FR3117230A1 - Methods for determining an anonymous data structure, data counting methods, device and system for implementing such methods - Google Patents

Abstract

Methods for determining an anonymous data structure, data counting methods, device and system for implementing such methods The invention relates to a method for determining a data structure from at least one datum personal d relating to an individual. Said method comprises a step of initializing a data structure L as well as a set of steps of:- determining a value W_{d} equal to b x h(d) + (1-b) x h(V ), where h is a hash function, b is a Bernoulli variable, V is a uniform random variable independent of b, and, if the value W_{d} does not belong to the structure L,- inserting the value W_{d} in structure L if the cardinality of said structure L is less than a given number k, - otherwise, if the cardinality of structure L is greater than k and if the value W_{d} is less than the most large value of the structure L, inserting the value W_{d} into the structure L by replacing said largest value. Figure for abstract: Fig. 3

Description

Methods for determining an anonymous data structure, data counting methods, device and system for implementing such methods

The present invention belongs to the general field of information processing. More particularly, it relates to methods for determining anonymous data structures from "personal" data, as well as methods for counting distinct elements in sets of personal data. It also relates to a processing device and a computer system configured to implement said methods.

“Personal data” generally means data relating to persons identified directly or indirectly.

Personal data can be of different natures, and concern either natural or legal persons. These include, for example, medical data, university data, data which reflect certain characteristics of individuals acquired on or via one or more communication networks, such as data from a social graph of individuals representing a network of connections and relations of these individuals (commonly referred to as "social network"), data extracted from reports of calls made in a telecommunications network (representative of the mobility of individuals between the various relay antennas of the network), data browsing of individuals on the public Internet network (and in particular the sites visited and transitions from one site to another), data relating to the use by individuals of various connected objects, etc.

It is therefore understandable that making this type of data public can infringe the privacy of the individuals concerned. However, with the current development of telecommunications networks and the increasing number of services that rely on these networks (social networks, connected objects, etc.), we are witnessing a spectacular increase in personal data that is exchange via or on these networks.

There are currently, in the state of the art, various methods for anonymizing (i.e. making anonymous) personal data stored in a database. As opposed to personal data, anonymous data such as that which can be obtained via these methods refers to data from which it is impossible to: (i) target an individual, (ii) know whether data is linked to a single individual , and (iii) infer information about an individual. Thus, data anonymization consists of modifying the content or structure of personal data in order to make it difficult, at least theoretically, to identify the individuals concerned from the anonymized data.

By having access to such anonymized data, for example if an entity that owns it decides to make it public, it then becomes possible to carry out counting operations with a limited risk of revealing sensitive information about said individuals. In particular, there is a definite interest (because of the large masses of data that it is becoming possible to collect) in operations aimed at counting the number of distinct data in a set of anonymized data, in order to carry out statistical studies on events carried out by the individuals concerned during a given period.

By way of non-limiting example, such statistical studies may concern the characterization of population flows in a given geographical area, for example to determine what actions can be implemented to regulate such flows (modification of one or more signals , construction of one or more new infrastructures aimed at facilitating travel, etc.) or even for example to assess the attractiveness of said geographical space. Thus, an example of application can consist in analyzing data structures obtained after anonymization of telephone numbers of individuals registered for a determined period in a train station (in other words, in this example of application, an event carried out by an individual consists of a telephone call made or received from said station).

It should be noted that the problem of counting anonymized data has already been studied extensively. In particular, various methods have already been proposed for constructing data structures from which it is possible to carry out counting operations in a relatively efficient manner. Thus, we know, for example, Bloom filters, Flagolet-Martin estimators as well as so-called minimum k-value structures (“k-minimum values” in the Anglo-Saxon literature, still abbreviated “KMV”). Such structures are for example described in the document: “Cardinality estimation: An experimental survey”, Proceedings of the VLDB Endowment, 11(4): 499-512, 2017.

However, each of these structures has its drawbacks. Thus, for a given set of personal data, a Bloom filter contains all the hash values of this personal data, which does not make it possible to guarantee very effective confidentiality in the face of an attack, for example of the brute force type.

A KMV structure, although more compact (only the smallest k hash values are contained in a KMV structure), inherits the same anonymization disadvantage as mentioned above for a Bloom filter.

Finally, with regard to a Flagolet-Martin estimator, this does not make it possible to carry out operations for counting distinct data in unions or intersections of sets, and this regardless of the level of anonymization that such an estimator can present. However, this is particularly penalizing when it comes to carrying out statistical studies involving different groups of individuals (example: determining how many people have traveled by train between two cities during a given period of the day, from two sets of data, each set containing personal data of persons present in a station of said two cities).

Ultimately, it emerges from the foregoing that the data structures proposed hitherto are deficient in that they do not make it possible to carry out, simultaneously, operations of counting distinct data in sets, and in particular in intersections and unions of sets, and at the same time to control the level of anonymization on these operations.

The objective of the present invention is to remedy all or part of the drawbacks of the prior art, in particular those set out above, by proposing a solution which makes it possible, in comparison with the solutions of the state of the art, to achieve counting operations aimed at estimating the number of distinct elements in datasets, especially in intersections and unions of datasets, with a better compromise in terms of compactness (number of data processed to provide an excellent estimate counting) and a strong guarantee of confidentiality.

To this end, and according to a first aspect, the invention relates to a method for determining, called "first method", a data structure from at least one datum d, said at least one datum being personal datum relating to an individual and stored during a storage process of determined duration following the occurrence of an event by said individual. Furthermore, said method comprises a step of initializing a data structure L to an empty set as well as a set E_DET of steps of:
- determination of a value W_{d} equal to bxh(d) + (1-b) xh(V), where:
● h is a hash function with discrete values between 0 and 1,
● b is a Bernoulli variable with parameter p, with M being the cardinal of the image of the hash function h, and r being an upper bound of the number of times the datum d can be stored during said duration, and ɛ being a strictly positive number,
● V is a uniform random variable independent of b,
and, if the value W_{d} does not belong to the structure L,
- insertion of the value W_{d} in the structure L if the cardinality of said structure L is less than a given number k,
- otherwise, if the cardinal of the structure L is greater than k and if the value W_{d} is less than the largest value of the structure L, inserting the value W_{d} into the structure L by replacing said greater value

Thus, said first method makes it possible to obtain a data structure L that is more compact than the set of data from which it is derived, and formed solely of values distinct from each other, while ensuring differential confidentiality of order ɛ to these values ( because of the interval in which the parameter p is chosen).

It should be noted that such a data structure L differs from a conventional structure of the KMV type insofar as the presence of a datum in said structure L is guaranteed with a probability p (which consequently leads to ensuring differential confidentiality of order ɛ), where the KMV structure comprises, by construction, all the hash values of the distinct values of the set of data considered at the start. Thus, the data structure L obtained by means of the first method has a much better level of confidentiality than that offered by a conventional KMV structure.

It is also understood that the gain in compactness procured by obtaining said data structure L offers the possibility of carrying out counting operations (estimating the number of distinct elements in a set of data, in a union of sets of data or even in an intersection of data sets) in a very efficient way (speed of calculations, gain in memory storage, etc.).

In particular modes of implementation, the determination method may also include one or more of the following characteristics, taken in isolation or in any technically possible combination.

In particular modes of implementation, the data structure L is determined from a plurality of data, the steps of said set E_DET of steps being iterated for each data of said plurality of data, the data structure considered for the insertion of a datum during a current iteration of the set of steps E_DET corresponding to the data structure into which a datum was inserted during an iteration of the set of steps E_DET preceding said iteration current.

In particular modes of implementation, said E_DET set of steps is implemented:
- after all of said plurality of data is stored, or
- Dynamically, after each storage of a datum of said plurality of data.

In particular embodiments, said method comprises, for each execution of the step of insertion by replacement, a step of incrementing a value called "counting value" N, said counting value N being representative , at the end of the method, of the total number of times said step of inserting by replacement has been executed during the implementation of the method

In particular embodiments, said counting value N is initialized to zero or else initialized to a realization of a centered Laplace random variable.

According to a second aspect, the invention relates to a method for determining, called "second method", a data structure, called "second data structure" L2, from a first data structure L1 obtained by application of 'an algorithm of minimum k'-values to data, each datum being personal datum relating to an individual and stored during a memorization process of determined duration following the occurrence of an event by said individual, the setting implementation of said minimal k'-value algorithm using a hash function h with discrete values between 0 and 1. In addition, said method comprises steps of:
- determination of a value D1 equal to the quotient of k'-1 by the greatest value of the first structure L1,
- uniform sampling of a number D1 of values in the image of the hash function h, so as to obtain a set L_D1 comprising said D1 sampled values,
- uniform sampling of a number D2 of values in the set L_D1, D2 being equal to the integer part of the product [1-p] x D1, with M being the cardinal of the image of the hash function h, and ɛ being a strictly positive number,
- selection of a number D3 of smallest values among said D2 sampled values, D3 being equal to the integer part of the product [1-p] xk, where k is a given number less than k',
- uniform sampling of a number D4 of values between the largest value of the first structure L1 and 1, so as to obtain a set L_D4 comprising said D4 sampled values, D4 being equal to D1-k,
- uniform sampling of a number D5 of values in the union of the sets L_D1 and L_D4, D5 being equal to the integer part of the product px D1,
- selection of a number D6 of smallest values among said D5 sampled values, D6 being equal to k-D3,
- grouping of said smallest values selected during said selections, so as to form said second structure L2

Said second method inherits the same advantages as those mentioned above with reference to said first method.

According to a third aspect, the invention relates to a method for inserting at least one datum into a data structure L, said at least one datum being personal datum relating to an individual and stored during a memorization process of fixed duration following the occurrence of an event by said individual. Furthermore, said method comprises steps of:
- obtaining a data structure L determined according to a first or a second determination method in accordance with the invention,
- implementation, for said at least one datum to be inserted, of a set of steps identical to the set E_DET of steps of a first determination method according to the invention.

Said third method inherits the same advantages as those mentioned above with reference to said first method.

In particular embodiments, the insertion method may also include one or more of the following characteristics, taken in isolation or in all technically possible combinations.

In particular embodiments, a plurality of data is considered for insertion into the structure L, said implementation step being iterated for each of the data to be inserted, the data structure considered for the insertion of a datum during a current iteration of the implementation step corresponding to the data structure into which a datum has been inserted during an iteration of the implementation step preceding said current iteration.

In particular modes of implementation, said set identical to said set E_DET of steps of the first determination method is implemented:
- after all of said plurality of data is stored, or
- Dynamically, after each storage of a datum of said plurality of data.

In particular embodiments, when the data structure L obtained has been determined according to a first determination method in accordance with the invention, so as to obtain a counting value N corresponding to the total number of times the step insertion by replacement has been executed, the insertion method also comprises, for each execution of the step identical to the step of insertion by replacement of said first determination method, a step of incrementing said counting value NOT.

According to a fourth aspect, the invention relates to a method for estimating the number of distinct data in a set of data, each data being personal data relating to an individual and stored during a storage process of determined duration following the realization of an event by said individual. Said method comprises steps of:
- obtaining a data structure determined according to a determination or insertion method in accordance with the invention, the cardinality of said structure obtained being equal to k,
- determination of a value Q equal to the quotient of k-1 by the largest value of the data structure obtained,
- determination of an estimator G of the number of distinct data of the set of data according to Q.

In particular modes of implementation, the estimator G is equal to g ^-1 (Q), where g ^-1 is an inverse function of a function g of unknown β and having the expression:

expression in which:
● ,
● ,
● if the respective numbers of occurrences of the data of said data set are all equal to the same given value R, r_avg is equal to R,
● otherwise, and if the data structure is determined according to a first method or an insertion method in accordance with the invention, so as to obtain a count value N, r_moy is equal to the integer part of the quotient of N by Q .

According to a fifth aspect, the invention relates to a method for estimating the number of distinct data in a union of a plurality of sets of data, each data being personal data relating to an individual and stored during a process of memorization of determined duration following the realization of an event by said individual. Said method comprises steps of:
- obtaining, for each set of data, a data structure determined according to a determination or insertion method in accordance with the invention,
- selection of a number D7 of smallest values of a structure corresponding to the union of the data structures obtained, D7 being equal to the smallest value among the respective cardinals of said data structures obtained,
- determination of a Q_UNION value equal to the quotient of D7-1 by the largest value among said smallest selected values,
- determination of an estimator G_UNION of the number of distinct data of said union of data sets as a function of Q_UNION.

In particular modes of implementation, the estimator G_UNION is equal to
g ^-1 (Q_UNION), where g ^-1 is an inverse function of a function g with unknown β and having the expression:

expression in which:
● ,
● ,
● if the respective numbers of occurrences of the data of said data sets are all equal to the same given value R, r_avg is equal to R,
● otherwise, and if the data structure is determined according to a first method or an insertion method in accordance with the invention, so as to obtain a value N_SUM equal to the sum of the respective counting values of said data structures, r_moy is equal to the integer part of the quotient of N_SUM by Q_UNION.

According to a sixth aspect, the invention relates to a method for estimating the number of distinct data in an intersection of a plurality of sets of data, each data being personal data relating to an individual and stored during a process of memorization of determined duration following the realization of an event by said individual. Said method comprises steps of:
- obtaining, for each set of data, a data structure determined according to a determination or insertion method in accordance with the invention,
- selection of a number D7 of smallest values of a structure corresponding to the union of said obtained data structures, D7 being equal to the smallest value among the respective cardinals of said obtained data structures,
- determination of a Q_UNION value equal to the quotient of D7-1 by the largest value among said smallest selected values,
- determination of a value Q_INTER equal to the quotient of the cardinality of a structure corresponding to the intersection of said data structures obtained by D7,
- determination of an estimator G_INTER of the number of distinct data of said intersection of data sets as a function of Q_INTER and Q_UNION.

In particular modes of implementation, the sets of data, called sets “A_1,…, A_T”, are T in number and respectively associated with parameters r_1,…, r_T, the cardinality of an associated data structure to a set A_i being equal to k_i, and the estimator G_INTER having the expression:


expression in which:
● if, for each set A_i, the respective numbers of occurrences of the data of said set A_i are all equal to the same given value R_i, r_i is equal to R_i,
● otherwise, and if the data structure is determined according to a first method or an insertion method in accordance with the invention, so as to obtain for each data structure associated with a set A_i a counting value N_i, the parameter r_i of each set A_i is equal to the integer part of the quotient of N_i by a value Q_i, said value Q_i being equal to the quotient of k_i-1 by the greatest value of the data structure obtained for said set A_i.

Thus, the estimation methods according to the invention offer additional functionalities for calculating intersection and union cardinals on sets of user data while guaranteeing protection of the privacy of these users. Such an advantage is not offered by known solutions of the prior art.

It is important to note that the first, second and third methods form alternative solutions to the determination of the same data structure. Such a data structure constitutes a particular technical element on which the estimation methods according to the invention are based for estimating the number of distinct elements in data sets, in particular in intersections and unions of sets of data, with a better compromise in terms of compactness and a strong guarantee of confidentiality. In other words, the different methods of the invention are linked together by the same general inventive concept consisting of the determination and use of a data structure according to the invention to carry out the counting operations in a precise and confidential manner. in question.

According to a seventh aspect, the invention relates to a computer program comprising instructions for the implementation of any of the methods according to the invention when said computer program is executed by a computer.

This program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in partially compiled form, or in any other desirable form.

According to an eighth aspect, the invention relates to a computer-readable information or recording medium on which a computer program according to the invention is recorded.

The information or recording medium can be any entity or device capable of storing the program. For example, the medium may include a storage medium, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or even a magnetic recording medium, for example a floppy disk or a disk. hard.

On the other hand, the information or recording medium can be a transmissible medium such as an electrical or optical signal, which can be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can in particular be downloaded from an Internet-type network.

Alternatively, the information or recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

According to a ninth aspect, the invention relates to a processing device comprising means configured to implement a method according to the invention.

According to a tenth aspect, the invention relates to a computer system comprising:
- a database in which is stored at least one personal data relating to an individual, said at least one data having been stored during a storage process of determined duration following the occurrence of an event by said individual,
- a processing device according to the invention.

Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended drawings which illustrate an exemplary embodiment thereof which is devoid of any limiting character. In the figures:
there schematically represents, in its environment, a particular embodiment of a computer system according to the invention;
there schematically represents an example of hardware architecture of a processing device belonging to the computer system of the ;
there represents, in the form of a flowchart, the main steps of a process, referred to as the “first process”, for determining a data structure according to the invention;
there represents, in the form of a flowchart, the main steps of a process, called “second process”, for determining a data structure according to the invention;
there represents, in the form of a flowchart, the main steps of a method, called a “third method”, of inserting at least one data item into a data structure according to the invention;
there represents, in the form of a flowchart, the main steps of a method, called “fourth method”, of estimating the number of distinct data in a set of data according to the invention;
there represents, in the form of a flowchart, the main steps of a method, called “fifth method”, for estimating the number of distinct data in a union of data sets according to the invention;
there represents, in the form of a flowchart, the main steps of a method, called “fourth method”, for estimating the number of distinct data in an intersection of a set of data according to the invention.

There schematically represents, in its environment, a particular embodiment of a computer system 10 according to the invention.

In the embodiment of the , the computer system 10 comprises a processing device 11 configured to carry out processing operations making it possible to anonymize one or more sets of data (a set may comprise one or more data), as well as to carry out counting operations of distinct elements in such data sets, by implementing various methods according to the invention and described in more detail later.

The data considered in the context of the present invention correspond to data relating to one or more individuals, and stored during a storage process of fixed duration following the occurrence of an event by said individual(s). Furthermore, the data set(s) from which the methods according to the invention are implemented are themselves included in a more general data set and denoted “X” (X is therefore itself a data set ) which includes the personal data of all individuals likely to carry out the said event during the said period.

Although no limitation is attached to the nature of the personal data considered and to the context in which they were acquired, it is considered in the present embodiment that the personal data processed by the computer system 10 are extracted from traces of mobility identified in a mobile telecommunications network for a plurality of individuals. Such traces of mobility are conventionally reported in call reports established by the network, and translate the mobility of individuals during communications established on the mobile telecommunications network between different relay antennas of the network, and this over a period of time. given.

More specifically, it is considered here that the personal data processed correspond to mobile telephone numbers belonging to one or more individuals, these telephone numbers having been stored in a database 12 illustrated on the , after said individuals have made one or more telephone calls even though they were in a train station for a determined period of time, for example between 4 p.m. and 8 p.m.

In other words, for this specific example of implementation, it is understood that an event carried out by an individual consists of a telephone call made or received in a train station, and that the memorization process in question consists of storing the number telephone number of this individual in the database 12 during the period of time concerned.

Therefore, a set of data intended to be used in a method according to the invention, for this specific example of implementation, corresponds to a set of telephone numbers. It is also noted that a telephone number may appear several times in such a data set if the individual associated with this telephone number has made and/or received several calls in the station during said period of time. Finally, the set X corresponds, in this example of implementation, to all the telephone numbers of the individuals likely to make and/or receive a telephone call in said station. In practice, the set X is made up of the numbers of all the inhabitants of the city in which the station in question is located. But there is also nothing to exclude considering a larger set X, such as, for example, the telephone numbers of individuals living in the country in which the said station is located.

No limitation is attached to the number of stations that can be considered, as detailed below when describing methods for providing count estimates in unions and/or intersections of data sets. Of course, it is also understood that the time period from 4 p.m. to 8 p.m. (and therefore of a fixed duration equal to 4 hours) is given here only by way of example, and that any other value can be considered.

More generally, the fact of considering personal data in the form of a telephone number only constitutes one particular example of application of the invention, and other examples can of course be considered, as is also described subsequently through various technical applications of the invention.

There schematically represents an example of hardware architecture of the processing device 11 belonging to the computer system 10 of the , for the implementation of various methods according to the invention.

As illustrated by the , the processing device 11 has the hardware architecture of a computer. Thus, the processing device 11 comprises, in particular, a processor 1, a random access memory 2, a read only memory 3 and a non-volatile memory 4. It also comprises a communication module 5.

The read only memory 3 of the processing device 11 constitutes a recording medium in accordance with the invention, readable by the processor 1 and on which is recorded a plurality of computer programs PROG_1, PROG_2, PROG_3, PROG_4, PROG_5, PROG_6 conforming to the invention, comprising instructions for the execution of process steps according to the invention. Each of the programs PROG_i, i being an integer index ranging from 1 to 6, defines at least one functional module of the processing device 11, which relies on or controls the hardware elements 1 to 5 of the processing device 11 mentioned above. The functions executed by such modules are specified below in connection with the description of the processes that can be implemented when the instructions (in the form of code) of said programs PROG_i are executed by processor 1.

The communication module 5 enables the processing device 11 to communicate with the database 12, and in particular to access the personal data stored therein. It may include, for example, a network card or any other means making it possible to connect to a communication network to which the processing device 11 and the database 12 belong, or even to communicate on a digital data bus connecting the processing device processing 11 to database 12.

It is noted that, in the embodiment of the , the database 12 corresponds to a distinct element of the processing device 11. It should however be noted that this is only a variant implementation of the invention, and that nothing excludes consider that the database 12 is for example stored directly in a memory of the processing device 11, for example in its non-volatile memory 4.

The rest of the description aims to describe the various methods that can be implemented by the processing device 11 by means of the programs PROG_i respectively. To this end, it is now considered in no way limiting that the set or sets of data on which these different methods are based come from the database 12 after the end of the storage process envisaged within the meaning of the invention.

That said, it should be noted that such provisions are in no way limiting of the invention. In particular, nothing excludes considering that said methods are implemented dynamically, in parallel with said memorization process and after each memorization of a piece of data in the database 12.

There represents, in the form of a flowchart, the main steps of a determination method according to the invention, called “first method”. The instructions dedicated to the execution of the steps of the first method are contained in the program PROG_1.

In its general principle, said first determination method consists in generating, from a set A of personal data, a data structure guaranteeing differential confidentiality of order ɛ of said set A, and from which it is possible to carry out counting operations of distinct elements in a particularly efficient manner.

The so-called “differential privacy” anonymization method, more commonly referred to as “differential privacy” or “differential privacy” in English, is well known to those skilled in the art. It makes it possible to anonymize data and is particularly appreciated because it makes it possible to formally and rigorously quantify the level of anonymity obtained, in other words, the risk of re-identifying from the anonymous data obtained (i.e. the data contained in the structure of data generated by means of the first determination method) the personal data relating to the individuals involved. This advantageously offers the possibility of controlling the compromise between the usefulness of the anonymous data obtained and the level of guaranteed anonymity.

Indeed, a level of anonymity that is too high can result in a loss of useful information concerning the original data. Conversely, an anonymous dataset that is too close to the initial dataset reveals too much information about the individuals concerned. Such a control is therefore important because it makes it possible to know whether the level of anonymity considered is reasonable or not.

In practice, the measurement of the level of anonymity is carried out by means of a parameter, denoted ɛ in the context of the present invention, and reflecting the fact that two data structures generated by means of said first method have almost the same law of probability if the sets of data supplied as input to the first method are close, that is to say differ by the contribution of a single datum. The "almost" is measured by said parameter ɛ: the smaller ɛ, the closer the probability laws and the more difficult it is to detect the participation of a particular individual in the data structures (the better the anonymity achieved ), which is the intended purpose of differential privacy. We note that the parameter ɛ and the anonymity achieved by the algorithm vary inversely, i.e. the smaller ɛ, the better the anonymity guaranteed by the algorithm.

Because differential privacy has been studied extensively, it is not described further here. For more details, it is for example possible to refer to the document by C. Dwork, F. McSherry, K. Nissim and A. Smith 15 entitled “Calibrating Noise to Sensitivity in Private Data Analysis”, Theory of Cryptography, pages 265 -284, 2006.

Said first method firstly comprises a step E10 of initializing a data structure L to an empty set. said initialization step E10 is implemented by an initialization module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

The objective of step E10 is therefore to create a structure capable of receiving data. In practice, from a computer point of view, the implementation of said step E10 consists in instantiating an empty list.

Said first method also comprises a set E_DET of steps implemented for each datum of set A. In order to describe the implementation of said set of steps E_DET, a datum, denoted "d", of the set a.

Therefore, for said datum d, said set of steps E_DET includes a step E_DET_10 for determining a value W_{d} equal to bxh(d) + (1-b) xh(V), where:
● h is a hash function defined on the set X and with discrete values in the interval [0,1], for example with values uniformly distributed between 0 and 1,
● b is a Bernoulli variable with parameter p, with


M being the cardinal of the image of the hash function h, and r being an upper bound of the number of times the datum d can be stored during said duration,
● V is a uniform random variable on the set X and independent of b.
Said step E_DET_10 is implemented by a determination module (not represented in the figures) equipping the determination device 11 and configured for this purpose.

The value of the parameter r intervening in the framing of the parameter p is determined by the application envisaged for said first method.

Thus, in the present mode of implementation, considering, as mentioned previously, that personal data corresponds to the mobile telephone number belonging to an individual, this number having been stored in the database 12 for a period of 4 hours (period of time ranging from 4 p.m. to 8 p.m.) in a specific train station, the parameter r can for example be set at 5. It is indeed reasonable to think that an individual does not pass and/or does not receive more than five telephone calls in the space of four hours in said station.

Of course, the choice consisting in considering r equal to 5 only constitutes an implementation variant of the invention, and other values can be envisaged provided that they reflect the reality of the application envisaged for the implementation. implementation of said first method. In particular, nothing excludes, as far as this mode of implementation is concerned, considering a value lower or higher than 5.

In general, the person skilled in the art is able to set a value for the parameter r with regard to the application envisaged.

The value of the parameter M intervening in the framing of the parameter p is also determined by the application envisaged for said first method. Thus, by taking up the considerations mentioned above for the parameter r, the parameter M can for example be fixed at one million. However, nothing excludes considering another value for the parameter M, this value preferably being at least of the order of the square of the cardinality of the set X, so as to avoid any risk of collisions in the image of the function of hashing h (such collisions can in fact be the source of cardinal estimation errors for estimation methods according to the invention which are described in more detail later).

It is important to note that the fact of choosing p while respecting the framework proposed above advantageously makes it possible to guarantee differential confidentiality of order ɛ of the data structure obtained at the end of said first process, as the inventor was able to demonstrate it.

It is also noted that the framework given above for the parameter p translates the level of confidentiality that one wishes to grant to the data forming the data structure obtained at the end of said first process. More precisely, the closer p is to the value 1/2, the more the data structure obtained at the end of the first process protects the data it contains against a risk of re-identification.

Said set E_DET of steps also comprises, for said datum d, a first test step E_DET_20 consisting in verifying whether or not the value W_{d} belongs to the structure L determined hitherto. Said first step E_DET_20 is implemented by a first test module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

Consequently, if the value W_{d} does not belong to the structure L (negative response to the first test step E_DET_20), said set E_DET of steps comprises a second test step E_DET_30 consisting in checking whether the cardinality of said structure L is less than a given number k. Said second step E_DET_30 is implemented by a second test module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

Therefore, if the cardinality of said structure L is less than k (positive response to the second test step E_DET_30), the set E_DET of steps includes a step E_DET_40 for inserting the value W_{d} into the structure I.

Conversely, if the cardinality of the structure L is greater than k, said set E_DET of steps comprises a third test step E_DET_50 consisting in checking whether the value W_{d} is less than the largest value of the structure L up to then determined. Said third step E_DET_50 is implemented by a third test module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

Therefore, if the value W_{d} is less than the largest value of the structure L (positive response to the third test step E_DET_50), the set of steps E_DET includes a step E_DET_60 for inserting the value W_{d} in structure L by replacing said largest value.

Said set E_DET of steps has been described so far for a single datum d belonging to set A. The other data belonging to set A are treated in a similar way, namely that the steps of said set E_DET d' steps are iterated for each of said other data of the set A. The executions of these iterations are carried out so that the data structure considered for the insertion of a data during a current iteration of the set of steps E_DET corresponds to the data structure into which data was inserted during an iteration of the set of steps E_DET preceding said current iteration.

Given the nature of said second and third test steps E_DET_30, E_DET_50, it is understood that the number k corresponds to a size that should not be exceeded for said structure L. It is therefore a fixed number, and advantageously less than the cardinal of the data set A so that the data structure L obtained at the end of the first method is more compact than said data set A.

It is also noted, given the nature of the first test step E_DET_20, that the data structure L obtained at the end of the first process only comprises distinct values between them.

Ultimately, at the end of said first process, a data structure L is obtained that is more compact than the set A from which it is derived, formed solely of values distinct from each other, and which ensures differential confidentiality of order ɛ to these values.

It should be noted that such a data structure L differs from a conventional structure of the KMV type insofar as the presence of a datum in said structure L is guaranteed with a probability p (which consequently leads to ensuring differential confidentiality of order ɛ), where the KMV structure comprises, by construction, all the hash values of the distinct values of the set A. Thus, the data structure L obtained by means of the first method has a much better level of confidentiality than that offered by a conventional KMV structure.

It should be noted that the first determination method has been described so far by considering that a set of data A comprises a plurality of data. However, it is understood that it is possible to implement it by considering only one piece of personal data (in which case, of course, the steps of said set of steps E_DET are executed only once).

It is also noted that the first method has been described above with reference to the main steps executed during the implementation of said first method. The fact remains that it remains possible to envisage more particular modes of implementation of said first method in which still other steps can be executed. Such other modes of implementation are in particular useful for the implementation of counting methods in sets, as described in more detail later.

Thus, in a particular mode of implementation, said first method also comprises, for each execution of step E_DET_60 of insertion by replacement, a step of incrementing a value called "counting value" N. From this In this way, said counting value N is representative, at the end of the method, of the total number of times said step of inserting by replacement has been executed during the implementation of the method.

Said counting value N is for example initialized to zero.

According to another example, said count value N is initialized to a realization of a centered Laplace random variable. Proceeding in this way proves to be advantageous insofar as the information obtained at the end of the first process, namely therefore a pair formed of the data structure L and of said counting value N, also respects the principle of confidentiality differential, as explained for example in the document by Dwork et al. already mentioned before.

The invention is not limited to obtaining a data structure L such as that described above from the first method alone. Indeed, the invention also proposes, according to another aspect, to generate, from a KMV structure previously determined for said set A, a more compact data structure than the set A from which it is derived, formed solely of distinct values between them, and which ensures confidentiality of order ɛ to these values. In other words, the invention also proposes to transform a first structure L1 of the KMV type into a second structure L2 inheriting the same advantages as those described above with reference to the structure L obtained at the end of the first process.

There represents, in the form of a flowchart, the main steps of another method of determination according to the invention, called “second method”. The instructions dedicated to the execution of the steps of the second method are contained in the program PROG_2.

For the description of the second process of the , we again consider a set A comprising a plurality of personal data. We also consider that a first data structure L1 has been obtained by applying a minimal k'-values algorithm to the data of the set A. We note that the implementation of said minimal k'-values algorithm uses conventionally a hash function h, this hash function being defined within the framework of the present invention on the set X (it is a hash function with discrete values in the interval [0,1], for example with values uniformly distributed between 0 and 1). It is further noted that the number k′ corresponds, in a manner known per se, to the cardinality of the first structure L1, and is fixed according to the application envisaged.

For example, in the application context considered here (calls made and/or received in a station by individuals and during a time period of 4 hours), said number k' can be taken as equal to 100.

In general, we note that the number k' is representative of a compromise between the ability to store enough data to be able to make reliable count estimates (better when k' is large) and the compactness of the L1 structure (better compactness when k' is small).

As illustrated by the , said second method comprises a step F10 of determining a value D1 equal to the quotient of k'-1 by the greatest value of the first structure L1. Said determination step F10 is implemented by a determination module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

The second method also includes a step F20 of uniform sampling of a number D1 of values in the image of the hash function h, i.e. in h(X), so as to obtain a set L_D1 comprising said D1 sampled values. Said step F20 is implemented by a first sampling module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

By "uniform sampling of a value in a set", we classically refer to the fact of randomly selecting a value from said set with a uniform probability equal to the inverse of the cardinality of said set. Consequently, the uniform sampling of a plurality of values in said set consists in repeating the previous operation (with replacement) as many times as the number of values of said plurality of values.

The second method also comprises a step F30 uniform sampling of a number D2 of values in the set L_D1, D2 being equal to the integer part of the product of [1-p] by D1 (ie [1-p] x D1) , with, in a manner similar to what was previously described in the context of the first method:

Said step F30 is implemented by a second sampling module (not represented in the figures) equipping the determination device 11 and configured for this purpose.

It is noted that the framework proposed for the parameter p in the context of said second method differs significantly from that proposed in the context of the first method in that the parameter r is here considered equal to 1. Such a variation results from the fact that the second method uses as a starting point the structure L1 which is a conventional KMV structure, the objective being, in particular, to transform this structure L1 into another structure providing a guarantee of differential confidentiality. However, in a manner known per se, the data contained in a conventional KMV structure, and therefore a fortiori in the L1 structure, are all distinct from each other, so that the maximum number of times a data item can appear in the structure L1 is equal to 1.

Said second method also comprises a step F40 of selecting a number D3 of smallest values from among said D2 sampled values, D3 being equal to the integer part of the product [1-p] x k, where k is a given number less than k '. Said step F40 is implemented by a first selection module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

Said second method also comprises a step F50 of uniform sampling of a number D4 of values between the largest value of the first structure L1 and 1, so as to obtain a set L_D4 comprising said D4 sampled values, D4 being equal to D1 -k. Said step F50 is implemented by a third sampling module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

Said second method also comprises a step F60 of uniform sampling of a number D5 of values in the union of the sets L_D1 and L_D4, D5 being equal to the integer part of the product p x D1. Said step F60 is implemented by a fourth sampling module (not shown in the figures) fitted to the determination device 11 and configured for this purpose.

Said second method also includes a step F70 of selecting a number D6 of smallest values from among said D5 sampled values, D6 being equal to k-D3. Said step F70 is implemented by a second selection module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

Said second method also comprises a step F80 of grouping together said smallest values selected during said selections, so as to form a second structure L2.

Ultimately, at the end of said second method, and in a manner similar to what was described above for the first method, a more compact data structure L2 is obtained than the set A from which it is derived, formed only of distinct values between them, and which ensures confidentiality of order ɛ to these values.

In addition, this L2 data structure also has the advantage of being more compact than the L1 data structure since k is less than k', while offering a much stronger guarantee of confidentiality.

From a theoretical point of view, it should be observed that the result of the mechanism consisting in generating the L2 data structure from the L1 data structure satisfies the guarantee of confidentiality of order ɛ differential since k' is greater than [1-p] x D_A + p x k, where D_A corresponds to the number of distinct elements of the set A. However, the number k' being given by the case of application of the second method, it is understood that it must choose k such that the condition k' is greater than [1-p] x D_A + p x k is satisfied. Since KMV type structures are used in situations where k' is less than D_A (otherwise it would suffice to store all the data of set A to count its distinct elements), the choice consisting in having k less than k' allows therefore to guarantee the differential confidentiality of order ɛ of the L2 structure.

It is therefore understood that the invention makes it possible to obtain a compact data structure and guaranteeing differential confidentiality of order ɛ in two different ways: either by creating said data structure directly from a raw set of data A, or by transforming a KMV type data structure itself obtained from said raw set of data A.

According to another aspect, the invention also makes it possible to enrich a data structure either obtained according to the first method or the second method, by inserting therein a data item newly stored in the database 12.

There represents, in the form of a flowchart, the main steps of a data insertion method according to the invention, called “third method”. The instructions dedicated to the execution of the steps of the third method are contained in the program PROG_3.

For the description of the third process of the , we again consider a set A comprising a plurality of personal data. Consideration is also given to a data item d_new newly stored in the database, for example following a new execution of the storage process, said data item d_new again corresponding to personal data relating to an individual and stored following the occurrence of an event (telephone call made or received in the train station in this embodiment) by said individual.

Said third method therefore comprises a step G10 of obtaining a structure L determined according to said first method or else according to said second method.

In a particular mode of implementation, said step G10 of obtaining consists of the implementation of the first method or else of the second method by considering the data of the set A. Of course, in the case where it is the second method which is implemented, it is understood that said third method is based on a first structure obtained by applying an algorithm of minimum k'-values to the set A.

In another particular mode of implementation, said data structure L has been determined by the determination device 11 by means of the first method or the second method, and prior to said obtaining step G10. In this case, the term “obtaining” refers to an access to a memory of the determination device 11 in which the structure L was stored at the end of the first process or the second process.

Said third method also includes a step G20 for implementing, for said data item d_new, a set of steps identical to the set E_DET of steps of said first method. In other words, steps E_DET_10 to E_DET_60 (if applicable) are executed for said d_new datum.

Of course, said third method is not limited to the insertion of a single datum into the structure L. It is in fact possible to insert a plurality of data into the structure L by reiterating, in a manner similar to what was has been described for the first method, the steps of said set E_DET of steps for each of said data to be inserted.

Furthermore, when the data structure L obtained has been determined according to the first method, so as to obtain a counting value N corresponding to the total number of times the step E_DET_60 of insertion by replacement has been executed during said first method , the third method may also comprise, according to a particular mode of implementation, an update of said counting value N. More precisely, in this particular mode of implementation, said third method comprises, when implementing implementation of step G20, and for each execution of the step identical to step E_DET_60 of insertion by replacement of said first method, a step of incrementing said counting value N. In other words, in this particular mode of implementation, the count of the number of times an insertion by replacement is executed is continued.

It should be noted that it has been considered so far that the device in charge of implementing the third method is the device 11 for determining the . This being so, nothing excludes considering that said third method is implemented by another device configured in a manner similar to said determination device 11, after the latter has determined the structure L. In this case, the term “obtaining for said obtaining step G10 refers to a data transfer (transmission/reception) between the determining device 11 and said other device. This data transfer is implemented by the communication module 5 equipping the determination device 11 as well as by a similar communication module equipping said other device.

The invention is not limited to obtaining data structures by means of said first, second and third methods. Indeed, the invention also makes it possible, from a structure thus obtained, to carry out counting operations aimed at estimating the number of distinct elements in a set of data, said set of data being able in particular itself to result from union(s) or intersection(s) of data sets.

There represents, in the form of a flowchart, the main steps of a counting method according to the invention, called “fourth method”. The instructions dedicated to the execution of the steps of the fourth method are contained in the program PROG_4.

Said fourth method consists in estimating the number of distinct data present in set A. To do this, said fourth method relies on a data structure determined for said set A by means of any one of said first, second and third processes. Thereafter, the number of distinct data present in the set A is estimated, in particular, from a quantity extracted from characteristics of the determined data structure.

For the description of the fourth process of the , we again consider a set A comprising a plurality of personal data, as was the case for Figures 3, 4 and 5. We then note that given the application context considered here, estimating the number of distinct data contained in set A amounts to estimating the number of individuals having made and/or received telephone calls in the station during the period of time concerned.

Said fourth method initially comprises a step H10 for obtaining a data structure L for said set A, said data structure L being determined according to any one of said first, second and third methods, and the cardinality of said structure obtained being equal to a number k.

The technical considerations described above for step G10 of the third method with regard to the meaning of the term “obtaining” apply here in the same way for step H10.

As a reminder, the determination of said data structure L is carried out by means of the parameter p, the value of which is chosen so as to be increased by a quantity which depends on the number M, and this so as to guarantee the differential confidentiality of order ɛ of said data structure L.

Said fourth method also comprises a step H20 of determining a value Q equal to the quotient of k-1 by the largest value of the data structure L (i.e. Q = (k-1)/max(L)). Said step H20 is implemented by a determination module (not shown in the figures) equipping the determination device 11 and configured for this purpose.

Said fourth method also comprises a step H30 of determining an estimator G of the number of distinct data of the set A as a function of Q.

Ultimately, we therefore obtain an estimator G from a data structure L which is more compact than the set A and which also guarantees differential confidentiality of order ɛ.

In a preferred mode of implementation, the estimator G is equal to g ^-1 (Q), where g ^-1 is an inverse function of a function g of unknown β and having the expression:

expression in which:
● ,
● .

It should be noted that the expression of the coefficient involved the binomial coefficient
which can also be written, following another convention:

The parameter r_moy considered in the expressions of the coefficients a and b can take different values depending on assumptions made on the application context envisaged for said fourth method.

Thus, it is for example possible to consider a hypothesis according to which the respective numbers of occurrences of the data of said set A are all equal to the same given value R. In this case, the r_avg parameter is equal to R. So in particular, if it is reasonable to assume that each datum of set A appears only once in said set A, we obtain the following simplified expressions for the coefficients a and b:
●
●

According to another example, a hypothesis is considered according to which the set A comprises several data whose respective numbers of occurrences in said set A differ from each other. In this case, the parameter r_moy is equal to the integer part of the quotient of N by Q. It is recalled here that N corresponds to the counting value mentioned previously, which therefore implies that to implement the fourth method in the present example , it is important that the data structure L be determined by means of a mode of implementation of the first or third method making it possible to obtain said counting value N.

It is important to note that the fact of considering a value of r_avg equal to the integer part of the quotient of N by Q is not limited to the single hypothesis considered in the previous example. Thus, such a value of r_moy can for example also be used when the respective numbers of occurrences of the data of said set A are all equal to the same value, without the common value being known.

Moreover, the fact of considering a determination of the estimator G by means of said function g ^-1 only constitutes a preferred variant of implementation of the fourth method. This variant proves to be particularly advantageous for providing a very precise estimate of the number of distinct data present in the set A. The invention nevertheless covers other modes of implementation of the fourth method, such as for example a mode in which the estimator G is determined equal to Q.

There represents, in the form of a flowchart, the main steps of another counting method according to the invention, called “fifth method”. The instructions dedicated to the execution of the steps of the fifth method are contained in the program PROG_5.

Said fifth method consists in estimating the number of distinct data present in the union of a plurality of data sets A_1, A_2,…, A_T, T being an integer strictly greater than 1 (a data set A_i, i being an integer index between 1 and T, corresponding for example to the set A considered for the fourth method).

Said fifth method initially comprises a step J10 of obtaining, for each set of data A_i, a data structure L_i determined according to any one of said first, second and third method, the cardinality of said structure L_i being equal to a number k_i (note that the values k_1, …, k_T can be, in whole or in part, distinct from each other).

The implementation of said step J10 is similar to that of step H10.

Said fifth method also comprises a step J20 of selecting a number D7 of smallest values of a so-called “union structure” structure L_UNION corresponding to the union of the data structures L_1, L_2,…, L_T. Said number D7 is equal to the smallest value among the respective cardinals of said data structures L_1, L_2,…, L_T (i.e. D7 = min(k_1,…, k_T)).

The fifth method also includes a step J30 of determining a Q_UNION value equal to the quotient of D7-1 by the largest value among said D7 smallest selected values.

The fifth method also includes a step J40 of determining an estimator G_UNION of the number of distinct data of said union of data sets A_1, A_2,…, A_T as a function of Q_UNION.

Ultimately, we therefore obtain an estimator G_UNION from a data structure L_UNION which is more compact than the union of the data sets A_1, A_2,…, A_T, and which also guarantees differential confidentiality of order ɛ .

In a preferred mode of implementation, the estimator G_UNION is equal to g ^-1 (Q_UNION), where g ^-1 is an inverse function of a function g of unknown β and having the expression:

expression in which:
● ,
● .

The parameter r_moy considered in the expressions of the coefficients a and b can take different values depending on assumptions made on the application context envisaged for said fifth method.

Thus, one can for example consider a hypothesis according to which the respective numbers of occurrences of the data of said sets A_1, A_2,…, A_T are all equal to the same given value R. In this case, the r_avg parameter is equal to R.

According to another example, a hypothesis is considered according to which said union of data sets A_1, A_2,…, A_T comprises several data whose respective numbers of occurrences in said union differ from each other. In this case, the r_avg parameter is equal to the integer part of the quotient of an N_SUM value by Q_UNION, said N_SUM value being equal to the sum of the respective counting values of said data structures L_1, L_2,…, L_T. It is therefore noted that to implement the fifth method in the present example, it is important that each data structure L_i be determined by means of an implementation mode of the first or third method making it possible to obtain a counting value N_i associated with said structure L_i. We also have that N_SUM is equal to N_1+N_2+…N_T.

It is important to note that the fact of considering a value of r_moy equal to the integer part of the quotient of N_SUM by Q_UNION is not limited to the single hypothesis considered in the previous example. Thus, such a value of r_moy can for example also be used when the respective numbers of occurrences of the data of said union of sets A_1, A_2,…, A_T are all equal to the same value, without however the common value be known. Such a value of r_moy can also be envisaged in the case where the respective numbers of occurrences of the data of a set A_i are all equal to the same value r_i, but there are at least two indices i and j (j being therefore also between 1 and T) such that r_i differs from r_j.

Moreover, the fact of considering a determination of the estimator G_UNION by means of said function g ^-1 only constitutes a preferred variant of implementation of the fifth method. This variant proves to be particularly advantageous for providing a very precise estimate of the number of distinct data present in the union of the data sets A_1, A_2,…, A_T. The invention nevertheless covers other modes of implementation of the fifth method, such as for example a mode in which the estimator G_UNION is determined equal to Q_UNION.

There represents, in the form of a flowchart, the main steps of another counting method according to the invention, called the “sixth method”. The instructions dedicated to the execution of the steps of the sixth method are contained in the program PROG_6.

Said sixth method consists in estimating the number of distinct data present in the intersection of a plurality of data sets A_1, A_2,…, A_T, T being an integer strictly greater than 1 (a data set A_i, i being an integer index between 1 and T, corresponding for example to the set A considered for the fourth method).

For purely illustrative purposes, taking up the application context according to which personal data relating to an individual corresponds to a telephone number of said individual stored after the latter has made or received a call in a given station and during a period of given time, said sixth method advantageously makes it possible to estimate the number of people who have traveled between two stations during a given period of time. More particularly, if we consider a set A_1 (respectively A_2) comprising all the numbers (possibly with repetitions) of the individuals having made and/or received telephone calls in a first station (respectively in a second station), said sixth method makes it possible to estimate the number of distinct elements included in the intersection of A_1 and A_2.

Said sixth method initially comprises a step M10 of obtaining, for each set of data A_i, a data structure L_i determined according to any one of said first, second and third method, the cardinality of said structure L_i being equal to a number k_i (note that the values k_1, …, k_T can be, in whole or in part, distinct from each other).

The implementation of said step M10 is similar to that of step H10 or even J10.

The sixth method also includes a step M20 of selecting a number D7 of smaller values of a so-called “union structure” L_UNION corresponding to the union of the data structures L_1, L_2,…, L_T. said number D7 is equal to the smallest value among the respective cardinals of said data structures L_1, L_2,…, L_T (i.e. D7 = min(k_1,…, k_T)).

The sixth method also includes a step M30 of determining a value Q_UNION equal to the quotient of D7-1 by the largest value among said D7 smaller values selected.

The sixth method also comprises a step M40 of determining a value Q_INTER equal to the quotient of the cardinality of a structure called "intersection structure" L_INTER corresponding to the intersection of said data structures L_1, L_2, ..., L_T by D7 .

The sixth method also includes a step M50 of determining an estimator G_INTER of the number of distinct data of said intersection of sets of data as a function of Q_INTER and Q_UNION.

Ultimately, we therefore obtain an estimator G_INTER from a data structure L_INTER which is more compact than the intersection of the data sets A_1, A_2,…, A_T, and which also guarantees differential confidentiality of order ɛ .

In a preferred mode of implementation, the estimator G_INTER has the expression:

The parameters r_1, r_2, …, r_T correspond to numbers respectively associated with the data sets A_1, A_2, …, A_T. Each parameter r_i considered in the expression of G_INTER can take different values depending on assumptions made on the application context considered for said sixth process.

Thus, one can for example consider a hypothesis according to which, for each set A_i, the respective numbers of occurrences of the data of said set A_i are all equal to the same given value R_i. In this case, the parameter r_i associated with the set A_i is equal to R_i.

According to another example, a hypothesis is considered according to which at least one set of data (among the sets of data A_1,…, A_T) comprises several data whose respective numbers of occurrences in said at least one set differ from one another. In this case, the parameter r_i of each set A_i is equal to the integer part of the quotient of N_i by a value Q_i, said value Q_i being equal to the quotient of k_i-1 by the largest value of the data structure L_i obtained for said set A_i. It is therefore noted that to implement the sixth method in the present example, it is important that each data structure L_i be determined by means of an implementation mode of the first or third method making it possible to obtain a counting value N_i associated with said structure L_i.

It is important to note that considering a value of r_i equal to the integer part of the quotient of N_i by Q_i is not limited to the single hypothesis considered in the previous example. Thus, identical provisions can also apply when the respective numbers of occurrences of the data of a set A_i are all equal to the same value, without the common value being known.

Moreover, the fact of considering a determination of the estimator G_INTER according to said preferred mode only constitutes an implementation variant of the sixth method. This variant proves to be particularly advantageous for providing a very precise estimate of the number of distinct data present in the intersection of the data sets A_1, A_2,…, A_T. The invention nevertheless covers other modes of implementation of the sixth method, such as for example a mode in which the estimator G_INTER is determined equal to the product between Q_INTER and Q_UNION.

The various methods according to the invention have been described so far in relation to an application context in which personal data relating to an individual corresponds to a telephone number of said individual stored after the latter has made or received a call in a given station and over a given period of time.

Nevertheless, the invention is not limited to such an application context, and can be implemented, ultimately, in any context in which it is useful to be able to estimate precisely, quickly and anonymously, the number of distinct data in a dataset, in a union of datasets or even in an intersection of datasets.

Thus, and more generally, the invention finds a particularly advantageous application in the statistical analysis of the frequentation of one or more geographical areas, so as to allow, for example, to dimension infrastructures according to flow of individuals, identify locations of interest based on individual profiles, etc.

Furthermore, the invention is not limited either to the storage of data corresponding to mobile telephone numbers. The invention can for example be applied to the storage of data corresponding to connection information with a computer server, such as for example an Internet server so as to be able to carry out statistical analyzes of network traffic.

Claims (15)

Method for determining a data structure from at least one datum d, said at least one datum being personal datum relating to an individual and stored during a memorization process of determined duration following the completion of d an event by said individual, said method comprising a step (E10) of initializing a data structure L to an empty set as well as a set E_DET of steps of:
- determination (E_DET_10) of a value W_{d} equal to bxh(d) + (1-b) xh(V), where:
● h is a hash function with discrete values between 0 and 1,
● b is a Bernoulli variable with parameter p, with
M being the cardinal of the image of the hash function h, and r being an upper bound of the number of times the datum d can be stored during said duration, and ɛ being a strictly positive number,
● V is a uniform random variable independent of b,
and, if the value W_{d} does not belong to structure L (E_DET_20),
- insertion (E_DET_40) of the value W_{d} in the structure L if the cardinality of said structure L is less than a given number k (E_DET_30),
- otherwise, if the cardinality of the structure L is greater than k and if the value W_{d} is less than the largest value of the structure L (E_DET_50), insertion (E_DET_60) of the value W_{d} in the structure L by replacing said largest value. Method according to claim 1, said method comprising, for each execution of the step of insertion by replacement, a step of incrementing a value called "counting value" N, said counting value N being representative, at at the end of the method, the total number of times said step of inserting by replacement has been executed during the implementation of the method. Method for determining a data structure, called "second data structure" L2, from a first data structure L1 obtained by applying an algorithm of minimum k'-values to data, each datum being a personal datum relating to an individual and stored during a storage process of determined duration following the occurrence of an event by said individual, the implementation of said algorithm of minimum k'-values using a hash function h to discrete values between 0 and 1, said method comprising steps of:
- determination (F10) of a value D1 equal to the quotient of k'-1 by the greatest value of the first structure L1,
- uniform sampling (F20) of a number D1 of values in the image of the hash function h, so as to obtain a set L_D1 comprising said D1 sampled values,
- uniform sampling (F30) of a number D2 of values in the set L_D1, D2 being equal to the integer part of the product [1-p] x D1, with
M being the cardinal of the image of the hash function h, and ɛ being a strictly positive number,
- selection (F40) of a number D3 of smallest values among said D2 sampled values, D3 being equal to the integer part of the product [1-p] xk, where k is a given number less than k',
- uniform sampling (F50) of a number D4 of values between the largest value of the first structure L1 and 1, so as to obtain a set L_D4 comprising said D4 sampled values, D4 being equal to D1-k,
- uniform sampling (F60) of a number D5 of values in the union of the sets L_D1 and L_D4, D5 being equal to the integer part of the product px D1,
- selection (F70) of a number D6 of smallest values among said D5 sampled values, D6 being equal to k-D3,
- grouping (F80) of said smallest values selected during said selections, so as to form said second structure L2. Method for inserting at least one datum into a data structure L, said at least one datum being personal datum relating to an individual and stored during a memorization process of determined duration following the performance of a event by said individual, said method comprising steps of:
- obtaining (G10) a data structure L determined according to a method in accordance with any one of claims 1 to 3,
- implementation (G20), for said at least one datum to be inserted, of a set of steps identical to the set E_DET of steps of a method in accordance with any one of claims 1 to 3. Method according to claim 4, in which, when the data structure L obtained has been determined according to a determination method according to claim 2, so as to obtain a count value N corresponding to the total number of times the step d insertion by replacement has been executed, the insertion method also comprises, for each execution of the step identical to the step of insertion by replacement of the said determination method according to claim 2, a step of incrementing the said count value N.
Method for estimating the number of distinct data in a set of data, each data being personal data relating to an individual and stored during a storage process of determined duration following the occurrence of an event by said individual, said method comprising steps of:
- obtaining (H10) a data structure determined according to a method in accordance with any one of claims 1 to 5, the cardinality of said structure obtained being equal to k,
- determination (H20) of a value Q equal to the quotient of k-1 by the largest value of the data structure obtained,
- determination (H30) of an estimator G of the number of distinct data of the data set as a function of Q. Method according to claim 6, in which the estimator G is equal to g ^-1 (Q), where g ^-1 is an inverse function of a function g of unknown β and having the expression:



expression in which:
● ,
● ,
● if the respective numbers of occurrences of the data of said data set are all equal to the same given value R, r_avg is equal to R,
● otherwise, and if the data structure is determined according to a method in accordance with any one of claims 2 and 5, r_moy is equal to the integer part of the quotient of N by Q. Method for estimating the number of distinct pieces of data in a union of a plurality of sets of data, each piece of data being personal data relating to an individual and stored during a storage process of determined duration following the completion of an event by said individual, said method comprising steps of:
- obtaining (J10), for each set of data, a data structure determined according to a method in accordance with any one of claims 1 to 5,
- selection (J20) of a number D7 of smallest values of a structure corresponding to the union of the data structures obtained, D7 being equal to the smallest value among the respective cardinals of said data structures obtained,
- determination (J30) of a Q_UNION value equal to the quotient of D7-1 by the largest value among said smallest selected values,
- determination (J40) of an estimator G_UNION of the number of distinct data of said union of data sets as a function of Q_UNION. Method according to claim 8, in which the estimator G_UNION is equal to g ^-1 (Q_UNION), where g ^-1 is an inverse function of a function g of unknown β and having the expression:



expression in which:
● ,
● ,
● if the respective numbers of occurrences of the data of said data sets are all equal to the same given value R, r_avg is equal to R,
● otherwise, and if each data structure is determined according to a method in accordance with any one of claims 2 and 5, so as to obtain a value N_SUM equal to the sum of the respective counting values of said data structures, r_moy is equal to the integer part of the quotient of N_SUM by Q_UNION. Method for estimating the number of distinct pieces of data in an intersection of a plurality of sets of data, each piece of data being personal data relating to an individual and stored during a storage process of determined duration following the completion of an event by said individual, said method comprising steps of:
- obtaining (M10), for each set of data, a data structure determined according to a method in accordance with any one of claims 1 to 5,
- selection (M20) of a number D7 of smallest values of a structure corresponding to the union of said obtained data structures, D7 being equal to the smallest value among the respective cardinals of said obtained data structures,
- determination (M30) of a Q_UNION value equal to the quotient of D7-1 by the largest value among said smallest selected values,
- determination (M40) of a Q_INTER value equal to the quotient of the cardinality of a structure corresponding to the intersection of said data structures obtained by D7,
- determination (M50) of an estimator G_INTER of the number of distinct data of said intersection of sets of data as a function of Q_INTER and Q_UNION. Method according to claim 10, in which the sets of data, called sets "A_1,..., A_T", are T in number and respectively associated with parameters r_1,..., r_T, the cardinality of a data structure associated with a set A_i being equal to k_i, and the estimator G_INTER having the expression:



expression in which:
● if, for each set A_i, the respective numbers of occurrences of the data of said set A_i are all equal to the same given value R_i, r_i is equal to R_i,
● otherwise, and if each data structure is determined according to a method in accordance with any one of claims 2 and 5, so as to obtain for each data structure associated with a set A_i a counting value N_i, the parameter r_i of each set A_i is equal to the integer part of the quotient of N_i by a value Q_i, said value Q_i being equal to the quotient of k_i-1 by the largest value of the data structure obtained for said set A_i. Computer program comprising instructions for implementing a method according to any one of claims 1 to 11 when said program is executed by a computer. A computer-readable recording medium on which a computer program according to claim 12 is recorded. Processing device (11) comprising means configured to implement a method according to any one of claims 1 to 11. Computer system (10) comprising:
- a database (12) in which is stored at least one personal datum relating to an individual, said at least one datum having been stored during a memorization process of determined duration following the occurrence of an event by said individual,
- a processing device (11) according to claim 14.