JP5974858B2 - Anonymization processing method and apparatus - Google Patents

Description

  The present technology relates to information anonymization technology.

  By analyzing data based on data such as the personal medical history of hospitals, etc., it is possible to obtain useful information such as “people living in the XX area of XX are prone to △ illness”. Is expected.

  Such data analysis processing can be outsourced to a third party such as external cloud computing with a large-scale resource that has expert knowledge of data analysis and can accept a large amount of data from multiple hospitals. Is desirable. However, medical history data, which is personal privacy information, cannot be disclosed directly to an external third party. Therefore, an anonymization technique for protecting personal privacy information is used.

  As the most basic method of anonymization, it is conceivable to remove information (namely, ID) for identifying an individual such as a name from each record including a plurality of data item values for an information provider. For example, it is assumed that data as shown in FIG. 1 exists. In the example of FIG. 1, three records including data item values are shown for each of the data items of ID, age, gender, address, and illness. When the ID is removed from such a record group, data as shown in FIG. 2 is obtained.

  However, based on the data items (address, age, etc.) that can be identified by combining the data from which the ID has been removed, the individual and the data (for example, illness) are linked to obtain personal privacy information. There is an attack method to do. For example, it is assumed that the attacker knows that a 24-year-old male A is going to hospital X. If there is only one record of “24-year-old man” in the anonymized data released by Hospital X (FIG. 2), it can be easily identified as the A record. Thereby, by confirming the record that will be A's, the medical history that is A's sensitive privacy information will be leaked.

  Therefore, the data item value is set until k or more records having the same data item value exist in the record group so that the individual cannot be uniquely specified from the data items that can be specified by combining them. A generalized k-anonymization technique has been proposed.

  For example, in the case of data as shown in FIG. 2, if A's age “24 years old” is generalized to “20s” and B's age “26 years old” is generalized to “20s”, k = 2 is satisfied. -Anonymization has been done. In the example of FIG. 3, the address is further anonymized by generalizing “Saitama” and “Tokyo” to “Kanto”.

  By making k or more records having the same data item value, the attacker cannot narrow down k or more records related to a certain person. The attacker has identified more than k records in the anonymized data published by X Hospital that correspond to A of a 24-year-old male, and therefore which of the k records is A records. It is impossible to obtain A's sensitive privacy information.

  The privacy level of the k-anonymized record group is determined by the value of k, which is a parameter for k-anonymization. In general, the larger k is, the higher privacy can be maintained, but the data is too generalized, or k records cannot be aligned and the record itself is deleted. Information loss due to anonymization also increases.

  On the other hand, each person has a different approach to privacy, and there are information providers who do not require such high privacy. Even useful information of such information providers is lost with the existing k-anonymization technology.

JP 2005-78138 A JP 2009-31900 A JP 2006-339895 A JP 2012-3440 A

  Therefore, the objective of this technique is to provide the anonymization processing technique which suppresses information loss according to one side surface.

  The anonymization processing method according to one aspect of the present technology includes (A) a first data item value and a second data item value that can be generalized to anonymize the first data item value and the second data item value. A process of selecting a first data block representing a group from a data storage unit storing a plurality of data blocks including the number of data blocks to be grouped for generalization of data item values of (B) data From the storage unit, a second data block calculated based on the second data item value and having a distance from the first data block that is less than the threshold and the number of data blocks to be grouped is greater than or equal to the threshold is extracted. And (C) if the number of first data blocks and second data blocks is equal to or greater than the number of data blocks to be grouped included in the first data block, the second data block A process of grouping at least a part of the block and the first data block; and (D) the process of selecting, the process of extracting, and the process of grouping are among the data blocks stored in the data storage unit , Processing executed in order of data blocks having the largest number of data blocks to be grouped, and (E) for each group, generalizing the second data item value in the data block included in the group according to a predetermined rule Including.

  According to one aspect, information loss can be suppressed in the anonymization process.

FIG. 1 is a diagram illustrating an example of a record. FIG. 2 is a diagram illustrating an example of a record from which an ID is removed. FIG. 3 is a diagram illustrating an example of a processing result of k-anonymization. FIG. 4 is a diagram illustrating an overview of a system according to an embodiment of the present technology. FIG. 5 is a functional block diagram of the information collector device. FIG. 6 is a diagram illustrating an example of data stored in the first data storage unit. FIG. 7 is a diagram illustrating an example of a generalized hierarchical tree stored in the setting data storage unit. FIG. 8 is a diagram illustrating an example of a generalized hierarchical tree stored in the setting data storage unit. FIG. 9 is a diagram for explaining a variation of the generalized hierarchical tree. FIG. 10 is a diagram illustrating an example of definition data stored in the setting data storage unit. FIG. 11 is a diagram illustrating a main processing flow according to the embodiment. FIG. 12 is a diagram illustrating a processing flow of record search processing. FIG. 13 is a diagram for explaining the k-anonymization process. FIG. 14 is a diagram for explaining the k-anonymization process. FIG. 15 is a diagram for explaining the k-anonymization process. FIG. 16 is a diagram for explaining the k-anonymization process. FIG. 17 is a diagram for explaining the outline of the present embodiment. FIG. 18 is a diagram for explaining the outline of the present embodiment. FIG. 19 is a diagram showing a processing flow of record search processing. FIG. 20 is a diagram illustrating a processing flow of the distance calculation processing. FIG. 21 is a diagram for explaining the distance calculation processing. FIG. 22 is a diagram for explaining the distance calculation processing. FIG. 23 is a diagram illustrating a processing flow of record group generation processing. FIG. 24 is a diagram showing a processing flow of integration or deletion processing. FIG. 25 is a diagram illustrating a processing flow of the generalization processing. FIG. 26 is a diagram for explaining the generalization processing. FIG. 27 is a diagram illustrating an example of the processing result. FIG. 28 is a diagram for explaining processing in the information analyst apparatus. FIG. 29 is a diagram for explaining processing in the information analyst apparatus. FIG. 30 is a functional block diagram of a computer.

  In the embodiment of the present technology, a different anonymization request level k is set for each information provider, and the anonymization process is executed based on the different anonymization request level k for each information provider. However, a record of an information provider with a large value of anonymization desired level k and a record of an information provider with a small value of anonymization desired level k should not be generalized for anonymization together. Information loss.

  Specifically, FIG. 4 shows a configuration example of a system that performs processing according to the present embodiment. As shown in FIG. 4, a network 1 such as the Internet includes, for example, a plurality of information provider devices (information provider devices A and B in FIG. 4) that provide patient data for analysis, and data analysis Therefore, an information collector device 3 that executes anonymization processing and an information analyzer device 5 that receives anonymized data from the information collector device 3 and executes analysis processing are connected. These devices are information processing devices and have a storage device, a communication function, and an arithmetic function.

  The information provider may be a person who provides his / her own personal data, or may be a person who provides data of a plurality of patients such as hospitals. Further, it is assumed that communication via the network 1 is concealed by encryption or the like.

  The information provider devices A and B transmit the data held by the information provider devices A and B to the information collector device 3 via the network 1. In this case, the data to be transmitted includes an identifier (ID), data that can be identified by combining (referred to as qID (quasi-ID)), privacy data or sensitive data, and anonymization request level. And are included. The anonymization desired level is a value corresponding to k in k-anonymization, and the value of qID is generalized so that the same value becomes k or more.

  The information collector device 3 performs anonymization processing as described below, and retains anonymization data. Then, the information collector device 3 transmits anonymized data to the information analyzer device 5 in response to a request from the information analyzer device 5. The information analysis device 5 performs a predetermined analysis process using the anonymized data and outputs some analysis result.

  The information collector 3 that performs the main processing according to the present embodiment has a configuration as shown in FIG. The information collector device 3 includes a receiving unit 31, a first data storage unit 32, a grouping processing unit 33, a setting data storage unit 34, a second data storage unit 35, a generalization processing unit 36, 3 includes a data storage unit 37 and a transmission unit 38.

  The receiving unit 31 receives data from the information provider devices A and B and stores the data in the first data storage unit 32. For example, data as shown in FIG. 6 is stored in the first data storage unit 32. In the example of FIG. 6, the name (ID), age and address (qID), illness and weight (sensitive data), and anonymization desired level k are included in each record (also referred to as a data block). It has become. The anonymization request level k can be different for each record.

  The grouping processing unit 33 executes processing for grouping the record group stored in the first data storage unit 32 based on the data stored in the setting data storage unit 34, and stores the processing result in the second data Stored in the unit 35. For each group stored in the second data storage unit 35, the generalization processing unit 36 performs a process of generalizing the qID data according to the data stored in the setting data storage unit 34, and displays the processing result. Store in the third data storage unit 37. The transmission unit 38 transmits data to be stored in the third data storage unit 37 to the information analyst apparatus 5 or the like in response to a request from the information analyst apparatus 5 or the like.

  In the setting data storage unit 34, for each qID, for example, data of a generalized hierarchical tree as shown in FIG. 7 is held. FIG. 7 shows a part of a generalized hierarchical tree for an address qID, with “Japan” as the top layer, “East Japan” and “West Japan” as the second layer, and “East Japan” as the third layer. “Kansai” and “Kyushu” are arranged as nodes under “West Japan” such as “Tohoku” and “Kanto”. If it is an address, for example, a hierarchical structure is prepared in advance so that a municipality becomes a leaf node among possible addresses. Using such a generalized hierarchical tree, distance between records and generalization processing are performed.

  FIG. 8 shows a part of a generalized hierarchical tree for qID called age. FIG. 8 shows a subtree below the 20th node. In this way, the nodes “early 20s” and “late 20s” are placed under the node of the 20s, and nodes from the age of 20 to 24 are placed under the node of the early 20s. The nodes from the age of 25 to 29 are arranged under the node of the late 20s. In this case, the leaf node has a value that actually appears as qID.

  As will be described below, in the present embodiment, the distance is calculated based on the depth of the hierarchy. Therefore, by providing a blank intermediate node, the depth of the hierarchy is adjusted to weight the distance. May be. For example, as shown in FIG. 9, under the younger node, the node of less than 10 years and the node of teenager are not arranged in parallel, but in order to deepen the hierarchy of teenagers, less than 10 years old In parallel with this node, a node {blank} is arranged. In this way, data of a generalized hierarchical tree that is appropriately designed for calculating generalization and distance is prepared in advance.

  In the present embodiment, definition data as shown in FIG. 10 is also stored in the setting data storage unit 34. In the example of FIG. 10, the column to be treated as ID is a “name” column, the columns to be treated as qID are “age” and “address”, and the columns to be treated as sensitive data are “disease” and “ It is shown to be “weight”. In the following processing, ID is removed, and qID is used when calculating or generalizing distance, so this data is used to distinguish it from other attribute columns.

  Next, processing contents of the information collector 3 will be described with reference to FIGS. 11 to 29. It is assumed that the receiving unit 31 has already received the data from the information provider devices A and B and stored the data in the first data storage unit 32.

The grouping processing unit 33 sets the records to be processed stored in the first data storage unit 32 in the set X of records r (FIG. 11: step S1). For example, the record r is specified as including a data item value other than the ID. That is, r = {qID ₁ ,..., QID _n , SD ₁ , .., SD _m , k}. However, SD represents sensitive data, the number of qIDs is n, and the number of items of sensitive data is m. For example, in the case of the patient A in FIG. 6, r = {23, Tokyo, gastritis, 67, 1}, 23 and Tokyo are qID, gastritis and “67” are SD, and 1 is k. It is.

Next, the grouping processing unit 33 sets a set Y = {} (empty set) of the record group e (step S3). The record group e in the present embodiment is represented by a representative record of the group and a set R of records included in the group. For example, e = {r _e , R = {r ₁ ,..., R _l }}. Note that l is an integer equal to or greater than the maximum value among the desired levels of anonymization k of the records included in R.

  Then, the grouping processing unit 33 selects one record as the representative record r_max among the records having the maximum anonymization desired level in the set X (step S5). The larger the anonymization request level, the more difficult it is to group. Therefore, grouping is performed preferentially in descending order of anonymization request level.

  Thereafter, the grouping processing unit 33 performs a record search process based on the record r_max (step S7). The record search process will be described with reference to FIGS.

  First, the grouping processing unit 33 generates a record group e = {r_max, R = {r_max}} for the record r_max (step S21). Further, the grouping processing unit 33 sets a set Rc = {} (empty set) of records to be included in the group (step S23).

  Further, the grouping processing unit 33 calculates k_a = α × k_max from the anonymization desired level k_max of r_max (step S25). k_a is used as a threshold for the level of anonymization of other records when grouping. For example, α is a coefficient stored in advance in the setting data storage unit 34.

  Further, the grouping processing unit 33 calculates a threshold value Δ_a = β × k_max for the distance (step S27). β is also a coefficient stored in advance in the setting data storage unit 34, for example.

  Here, the difference with general k-anonymization is shown concretely. For example, when a record including qIDs such as age and address as shown in FIG. 13 is k-anonymized with k = 3, as shown schematically in FIG. 14) and generalize the values so that the records in the group have the same qID. Then, as shown in FIG. 15, the age and address which are qID are generalized. In this way, in general k-anonymization, k is the same for all records, but when the desired level of anonymization k is set for each record as in this embodiment, it has the same k. If a group consisting of only records is formed, information loss will increase. For example, as shown in FIG. 16, if there are only four circles representing records with k = 5, those records are deleted as indicated by a cross. On the other hand, there are three circles representing the record of k = 3, but they are far apart, and if these qIDs are generalized to the same value, the information will be generalized too much. Further, although there are 1 k = 3 records near the 4 records to be deleted, they are not grouped.

  In the present embodiment, if k_a calculated based on k for the representative record r_max is equal to or greater than k_a, they are grouped into the same group if the distance described below is equal to or smaller than Δ_a. When grouping record groups similar to those in FIG. 16, as schematically shown in FIG. 17, four records with k = 5 and one record with k = 3 are close to each other in k value and distance. Because they are close, they are grouped into one group (dotted circle). At this time, the records are grouped into five records according to the record of k = 5. Also, two records with k = 3 and one record with k = 1 are grouped into one group (dotted circle) because the values of k are close and the distance is close. At this time, three records are grouped according to the record of k = 3.

  More specifically, as shown in FIG. 18, the records that fall within the distance threshold Δ_a (the range of the alternate long and short dash line) centering on the representative record 100 are grouped. However, if the desired level of anonymization k of the representative record 100 is “3” and α = 0.6, the records are not grouped unless they have k_a = 1.8 or higher, so the record of k = 1 101 cannot be in the same group.

  Initially, a record that falls within Δ_a may be found exceeding the anonymization desired level k of the representative record. For example, in the case of the representative record 110, four records are found in the range 111 within the distance threshold Δ_a, but the record 112 with the longest distance is temporarily excluded from the group. However, as a result of grouping the record 112 as a representative record, if no record with an anonymization desired level k = 2 or higher of the record 112 is found, the record 112 is put into the group of the representative record 110. If the record 102 is isolated, that is, if no other record that satisfies the requirements of the distance, the level of anonymization, and the number is found, it is deleted.

  Hereinafter, returning to the processing flow of FIG. 12, specific processing contents will be described. The grouping processing unit 33 selects one unprocessed record r_j included in the set X (step S29). The processing shifts to the processing in FIG.

  19, the grouping processing unit 33 determines whether or not the anonymization request level of the record r_j is equal to or higher than k_a (step S31). If the desired level of anonymization of record r_j is less than k_a, the process proceeds to step S39.

  On the other hand, if the anonymization desired level of the record r_j is equal to or higher than k_a, the grouping processing unit 33 executes a distance calculation process for calculating the distance Δ_j between the representative record r_max and the record r_j (step S33). The distance calculation process will be described with reference to FIGS.

  First, the grouping processing unit 33 sets the distance Δ to 0 (FIG. 20: Step S41). Then, the grouping processing unit 33 selects an unprocessed qIDi among all the qIDs (Step S43). Thereafter, the grouping processing unit 33 specifies the depth Depth_p of the minimum subtree including the qIDi values of the records r0 and r1 whose distances are to be calculated from the generalized hierarchical tree for qIDi in the setting data storage unit 34. (Step S45).

  If the subtree as shown in FIG. 8 is a generalized hierarchical tree, as shown in FIG. 21, the age that is qIDi of record r0 is “20 years”, and the age that is qIDi of record r1 is “24 years”. Then, the subtree including both the values of the records r0 and r1 is surrounded by the dotted line X. Then, the depth of the partial tree is the depth indicated by the arrow A, and Depth_p = 1. On the other hand, the depth of the generalized hierarchical tree is “2”.

  On the other hand, as shown in FIG. 22, if the age that is qIDi of record r0 is “20 years old” and the age that is qIDi of record r1 is “29 years old”, a portion that includes both the values of records r0 and r1 The tree is the entire generalized hierarchical tree surrounded by the dotted line Y. Therefore, the depth of the partial tree is the depth indicated by the arrow B, and Depth_p = 2.

  Then, the grouping processing unit 33 calculates the distance Δ_i = Depth_p / {depth of the generalized hierarchical tree of qIDi} for qIDi (step S47). Further, the grouping processing unit 33 calculates Δ = Δ + Δ_i (step S49). That is, the sum of the distances Δ_i calculated for qIDi is the distance between records.

  Then, the grouping processing unit 33 determines whether there is an unprocessed qIDi (step S51). If there is an unprocessed qIDi, the process returns to step S43. On the other hand, if there is no unprocessed qIDi, the process returns to the caller process.

  Returning to the description of the processing in FIG. 19, when the distance between the representative record r_max and the record r_j is calculated, the grouping processing unit 33 determines whether Δ_j ≦ Δ_a is satisfied (step S35). That is, it is determined whether the distance Δ_j between the representative record r_max and the record r_j is equal to or less than the threshold value Δ_a. If the distance Δ_j exceeds the threshold value Δ_a, the process proceeds to step S39.

  On the other hand, when the distance Δ_j is equal to or smaller than the threshold value Δ_a, the grouping processing unit 33 sets the record r_j and the distance Δ_j in the set Rc (step S37). Thereafter, the grouping processing unit 33 determines whether or not an unprocessed record exists in the set X (step S39). If no unprocessed record exists in the set X, the process returns to the step S29 in FIG.

  In this way, the record that satisfies the conditions for the distance and the anonymization level and the distance to the record are registered in the set Rc.

  Returning to the description of the processing in FIG. 11, the grouping processing unit 33 determines whether the number of elements of Rc is equal to or greater than k_max−1 (step S <b> 9). If the number of elements of Rc is greater than or equal to k_max−1, the grouping processing unit 33 executes a record group generation process (step S11). The record group generation process will be described with reference to FIG. When the record group generation process ends, the process proceeds to step S15.

  The grouping processing unit 33 extracts k_max-1 records r_j in ascending order of Δ_j in the set Rc, and adds the extracted record r_j to the set R (step S61). In order to include as many records as possible in a certain group, initially, the set R includes the representative record r_max and only includes k_max records. As a result, this group may contain k_max or more records.

  Further, the grouping processing unit 33 adds the record group e to the set Y (step S63). Data about the set Y is stored in the second data storage unit 35.

  Further, the grouping processing unit 33 excludes records included in the set R from the set X (step S65). Then, the process returns to the caller process.

  By performing such processing, one record group e to be generalized is completed. However, a record may still be added to the record group e.

  Returning to the description of the processing in FIG. 11, if the number of elements of the set Rc is less than k_max−1, the grouping processing unit 33 executes integration or deletion processing (step S13). The integration or deletion process will be described with reference to FIG. Note that when this process ends, the process proceeds to step S15.

  The grouping processing unit 33 identifies the record group e_min having the smallest distance Δ (r_o, r_max) between the representative record r_max and the representative record r_o of the record group e included in the set Y (FIG. 24: step S71).

  Then, the grouping processing unit 33 determines whether Δ (r_o, r_max) ≦ β × {desired anonymization level of the representative record r_o} (step S73). Even for the representative record r_max in which there are not enough records in the vicinity of itself, the shortest distance among the representative records of the other record groups is within the range of the representative records of the other record groups (β × If it is {anonymization request level of representative record r_o), for example, it is a record that was not selected in step S61 of FIG. Therefore, reconfirmation is performed here.

  In this processing flow, the record group e_min having the smallest distance is first identified, but the record group e satisfies the condition that the distance Δ (r_o, r_max) satisfies β × {desired level of representative record r_o} or less. If so, there is no significant problem even if the record r_max is included in the record group.

  If Δ (r_o, r_max) ≦ β × {desired level of representative record r_o} is not satisfied, the process proceeds to step S77. That is, the representative record r_max is deleted.

  On the other hand, when Δ (r_o, r_max) ≦ β × {desired level of representative record r_o}, the grouping processing unit 33 adds the record r_max related to the process to the record set R_min of the record group e_min. (Step S75).

  Then, the grouping processing unit 33 excludes the record r_max from the set X (Step S77). As a result, the record r_max is excluded from the target of subsequent processing. Then, the process returns to the caller process.

  Returning to the description of the processing in FIG. 11, the grouping processing unit 33 determines whether the set X is an empty set (step S15). If the set X is not an empty set, the grouping processing unit 33 sets, as a new r_max, a record r having a maximum distance from the current r_max among the records having the maximum anonymization desired level in the set X (step r). S17). Then, the process returns to step S7.

  If the record r having the maximum distance from the current r_max is extracted in this way, the group generation of the record r can be efficiently performed. That is, it is expected that more records still remain around the record r. However, if the record is located at a position beyond the distance Δ_a from the current r_max, the process can be performed even if it is selected as a new r_max in this step.

  On the other hand, if the set X is an empty set, the generalization processing unit 36 executes the generalization processing using the data stored in the setting data storage unit 34 and sends the processing result to the third data storage unit 37. Store (step S19). The generalization process will be described with reference to FIGS.

  The generalization processing unit 36 identifies an unprocessed record group among the record groups e included in the set Y (FIG. 25: Step S81). Then, the generalization processing unit 36 selects one unprocessed qIDi (step S83).

  Thereafter, the generalization processing unit 36 identifies a common parent for the qIDi values of the records included in the set R of the record group e from the generalized hierarchical tree, and determines the qIDi values of the records included in the set R as the common Replace with the parent value (step S85). For example, as shown in FIG. 26, when a set of records whose age values of qIDi are “20 years old”, “24 years old”, and “25 years old” are included in the set R, the common parent “20 generations” Is replaced.

  Then, the generalization processing unit 36 determines whether there is an unprocessed qIDi (step S87). If there is an unprocessed qIDi, the process returns to step S83. On the other hand, if there is no unprocessed qIDi, the generalization processing unit 36 determines whether an unprocessed record group e exists in the set Y (step S89). If there is an unprocessed record group e, the process returns to step S81. On the other hand, in the case where there is no unprocessed record group e, the generalization processing unit 36 stores the data of all the record groups e included in the set Y and the records included in the set R of the record group e. It stores in the 3rd data storage part 37 (step S91).

  By executing the processing as described above, anonymization can be performed while suppressing information loss even when the anonymization request level k is different for each record.

  For example, if the process as described above is executed on the data as shown in FIG. 6, the data as shown in FIG. 27 is obtained. In the example of FIG. 27, qIDs such as age and address are generalized.

  After performing such processing, data as shown in FIG. 27 is transmitted to the information analyst apparatus 5 by the transmission unit 38 in response to a request from the information analyst apparatus 5, for example.

  However, as shown in FIG. 28, for example, anonymization is performed so as to minimize information loss, but data such as “Tokyo” or “Kanto”, “20s”, and “23” There is also an aspect that data analysis is difficult if the granularity of each is different. Accordingly, as shown in FIG. 29, the attribute is divided according to the hierarchy of the generalized hierarchical tree, and the attribute value that has been generalized and is unknown is set as a blank “blank”. That is, when the address is “Kanto” and the prefecture is unknown, the prefecture attribute is “blank”. In addition, since the age is “20's” and it is not known how many 20 years old, the age attribute is “blank”. If such processing is performed by the information analyst apparatus 5, data analysis such as correlation extraction becomes easy.

  Although the embodiment of the present technology has been described above, the present technology is not limited to this. For example, the functional block diagram of the information collection device 3 shown in FIG. 5 may not match the program module configuration. As for the processing flow, as long as the processing result does not change, the order of the steps may be changed or executed in parallel.

  Moreover, although the example of medical information is shown, this is an example and any data may be sufficient.

  The information provider devices A and B, the information collector device 3 and the information analyst device 5 described above are computer devices, and as shown in FIG. 30, a memory 2501 and a CPU (Central Processing Unit) 2503. A hard disk drive (HDD) 2505, a display control unit 2507 connected to the display device 2509, a drive device 2513 for the removable disk 2511, an input device 2515, and a communication control unit 2517 for connecting to the network. Are connected by a bus 2519. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing content of the application program, and performs a predetermined operation. Further, data in the middle of processing is mainly stored in the memory 2501, but may be stored in the HDD 2505. In an embodiment of the present technology, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed from the drive device 2513 to the HDD 2505. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above and programs such as the OS and application programs. .

  The above-described embodiment can be summarized as follows.

  The anonymization processing method according to the present embodiment includes (A) a first data item value and a second data item value that can be generalized to anonymize the first data item value and the second data item value. A process of selecting a first data block representing a group from a data storage unit that stores a plurality of data blocks including the number of data blocks to be grouped for generalization of data item values; and (B) data storage Processing to extract a second data block calculated based on the second data item value and having a distance from the first data block that is less than the threshold and the number of data blocks to be grouped is greater than or equal to the threshold (C) if the number of first data blocks and second data blocks is equal to or greater than the number of data blocks to be grouped included in the first data block, the second data A process of grouping at least a part of the lock and the first data block; and (D) the process of selecting, the process of extracting, and the process of grouping are among the data blocks stored in the data storage unit , Processing executed in order of data blocks having the largest number of data blocks to be grouped, and (E) for each group, generalizing the second data item value in the data block included in the group according to a predetermined rule Including.

  If such processing is executed, even if the number of data blocks to be grouped for each data block (corresponding to the desired level of anonymization in the embodiment) is set, anonymization is appropriately performed while suppressing information loss. Will be able to do.

  In the process to be executed, the data block having the maximum distance to the first data block selected immediately before or the data block whose distance to the first data block selected immediately before exceeds the threshold is selected. Anyway. If the former, grouping can be performed efficiently.

  Further, in the hierarchical tree data in which the distance is generalized in a stepwise manner with respect to the second data item value, the number of hierarchies in the smallest subtree including the two second data item values, It may be calculated from In this way, the distance can be appropriately defined.

  The distance threshold may be determined according to the number of data blocks to be grouped included in the first data block. For example, the threshold value is increased if the number of data blocks to be grouped is large, and the threshold value is decreased if the number is small, and the range for grouping the data blocks is adjusted appropriately.

  Further, the threshold value for the number of data blocks may be determined according to the number of data blocks to be grouped included in the first data block. If data blocks that have too different numbers of data blocks to be grouped are grouped together, they are too generalized to limit information loss.

  Furthermore, in the anonymization processing method, when the number of the first data block and the second data block is less than the number of data blocks to be grouped included in the first data block, If the distance from the included first data block is equal to or smaller than the threshold value, a process of adding the first data block selected in the selecting process to the other group may be further included. In this way, the number of data blocks discarded can be suppressed. As an additional condition, a condition that “the shortest distance is equal to or less than a threshold value” may be added.

  Furthermore, the anonymization processing method may further include a process of discarding the first data block when the distance from the first data block included in the other group exceeds a threshold value.

  Note that a program for causing a computer to execute the processing described above can be created, and the program includes, for example, a flexible disk, an optical disk such as a CD-ROM, a magneto-optical disk, and a semiconductor memory (for example, ROM). Or a computer-readable storage medium such as a hard disk or a storage device.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Appendix 1)
A first data item value and a second data item value that can be generalized to anonymize the first data item value and a data block to be grouped for generalization of the second data item value A process of selecting a first data block representing a group from a data storage unit that stores a plurality of data blocks including a number;
A second data block calculated from the data storage unit based on a second data item value and having a distance from the first data block that is less than a threshold and the number of data blocks to be grouped is greater than or equal to the threshold The process of extracting
If the number of the first data block and the second data block is equal to or greater than the number of data blocks to be grouped included in the first data block, at least a part of the second data block and Processing to group the first data blocks;
A process of executing the process of selecting, the process of extracting, and the process of grouping in order of data blocks having a large number of data blocks to be grouped among the data blocks stored in the data storage unit;
For each group, a process of generalizing the second data item value in the data block included in the group according to a predetermined rule;
And an anonymization processing method executed by a computer.

(Appendix 2)
In the processing to be executed,
The data block whose distance from the first data block selected immediately before is the maximum or the data block whose distance from the first data block selected immediately before exceeds the threshold is selected. Anonymization processing method.

(Appendix 3)
The distance is
In the hierarchical tree data that generalizes the second data item value step by step, it is calculated from the number of hierarchies in the smallest subtree including the two second data item values and the number of hierarchies of the hierarchical tree. The anonymization processing method according to 1 or 2.

(Appendix 4)
The distance threshold is
The anonymization processing method according to any one of appendices 1 to 3, which is determined according to the number of data blocks to be grouped included in the first data block.

(Appendix 5)
The threshold of the number of data blocks is
The anonymization processing method according to any one of appendices 1 to 4, which is determined according to the number of data blocks to be grouped, included in the first data block.

(Appendix 6)
When the number of the first data block and the second data block is less than the number of data blocks to be grouped included in the first data block, the first data block included in another group The anonymization process according to any one of appendices 1 to 5, further including: a process of adding the first data block selected in the process of selecting to the other group if the distance to is less than or equal to a threshold value Method.

(Appendix 7)
The anonymization processing method according to appendix 6, further including a process of discarding the first data block when a distance from the first data block included in the other group exceeds a threshold.

(Appendix 8)
A first data item value and a second data item value that can be generalized to anonymize the first data item value and a data block to be grouped for generalization of the second data item value A process of selecting a first data block representing a group from a data storage unit that stores a plurality of data blocks including a number;
A second data block calculated from the data storage unit based on a second data item value and having a distance from the first data block that is less than a threshold and the number of data blocks to be grouped is greater than or equal to the threshold The process of extracting
If the number of the first data block and the second data block is equal to or greater than the number of data blocks to be grouped included in the first data block, at least a part of the second data block and Processing to group the first data blocks;
A process of executing the process of selecting, the process of extracting, and the process of grouping in order of data blocks having a large number of data blocks to be grouped among the data blocks stored in the data storage unit;
For each group, a process of generalizing the second data item value in the data block included in the group according to a predetermined rule;
Is an anonymization processing program for causing a computer to execute.

(Appendix 9)
A first data item value and a second data item value that can be generalized to anonymize the first data item value and a data block to be grouped for generalization of the second data item value Calculating a first data block representing a group from a data storage unit that stores a plurality of data blocks including a number, and calculating the second data item value from the data storage unit. A process of extracting a second data block whose distance from one data block is less than a threshold and the number of data blocks to be grouped is equal to or greater than a threshold; and the first data block and the second data block If the number is greater than or equal to the number of data blocks to be grouped included in the first data block, at least part of the second data block and the previous And a process of grouping a first data block, and wherein among the data blocks stored in the data storage unit, a first processing unit that executes the order of a few large data blocks of the data block to be the grouping,
A second processing unit that generalizes a second data item value in a data block included in the group for each group according to a predetermined rule;
An information processing apparatus.

3 information collector device 31 receiving unit 32 first data storage unit 33 grouping processing unit 34 setting data storage unit 35 second data storage unit 36 generalization processing unit 37 third data storage unit 38 transmission unit

Claims (9)

A first data item value and a second data item value that can be generalized to anonymize the first data item value and a data block to be grouped for generalization of the second data item value A process of selecting a first data block representing a group from a data storage unit that stores a plurality of data blocks including a number;
A second data block calculated from the data storage unit based on a second data item value and having a distance from the first data block that is less than a threshold and the number of data blocks to be grouped is greater than or equal to the threshold The process of extracting
If the number of the first data block and the second data block is equal to or greater than the number of data blocks to be grouped included in the first data block, at least a part of the second data block and Processing to group the first data blocks;
A process of executing the process of selecting, the process of extracting, and the process of grouping in order of data blocks having a large number of data blocks to be grouped among the data blocks stored in the data storage unit;
For each group, a process of generalizing the second data item value in the data block included in the group according to a predetermined rule;
And an anonymization processing method executed by a computer. In the processing to be executed,
The data block having the maximum distance from the first data block selected immediately before or the data block having a distance from the first data block selected immediately before exceeds the threshold is selected. Anonymization processing method. The distance is
In the hierarchical tree data that generalizes the second data item value step by step, it is calculated from the number of hierarchies in the smallest subtree including two second data item values and the number of hierarchies of the hierarchical tree. Item 3. Anonymization processing method according to item 1 or 2. The distance threshold is
The anonymization processing method according to claim 1, wherein the anonymization processing method is determined according to the number of data blocks to be grouped included in the first data block. The threshold of the number of data blocks is
The anonymization processing method according to claim 1, wherein the anonymization processing method is determined according to the number of data blocks to be grouped included in the first data block. When the number of the first data block and the second data block is less than the number of data blocks to be grouped included in the first data block, the first data block included in another group The anonymization according to any one of claims 1 to 5, further comprising: adding the first data block selected in the process to be selected to the other group if the distance to is less than or equal to a threshold value. Processing method. The anonymization processing method according to claim 6, further comprising: a process of discarding the first data block when a distance from the first data block included in the other group exceeds a threshold. A first data item value and a second data item value that can be generalized to anonymize the first data item value and a data block to be grouped for generalization of the second data item value A process of selecting a first data block representing a group from a data storage unit that stores a plurality of data blocks including a number;
A second data block calculated from the data storage unit based on a second data item value and having a distance from the first data block that is less than a threshold and the number of data blocks to be grouped is greater than or equal to the threshold The process of extracting
If the number of the first data block and the second data block is equal to or greater than the number of data blocks to be grouped included in the first data block, at least a part of the second data block and Processing to group the first data blocks;
A process of executing the process of selecting, the process of extracting, and the process of grouping in order of data blocks having a large number of data blocks to be grouped among the data blocks stored in the data storage unit;
For each group, a process of generalizing the second data item value in the data block included in the group according to a predetermined rule;
Is an anonymization processing program for causing a computer to execute. A first data item value and a second data item value that can be generalized to anonymize the first data item value and a data block to be grouped for generalization of the second data item value Calculating a first data block representing a group from a data storage unit that stores a plurality of data blocks including a number, and calculating the second data item value from the data storage unit. A process of extracting a second data block whose distance from one data block is less than a threshold and the number of data blocks to be grouped is equal to or greater than a threshold; and the first data block and the second data block If the number is greater than or equal to the number of data blocks to be grouped included in the first data block, at least part of the second data block and the previous And a process of grouping a first data block, and wherein among the data blocks stored in the data storage unit, a first processing unit that executes the order of a few large data blocks of the data block to be the grouping,
A second processing unit that generalizes a second data item value in a data block included in the group for each group according to a predetermined rule;
An information processing apparatus.

Images