit 130 sets all the records Ra in the record group Rs (step S136). Then, the process returns to the caller process.

  On the other hand, when the frequency distribution for the record Ra does not satisfy the condition in the frequency distribution pattern, the grouping processing unit 130 executes an exclusion process (step S135). If the condition l is satisfied, it is possible to exclude records so as to satisfy the condition a. Therefore, the exclusion process is executed. The exclusion process will be described with reference to FIGS.

  Then, according to a predetermined rule, the grouping processing unit 130 specifies the number of records to be excluded determined by the exclusion process, excludes the records from the record Ra, and sets the remainder in the record group Rs ( Step S137). The predetermined rule may be a simple method such as random.

  Here, the exclusion process will be described. First, the grouping processing unit 130 generates a frequency distribution table F for the records Ra and arranges them in ascending order of the frequencies (FIG. 13: step S141). In the example described above, since the exclusion process is not performed, it is assumed here that a frequency distribution table F as shown in FIG. 14 is generated. Also assume that l = 4 and a = 0.5.

  Then, the grouping processing unit 130 initializes the variable p (step S143) and initializes the variable i to 0 (step S145). Thereafter, the grouping processing unit 130 determines whether i is smaller than the number of rows | F | of the frequency distribution table F (step S147). If i is smaller than the number of rows | F | in the frequency distribution table F, the grouping processing unit 130 determines whether i + l−1 is smaller than | F | (step S149). When i + l−1 is smaller than | F |, the grouping processing unit 130 substitutes F [i] for the variable p (step S151). F [i] is the frequency of the (i + 1) th row of F. If i = 0, the frequency “1” in the first row of F is assigned to the variable p.

  On the other hand, if i + 1−1 is equal to or greater than | F |, the grouping processing unit 130 substitutes min (F [i], floor (p / a)) for the variable p (step S153). min (A, B) is a function that outputs the smaller one of A and B.

  After step S151 or S153, the grouping processing unit 130 substitutes F [i] -p for F [i] (step S155). When S149 is executed when i = 0, the frequency distribution table F becomes as shown in FIG.

  Thereafter, the grouping processing unit 130 increments the variable i by 1 (step S157), and the process returns to step S147.

  In the second step S147, since | F | = 5 and i = 1, i <| F |. Since l = 4, i + l−1 <| F |. Therefore, in step S151, p = 3 and F [1] = 3-3 = 0. Then, the frequency distribution table F becomes as shown in FIG. After that, i = 2.

  In the third step S147, since | F | = 5 and i = 2, i <| F |. Since l = 4, i + l−1 <| F | is not satisfied, and the process proceeds to step S153, where a = 0.5 and p = 3, and thus min (F [i] = 4, floor (p / a) = 6) = 4. Therefore, F [2] = 4-4 = 0. Then, the frequency distribution table F becomes as shown in FIG. Then i = 3.

  In the fourth step S147, since | F | = 5 and i = 3, i <| F |. Since l = 4, i + l−1 <| F | is not satisfied, and the process proceeds to step S153, where a = 0.5 and p = 4, and thus min (F [i] = 9, floor (p / a) = 8) = 8. Therefore, F [3] = 9-8 = 1. Then, the frequency distribution table F becomes as shown in FIG. Then i = 4.

  In the fifth step S147, since | F | = 5 and i = 4, i <| F |. Since l = 4, i + l−1 <| F | is not satisfied, and the process proceeds to step S153, where a = 0.5 and p = 8, so min (F [i] = 10, floor (p / a) = 16) = 10. Therefore, F [4] = 10−10 = 0. Then, the frequency distribution table F becomes as shown in FIG. Then i = 5.

  In the sixth step S147, since | F | = 5 and i = 5, i <| F | does not hold. Then, the process returns to the caller process. That is, the frequency distribution table F (FIG. 19) at this time indicates records to be excluded. Here, one record with ID “E” is excluded. The records to be excluded may be selected at random as described above.

  The processing shifts to the description of the processing in FIG. 20 via the terminal A in FIG. As in the example described above, when Ra = {1, 2, 3, 4, 5, 6, 7}, since the conditions of l and a are satisfied, Ra = Rs.

  The grouping processing unit 130 determines whether the record group Rs is empty (step S41). If the record group Rs is empty, no grouping is performed, and the process proceeds to step S55.

  On the other hand, when the record group Rs is not empty, the grouping processing unit 130 determines whether or not an ungrouped record exists in the record group Rs (step S43). If there is no ungrouped record, no new group is generated, and the process proceeds to step S55.

  On the other hand, when an ungrouped record exists in the record group Rs, the grouping processing unit 130 generates a group with the record group Rs (step S45). Rs = {1, 2, 3, 4, 5, 6, 7} forms one group.

  Then, the grouping processing unit 130 performs transferable record extraction processing on the generated group (step S47). That is, a process of extracting records other than those essential to satisfy the frequency distribution pattern from the generated group is executed. More specific description will be given with reference to FIGS.

  First, the grouping processing unit 130 generates a frequency distribution table F for the records Rs and arranges them in ascending order of the frequencies (FIG. 21: step S171). In order to make the process easy to understand, it is assumed that a frequency distribution table F as shown in FIG. 22 is generated.

  Then, the grouping processing unit 130 sets | F | −1 for the variable ci and sets ceil (F [ci] * a) for the variable min (step S173). ceil (x) is a ceiling function, and is a function that outputs the smallest integer equal to or greater than x with respect to the real number x. F [i] represents the frequency in the (i + 1) th row of the frequency distribution table F, and | F | represents the number of rows in the frequency distribution table F. ci = 5-4 = 1 and min = ceil (2 * 0.5) = 1.

  In addition, the grouping processing unit 130 initializes the variable i to 0 and initializes the variable max to 0 (step S175).

  Thereafter, the grouping processing unit 130 determines whether i <| F | is satisfied (step S177). If i <| F |, the grouping processing unit 130 initializes the variable c (step S179). Thereafter, the grouping processing unit 130 determines whether i <ci (step S181). If i = 0, this condition is satisfied because ci = 1.

  If i <ci, the grouping processing unit 130 sets c to 0 (step S183). Then, the grouping processing unit 130 sets F [i] -c for F [i] (step S185). Since F [i] = 1 and c = 0, F [i] = 1. Thereafter, the grouping processing unit 130 increments i by 1 (step S187), and the process returns to step S177.

  When i = 1, i <ci does not hold in step S181, so the grouping processing unit 130 determines whether i + 1 = | F | (step S189). If i = 1, since i + 1 = 2, this condition is not satisfied. If the condition of step S189 is not satisfied, the grouping processing unit 130 substitutes ceil (F [i + 1] * a) for c (step S191). c = ceil (F [2] * 0.5) = 2. Then, the grouping processing unit 130 determines whether max <c is satisfied (step S193). This condition is satisfied because max = 0. Then, the grouping processing unit 130 substitutes c for max (step S197). That is, max = c = 2. Thereafter, the process proceeds to step S185. Accordingly, in the second step S185, F [1] = 2-2 = 0. Therefore, a frequency distribution table F as shown in FIG.

  When i = 2, i <ci is not satisfied in step S181, and the process proceeds to step S189. However, since i + 1 <| F |, the process proceeds to step S191, and c = ceil (F [3] * 0.5) = 2. Since max = 2, the condition of max <c is not satisfied. Then, the grouping processing unit 130 substitutes min for c (step S195). Since min = 1, c = 1. Then, the process proceeds to step S185, and in the third step S185, F [2] = 3-1 = 2. Therefore, a frequency distribution table F as shown in FIG.

  When i = 3, since i <ci does not hold in step S181, the process proceeds to step S189. However, since i + 1 <| F |, the process proceeds to step S191, and c = ceil (F [4] * 0.5) = 3. Since max = 2 and c = 3, the condition of max <c is satisfied. Therefore, max = c = 3. In the fourth step S185, F [3] = 4-3 = 1. Therefore, a frequency distribution table F as shown in FIG. 25 is obtained.

  When i = 4, since i <ci does not hold in step S181, the process proceeds to step S189. Since i + 1 = | F | is satisfied, the process proceeds to step S195, where c = min = 1. Then, the process proceeds to step S185, and in the fifth step S185, F [4] = F [4] −c = 5-1 = 4. Therefore, a frequency distribution table F as shown in FIG. 26 is obtained.

  Thereafter, when i = 5, the condition of i <| F | is not satisfied in step S177, and the process returns to the caller process. Therefore, as shown in FIG. 26, one record whose ID is A, two records whose ID is C, one record whose ID is D, and four records whose ID is E are specified as transferable records.

  Returning to the description of the processing in FIG. 20, the grouping processing unit 130 specifically identifies a transferable record according to a predetermined rule based on the processing result in step S47 (step S49). The predetermined rule may be random, for example, or may be in order of increasing row numbers.

  In the example described above, among Rs = {1, 2, 3, 4, 5, 6, 7}, the record that can be transferred is {2, 4, 6, 7}, and the record that cannot be transferred is {1, 3, 5}.

  Through the processing so far, the data of FIGS. 27 to 29 is stored in the second data storage unit 140. FIG. 27 shows a table that associates grouped meshes and mesh element IDs with group IDs (G_IDs). In the example, the group ID is serially numbered so as to be unique. Also, in FIG. 28, in association with a group ID, a row number set of records that cannot be transferred among records belonging to the group and a row number set of records that can be transferred are registered. Furthermore, FIG. 29 shows the correspondence between row numbers and group IDs.

  Then, the grouping processing unit 130 determines whether there is a record given from another group (step S51). If there is a record that has been grouped into another group but is classified as a record to be transferred and belongs to the group generated this time, the group to which the group belongs is changed. Therefore, when there is a record transferred from another group, the grouping processing unit 130 deletes the row number of the record transferred from the transfer source group in the second data storage unit 140. (Step S53). On the other hand, if there is no record given from another group, the process proceeds to step S55.

  Then, the grouping processing unit 130 determines whether there is an unprocessed mesh element (step S55). If there is an unprocessed mesh element, the process returns to step S35 in FIG. On the other hand, if there is no unprocessed mesh element, the grouping processing unit 130 determines whether there is an unprocessed mesh (step S57). If there is an unprocessed mesh, the process returns to step S31 in FIG. On the other hand, if there is no unprocessed mesh, the process returns to the caller process.

  In the example described above, the processing shifts to mesh element ID (1, 0) for mesh (0, 0). However, since Ra = {8}, the conditions of l and a are not satisfied, so Rs is set to be empty and no grouping is performed.

  Further, the process proceeds to the process for the mesh element ID (1, 1) for the mesh (0, 0). In this case, Ra = {9, 10, 11, 12} and the conditions of l and a are satisfied. Therefore, Ra = Rs = {9, 10, 11, 12} is set, and the group is also generated as it is. . When the transferable record extraction process (FIG. 21) is executed, {12} is specified as the record to be transferred, so the record that cannot be transferred is {9, 10, 11}.

  When the processing so far is performed, the second data storage unit 140 stores data as illustrated in FIGS. 30 to 32. FIG. 30 shows a state after FIG. 27, and the group ID “2” is assigned to the mesh (0, 0) and the mesh element ID (1, 1). FIG. 31 shows the state after FIG. 28, and for group ID “2”, as described above, the row number set {9, 10, 11} of records that cannot be transferred, and the records that can be transferred A row number set {12} is shown. FIG. 32 shows a state after FIG. 29, and row data for the group ID “2” is added.

  Next, when the processing is shifted to the mesh (3, 3) process and the records are classified, a classification result as shown in FIG. 33 is obtained. It can be seen that it is classified into two mesh elements.

  First, a record classified as a mesh element having a mesh element ID (-1, 0) is processed. Since the record {1, 2} does not satisfy the conditions of l and a, the process proceeds to processing of the mesh element ID (0, 0).

  Then, among {3, 4, 5, 6, 7, 8, 9, 10, 11, 12}, records that cannot be transferred in the groups generated so far are {1, 3, 5, 9, 10, 11 }, Ra = {4, 6, 7, 8, 12}. Since Ra satisfies the conditions of l and a, Ra = Rs.

  Since Rs includes a record {8}, a group is generated with Rs. Further, when the transferable record extraction process (FIG. 21) is executed, the record that can be transferred is identified as {7, 8}, and the record that cannot be transferred becomes {4, 6, 12}. Since these are already grouped as can be seen from FIG. 31, they are handed over from each group.

  Then, the data stored in the second data storage unit 140 is updated to data as shown in FIGS. FIG. 34 shows a state after FIG. 30, and a mesh element ID (0, 0) of the mesh (3, 3) is added in association with the group ID. Furthermore, FIG. 35 shows the state after FIG. 31, and records {4, 6, 12} that cannot be transferred and records {7, 8} that can be transferred are registered in association with the group ID “3”. ing. Since records other than the record {8} were handed over from other groups, the row numbers of those groups are deleted from the groups “1” and “2”. FIG. 36 shows the state after FIG. 32, in which a record {8} is newly added, and the group ID for the record that has been transferred is changed.

  Further, the processing shifts to mesh (3/2, 3/2). Then, a classification result as shown in FIG. 37 is obtained. As can be seen from FIG. 37, the mesh element ID (-1, 0) (0, 1) (1, 1) does not satisfy the conditions of l and a. In the case of the mesh element ID (0, 0), since the records that cannot be transferred in the groups generated so far are {1, 3, 4, 5, 6, 9, 10, 11, 12}, Ra = {2, 7, 8}. Since this satisfies the conditions of l and a, Ra = Rs. However, since {2, 7, 8} are all grouped, no new group is generated.

  Hereinafter, even if processing is performed on other meshes, no new group is generated.

  FIG. 38 shows the above processing results on a plane. In FIG. 38, a triangle represents a record with ID “A”, a cross represents a record with ID “B”, a circle represents a record with ID “C”, and a number beside such a symbol represents a row number. .

  The group “1” corresponds to the rectangle 1001 and the record {1, 2, 3, 5} belongs to it. The group “2” corresponds to the rectangle 1002 and the record {9, 10, 11} belongs to it. The group “3” corresponds to the rectangle 1003 and the record {4, 6, 7, 8, 12} belongs to it. Thus, the records included in the overlapping area portion are shared, and only a specific ID does not belong to each rectangle.

  Returning to the description of the processing in FIG. 5, the anonymization processing unit 150 executes anonymization for each group from the data stored in the second data storage unit 140, and sends the processing result to the third data storage unit 160. Store (step S5). For example, the data is converted so that the record belonging to the group exists at the center point of the mesh element corresponding to the group, and the ID which is the confidential attribute is deleted. For example, in the case of the record group shown in FIG. 4, data as shown in FIG. 39 is obtained. It can be seen that (X, Y) in FIG. 4 is replaced with the center coordinates of the mesh element. In this way, anonymization is not performed and individual records are not specified.

  Then, the output unit 170 outputs the data stored in the third data storage unit 160 to an output device (for example, a display device, a printing device, or another computer connected via a network) (step S7).

  If processing is performed as described above, it is possible to disclose data having both anonymity and analysis accuracy. Moreover, since mesh generation is performed at high speed, the entire anonymization process can be performed at high speed.

  Only records grouped so as to satisfy the condition of diversity l are disclosed, but since there are more than one type of confidential attribute value in each group, a mesh in which each group record can only have a specific ID It is not included in the element and anonymity is ensured.

  In addition, since each disclosed mesh element has a size less than d, high-precision analysis is expected by specifying a small d. However, as d is smaller, records that are not classified into any mesh element increase, and such records are not disclosed. Therefore, it is not necessary to make d too small.

  Furthermore, since it is determined whether or not the diversity condition l is satisfied by a plurality of types of meshes, the number of records that do not satisfy the diversity condition l can be reduced. This increases the number of records to be disclosed, that is, increases the amount of data that can be used for analysis, so high-precision analysis is expected.

  Although the embodiment of the present invention has been described above, the present invention is not limited to this embodiment. For example, the functional block diagram shown in FIG. 3 is an example, and may not match the program module configuration or the file configuration. As for the processing flow, as long as the processing result does not change, the order of the steps may be changed or a plurality of steps may be executed in parallel.

  Note that the mesh generation process of FIG. 6 is an example, and a similar mesh may be generated by another procedure, or a mesh having a different aspect may be generated. A predetermined number of meshes of unit size may be generated in advance, and size conversion may be performed according to the size d.

  The information processing apparatus 100 described above is, for example, a computer apparatus, and as shown in FIG. 40, a display control unit 2507 connected to a memory 2501, a CPU 2503, a hard disk drive (HDD) 2505, and a display apparatus 2509. A drive device 2513 for the removable disk 2511, an input device 2515, and a communication control unit 2517 for connecting to a network are connected by a bus 2519. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing content of the application program, and performs a predetermined operation. Further, data in the middle of processing is mainly stored in the memory 2501, but may be stored in the HDD 2505. In an embodiment of the present technology, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed from the drive device 2513 to the HDD 2505. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above and programs such as the OS and application programs. .

  The above-described embodiment can be summarized as follows.

  The anonymized data generation method according to the present embodiment includes (A) a plurality of spaces in a space spanned by each numerical attribute in a plurality of data blocks that are stored in the data storage unit and each include a confidential attribute value and a numerical attribute value. For each type of mesh, the frequency distribution of confidential attribute values satisfies a predetermined condition, including a first data block that is included in one mesh element of the mesh and that has not been grouped, among a plurality of data blocks. (B) processing for replacing the numerical attribute values of the data blocks belonging to the group with the numerical attribute values for the group.

  Since a group of data blocks whose frequency distribution of confidential attribute values satisfies a predetermined condition is generated, reliable anonymization is performed. In addition, by using a plurality of types of meshes, there is a possibility that grouping may be performed with mesh elements of any mesh, so the number of data blocks that are not disclosed can be reduced. That is, the amount of data that can be used for analysis increases and the analysis accuracy improves. In addition, the size of the mesh element can be adjusted, and this is also a factor in improving the analysis accuracy. The size of the mesh element may be the same for each type of mesh. Further, by defining a grouping range at an arbitrary position, the processing speed is increased as compared with the case where grouping is performed.

  Further, the anonymized data generation method may further include a process of deleting the confidential attribute value of the data block belonging to the group described above. This makes it possible to disclose safe data.

  Furthermore, the predetermined condition described above may include a lower limit value for the number of types of confidential attribute values. In this case, the extraction process described above includes (a1) the type of confidential attribute value in the set of data blocks including the first data block not yet grouped and included in the one mesh element is classified attribute You may make it include the process which judges whether it is more than the lower limit of the kind of value. If it does in this way, the security of concealment will increase.

  Further, the extracting process described above includes: (a2) a frequency distribution of confidential attribute values for a second set of data blocks including a first data block that has not been grouped and included in the one mesh element; (A3) If the frequency distribution of the confidential attribute value for the second set of data blocks does not satisfy the predetermined condition, the data block is configured to satisfy the predetermined condition. A process of generating a group of data blocks by excluding the second data block from the second set may be included. For example, if the number of types of confidential attribute values for the second set of data blocks is equal to or greater than the lower limit value, the frequency distribution condition may be satisfied by excluding appropriate data blocks. .

  The extraction process described above includes (a4) a process of extracting a third data block other than the data block that is essential when the frequency distribution of the confidential attribute value satisfies a predetermined condition from the group of data blocks. May be included. In this case, in the process of extracting another group of data blocks, the third data block may be extracted from mesh elements in other types of meshes. In this way, since the third data block is used for generating other groups, data blocks that are deleted can be reduced.

  Note that the anonymized data generation method according to the present embodiment may further include (C) a process of generating a plurality of types of meshes so as not to share the boundaries of the mesh elements. In this way, data blocks that are not anonymized can be more efficiently reduced.

  In addition, the anonymized data generation method according to the present embodiment is (D) the maximum distance from the nearest boundary among mesh boundaries generated so far, and the mesh grid points generated so far And (E) a process of generating a mesh based on the selected reference point and the size of the mesh element may be further included. In this way, data blocks that are not anonymized can be more efficiently reduced.

  It is possible to create a program for causing a computer to carry out the processing described above, such as a flexible disk, an optical disk such as a CD-ROM, a magneto-optical disk, and a semiconductor memory (for example, ROM). Or a computer-readable storage medium such as a hard disk or a storage device. Note that data being processed is temporarily stored in a storage device such as a RAM.

  Hereinafter, additional notes according to the present embodiment will be described.

(Appendix 1)
For each of a plurality of types of meshes in the space that is stored in the data storage unit and that is spanned by each numerical attribute in a plurality of data blocks each including a confidential attribute value and a numerical attribute value, among the plurality of data blocks, Extracting a group of data blocks including a first data block which is included in one mesh element of the mesh and has not yet been grouped and whose frequency distribution of confidential attribute values satisfies a predetermined condition;
An anonymized data generation method executed by a computer, including a process of replacing a numerical attribute value of a data block belonging to the group with a numerical attribute value for the group.

(Appendix 2)
The anonymized data generation method according to appendix 1, further including a process of deleting a confidential attribute value of a data block belonging to the group.

(Appendix 3)
The predetermined condition includes a lower limit value of the number of types of confidential attribute values,
The extraction process is:
It is determined whether the type of the confidential attribute value in the set of data blocks including the first data block that has not been grouped and included in the one mesh element is equal to or greater than the lower limit value of the type of the confidential attribute value. The anonymization data generation method of Additional remark 1 or 2 including a process.

(Appendix 4)
The extraction process is:
Determining whether a frequency distribution of confidential attribute values for a second set of data blocks including the first data block that has not been grouped and included in the one mesh element satisfies the predetermined condition;
If the frequency distribution of confidential attribute values for the second set of data blocks does not satisfy the predetermined condition, the second data block from the second set of data blocks to satisfy the predetermined condition The anonymized data generation method according to any one of appendices 1 to 3, including a process of generating a group of data blocks by excluding.

(Appendix 5)
The extraction process is:
A process of extracting a third data block other than the data block that is essential when the frequency distribution of the confidential attribute value satisfies the predetermined condition from the group of data blocks,
The anonymized data generation method according to any one of appendices 1 to 4, wherein in the process of extracting another group of data blocks, the third data block is extracted in a mesh element in another type of mesh.

(Appendix 6)
The anonymized data generation method according to any one of appendices 1 to 5, further including a process of generating the plurality of types of meshes so as not to share a boundary between mesh elements.

(Appendix 7)
Select a reference point that maximizes the distance to the nearest boundary of the mesh boundaries generated so far, and maximizes the distance to the grid points of the mesh generated so far,
The anonymized data generation method according to any one of appendices 1 to 5, further including a process of generating a mesh based on the selected reference point and the size of the mesh element.

(Appendix 8)
For each of a plurality of types of meshes in the space that is stored in the data storage unit and that is spanned by each numerical attribute in a plurality of data blocks each including a confidential attribute value and a numerical attribute value, among the plurality of data blocks, Extracting a group of data blocks including a first data block which is included in one mesh element of the mesh and has not yet been grouped and whose frequency distribution of confidential attribute values satisfies a predetermined condition;
An anonymized data generation program for causing a computer to execute a process of replacing a numerical attribute value of a data block belonging to the group with a numerical attribute value for the group.

(Appendix 9)
For each of a plurality of types of meshes in the space that is stored in the data storage unit and that is spanned by each numerical attribute in a plurality of data blocks each including a confidential attribute value and a numerical attribute value, among the plurality of data blocks, A grouping processing unit that extracts a group of data blocks that include a first data block that is included in one mesh element of the mesh and that has not been grouped and whose frequency distribution of confidential attribute values satisfies a predetermined condition;
Anonymization processing unit for replacing the numerical attribute value of the data block belonging to the group with the numerical attribute value for the group;
An information processing apparatus.

110 First data storage unit 120 Setting data storage unit 130 Grouping processing unit 140 Second data storage unit 150 Anonymization processing unit 160 Third data storage unit 170 Output unit 180 Mesh generation unit 190 Fourth data storage unit

Claims (9)

For each of a plurality of types of meshes in the space that is stored in the data storage unit and that is spanned by each numerical attribute in a plurality of data blocks each including a confidential attribute value and a numerical attribute value, among the plurality of data blocks, Extracting a group of data blocks including a first data block which is included in one mesh element of the mesh and has not yet been grouped and whose frequency distribution of confidential attribute values satisfies a predetermined condition;
An anonymized data generation method executed by a computer, including a process of replacing a numerical attribute value of a data block belonging to the group with a numerical attribute value for the group. The anonymized data generation method according to claim 1, further comprising a process of deleting a confidential attribute value of a data block belonging to the group. The predetermined condition includes a lower limit value of the number of types of confidential attribute values,
The extraction process is:
It is determined whether the type of the confidential attribute value in the set of data blocks including the first data block that has not been grouped and included in the one mesh element is equal to or greater than the lower limit value of the type of the confidential attribute value. The anonymized data generation method of Claim 1 or 2 including a process. The extraction process is:
Determining whether a frequency distribution of confidential attribute values for a second set of data blocks including the first data block that has not been grouped and included in the one mesh element satisfies the predetermined condition;
If the frequency distribution of confidential attribute values for the second set of data blocks does not satisfy the predetermined condition, the second data block from the second set of data blocks to satisfy the predetermined condition The anonymized data generation method according to any one of claims 1 to 3, including a process of generating a group of data blocks by excluding. The extraction process is:
A process of extracting a third data block other than the data block that is essential when the frequency distribution of the confidential attribute value satisfies the predetermined condition from the group of data blocks,
5. The anonymized data generation method according to claim 1, wherein in the process of extracting another group of data blocks, the third data block is extracted in a mesh element in another type of mesh. The anonymized data generation method according to any one of claims 1 to 5, further including a process of generating the plurality of types of meshes so as not to share a boundary between mesh elements. Select a reference point that maximizes the distance to the nearest boundary of the mesh boundaries generated so far, and maximizes the distance to the grid points of the mesh generated so far,
The anonymized data generation method according to claim 1, further comprising: generating a mesh based on the selected reference point and the size of the mesh element. For each of a plurality of types of meshes in the space that is stored in the data storage unit and that is spanned by each numerical attribute in a plurality of data blocks each including a confidential attribute value and a numerical attribute value, among the plurality of data blocks, Extracting a group of data blocks including a first data block which is included in one mesh element of the mesh and has not yet been grouped and whose frequency distribution of confidential attribute values satisfies a predetermined condition;
An anonymized data generation program for causing a computer to execute a process of replacing a numerical attribute value of a data block belonging to the group with a numerical attribute value for the group. For each of a plurality of types of meshes in the space that is stored in the data storage unit and that is spanned by each numerical attribute in a plurality of data blocks each including a confidential attribute value and a numerical attribute value, among the plurality of data blocks, A grouping processing unit that extracts a group of data blocks that include a first data block that is included in one mesh element of the mesh and that has not been grouped and whose frequency distribution of confidential attribute values satisfies a predetermined condition;
Anonymization processing unit for replacing the numerical attribute value of the data block belonging to the group with the numerical attribute value for the group;
An information processing apparatus.

Images