FR3077894A1 - AUTOMATIC PROCESSING METHOD FOR ANONYMOUSING A SET OF DIGITAL DATA - Google Patents

Abstract

The invention relates to the field of digital data processing and more particularly automatic processing of large volumes of digital data by modifying the content and / or the structure of these data in order to make it very difficult or impossible to "re-identify" the data. persons (natural or legal) or entities concerned, in particular by proceeding with anonymisation.

Description

AUTOMATIC PROCESSING METHOD FOR THE ANONYMIZATION OF A DIGITAL DATA GAME

Field of the invention

The present invention relates to the field of digital data processing and more particularly to the automatic processing of large volumes of digital data consisting in modifying the content and / or the structure of this data in order to make it very difficult or impossible to "re-identify" individuals (natural or legal) or entities concerned, in particular by anonymizing.

Companies today accumulate large volumes of data, the processing and monetization of which can create value. These data cover personal data which subjects them to regulatory and ethical requirements before their dissemination. The anonymization of data is therefore a crucial step to prevent access to personal data. Anonymization generally generates a loss of information which must however be controlled in order to keep the data useful for users. In order to properly target anonymization, it is therefore necessary to decide on the variables qualified as identifiers or as sensitive to disclosure. A rationalized analysis of the attributes of a data set, their characteristics and their modalities is therefore essential to classify the attributes, prior to the anonymization exercises and / or evaluation of the risk of disclosure of personal data. . The streamlining of the identification of attributes for anonymization makes it possible to resolve the potential problems of subjectivity and / or non-precision of the analyzes, which may arise when the classification of attributes is left to the choice of the user / anonymizer and is not based on the advice of an expert.

Choosing ¹ anonymize data often results from a compromise ethical, legal and ethical, between a desire or an obligation to protect individuals and their personal data. Anonymization is used in particular for the dissemination and sharing of data deemed to be of public interest, such as open data.

A first step generally consists in deleting the identifiers from the files or databases concerned such as names, first names, fiscal identifiers, social security numbers, etc.

The next step will consist of files or databases of “cryptographic transformations” (eg to apply to filters ”and“ encryption and / or hashing of data by a dedicated algorithm, for example SHA for Secure Hash Algorithm), but before this work, the data manager carries out or has carried out a study clarifying his need for anonymization, his objectives and his requirements (ex: should there be a possible reversibility of anonymization), prioritizing if necessary the data to be protected, according to their degree of sensitivity and according to the purpose of the processing which the information must then undergo. He can thus produce and compare several anonymization scenarios to better choose the solution which seems to him the most relevant (according to his requirements, and the requirements of the Law). In all cases, anonymization must resist dictionary attacks.

Several phases and levels of anonymization sometimes follow one another: for example, the hospital performs an initial anonymization, the data processing center can then complete this work, and secondary users (researchers in general) can still anonymize the reworked data. (before publication in a journal or distribution to other users). Many methods exist (erasure of certain data (deletion) and / or manual transcoding, generalization, addition of noise; use of pseudonyms for example for the doctor / patient couple; encryption (generally with a public key - possibly fragmented - possessed by The competent authority).

In the medical field, the notion of anonymized identity and patient re-identification concerns the direct and indirect means of re-identification (ex: name, address ...) but also the figures if the means of decryption is available. .

To limit the risk of information leaks, a person (eg a patient) is only included in an anonymous database if this is mandatory or really useful, and a project can be associated with only one anonymous database . Increased legal certainty is obtained if all the persons appearing there have given their consent (in writing or by providing their identifier, for a study of a medico-commercial nature, for example, but this type of basis induces bias in interpretation .

Of course, at each level of data production or storage:

- Internal staff must be subject to access control mechanisms designed to prevent unauthorized access;

- Mechanisms must be provided to detect and block intrusion attempts (via the Internet or other means) and in particular malicious attempts at data inference, abuse of power, etc.

State of the art

Patent application WO 2015066523 describes an example of a computer-implemented method for providing better levels of data confidentiality, anonymity and security by allowing subjects to whom data belongs to remain dynamically anonymous, in other words anonymous as long as they wish and to the extent desired.

Embodiments include systems that create, access, use, store and / or erase data with increased levels of confidentiality, anonymity and security, thereby obtaining better qualified and more accurate information. For the data to be shared with third parties, embodiments can make possible a controlled sharing of information which makes it possible to deliver information limited in time, geographically and / or by use, to the receiving party. In one example, anonymity measure scores can be calculated for shared data items, so that a level of consent / commitment required by the data object before sharing of relevant data items to third parties can be specified.

Patent application WO2012080081 relates to a computer-implemented method of anonymizing data originating from a data source for a target application, the method consisting in: identifying sensitive data elements in data originating from the data through a discovery tool and generating data definitions for data elements indicating sensitive data elements, the data definitions comprising at least one property for the data elements; specify a set of execution engine rules comprising at least one execution engine rule, the execution engine rule comprising an execution engine anonymization protocol, the execution engine rule set being specified by

1'intermediate interface; mapping the set of execution engine rules to the definitions of data generated by the discovery tool for each of the sensitive data elements; and consuming the generated data definitions and applying the execution engine anonymization protocol mapped to the sensitive data item data definition, in order to anonymize the sensitive data item for the target application.

Also known is patent application EP2752786 which describes an anonymization device and an anonymization process characterized in that all the data satisfy the requested levels of anonymity for each, and in that they prevent the loss of value of information that results from abstracting the entire data collection. The present anonymization device comprises: an anonymization means for carrying out an anonymization processing during which a group of data is treated as a processing unit for a collection of data comprising at least two data; an anonymity level specifying means for specifying an adaptive anonymity level for each group; and an anonymity assessment means for judging whether a group meets the specified adaptive anonymity level. The anonymization means, on the basis of the evaluation result of the anonymity evaluation means, moreover performs an anonymization processing of the data collection for which the anonymization processing has been carried out.

The European patent application EP2573699 describes another example of anonymization device for automatically configuring a hierarchical tree of values General ¹ attribute in protecting identity information technology. In addition, the anonymization device described, quantitatively assesses the amount of information which is lost during the generalization of an attribute value, and can thus automatically evaluate priorities between anonymized data and between data which are in anonymization course. Information of each person include the values of ^one attribute of the person for a plurality of attributes. Anonymization is achieved by obscuring attribute values, and a structure in which attribute values to be obscured are expressed in a tree structure according to the level of obscuration is called a general hierarchical tree. The described identity information anonymization device performs an automatic configuration by configuring a tree using attribute value frequency information. In addition, by definition of a means of measuring the amount of information lost, using the general hierarchical tree, an amount of information lost between two anonymized data or between data being anonymized is quantitatively evaluated.

The patent application US 2107/0124336 describes an automated method of identifying attributes for the exercise of anonymization. This method is based on data encryption, a step prior to studying the level of sensitivity of the data and therefore their degree of requirement in terms of anonymization. This patent proposes three methods for choosing the values / attributes for anonymization. A first method consists in comparing the different values with values present in a dictionary, with which various levels of sensitivity are associated. Attributes for which the presence of sensitive values in the data set exceeds a certain predetermined threshold will be selected for anonymization. A second classification method is based on a comparison of the distributions of the values of an attribute in the dataset and in a known distribution. This method can confirm the results of the first method of identifying attributes to be anonymized. A final method is to provide the anonymizer with part of the original version of the data set (before encryption) and to generate from this sample a number of expressions for one or more attributes. The rest of the dataset will be encrypted and compared to these generated expressions to identify certain attributes and their sensitivity.

Disadvantages of the prior art

The solutions of the prior art are adapted to prepare anonymized databases during their creation. On the other hand, these solutions do not make it possible to easily change the anonymization, for example when the addition of new entries modifies the context of anonymization. The solutions of the prior art in this case require the reprocessing of the entire database, which can require considerable computation time, for databases which can represent several terabytes.

Furthermore, the solutions of the prior art do not make it possible to flexibly and dynamically evolve the level of requirement for anonymization as a function of the possibilities of re-identification by elaborate processing of the data.

Too demanding anonymization leads to the loss of any usefulness / value of the data.

On the other hand, if we privilege the wealth of information accessible by data processing, anonymization risks being insufficient with regard to regulatory standards.

This trade-off between these two constraints evolves according to the number and nature of the entries recorded in the database.

For example, information relating to sex combined with information relating to age can be identifying, which requires a transformation / anonymization action, especially when the data set contains in addition information relating to a given pathology . However, if all the entries / records correspond to the same sex, or to the same age group, the information is in reality not identifying. But if new entries change this situation, the “sex” or “age” information may require different processing.

In addition, anonymization requires a prior step of identifying the attributes / values to be anonymized. This step is left to the choice of the anonymizer / user and is therefore subject to a problem of subjectivity and non-precision of the classification. Furthermore, even the works which focus on the classification of attributes, do not provide a clear and documented methodology for qualifying attributes.

Solution provided by the invention

The present invention aims to remedy these drawbacks by proposing a method making it possible to have different levels of anonymization through a classification of the variables of a database.

The invention relates, according to its most general meaning, to a method of automatic processing of a set of digital data consisting of:

to save in a non-permanent memory a set of original data, to save in a permanent memory o a digital file constituted by a table determining at least identifiers / denominations of the variables, and for each of said variables a parameter "Identifier status" [identifier “I”, quasi-identifier “QI”, non-identifier “NP”] a “Sensitivity Status” parameter [: yes “S”, or not “NS”]. This parameter depends on the definition of sensitivity adopted:

“Regulatory” sensitivity, limited to legal requirements in terms of protection of privacy.

- "General" sensitivity, encompassing other aspects such as psychological, cultural, ...

o A digital file consisting of a table of census variables of the reference population with each for

The different modalities / values taken by each variable according to the census

The frequency of appearance of each modality in the reference population (France, United States, etc.)

An order of the power to identify the different census variables o A digital file consisting of a table of variables with an established order of the degree of ease (208) by which a potential attacker can access information on the different variables. This order can be deduced from certain databases retracing the history of attacks.

o A digital file made up of a table of “sensitive” attributes, for which the values / methods are classified in order of sensitivity.

The process of applying:

a first processing based on the attributes repository, noted “Initial Classification” consisting in o associating with each of the variables of said original data set a “status” parameter and in processing the variables associated with a “hidden” status (“I” , "Qi" or "S"), that is to say requiring action before data sharing, to prevent their normal use (without anonymization for example) in said dataset o to be assigned to each of the variables associated with a “NP” / “NS” status, a flag of definitive non-processing and conservation in the final data set, a second processing concerning the residual variables associated with a “quasi-identifying” status consisting of:

o Prohibit their exploitation consisting in assigning a “hidden” status to prevent their normal use in the final version of said dataset OR o assign to each of said residual variables:

a first indicator corresponding to the availability of the associated value from external data sources, for example from a web crawler or a repository or attack histories and / or a second indicator corresponding to the frequency values of said associated variables in the general population (also called reference population) whose dataset constitutes a subset o to order each of said residual variables as a function of said associated indicators, which will result for example in levels of different processing / anonymization during the anonymization process. This order translates the classification

digital final attributes IQ ”. assigned to a sequence a third treatment concerning the variables residuals associated with a setting of sensitivity

"Regulatory" consisting of:

o Prohibit their exploitation consisting in assigning a “hidden” status to prevent their normal use in the final version (215) of said dataset

OR o Assign a sensitivity indicator to each of these residual variables by referring to a list of sensitive variables with their different modalities / values ranging from the most sensitive to the least sensitive. These indicators are calculated on the basis of the frequency of appearance of the most sensitive values of the sensitive attribute. They will then be compared to a previously defined “acceptable” frequency threshold.

o Keep for each of the residual variables characterized, by a frequency of appearance of sensitive values greater than a threshold value, their "hidden" status to prevent their normal use in said data set.

o Assign the remaining variables a “hidden” but more “flexible” status in terms of processing requirements during the anonymization process.

According to a particular mode of implementation, a fourth processing concerning the residual variables associated with a “general” sensitivity parameter consisting in assigning to some of said variables a “hidden” status to prevent their normal use in said data set.

According to one variant, before the first classification step, the method includes processing to assign to each of the variables for which no correspondence with the attribute repository (201) is established, a provisional status in the attribute repository (201) , which can be changed into final status or rejected according to the opinion of an operator.

Advantageously, the method further comprises a step consisting in dynamically applying to the variables not associable with the frame of reference of the attributes, a specific processing consisting in recording in said frame of reference the couple “variable, status” awaiting validation / rejection according to the opinion of an operator. This would also imply potential enhancements to the “Identification power” (207) and / or “sensitivity” benchmarks.

According to a variant, said processing operations are applied periodically [for example during each evolution of the data set (210) or each evolution of the regulatory framework].

Advantageously, said treatments applied to “hidden” variables / values consist of:

delete said variables / values (in particular for variables assigned to status "I") record said variables in a DMZ the anonymization of at least part of the values corresponding to said variables.

Detailed description of a nonlimiting example of

1'invention

The present invention will be better understood on reading the detailed description of a nonlimiting example of the invention which follows, referring to the appended drawings, where:

FIG. 1 represents the flow diagram of all the treatments.

- Figure 2 shows all the processing modules for the implementation of the invention.

Figure 3 presents a detailed view of the flow diagram of the first classification step.

FIG. 4 presents a detailed view of the flow diagram of the analysis of the power of identification of the attributes.

Figure 5 presents a detailed view of the flowchart of the attribute sensitivity analysis.

Context of the invention

The present invention relates to the automatic classification of the attributes of a digital data set allowing better targeting of anonymization and / or re-identification risk assessment (IR) exercises. The aim is to automate technical processing to ensure compliance with the regulatory framework for the protection of personal data.

The proliferation of personal data and legal and legal developments in this area make the exercise of database anonymization a challenge for owners / users of digital databases.

Certain national and European organizations such as the CNIL or the G2 9 insist on the importance of the protection of personal data, by proposing anonymization methodologies making it possible to have a compromise between the protection of privacy and the data analysis. The regulatory framework is further strengthened by the European Data Protection Regulation (GDPR) which aims to harmonize European laws on the issue of the protection of personal data. In order to guarantee data protection, anonymization work must be checked by assessing the risk of re-identification of personal data.

The anonymization and the evaluation of the risk of disclosure of personal data generally concern certain variables of a data set, particularly those having an identifying character or those having a sensitive character. At the same time, anonymization implies a loss of information about the dataset, which can affect the usefulness of the data for users such as researchers. For this, it is relevant for a user or owner of the data to target the variables on which anonymization or the risk of re-identification will be carried out. Thus, the classification of the attributes of a data set would be an asset to strike a balance between the obligation of respect for private life and the guarantee of the usefulness of the data.

The classification of attributes is carried out by “manual” processing by the data owner and remains linked to his assessment. This leaves the question of the classification of variables subject to subjectivity and therefore capable of giving rise to decisions on anonymisation or assessment of the risk of re-identification which are not in accordance with the requirements of the manipulation of personal data. Furthermore, the context of dissemination of the data sets, the evolution of laws and customs as well as the characteristics of certain data sets mean that the classification of the variables is not final and that an expert assessment is always desirable to guarantee the ethical use of personal data.

In view of these elements, there is therefore a technical problem related to the prior analysis (manual or automatic) of the attributes of a data set in order to properly target the anonymization and / or assessment of the risk of re-identification exercises. data by a potential attacker of the dataset.

In this case, there is a need to rationalize the classification of the attributes in order to firstly introduce objectivity to this task often subject to subjectivity, automatically given the considerable amount of data requiring processing, in certain cases. applications. This will make it possible to compare data sets of the same kind, in terms of risk of disclosure. A good classification of the attributes will facilitate the decisions concerning the methods of anonymization and / or measurement of risk of disclosure of the personal data. In addition, having a classification of attributes which depends on the data set and which is not necessarily final offers more flexibility for data owners to be able to satisfy different pairs of contexts of use / nature of customers.

The present invention provides an attribute classification methodology to help data owners share their data while respecting personal data requirements automatically and dynamically, allowing parameters to evolve automatically based on the introduction of new data into the database.

The data owner accesses a dataset with attributes. Each attribute has a name allowing it to be classified. Each attribute can take different modalities / values and can therefore also be classified according to the composition of these values (distribution, frequency or other).

The innovation of this classification methodology therefore lies particularly in the intervention of the modalities of the different attributes of a data set in the process of classification of attributes.

Description of the invention

This invention has two stages of data classification. Classification begins with a first step, where the attributes of the data set to be processed are subjected to a first classification, using a database created called "Attribute repository". This invention will be described according to a detailed example with reference to Figures 1 to 5 annexed presenting the functional architecture and the flow diagrams of the main functional modules.

1- Attributes repository (201)

The “Attributes repository” (201) consists in applying a classification of attributes according to two main criteria for anonymizing personal data, namely:

- their identifying character (202) and

- their sensitive nature (203)

The identifying character (202) results in the recording of a numerical sequence which can take three states: "I" when the variable is directly identifying like the social security number, "QI" when the variable can become identifying, combined with other variables associated with the same state such as postal code, or "NP". The variables associated with the numerical sequence "NP" are not the subject of a processing within the framework of this invention, which can reduce the computation time in the anonymization process / process (204).

The sensitive character (203) results in the recording of a numerical sequence which can take two states: "S" when the variable is sensitive in the sense that its disclosure must be avoided and "NS" in other cases.

The repository (201) translates into a file gathering variables, listed on the basis of the state of the art, the recommendations of the privacy protection institutes as well as the use cases encountered. These variables are classified by category in order to facilitate the use of the repository when classifying the attributes of a given data set. The categories listed are: health, education and work, addresses, numbers and dates ...

The classification of attributes is then based on two elements:

- the identifying character (202) of the attributes and precisely their power of identifying the attributes, and

- the sensitive nature (203) of the data within the meaning of the law and also more generally within the meaning of customs, society ... For the sensitive nature, we consider:

- belonging to a particular category in the legal sense and

- a more general sensitivity, not limited to the level of legal requirements.

The attributes belonging, according to the law, to a “particular category” are classified as sensitive variables affected by the numerical sequence “S”, for example health data, criminal record ...

“General” sensitivity cannot, however, be reduced to legal sensitivity; it takes into account ethical and social aspects. The number of repetitions for example can be considered as a sensitive variable, and therefore this variable could be associated with a sequence "S" or "NS" according to the choice of the user.

These criteria come from the literature on anonymization and taking them into account to categorize the variables makes it possible to attenuate the subjectivity of the qualification and the analyzes. Indeed, most anonymization software / tools do not provide assistance to their users in the step of classifying the attributes of the data sets.

This repository (201) can be continuously enriched and is supposed to bring together a large set of variables relating to numerous sectors of activity, in order to increase its usefulness.

The processing results in the enrichment of the data table constituting the repository (201) by numerical parameters defined as follows:

Category: This is the theme to which the attribute relates.

Attribute: Name of the attribute.

Status Identifier: This involves classifying the variable as identifier "I, to be eliminated from the anonymized version", quasi-identifier "QI" or not "NP".

Special category in the legal sense: These are attributes that must be considered sensitive and therefore protected in the sense of the law.

General Sensitivity: Sensitivity includes sensitivity to the legal sense but also to the sense of ethics, custom, society, ...

Additional remarks: Precisions to be taken into account during classification.

Two other standards are added to refine the classification of attributes ^(2nd classification stage):

2- Attribute sensitivity reference (205)

In order to offer flexibility to users when classifying attributes, the “attribute sensitivity” reference frame (205) proposes to reference, according to the degree of sensitivity, the different modalities / values of an attribute classified as sensitive and therefore assigned the digital sequence "S".

Certain attributes classified as “sensitive” and assigned to the numerical sequence “S” take on values that do not necessarily have the same degree of sensitivity and / or protection requirement, hence the advantage of offering a more detailed analysis of sensitivity and an order of sensitivity for the different modalities of sensitive attributes (206).

For example, to establish the order of sensitivity of the modalities that the attribute "Disease" can take, it is relevant to take into account that certain diseases are more sensitive to disclosure than others, that is to say, that their disclosure could cause more harm to the person (s) concerned.

Based on the international classifications of diseases published by the World Health Organization (WHO), we can propose an order of sensitivity of the different diseases (according to the degree of dangerousness and / or social judgments) which will take for example the form next :

Highly sensitive diseases: Sexually transmitted diseases, ...

Moderately sensitive diseases: Chronic diseases, ...

Low sensitivity diseases: others

Ultimately, the "Sensitivity reference system for attributes "(205) consists of the list of attributes sensitive identified using the "Attribute repository" (201) and for each attribute, the different modalities possible (which may evolve) are classified in order of

sensitivity and / or requirement in terms of privacy protection and from a socio-cultural point of view.

3- Data identification power repository (207)

The qualification of the quasi-identifying attributes, assigned to a numerical sequence "IQ" can be improved by passing to a finer degree of analysis (212). Indeed, the power of identification can vary from one quasi-identifying attribute to another. Thus, the level of requirement in terms of anonymization and / or evaluation of anonymization could be different depending on the level of power of a quasiidentifier in the re-identification of an individual.

Two decision rules facilitating the classification of quasi-identifiers according to their power of identification are determined, the aim being to create a "Repository of Power of identification" (207). Specifically, we propose two criteria on which the order of identification power is based: "ease of access to attributes" and "frequency of appearance in the reference population".

3.1- * Accessibility repository for attributes (208)

The basic principle of this "Attribute ease of access repository" (208) is that a potential attacker could not access all the quasi-identifier attributes, assigned to the numerical sequence "QI", with the same degree of ease. In fact, all other things being equal, certain quasi-identifying attributes "IQ" are easier to access than others because of their public availability (on the Internet, on official sites, results of competitions, etc.). ).

We therefore propose an order by attribute category. If we consider for example the category of "dates", the different dates that we can find in the datasets do not necessarily have the same degree of accessibility. We consider for example the following classification:

Easy access dates: birth dates, ...

Dates less hospitalization, ...

Difficult medical dates, ...

The goal is to have quasi-identifiers, assigned by classified according to their attacking ease.

accessible: dates of access: dates of control a repository of attributes the numerical sequence "QI", of access by a potential

3.2- * Reference population reference (209)

We also consider that the power of identification of a quasi-identifying attribute, affected by a numerical sequence "QI", could depend on the frequency of the appearance of its different modalities in the reference population, like the French population. For example, all other things being equal, we can consider that the variable “date of birth” has a higher identification power than age. The “date of birth” gives more information than this age gives and is more identifying of individuals. In the same spirit, "being a woman / man" is less identifying than "being a teacher of philosophy".

The "Reference Population Reference System" (209) is therefore based on the distribution of the various attributes in the reference population, for example a country. For France, we refer for example to data from the last census of the French population in 2013 to deduce the distribution of a set of attributes.

The data collected concern the following variables at this level: age, socio-professional category, birth department, previous residence department, current residence department, work department, diploma obtained, nationality, sector of activity, region of birth, region of previous residence, region of work, sex, marital status and type of activity. This list can be enriched by other data on the French population which will allow to widen the list of attributes.

From this census, the attributes are classified according to the frequencies of appearance of their different modalities / values proposed. The decision rule is as follows:

The frequencies of appearance of the values / modalities of two quasi-identifying attributes A and B are compared. The attribute for which the least frequent modality has a lower percentage of appearance will be considered as an attribute with a higher power of identification, which will result in a level of anonymization and / or risk of re - more important identification.

This processing makes it possible to give an order of power to identify the attributes. This reference population reference frame (209) can be widened by taking into account the characteristics of other reference populations, such as the United States or Canada. We will therefore have, ultimately, a database giving the main characteristics of the reference populations (populations to which the data sets are attached).

These two criteria of "ease of access" and "reference population" will make it possible to have a repository of power of identification (207).

The two criteria can be complementary to cover the most quasi-identifying attributes, assigned the numerical sequence "IQ", of a dataset.

Description of an example of implementation of the invention

The classification of attributes can follow the following methodology:

Step (1): the data owner / user accesses a data set (210) which contains attributes with different names. The data owner examines the attribute dictionary (if it exists) or the attributes directly to classify them.

Step (2): At during this stage , the user accessed at " repository of the attributes ”(201). Step (3): At during this stage, the calculator treaty the game of data (210) to put in agreement each of the attributes with the attributes repository (201).

For the attributes of the data set (210), for which a matching is carried out, the processing consists in assigning them a marker. This correspondence can be done manually by the user by comparing the list of attributes in his dataset to the attributes repository or automatically by creating search automation algorithms such as the Rabin-Karp algorithm, String searching, approximate string searching, or even semantic search algorithms such as Lesk's algorithm.

Step (4): This step distinguishes the attributes of the data set (201) for which a matching has been carried out on the one hand, and the attributes for which no matching has been determined, on the other hand .

Step (5): This step consists in recording in the attributes repository (201), the attributes of the data set (210) for which no match has been found. These variables are saved with a provisional status, which can be modified in final status or rejected according to the opinion of an operator.

Stage (6)

This step to proceed to a first classification of the attributes, noted “Classification

Initial ”(211), based on“ the attributes repository ”(201)

This step only concerns the attributes for which a concordance with the "attributes repository" (201) has been established. At the end of this step, each of the marked attributes will have a status based on the attributes repository (201) translated by a numerical sequence which can take different states.

I "," NP "," S "or" NS "

This step is described in more detail with reference to the object flow diagram in FIG. 3

Using this repository, a user / owner of the data can make a first classification, denoted “Initial Classification” (211) of the attributes of their data set in order to properly target the anonymization / risk measurement exercises. disclosure.

A user accesses (301) the dictionary of attributes of the data set to be studied and the "attributes repository" (201). For the attributes for which a correspondence in the attributes repository has been found (303), a determination of their identifying (304) / sensitive (305) status will make it possible to have an initial classification of the attributes (306). The determination of this first classification is done by referring to the different columns of the file of the "attributes repository" (201). Here again, the correspondence between the attributes of the data set (201) and their status in the "attributes repository" (201) can be done manually or automatically by algorithms for automating the search.

For the attributes of the data set (210) assigned a numerical sequence "I", "NP" or "NS", the initial classification of the attributes (306) corresponds to their final classification. These attributes will therefore be permanently stored in the classification module (213), on which the anonymization process is based:

- The attributes assigned to a digital sequence "I" will undergo special processing and will not appear in the final data set (215) in order to guarantee respect for private life.

- The attributes assigned to a numerical sequence "NP" or "NS" will not undergo (214) special processing (204) and will be stored directly in the final data set (215).

Step (7): The user then determines an option consisting in granting to the attributes assigned to a numerical sequence "IQ" or "S" a hidden status preventing their normal use in the final data set (215) and to pass directly to the anonymization process (204) or to carry out additional processing of the data set (210), described below.

Step (8):

This step only applies to attributes, assigned to a digital sequence "S", determined by a filtering module (501). This step, called “Sensitivity analysis” (206), is presented in more detail by the flow diagram, object of FIG. 5.

The processing will be based on the result of the initial classification of attributes (306) and on the "sensitivity benchmark" (205).

By accessing (502) the "attribute sensitivity reference frame" (205), the computer will examine the distribution of the modalities of the sensitive attribute in the data set (503).

The frequencies of appearance of the most sensitive modalities of the attribute are then calculated for the data set to be studied (504).

The frequency of appearance of the sensitive modalities (of this sensitive attribute) is then compared with a frequency threshold defined previously (505). The attribute in question will retain its "sensitive" character if the frequency of appearance of the "sensitive" modalities in the data set exceeds the previously chosen threshold (506). Otherwise, the attribute will be assigned to a "less sensitive" class (507). We therefore obtain a final classification of sensitive attributes (508). This rule will allow users to be flexible during the anonymization process (204) in order to obtain the final version of the data set (215).

Step (9): This step only applies to attributes, assigned to a “QI” digital sequence, determined by a filtering module (401). This step, called “Analysis of the power of identification” (212), is presented in more detail by the flowchart, object of FIG. 4.

The processing will be based on the result of the initial classification of attributes (306) and on the "repository of power of identification" (207).

then different degrees of ease

digital access

given a sequence

results in an "easy access" order

This comparison

then

"Reference population reference" (209) and will sort (405) the attributes assigned to a numerical sequence "IQ" according to the order established in the "reference population reference" (209). This order can be done manually or automatically by sorting algorithms, namely "sorting by selection", "tree sorting" ...

The comparison of quasi-identifying attributes from the point of view of ease of access (403) and the order of the different attributes in terms of the characteristics in the reference population (405), make it possible to have a final order ( 406) attributes assigned to a “IQ” digital sequence according to their power of re-identification. This order will provide flexibility for users during the anonymization process (204), in terms of the need for anonymization for the different marked attributes of the data set (210).

Step (10): This step presents the end of the classification process of the attributes of the data set (210). The results of the analyzes of sensitivity (206) and of the power of identification (212) are grouped in a classification module (213), on which the calculator will be based for processing the data (204) of the data set (210 ). This processing can result in the anonymization of certain attributes, with different degrees of requirement in order to arrive at a final version of the data set (215). In all cases, the processing of the data must meet privacy needs while retaining the usefulness of the data set (210).

Claims (6)

claims 1 - Method for automatic processing of a digital data set consisting of: to save in a non-permanent memory a set of original data, to save in a permanent memory o a digital file (201) constituted by a table determining at least identifiers / denominations of the variables, and for each of said variables a parameter "Identifying Status »[Identifier“ I ”, quasi-identifier“ QI ”, non-identifier“ NP ”] a parameter“ Sensitivity Status ”[: yes“ S ”, or not“ NS ”] o A digital file consisting of a table of variables of census of the reference population (209) with for each The different modalities / values taken by each variable according to the census The frequency of appearance of each modality in the reference population (France, United States, ..) An order of power identification of the different census variables o A digital file consisting of a table of variables with an established order of the degree of ease (208) by which el a potential attacker can access information on the different variables o A digital file consisting of a table of “sensitive” attributes (205), for which the values / methods are classified in order of sensitivity. the process consisting in applying: a first processing based on the attributes repository (201), noted “Initial Classification” (211) consisting in o associating with each of the variables of said original data set a “status” parameter and in processing the variables associated with a status “ hidden ”(“ I ”,“ IQ ”or“ S ”), o to assign to each of the variables associated with a“ NP ”/“ NS ”status a flag of final non-processing and conservation (214) in the game final data (215) a second processing concerning the residual variables associated with a “quasi-identifying” status consisting of: o Prohibit their exploitation consisting in assigning a “hidden” status to prevent their normal use in the final version (215) of said dataset (210) OR o assign to each of said residual variables: a first indicator corresponding to the availability of the associated value from external data sources and / or a second indicator corresponding to the frequency of the values of said associated variable in the general population of which the data set constitutes a subset o to order each of said residual variables as a function of said associated indicators, which will result, for example, in different processing / anonymization levels during the anonymization process (204) determining the final classification of the attributes assigned to a numerical sequence "IQ" (406 ) a third treatment concerning the residual variables associated with a “regulatory” sensitivity parameter consisting of: o Prohibit their exploitation consisting in assigning a “hidden” status to prevent their normal use in the final version (215) of said dataset (210) OR Assign each of these residual variables a sensitivity indicator by referring to a list of sensitive variables with their different modalities / values (205) ranging from the most sensitive to the least sensitive, calculated on the basis of the frequency of occurrence of the most more sensitive to the sensitive attribute Keep for each of the residual variables characterized, by a frequency of appearance of sensitive values greater than a threshold value, their "hidden" status to prevent their normal use in said dataset Assign the remaining variables a “hidden” but more “flexible” status in terms of processing requirements during the anonymization process (204) 2 - Method according to claim 1 characterized in that it further comprises a fourth treatment concerning the residual variables associated with a "general" sensitivity parameter consisting in assigning to some of said variables a "hidden" status to prevent their normal use in said data set. 3 - Method according to claim 2 characterized in that before the first classification step a treatment to assign to each of the variables for which no correspondence with the attributes repository (201) is established, a provisional status in the attributes repository (201), which can be modified in final status or rejected according to the opinion of an operator. 4 - Method according to claim 1 characterized in that it further comprises a step consisting in applying dynamically to the variables not associable with the repository of attributes (201), a specific processing consisting in recording in said repository the couple "variable, status" awaiting validation / rejection according to the opinion of an operator. This would also imply potential enhancements to the "Identification power" (207) and / or "sensitivity" (205) benchmarks. 5 - Method according to claim 1, characterized in that said treatments are applied periodically [for example during each evolution of the data set (210) or each evolution of the regulatory framework]. 6 - Method according to claim 1 characterized in that said treatments applied to "hidden" variables / values consist of: delete said variables / values (in particular for variables assigned to status "I") record said variables in a DMZ the anonymization of at least part of the values corresponding to said variables. 1/5