JP2012022315A - Method and device for anonymizing data - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method and device for anonymizing data.SOLUTION: A data anonymizing device 1 includes: a distance calculation unit 10 which calculates a distance between each pair of records of a plurality of data records; a complete graph construction unit 12 which uses each record as an apex, connects all pairs of apexes by sides, and weights the sides by distances between corresponding pairs of records to construct a complete graph including all records; a side cut unit 14 which cuts the sides in the order of side weight in order to divide the complete graph into a plurality of components each of which includes at least k apexes; a large component decomposition unit 16 which decomposes a component in which the number of apexes included exceeds 2k-1, into a plurality of clusters so that the number of apexes included in each cluster is between k and 2k-1; and a generalizing unit 18 which generalizes records corresponding to apexes of each cluster so that records in the cluster cannot be distinguished from one another.

Description

  The present invention relates to the technical field of data protection, and more particularly to a method and apparatus for data anonymization.

  As social informatization develops, data sharing is becoming increasingly widespread. However, attackers can obtain or infer personal or organizational confidential information from shared data record entries, which poses security threats to protected data such as personal privacy and organizational confidentiality. Bring.

In general, attributes of various data records (table format data records, etc.) can be classified into four categories.
Explicit identification information that can directly identify an object, such as an individual's first and last name, ID, or company registered name.
Quasi-identifiers (quasi-identifiers) that can be used in conjunction with relevant external information, such as an individual's age, gender, educational background, birthplace or company category and location, to infer the corresponding subject.
Sensitive attributes that generally want confidentiality, such as income and medical history.
Non-sensitive attributes where disclosure generally has little effect on the subject.

  Assuming that the value of sensitive information should be saved for data analysis, data anonymization means an operation to hide the identity of the individual who owns the sensitive data. To protect the privacy of an individual or organization, explicit identification information is generally completely hidden or deleted, for example, replaced by “*”. Non-confidential information can be fully disclosed. Quasi-identification information can be considered as the smallest set of data records necessary to infer the corresponding object in combination with relevant external information and therefore needs to be protected. However, if the quasi-identification information is completely hidden or deleted as explicit identification information, the data record cannot be provided with useful information about the object, so it is included in the finally obtained data record Information will be almost completely lost. In this case, such data records are no longer worth using.

Thus, data record protection is primarily focused on how to minimize information loss and reduce quasi-identification information in data records from potential attack threats without reducing the availability of data records. Put. From this point, a data anonymization technique has been proposed. There are two basic data anonymization techniques.
1) Generalization; replace many quasi-identification information, attributes or attribute values with their generalized versions. For example, the city names “Beijing” and “Shanghai” are generalized to the country name “China”.
2) Suppression: Replaces a lot of semi-identification information, attributes or attribute values with characters such as “*” and a code. Suppression can be viewed as a special case of generalization.

  In the generalization process, information loss is inevitable. Suppression will cause complete loss of information. In order to reduce the loss of information, various anonymization methods have been proposed, and the widely used method is called the k-anonymization method. For each record in the table AT, the table AT is k-anonymity if there are at least k-1 other records identical to that for the given semi-identification information. The optimized k-anonymization method calculates the k-anonymity table AT for a given data record, such as the table T, taking into account the semi-identification information Q for the minimum loss of information.

One important k-anonymization method is a k-anonymization method based on clustering. It contains two basic procedures. First, a data record is divided into a plurality of clusters each having at least k records by clustering. Each cluster is then generalized so that the quasi-identification information of all records in the cluster has the same value. According to this method, records related to each other can be divided into a single cluster. Also, the resulting clusters can be generalized separately. Compared to global generalization without clustering, this generalization based on clustering retains more information and reduces the loss of information. The optimized clustering process can properly divide the data records into clusters in an appropriate manner that can reduce the loss of information.
Therefore, the k-anonymization method based on clustering has a clustering problem of how to divide records by an optimal method while minimizing information loss.

  For the above problem, the k-anonymization method based on the conventional clustering generally adopts a local optimization approach. Non-Patent Document 1 provides a polynomial time approximation algorithm for k-anonymity that uses a local optimization method for record partitioning. Patent Document 1 provides a dynamic programming method for k-anonymity that finds an optimal solution for an arbitrary measure in consideration of all generalized versions.

In previous methods, record clustering and generalization is performed in consideration of local optimization of information loss. The method disclosed in Non-Patent Document 1 performs bottom-up clustering for each record that is a vertex. Specifically, in such a bottom-up method, first, an arbitrary vertex is regarded as a subgraph.
For any subgraph that includes less than k vertices, if the vertex (u) is not connected to any directed edge towards another vertex, a directional edge (u, v) is generated. Here, v is one of the k−1 adjacent vertices closest to the vertex u (for example, the distance calculated from the attribute or attribute value is the closest).
This process guarantees that the loop-free condition is satisfied and that any vertex has only one directed edge towards the other vertex (but there are one or more other vertices towards that vertex) It is necessary. The above process is repeated until there are at least k vertices included in any directed graph.
Thereafter, the direction of the edge is deleted, and the directed graph is converted into an undirected graph. For graphs with vertices greater than or equal to max (2k-1, 3k-5) (any graph obtained by the above method can be considered as a tree), vertex (x) is randomly selected from the graph and the subtree And vertex x are considered as root nodes. In this way, the graph is decomposed into two subgraphs, each having a size greater than k. If such decomposition is not possible, another vertex (y) is selected by performing the same processing until the graph can be decomposed into two parts that respectively satisfy the condition of the number of vertices. The above process is repeated until the number of vertices included in each finally acquired subgraph is less than max (2k-1, 3k-5).

US20100027780 A1, “Systems andmethods for anonymizing personally identifiable information associated withepigenetic information”

G. Aggarwal, A. Feder, K. Kenthapadi, R. Motwani, R. Panigrahy, D. Thomas, and A. Zhu, ApproximationAlgorithms for k-Anonymity, Journal of Privacy Technology, 2005.

  According to the bottom-up method, vertices and their neighbors are randomly selected without order or sequence control mechanism during tree construction. In the decomposition of a graph having vertices greater than max (2k-1, 3k-5) (referred to as large components), optimization of information loss is not considered. Furthermore, these methods mainly focus on local optimization of information loss without considering global optimization involving all records or vertices. Although such local optimization can reduce information loss to some extent, global optimization cannot be realized because the global situation is not considered. The loss of information caused is still unacceptable for subsequent data analysis with strict requirements.

  There is a need for a data anonymization method that can achieve global optimization and further reduction of information loss.

  A data anonymization device according to the present invention uses a distance calculation unit that calculates a distance between two records in a plurality of data records, and uses each record as a vertex, and connects all two vertices with edges. A complete graph construction unit that constructs a complete graph containing all records by weighting edges with the distance between two corresponding records, and a plurality of complete graphs comprising at least k (predetermined natural number) vertices In order to divide into components, an edge cut unit that sequentially cuts edges in the order of edge weights, and 2k-1 pieces so that the number of vertices included in each cluster is between k and 2k-1 pieces. Large component decomposition unit that decomposes components that contain more vertices into multiple clusters and records in each cluster cannot be distinguished from each other A generalization unit that generalizes records corresponding to the vertices of each cluster, and a component including more than 2k-1 vertices is a large component, and a component including k or more and 2k-1 or less vertices is a cluster And

  In the data anonymization method according to the present invention, a distance calculating step for calculating a distance between two records in a plurality of data records, and using each record as a vertex, connecting all two vertices with edges, A complete graph construction step of constructing a complete graph including all records by weighting edges with the distance between two corresponding records, and the complete graph includes at least k (k is a predetermined natural number) vertices In order to divide into a plurality of components, an edge cutting step for sequentially cutting edges in the order of edge weights, and 2k−1 so that the number of vertices included in each cluster is between k and 2k−1. Large component decomposition step that decomposes components with more than vertices into multiple clusters and records in each cluster cannot be distinguished from each other A generalization step for generalizing records corresponding to the vertices of each cluster, and a component including more than 2k-1 vertices as a large component, and a component including k or more and 2k-1 or less vertices. A cluster.

  According to the data anonymization apparatus and method of the present invention, the record division / clustering process is executed in a top-down manner. Then, by using a carefully determined sequence control mechanism, edges in the graph are cut in a predetermined order. When disassembling the large component, the edges are cut in a predetermined order. In this way, not only local optimization but also global optimization can be realized, and information loss can be further reduced.

The above and other features and advantages of the present invention will become more apparent from the following preferred embodiments described with reference to the drawings.
It is a block diagram which shows schematic structure of the data anonymization apparatus by preferable embodiment of this invention. It is a block diagram which shows schematic structure of the large component decomposition | disassembly unit in the data anonymization apparatus of FIG. It is a flowchart explaining the data anonymization method by preferable embodiment of this invention. It is a flowchart explaining the large component decomposition | disassembly procedure in the data anonymization method of FIG. FIG. 6 is a schematic diagram illustrating a complete graph construction process for a record according to a preferred embodiment of the present invention. It is the schematic which shows the edge cut process in which the sequence control mechanism by preferable embodiment of this invention is introduced. FIG. 3 is a schematic diagram illustrating a large component disassembly process according to a preferred embodiment of the present invention. It is a figure which shows roughly the final result of the record division | segmentation by preferable embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to the following embodiment. In order to clarify the explanation of the basic concept of the present invention, only components, functions or steps related to the solution of the present invention are shown. Detailed descriptions of existing technologies, functions, components or steps are omitted in the following description.

  FIG. 1 shows a block diagram of a data anonymization device 1 according to a preferred embodiment of the present invention. The data anonymization device 1 is configured to anonymize a plurality of data records in order to obtain an anonymous version of the data records. Here, terms such as “data record”, “record”, and “record item” have the same meaning and can be used interchangeably.

According to a preferred embodiment of the present invention, the data anonymization apparatus 1 mainly considers, for example, a data record including semi-identification information.
In order to adopt a k-anonymization method (where k is a predetermined natural number), the data anonymization device 1 avoids privacy leakage due to quasi-identification information and at the same time minimizes information loss, for example The k-anonymity table AT is generated by generalization from the table T including a plurality of data records.
As described in the background art, explicit identification information can be directly hidden or deleted, and non-confidential information does not require protection. Quasi-identification information can be viewed as the minimum set of data records required to infer the corresponding object in combination with related external information. Therefore, it is necessary to protect the semi-identification information.
The semi-identification information is multidimensional and includes a number of attributes. For example, the semi-identification information can be expressed as Q = {A1, A2,... Am}. Here, A1, A2,..., Am indicate individual attributes of the semi-identification information. Alternatively, the quasi-identification information can be expressed in the form of Q = {Rec ID, A1, A2,... Am} or Q = {Rec ID, A1-value1, A2-value1,... Am-valuem}, for example. . Here, RecID indicates an index of semi-identification information in all data records, and value indicates a value of a corresponding attribute.
Hereinafter, terms such as “data record”, “record”, and “record item” refer to a record of semi-identification information. However, the present invention is not limited to the above, and can be applied to anonymization and protection of any other data record. Further, in the following description, the k-anonymization method is taken as an example, but the present invention can be applied to any data anonymization method based on clustering.

Data records have various formats such as lists or tables. Data records are stored in the record recording unit 20.
As shown in FIG. 1, the record storage unit 20 may be a stand-alone unit accessible by the data anonymization device 1, or may be a part of the data anonymization device 1.
The data anonymization apparatus 1 uses a distance calculation unit 10 for calculating the distance between each two records in a plurality of data records, and uses each record as a vertex and connects all the two vertices with edges. A complete graph construction unit 12 for constructing a complete graph including all records by weighting edges with the distance between two corresponding records, and a plurality of components including a complete graph including at least k vertices ( 2k so that the number of vertices included in each cluster is between k and 2k−1. A large component decomposition unit 16 for decomposing a component including more than one vertex into a plurality of clusters, and a record in each cluster So that it can not be distinguished from each other, and a generalized unit 18 for generalizing the record corresponding to the vertices of each cluster.
Here, a component including more than 2k−1 vertices is referred to as a “large component”, and a component including k or more and 2k−1 or less vertices is referred to as a “cluster”.
The generalization unit 18 generalizes the records corresponding to the vertices of each cluster acquired by both the edge cut unit 14 and the large component decomposition unit 16. In the present invention, each component is a tree.

The distance calculation unit 10 is configured to calculate the distance between records based on the name, attribute, or attribute value of each record stored in the record storage unit.
For example, it is possible to quantize the name or attribute of each record according to defined criteria and calculate the distance between records based on the quantized value (eg, by using the well-known Euclidean distance algorithm ). If possible, the calculated distance may be stored in a distance storage device (not shown).

The complete graph construction unit 12 is configured to construct a complete graph including all records. That is, an edge exists between any two records.
As described above, according to the present invention, the top-down record division / clustering process is adopted instead of the bottom-up process of the existing technology in which the construction starts from each record.
Thus, a complete graph is introduced into the present invention. A complete graph includes the distance between two arbitrary records.
All records are divided into sub-graphs or components, respectively (each sub-graph can now be considered a component) in a top-down manner by dividing or decomposing the complete graph.
If possible, the constructed complete graph may be stored in a storage device (not shown).

The side cut unit 14 is configured to sort the sides according to the respective weights and cut the sides in descending order of the weights.
In this method, a sequence control mechanism is used to achieve global optimization while ensuring local optimization, as opposed to existing schemes where components are constructed by arbitrarily selecting adjacent values of vertices. (Sequential control mechanism) is introduced in the present invention.
For example, for the three records “Master”, “Doctor” and “Engineer”, the distance between “Master” and “Doctor” is the distance between “Master” and “Engineer” based on established criteria. It is determined that the distance between “Doctor” and “Engineer” is the longest.
In this case, in the edge cutting process, the edge between “Doctor” and “Engineer” is cut first, then the edge between “Master” and “Engineer” is cut, and “Master” and “Doctor” The edges between are preserved.
In this way, the subgraph or component containing “Master” and “Doctor” is separated from “Engineer”.

In the continuous cutting of the side, the side cutting unit 14 is configured to cut the side if one of the following conditions is satisfied.
1) An edge is a bridge (ie, when an edge is cut, the graph containing the edge is divided into two subgraphs), and each subgraph obtained after cutting an edge has at least k vertices Including.
2) An edge is not a bridge (ie, even if an edge is cut, the graph containing the edge is not divided into two subgraphs).

The operation of the side cut unit 14 will be described later with reference to specific examples and drawings.
The result output from the side cut unit 14 may be stored in a side cut result storage unit (not shown).

Some components obtained after the operation of the edge cut unit 14 may include k or more and 2k-1 or less vertices. Each such component is considered a cluster that requires no further decomposition.
On the other hand, some components obtained after the operation of the edge cut unit 14 include more than 2k-1 vertices. Such a component is called a large component and needs to be decomposed so that the number of vertices contained in each decomposed part is between k and 2k-1.
According to a preferred embodiment of the present invention, the following two methods are adopted for the decomposition of the large component.
1) Use any suitable method in existing technology. A detailed description thereof is omitted to avoid obscuring the present invention more than necessary.
2) Unlike the existing random merge method, a sequence control mechanism similar to that used in the edge cut processing is introduced in consideration of global optimization and information loss. This will be further described below.

FIG. 2 is a block diagram showing a configuration of the large component decomposition unit 16 in the data anonymization device 1 of FIG.
The large component decomposition unit 16 includes a k-center vertex detection unit 160, a subcomponent distance calculation unit 162, a subcomponent complete graph construction unit 164, a subcomponent complete graph edge cut unit 166, and a merge unit 168. Here, each subcomponent is a tree.

According to a preferred embodiment of the present invention, k-central-vertex is introduced into the large component decomposition. When a vertex is deleted, if each acquired subcomponent (which can also be considered as a subgraph) contains at most k-1 vertices, the vertices in the component are defined as k-center vertices Is done.
Here, we introduce the following lemma (Lemma).
Lemma
For components with more than 2k-1 vertices, there is only one k-center vertex.

Proof
Suppose that there are two k-center vertices v1 and v2 defined above in one component with more than 2k-1 vertices.
When the edge between v1 and v2 is cut, each acquired subcomponent has at most k−1 vertices. The large component will then have at most 2k-2 nodes, which contradicts the above assumption. This proves that the above lemma holds.

  The k-center vertex detection unit 160 detects all the k-center vertices in each large component, and obtains a plurality of sub-components or subgraphs other than the k-center vertices. It is configured to cut a side.

  The subcomponent distance calculation unit 162 is configured to calculate the center of each subcomponent and to calculate the distance between the two subcomponent centers. According to the preferred embodiment of the present invention, k-center vertices are excluded, so that each acquired subcomponent contains at most k-1 vertices. Thus, it is not necessary to disassemble each of the subcomponents. Therefore, in the large component decomposition process, each subcomponent can be represented entirely by the center of the subcomponent. The center of the subcomponent is the quantized value or the average or median value of the records corresponding to the vertices contained in the subcomponent, or other suitable measure. The distance between the centers of the two subcomponents can also be calculated by using any suitable existing method (eg, Euclidean distance algorithm).

According to the preferred embodiment of the present invention, as described above, a top-down partitioning / clustering process is also introduced into the large component decomposition, thereby ensuring global optimization. The subcomponent complete graph construction unit 164 in the large component decomposition unit 16 uses the entire subcomponent as a vertex. Thereby, the subcomponent complete graph construction unit 164 uses each subcomponent as a vertex, specifically, uses the calculated center of each subcomponent as a vertex and connects all two vertices with edges. Thus, a complete graph is constructed.
In such a constructed graph, the vertices are each weighted by the size of the corresponding subcomponent (ie, the number of vertices contained in the subcomponent), and the edges are each by the distance between the two corresponding subcomponent centers. Weighted.

  The continuous cutting method is also introduced for large component decomposition. Similar to the above operation of the edge cut unit 14, the subcomponent complete graph edge cut unit 166 is configured to continuously cut edges in the order of edge weights and to divide the subcomponent into a plurality of clusters. The sum of the weights of all the vertices included in each cluster is k or more and 2k−1 or less.

The subcomponent complete graph edge cut unit 166 cuts edges continuously in descending order of edge weights. In the continuous edge cutting process, the sub-component complete graph edge cutting unit 166 cuts an edge if one of the following conditions is satisfied.
1) An edge is a bridge (ie, when an edge is cut, the graph containing the edge is divided into two subgraphs), and the weight of the vertex included in each component obtained after the edge is cut The sum is at least k.
2) An edge is not a bridge (ie, even if an edge is cut, the graph containing the edge is not divided into two subgraphs).

  The operation of the sub-component complete graph edge cut unit 166 will be described later with reference to specific examples and drawings.

  After the operation of the subcomponent complete graph edge cut unit 166 is complete, it is necessary to merge the k-center vertices previously excluded into one of the clusters. The merge unit 168 is configured to merge the k center vertex with the cluster having the closest distance to the k center vertex. If the sum of the weights of all vertices included in the cluster merged with the k-center vertex is equal to 2k, the cluster is further decomposed into two clusters, so that the sum of the weights of all vertices included in each cluster is obtained. Is equal to k.

  The clusters acquired by the large component decomposition unit 16 together with the clusters acquired by the edge cut unit 14 constitute a record division / clustering result. As a result, the number of vertices or records included in each cluster is k or more and 2k-1 or less. If possible, the resulting record may be stored in a record division storage device (not shown).

The generalization unit 18 is configured to generalize the records corresponding to the vertices for each resulting cluster. As a result, the records in each cluster cannot be divided from each other. The generalization unit 18 can use any known generalization method. As an example, a plurality of numerical values can be generalized as their least common multiple. For example, the values 2, 4, 10 can be generalized as 20.
As another example, a plurality of city names can be generalized as names of states to which these cities belong. For example, the city names “Chengdu”, “Mianyang” and “Leshan” can be generalized as the state name “Sichuan”. In general, different attributes can be generalized as the lowest level of the category to which they belong. This prevents those attributes from being separated from each other and at the same time keeps information loss to a minimum. The result output from the generalization unit 18 is stored in an anonymous record storage unit (not shown) in various formats such as an anonymous table or a list.

The data anonymization apparatus 1 according to the preferred embodiment of the present invention has been described above.
FIG. 3 is a flowchart illustrating a data anonymization method 300 according to a preferred embodiment of the present invention. This data anonymization method 300 is executed by the data anonymization device 1.
In step 302, the distance between every two records in a table containing a plurality of data records is calculated.
At step 304, use each record as a vertex, connect all two vertices with edges, and weight the edges with the distance between the two corresponding records to construct a complete graph containing all records .
In step 306, edges are cut in order of edge weights to divide the complete graph into multiple components including at least k vertices.
In step 308, a large component including more than 2k-1 vertices is decomposed into a plurality of clusters such that the number of vertices included in each cluster is between k and 2k-1.
In step 310, the records corresponding to the vertices of each cluster are generalized so that the obtained records in each cluster cannot be divided from each other.

FIG. 4 is a flowchart showing the large component decomposition step 308 in the data anonymization method 300 of FIG.
In step 402, connected to the detected k-center vertices to detect k-center vertices in each large component that includes more than 2k-1 vertices and to obtain a plurality of sub-components other than the k-center vertices. Cut all sides that are present.
In step 404, the center of each subcomponent and the distance between the two subcomponent centers is calculated.
In step 406, the calculated center of each subcomponent is used as a vertex, the vertex is weighted by the size of the corresponding subcomponent, all two vertices are connected by edges, and between the two corresponding subcomponent centers Construct a complete graph that vertexes each subcomponent by weighting edges by distance.
In step 408, edges are successively cut in the order of edge weights, the subcomponent is divided into a plurality of clusters, and the sum of the weights of all the vertices included in each cluster is set to k or more and 2k-1 or less.
In step 410, the k-center vertex is merged with the cluster closest to the k-center vertex, and if the sum of the weights of all the vertices included in the merged cluster is equal to 2k, all the vertices included in each cluster are The cluster is further decomposed into two clusters so that the sum of the weights is equal to k.

  In order to show the embodiment of the present invention more clearly, specific examples according to the embodiment will be described below with reference to FIGS. These specific examples are only for the purpose of illustrating preferred embodiments of the invention and are not intended to limit the invention.

  For example, if there is a table containing 10 data records T = [Q0, Q1,…, Q9], Qi = {A1, A2,…, Am}, i = {0, 2, .., 9} To do. Here, m is a natural number. k (= 2) —In order to form an anonymous table, these 10 data records need to be anonymized.

  First, the distance calculation unit 10 calculates the distance between all two Q0, Q1,..., Q9 by using the Euclidean distance algorithm. Thereafter, the complete graph construction unit 12 constructs a complete graph.

FIG. 5 is a schematic diagram illustrating a complete graph construction according to a preferred embodiment of the present invention. As shown in FIG. 5, the left side of the figure shows a plurality of vertices of the record.
These vertices are connected by two edges to form a complete graph as shown on the right side of FIG. For convenience of explanation, it is assumed that the length of each side between two vertices represents the weight of that side (ie, the distance between two records corresponding to the two vertices).

  Next, the side cut unit 14 cuts the sides in descending order of the side weights according to the above-described conditions. FIG. 6 is a schematic diagram illustrating edge cut processing in which a sequence control mechanism according to a preferred embodiment of the present invention is introduced. As can be seen from FIG. 6, the edge edge 38 between Q3 and Q8 is the longest and has the largest weight. The edge edge04 between Q0 and Q4 is the second longest,..., The edge edge89 between Q8 and Q9 is the shortest.

First, the side cut unit 14 determines whether or not the side edge 38 satisfies the two conditions described above. In this example, the edge 38 is not a bridge and is therefore cut. Next, the edge cut unit 14 determines whether or not the edge edge04 satisfies two conditions. Since edge 04 is not a bridge, it is cut.
The edge cut unit 14 continues such an operation until it is determined whether the edge edge01 between Q0 and Q1 satisfies two states.
If edge edge01 is cut, the graph is completely divided into two components or subgraphs, so edge edge01 is a bridge. It is therefore necessary to determine whether each of the resulting two components has at least k vertices. As shown, the two components obtained from the cut of edge edge01 each include six vertices and four vertices. Therefore, the side cut unit 14 cuts the side edge01.
When determining whether the edge edge09 between Q0 and Q9 satisfies the two conditions, the edge cut unit 14 determines that the component of the complete graph is further divided into two parts if the edge edge09 is cut To do.
It is therefore necessary again to determine whether the two parts obtained each have at least k vertices. As shown, the two parts obtained from the cut of edge edge09 include 1 and 5 vertices, respectively. Therefore, the condition is not satisfied. Therefore, the side cut unit 14 does not cut the side edge 09. In this way, as shown in the lower right part of FIG. 6, the parts CQ1, CQ2, CQ3 and CQ4 are finally obtained.

Here, the parts CQ2, CQ3 and CQ4 each contain two vertices and therefore no further decomposition is required. That is, each part CQ2, CQ3, CQ4 is a cluster. However, the part CQ1 includes four vertices Q0, Q7, Q8 and Q9, the number of which is greater than 2k (= 2) -1, and therefore needs to be decomposed. Therefore, the large component disassembly unit 16 performs a large component disassembly process on the portion CQ1.
FIG. 7 is a schematic diagram illustrating a large component disassembly process according to a preferred embodiment of the present invention.
First, the k center vertex detection unit 160 detects the k center vertex. As illustrated, the k-center vertex of the large component CQ1 is the vertex Q9. Therefore, all the sides connected to the vertex Q9 are cut to obtain individual separated subcomponents. In this example, each subcomponent contains only one vertex, as shown in the second partial view of FIG. However, this is only shown as an example for convenience, and in other situations, each subcomponent may include one or more vertices.

  Since each subcomponent contains only one vertex, the calculation unit 162 directly uses the representative value of the vertex as the subcomponent center to calculate the distance between the subcomponent centers. As shown in the third partial diagram of FIG. 7, the subcomponent complete graph construction unit 164 connects all subcomponent centers other than the k-center vertex, and obtains a complete graph including all subcomponents. As shown in the fourth partial diagram of FIG. 7, the subcomponent complete graph edge cut unit 166 has Q0 and Q0 based on the edge weight (that is, the edge length shown in the figure) according to the two conditions described above. Cut the side between Q7 and do not cut the other side. As shown in the fifth partial diagram of FIG. 7, the merge unit 168 merges the vertex Q9 with the left component to obtain a cluster including four vertices. As a result, the merge unit 168 cuts the side between Q7 and Q8 as shown in the sixth partial diagram of FIG. 7, and acquires two clusters each including two vertices.

FIG. 8 schematically illustrates the final result of record splitting according to a preferred embodiment of the present invention.
According to the k (= 2) -anonymization method according to the preferred embodiment of the present invention, records Q0-Q9 are divided into five clusters each containing two records.
Thereafter, the generalization unit 18 performs generalization for each cluster, and obtains a k-anonymity table AT = [AQ0, AQ1,..., AQ4]. Here, AQi represents the generalized value of the record in each cluster.

  The data anonymization apparatus and method according to the preferred embodiment of the present invention have been described above. In the above description, preferred embodiments of the present invention are illustrated by specific examples only, but this does not mean that the present invention is limited to the above procedures and unit configurations. These means and elements can be adjusted, selected and combined as needed. In addition, some of these procedures and elements are not essential for implementing the inventive concept of the present invention. Thus, the technical features essential to the present invention are not limited to the specific embodiments described above, but are limited only to the minimum requirements for realizing the inventive concept of the present invention.

  Although the present invention has been described with reference to preferred embodiments thereof, various other modifications, changes and additions can be made by those skilled in the art without departing from the spirit and scope of the present invention. It will be clear that this is possible. Accordingly, the scope of the invention is not limited to the specific embodiments described above, but only by the appended claims.

  Further, a part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.

(Appendix 1)
A distance calculation unit for calculating the distance between every two records in the plurality of data records;
A complete graph construction unit that builds a complete graph containing all records by using each record as a vertex, connecting all two vertices with edges, and adding weights to the edges at the distance between two corresponding records When,
An edge cutting unit that sequentially cuts edges in order of edge weights to divide the complete graph into a plurality of components including at least k (predetermined natural number) vertices;
A large component decomposition unit for decomposing a component including more than 2k-1 vertices into a plurality of clusters such that the number of vertices included in each cluster is between k and 2k-1.
A generalization unit that generalizes the records corresponding to the vertices of each cluster so that the records in each cluster cannot be distinguished from each other;
A data anonymization device, wherein a component including more than 2k-1 vertices is a large component, and a component including k or more and 2k-1 or less vertices is a cluster.

(Appendix 2)
The data anonymization device according to appendix 1, wherein the side cut unit sorts the sides according to the weights of the sides and cuts the sides in descending order of the weights.

(Appendix 3)
The edge cut unit cuts an edge if one of the following conditions is satisfied: 1) The edge is a bridge, and each subgraph obtained after the edge is cut includes at least k vertices 2) An edge is not a bridge If an edge is cut and the graph containing the edge is divided into two separate sections, the edge is a bridge,
The data anonymization device according to appendix 1, wherein, even if an edge is cut, if the graph including the edge is not divided into two individual sections, the edge is not a bridge.

(Appendix 4)
The large component disassembly unit is
A k-center vertex detection unit that cuts all sides connected to the detected k-center vertex in order to detect the k-center vertex in each large component and obtain a plurality of subcomponents other than the k-center vertex; ,
A sub-component distance calculation unit that calculates the center of each sub-component and calculates the distance between the two sub-component centers;
Use the center of each subcomponent as a vertex, weight the vertex by the size of the corresponding subcomponent (represented by the number of vertices in the record contained in the subcomponent), connect all two vertices with edges, A subcomponent complete graph construction unit that constructs a subcomponent complete graph by weighting by the distance between two corresponding subcomponent centers;
Subcomponent that cuts edges continuously in the order of edge weights, divides the subcomponent complete graph into multiple clusters, and sets the sum of the weights of all vertices in each cluster to be greater than or equal to k and less than or equal to 2k-1 Complete graph edge cut unit,
If the k-center vertex is merged with the cluster having the closest distance to the k-center vertex, and the sum of the weights of all the vertices included in the cluster merged with the k-center vertex is equal to 2k, the cluster is divided into two clusters. The data anonymization device according to appendix 1, further comprising: a merge unit that decomposes and makes a sum of weights of all vertices included in each cluster equal to k.

(Appendix 5)
The data anonymization device according to appendix 4, wherein the sub-component complete graph edge cut unit sorts edges according to edge weights and cuts edges in descending order of the weights.

(Appendix 6)
The sub-component complete graph edge cut unit cuts an edge if one of the following conditions is satisfied: 1) The edge is a bridge, and the weight of the vertex included in each component obtained after the edge is cut Is at least k.
2) An edge is not a bridge If an edge is cut and the graph containing the edge is split into two subgraphs, the edge is a bridge,
The data anonymization device according to appendix 4, wherein if an edge is cut and the graph including the edge is not divided into two subgraphs, the edge is not a bridge.

(Appendix 7)
A distance calculating step for calculating a distance between every two records in the plurality of data records;
A complete graph construction step that builds a complete graph containing all records by using each record as a vertex, connecting all two vertices with edges, and weighting the edges with the distance between the two corresponding records When,
An edge cutting step for sequentially cutting edges in order of edge weights in order to divide the complete graph into a plurality of components including at least k (k is a predetermined natural number) vertices;
A large component decomposition step of decomposing a component including more than 2k-1 vertices into a plurality of clusters such that the number of vertices included in each cluster is between k and 2k-1;
A generalization step that generalizes the records corresponding to the vertices of each cluster so that the records in each cluster cannot be distinguished from each other;
A data anonymization method, wherein a component including more than 2k-1 vertices is a large component, and a component including k or more and 2k-1 or less vertices is a cluster.

(Appendix 8)
The data anonymization method according to appendix 7, wherein in the side cutting step, the sides are sorted according to the weights of the sides and the sides are cut in descending order of the weights.

(Appendix 9)
In the edge cutting step, if one of the following conditions is satisfied, the edge is cut 1) The edge is a bridge, and each subgraph obtained after cutting the edge includes at least k vertices 2) An edge is not a bridge If an edge is cut and the graph containing the edge is divided into two separate sections, the edge is a bridge,
The data anonymization method according to appendix 7, wherein if an edge is cut but the graph including the edge is not divided into two separate sections, the edge is not a bridge.

(Appendix 10)
The large component decomposition step comprises:
A k-center vertex detection step of cutting all sides connected to the detected k-center vertex to detect the k-center vertex in each large component and to obtain a plurality of sub-components other than the k-center vertex; ,
A sub-component distance calculation step for calculating the center of each sub-component and calculating the distance between the two sub-component centers;
Use the center of each subcomponent as a vertex, weight the vertex by the size of the corresponding subcomponent (represented by the number of vertices in the record contained in the subcomponent), connect all two vertices with edges, A subcomponent complete graph construction step of constructing a subcomponent complete graph by weighting by the distance between two corresponding subcomponent centers;
Subcomponent that cuts edges continuously in the order of edge weights, divides the subcomponent complete graph into multiple clusters, and sets the sum of the weights of all vertices in each cluster to be greater than or equal to k and less than or equal to 2k-1 Complete graph edge cut step;
If the k-center vertex is merged with the cluster having the closest distance to the k-center vertex, and the sum of the weights of all the vertices included in the cluster merged with the k-center vertex is equal to 2k, the cluster is divided into two clusters. The data anonymization method according to appendix 7, further comprising a merging step of decomposing and making the sum of weights of all vertices included in each cluster equal to k.

(Appendix 11)
The data anonymization method according to supplementary note 10, wherein in the sub-component complete graph edge cut step, edges are sorted according to edge weights, and the edges are cut in descending order of the weights.

(Appendix 12)
In the sub-component complete graph edge cutting step, if one of the following conditions is satisfied, the edge is cut 1) The edge is a bridge, and the weight of the vertex included in each component obtained after the edge is cut Is at least k.
2) An edge is not a bridge If an edge is cut and the graph containing the edge is split into two subgraphs, the edge is a bridge,
The data anonymization method according to claim 10, wherein, even if an edge is cut, if the graph including the edge is not divided into two subgraphs, the edge is not a bridge.

1: Data anonymization device 10: Distance calculation unit 12: Complete graph construction unit 14: Edge cut unit 16: Large component decomposition unit 18: Generalization unit 20: Record recording unit 16: Large component decomposition unit 160: k-center vertex detection Unit 162: Subcomponent distance calculation unit 164: Subcomponent complete graph construction unit 166: Subcomponent complete graph edge cut unit 168: Merge unit

Claims (10)

A distance calculation unit for calculating the distance between every two records in the plurality of data records;
A complete graph construction unit that builds a complete graph containing all records by using each record as a vertex, connecting all two vertices with edges, and adding weights to the edges at the distance between two corresponding records When,
An edge cutting unit that sequentially cuts edges in order of edge weights to divide the complete graph into a plurality of components including at least k (predetermined natural number) vertices;
A large component decomposition unit for decomposing a component including more than 2k-1 vertices into a plurality of clusters such that the number of vertices included in each cluster is between k and 2k-1.
A generalization unit that generalizes the records corresponding to the vertices of each cluster so that the records in each cluster cannot be distinguished from each other;
A data anonymization device, wherein a component including more than 2k-1 vertices is a large component, and a component including k or more and 2k-1 or less vertices is a cluster.   The data anonymization device according to claim 1, wherein the side cut unit sorts the sides according to the weights of the sides and cuts the sides in descending order of the weights. The edge cut unit cuts an edge if one of the following conditions is satisfied: 1) The edge is a bridge, and each subgraph obtained after the edge is cut includes at least k vertices 2) An edge is not a bridge If an edge is cut and the graph containing the edge is divided into two separate sections, the edge is a bridge,
2. The data anonymization device according to claim 1, wherein, even if an edge is cut, if the graph including the edge is not divided into two individual sections, the edge is not a bridge. The large component disassembly unit is
A k-center vertex detection unit that cuts all sides connected to the detected k-center vertex in order to detect the k-center vertex in each large component and obtain a plurality of subcomponents other than the k-center vertex; ,
A sub-component distance calculation unit that calculates the center of each sub-component and calculates the distance between the two sub-component centers;
Use the center of each subcomponent as a vertex, weight the vertex by the size of the corresponding subcomponent (represented by the number of vertices in the record contained in the subcomponent), connect all two vertices with edges, A subcomponent complete graph construction unit that constructs a subcomponent complete graph by weighting by the distance between two corresponding subcomponent centers;
Subcomponent that cuts edges continuously in the order of edge weights, divides the subcomponent complete graph into multiple clusters, and sets the sum of the weights of all vertices in each cluster to be greater than or equal to k and less than or equal to 2k-1 Complete graph edge cut unit,
If the k-center vertex is merged with the cluster having the closest distance to the k-center vertex, and the sum of the weights of all the vertices included in the cluster merged with the k-center vertex is equal to 2k, the cluster is divided into two clusters. The data anonymization device according to claim 1, further comprising: a merge unit that decomposes and makes a sum of weights of all vertices included in each cluster equal to k.   5. The data anonymization device according to claim 4, wherein the sub-component complete graph edge cut unit sorts edges according to edge weights and cuts edges in descending order of the weights. The sub-component complete graph edge cut unit cuts an edge if one of the following conditions is satisfied: 1) The edge is a bridge, and the weight of the vertex included in each component obtained after the edge is cut Is at least k.
2) An edge is not a bridge If an edge is cut and the graph containing the edge is split into two subgraphs, the edge is a bridge,
The data anonymization device according to claim 4, wherein, even if an edge is cut, if the graph including the edge is not divided into two subgraphs, the edge is not a bridge. A distance calculating step for calculating a distance between every two records in the plurality of data records;
A complete graph construction step that builds a complete graph containing all records by using each record as a vertex, connecting all two vertices with edges, and weighting the edges with the distance between the two corresponding records When,
An edge cutting step for sequentially cutting edges in order of edge weights in order to divide the complete graph into a plurality of components including at least k (k is a predetermined natural number) vertices;
A large component decomposition step of decomposing a component including more than 2k-1 vertices into a plurality of clusters such that the number of vertices included in each cluster is between k and 2k-1;
A generalization step that generalizes the records corresponding to the vertices of each cluster so that the records in each cluster cannot be distinguished from each other;
A data anonymization method, wherein a component including more than 2k-1 vertices is a large component, and a component including k or more and 2k-1 or less vertices is a cluster.   The data anonymization method according to claim 7, wherein in the side cutting step, the sides are sorted according to the weights of the sides, and the sides are cut in descending order of the weights. In the edge cutting step, if one of the following conditions is satisfied, the edge is cut 1) The edge is a bridge, and each subgraph obtained after cutting the edge includes at least k vertices 2) An edge is not a bridge If an edge is cut and the graph containing the edge is divided into two separate sections, the edge is a bridge,
The data anonymization method according to claim 7, wherein, even if an edge is cut, if the graph including the edge is not divided into two separate sections, the edge is not a bridge. The large component decomposition step comprises:
A k-center vertex detection step of cutting all sides connected to the detected k-center vertex to detect the k-center vertex in each large component and to obtain a plurality of sub-components other than the k-center vertex; ,
A sub-component distance calculation step for calculating the center of each sub-component and calculating the distance between the two sub-component centers;
Use the center of each subcomponent as a vertex, weight the vertex by the size of the corresponding subcomponent (represented by the number of vertices in the record contained in the subcomponent), connect all two vertices with edges, A subcomponent complete graph construction step of constructing a subcomponent complete graph by weighting by the distance between two corresponding subcomponent centers;
Subcomponent that cuts edges continuously in the order of edge weights, divides the subcomponent complete graph into multiple clusters, and sets the sum of the weights of all vertices in each cluster to be greater than or equal to k and less than or equal to 2k-1 Complete graph edge cut step;
If the k-center vertex is merged with the cluster having the closest distance to the k-center vertex, and the sum of the weights of all the vertices included in the cluster merged with the k-center vertex is equal to 2k, the cluster is divided into two clusters. The data anonymization method according to claim 7, further comprising: a step of decomposing and merging the sum of weights of all vertices included in each cluster to be equal to k.

Images