JP2013008175A - Conversion processing method, device and program and restoration processing method, device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent data leakage from being generated from the distribution of data.SOLUTION: A conversion processing method includes: a step (A) of, as for a plurality of records having attribute values about a plurality of attribute items stored in a first data storage section, detecting first distribution about the appearance frequency of the attribute value which appears about a specific attribute item among the plurality of attribute items; and a step (B) of converting each of at least partial attribute values among the attribute values into any of a plurality of second attribute values to be specified according to a predetermined first rule so that the first distribution can be turned into second distribution different from the first distribution.

Description

  The present technology relates to data concealment technology.

  For example, as shown in FIG. 1A to FIG. 1C, for each student in the university's engineering department, pharmacy department, and commerce department, there are a plurality of attribute items (for example, gender, grade level, physical fitness score, and presence or absence of disease (1 = Yes, 0 = (None)) Consider a case where each attribute value is retained. Further, for such entire data (here, the entire university), for each attribute value of the specific attribute item, the record group in which the attribute value appears is specified, and the attribute value of the other attribute item in the record group Consider the case of performing cross tabulation to calculate the number of occurrences of.

  For example, if the data as shown in FIGS. 1A to 1C is passed to the tabulator who performs the cross tabulation as it is, an individual is specified. Therefore, in order to prevent leakage of privacy information, some simple methods are used. The attribute item may be encrypted or concealed using a hash function. For example, when encrypting the attribute item of gender, for example, when M (male) is encrypted to abc and F (female) is encrypted to def, data as shown in FIGS. 2A to 2C is obtained. . With such data, an individual cannot be identified from this data alone. In addition, if cross tabulation is implemented about sex and a disease, a tabulation result as shown in FIG. 3 will be obtained.

  However, for example, if the engineering department has a background knowledge that there are few women, or the pharmacy department has a background knowledge that there are few men, it is on the tabulator side that abc = M (male) and def = F (female). Will understand. Furthermore, an individual can be specified, and sensitive information about the presence or absence of a disease may be specified for the individual. This is a problem that occurs even if the value itself is concealed, if the value before concealment and the value after concealment have a one-to-one correspondence, the distribution of values does not change at all before and after concealment.

  In addition, there is a risk that the method of converting letters and numbers into numbers and symbol strings with arbitrary correspondence with them will be easily deciphered due to the regularity of appearance of the same numbers and symbol strings in the ciphertext. There is a conventional technique that considers the above. In this conventional technique, when a character string that has already appeared as a character string after concealment is the same, the conversion rule is partially modified to make it difficult to determine the conversion rule. However, the distribution of the data after concealment and the summarization processing such as cross tabulation after concealment are not considered.

  There is also a technique for converting a character string in an electronic document designated as a conversion processing target into another character string. Specifically, a character list that defines conversion characters and identifiers that uniquely identify each conversion character is held in advance, an input of a conversion instruction is accepted, and each character included in the character string to be converted is A search is performed from the character list, and the character list is converted into another character in the character list according to a predefined conversion rule based on the identifier assigned to the character to be converted from the character list. On the other hand, the input of the restoration instruction is accepted, and the converted character is restored to the conversion target character included in the character list by the restoration rule corresponding to the conversion rule. However, aggregation processing such as distribution of data after concealment and cross tabulation is not considered.

  Further, there is a technique for protecting the confidential information portion in the file while allowing other portions to be easily disclosed to the general public and allowing the administrator to restore the original file. In this technology, a replacement character for a replacement target character is selected from characters that do not exist in the file, a replacement map indicating the correspondence between the selected replacement character and the replacement target character is created, and the replacement map is created. Based on this, the replacement target character in the conversion target character string existing in the file is replaced with the replaced character. Further, the replaced character existing in the file is returned to the replacement target character based on the replacement map. However, aggregation processing such as distribution of data after concealment and cross tabulation is not considered.

  In addition, for the purpose of strengthening or maintaining the encryption strength, there is a technique in which one value is scattered into a plurality of values by the probability encryption while maintaining the order relation. However, it does not take into account the aggregation processing such as the distribution of data after concealment and cross tabulation.

JP 2002-374243 JP 2007-102540 A JP 2007-156861 A

"Order-Preserving Symmetric Encryption" EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques Springer-Verlag Berlin, Heidelberg, 2009 ISBN: 978-3-642-01000-2

  Therefore, the objective of this technique is to provide the technique for preventing that a data leak arises from distribution of data according to one side surface.

  The conversion processing method according to the first aspect of the present technology includes: (A) identifying a plurality of attribute items among a plurality of records stored in the first data storage unit and having attribute values for each of the plurality of attribute items. Detecting the first distribution of the appearance frequency of the attribute value appearing for the attribute item, and (B) the attribute so that the first distribution is a second distribution different from the first distribution. Converting each of at least some of the attribute values into one of a plurality of second attribute values specified according to a predetermined first rule.

  The restoration processing method according to the second aspect of the present technology includes (A) a plurality of second attribute values according to a predetermined rule from a first attribute value that appears for a first attribute item in a plurality of records to be counted. And (B) a first result storing a count result including a count value of attribute values of the second attribute item or a total value of attribute values for each of the third attribute values that appear for the first attribute item. In the data storage unit, for each of the plurality of second attribute values, it is determined whether there is a third attribute value that matches the second attribute value. If there is a second attribute value, the second attribute value is associated with the third attribute value. The count value for each attribute value of the two attribute items or the total value of the attribute values is read from the first data storage unit and accumulated for each attribute value of the second attribute item, or the attribute value of the second attribute item is Accumulate the accumulated result to the second attribute value And storing in the second data storage unit with response.

  It is possible to prevent data leakage from the data distribution.

FIG. 1A is a diagram for explaining a problem of the related art. FIG. 1B is a diagram for explaining a problem of the conventional technology. FIG. 1C is a diagram for explaining a problem of the related art. FIG. 2A is a diagram for explaining a problem of the related art. FIG. 2B is a diagram for explaining a problem of the related art. FIG. 2C is a diagram for explaining a problem of the related art. FIG. 3 is a diagram illustrating an example of cross tabulation. FIG. 4 is a diagram showing a system overview in the present embodiment. FIG. 5 is a functional block diagram of the information processing apparatus. FIG. 6 is a diagram showing a processing flow of processing in the present embodiment. FIG. 7 is a diagram illustrating an example of provided data. FIG. 8 is a diagram illustrating an example of a distribution obtained from provided data. FIG. 9 is a diagram illustrating a processing flow of distribution conversion data generation processing. FIG. 10A is a diagram illustrating a process of generating distribution conversion data. FIG. 10B is a diagram illustrating a process of generating distribution conversion data. FIG. 10C is a diagram for explaining distribution conversion. FIG. 11 is a diagram illustrating a processing flow of conversion processing. FIG. 12 is a diagram illustrating an example of data after conversion processing. FIG. 13A is a diagram schematically illustrating an encryption operation. FIG. 13B is a diagram illustrating an example of the encrypted attribute value after conversion. FIG. 14A is a diagram illustrating a conversion example of the data in FIG. 1A. FIG. 14B is a diagram illustrating a conversion example of the data in FIG. 1B. FIG. 14C is a diagram illustrating an example of conversion of the data in FIG. 1C. FIG. 15A is a diagram illustrating an example of encrypted data of the data in FIG. 1A. FIG. 15B is a diagram illustrating an example of encrypted data of the data in FIG. 1B. FIG. 15C is a diagram illustrating an example of encrypted data of the data in FIG. 1C. FIG. 16A is a diagram illustrating an example of the cross tabulation of FIGS. 15A to 15C. FIG. 16B is a diagram illustrating an example of the cross tabulation of FIGS. 15A to 15C. FIG. 16C is a diagram illustrating an example of the cross tabulation of FIGS. 15A to 15C. FIG. 16D is a diagram illustrating an example of the cross tabulation of FIGS. 15A to 15C. FIG. 17 is a diagram illustrating another example of distribution data. FIG. 18 is a diagram illustrating another example of distribution conversion data. FIG. 19 is a diagram for explaining distribution conversion. FIG. 20 is a diagram showing a processing flow of processing in the present embodiment. FIG. 21A is a diagram illustrating processing contents of the attribute value generation processing unit. FIG. 21B is a diagram illustrating processing contents of the attribute value generation processing unit. FIG. 22 is a diagram showing a processing flow of processing in the present embodiment. FIG. 23 is a diagram illustrating an example of the restoration count result. FIG. 24 is a diagram illustrating another example of the result of restoration tabulation processing. FIG. 25 is a diagram illustrating another example of distribution conversion data. FIG. 26 is a functional block diagram of a computer.

  FIG. 4 shows a system configuration example according to the present embodiment. In the network 1 such as the Internet, a totaling server 300 that performs a totaling process such as cross tabulation, and a plurality of information processing apparatuses that perform processing for providing data to the totaling server 300 and using the totaling result (FIG. 4). Are connected to the information processing apparatuses A to C). The aggregation server 300 includes a data receiving unit 310 that receives data to be aggregated from the information processing device, a data storage unit 320 that stores data to be aggregated received by the data receiving unit 310, and an aggregation request from the information processing device. And a totaling processing unit 330 that performs a totaling process such as cross tabulation in response to the request and returns a totaling result to the requesting information processing apparatus. Since the processing content of the totaling server 300 is not different from the conventional one, it will not be described further.

  FIG. 5 shows a functional block diagram of the information processing apparatus. The information processing apparatus includes a provided data storage unit 101, a distribution detection unit 102, a distribution data storage unit 103, a distribution conversion data generation unit 104, a rule storage unit 105, a distribution conversion data storage unit 106, and a conversion processing unit. 107, converted data storage unit 108, encryption processing unit 109, key storage unit 110, encrypted data storage unit 111, transmission unit 112, aggregation request processing unit 121, and aggregation result storage unit 122 A restoration processing unit 123, an attribute value generation unit 124, and a restoration tabulation result storage unit 126. Note that the information processing apparatus may include an attribute value storage unit 125 that stores attribute value data that appears for each attribute item.

  Note that a terminal device operated by an administrator or the like who manages the information processing apparatus is connected to the information processing apparatus via another network, and the information processing apparatus performs processing according to an instruction from the terminal apparatus. For example, when the provision data sent from the terminal device is received, the provision data is stored in the provision data storage unit 101.

  The provided data storage unit 101 stores provided data that is data to be transmitted to the aggregation server 300. The distribution detection unit 102, for a plurality of records stored in the provided data storage unit 101, for example, counts the appearance frequency for each attribute value for a specific attribute item specified by the administrator, and sums the attribute values The processing result is stored in the distribution data storage unit 103.

  The distribution conversion data generation unit 104 processes the distribution data stored in the distribution data storage unit 103 in accordance with the rule data stored in the rule storage unit 105, thereby specifying specific records in a plurality of records included in the provided data. Data for converting the attribute value of the attribute item is generated and stored in the distribution conversion data storage unit 106. The conversion processing unit 107 converts attribute values for specific attribute items in a plurality of records stored in the provided data storage unit 101 in accordance with the data stored in the distribution conversion data storage unit 106, and converts the converted values. Data is stored in the converted data storage unit 108.

  The encryption processing unit 109 encrypts attribute values for specific attribute items in a plurality of records stored in the converted data storage unit 108 in accordance with the key stored in the key storage unit 110 and a predetermined hash function. The processing result is executed, and the processing result is stored in the encrypted data storage unit 111. The transmission unit 112 transmits the data stored in the encrypted data storage unit 111 to the aggregation server 300.

  The aggregation request processing unit 121 transmits an aggregation request to the aggregation server 300 in response to an instruction from the user of the information processing apparatus, receives the aggregation result from the aggregation server 300, and stores it in the aggregation result storage unit 122. The restoration processing unit 123 cooperates with the attribute value generation unit 124 to extract the attribute value of the attribute item that is encrypted and the attribute value is converted from the aggregation result stored in the aggregation result storage unit 122. The restoration process is performed, and the processing result is stored in the restoration tabulation result storage unit 126. The attribute value generation unit 124 converts the attribute value of a specific attribute item stored in the distribution data storage unit 103 (or attribute value storage unit 125) according to the rule data stored in the rule storage unit 105, and The encrypted attribute value encrypted by encrypting with the key stored in the storage unit 110 and a predetermined hash function is generated and output to the restoration processing unit 123.

  In the example of FIG. 5, the information processing apparatus includes a portion that performs processing for transmitting provided data to the aggregation server 300 and a portion that performs processing for receiving and restoring the aggregation result from the aggregation server 300. However, they may be provided in another device. The key and the hash function stored in the key storage unit 110 are shared by the person or company sharing the aggregation result. In addition, the attribute value storage unit 125 stores in common variations of attribute values that may appear for a specific attribute item by a person or company sharing the aggregation result. By using this, it becomes possible to cope with an attribute value that is not included in the data provided by the user, even if it appears in the aggregation result. Similarly, in the rule storage unit 105, common rule data is stored by the person or company sharing the aggregation result.

  Next, processing contents of the information processing apparatus will be described with reference to FIGS. It is assumed that the provided data is already stored in the provided data storage unit 101. First, the distribution detection unit 102 counts the appearance frequency for each attribute value of a specific attribute item to be processed in a plurality of records that are provided data stored in the provided data storage unit 101, An average value (such as a minimum value in some cases) is calculated and stored in the distribution data storage unit 103 (FIG. 6: step S1).

  For example, when provision data as shown in FIG. 7 is stored in the provision data storage unit 101, if the specific attribute item is “gender”, data as shown in FIG. 8 is obtained. In the example of FIG. 8, the appearance frequency of the attribute value “M”, the appearance frequency of the attribute value “F”, and the average value thereof are included. The average value is used as a reference value for determining the bias in appearance frequency. Note that the minimum value may be used as a reference value.

  Next, the distribution conversion data generation unit 104 performs distribution conversion data generation processing (step S3). The distribution conversion data generation processing will be described with reference to FIGS. 9 to 10C.

  The distribution conversion data generation unit 104 identifies one unprocessed attribute value in the distribution data stored in the distribution data storage unit 103 (FIG. 9: Step S11). Then, the distribution conversion data generation unit 104 determines whether the appearance frequency of the identified attribute value is less than the reference value (step S13). For example, in the case of using the average value as the reference value, in the case of FIG. 8, in the case of the attribute value “M”, an appearance frequency equal to or higher than the average value is obtained, and in the case of the attribute value “F”, Appearance frequency less than the average value is obtained.

  If the appearance frequency of the identified attribute value is less than the reference value (step S13: Yes route), the distribution conversion data generation unit 104 sets one converted attribute value according to the rule data stored in the rule storage unit 105. A record including the converted attribute value and the conversion probability “100%” is generated and stored in the distribution conversion data storage unit 106 (step S15). Then, control goes to a step S23.

  If the rule data stored in the rule storage unit 105 is data representing a rule for generating a converted attribute value by serially adding a number to the attribute value before conversion, for example, the attribute value “F”. In the case of, the converted attribute value is “F1”. Note that the rule data may be data representing a rule that randomly selects an integer value within a predetermined range as an attribute value before conversion, for example. Such a rule is an example, and any rule may be used as long as it can be converted regularly.

  In the example of FIG. 8, as shown in FIG. 10A, the attribute value “F1” after conversion and the probability “100” are stored in association with the attribute value “F” before conversion.

On the other hand, if the appearance frequency of the identified attribute value is equal to or higher than the reference value (step S13: No route), the distribution conversion data generation unit 104 calculates the number of expansions (also referred to as the number of divisions) (step S17). For example, the frequency of occurrence of the specified attribute value may be divided by “2” until it falls below the reference value, and the number of expansions = 2 ^N (N is the number of divisions) may be calculated. Further, the appearance frequency of the identified attribute value may be subtracted by the reference value until it falls below the reference value, and the number of subtractions may be set as the number of expansions. Furthermore, the solution (+1 if there is a remainder) when the appearance frequency of the specified attribute value is divided by the reference value may be set as the number of expansions.

  In the example of FIG. 8, the appearance frequency “10” and the average value “6.5” are obtained for the pre-conversion attribute value “M”. Therefore, even with the method of dividing by “2”, subtraction is performed with the reference value. The number of expansions is calculated to be “2” regardless of the method used or the method of dividing by the reference value.

  The distribution conversion data generation unit 104 generates a number of converted attribute values corresponding to the number of expansions calculated according to the rule data stored in the rule storage unit 105, and expands the record including the converted attribute values. The number is generated and stored in the distribution conversion data storage unit 106 (step S19). In the example of FIG. 8, since the number of expansions is “2”, post-conversion attribute values “M1” and “M2” are generated, and records are generated for them and stored in the distribution conversion data storage unit 106. Furthermore, the distribution conversion data generation unit 104 sets a conversion probability in the generated record (step S21). The conversion probability may be set to a uniform value by dividing “100” by the number of expansions. As shown in FIG. 10B, if the number of expansions is “2”, “50” is set. Note that the conversion probabilities need only add to 100, and may have fluctuations such as 51 and 49. This is to prevent an unnatural distribution.

  Thus, when the conversion probability is “50”%, the attribute value “M1” has the appearance frequency “5”, the attribute value “M2” has the appearance frequency “5”, and the attribute value “F” has the appearance frequency. Is “3”. Then, as shown in FIG. 10C, it can be seen that the distribution biased toward the attribute value “M” is corrected. That is, as shown on the left side of FIG. 10C, the appearance frequency of the attribute value “M” is prominent before conversion, but as shown on the right side of FIG. 10C, the appearance frequency of all the attribute values is The average value is below, and the difference in appearance frequency is small.

  Thereafter, the distribution conversion data generation unit 104 determines whether there is an unprocessed attribute value (step S23). If there is an unprocessed attribute value, the process returns to step S11. On the other hand, if there is no unprocessed attribute value, the process returns to the caller process.

  By performing such processing, distribution conversion data as shown in FIG. 10B is generated. With this distribution conversion data, the distribution of the appearance frequency of attribute values for a specific attribute item can be appropriately converted for the purpose of concealment.

  Returning to the description of the processing in FIG. 6, the conversion processing unit 107 and the encryption processing unit 109 perform conversion processing (step S5). The conversion process will be described with reference to FIGS. 11 to 13B.

  First, the conversion processing unit 107 identifies one unprocessed record among a plurality of records included in the provided data stored in the provided data storage unit 101 (FIG. 11: step S31). And the conversion process part 107 specifies the applicable part of distribution conversion data from the attribute value of the specific attribute item which is the object of the process in the specified record (step S33). In the case of the attribute value “M” of the attribute item “sex” in the first record of the data as shown in FIG. 7, if the distribution conversion data of FIG. 10B, the row of the attribute value “M” before conversion is specified. To do.

  Then, the conversion processing unit 107 converts the attribute value of the specific attribute item in the specified record into the converted attribute value according to the probability defined in the corresponding part of the distribution conversion data, and the processed record Is stored in the converted data storage unit 108 (step S35). If there are a plurality of post-conversion attribute values and the probabilities are uniform, the post-conversion attribute values may be adopted in turn in round robin. Alternatively, a random number may be generated and the converted attribute value may be selected each time according to the probability value.

  For example, in the case of provided data as shown in FIG. 7, according to the distribution conversion data shown in FIG. 10B, when step S35 is performed, data as shown in FIG. 12 is obtained. The gender attribute value “M” is converted so that “M1” and “M2” are uniformly generated. The gender attribute value “F” is converted to “F1”.

  Thereafter, the encryption processing unit 109 uses the key k stored in the key storage unit 110 and the predetermined hash function H to convert the attribute after conversion of a specific attribute item in the record stored in the converted data storage unit 108. The value is encrypted, and the processed record is stored in the encrypted data storage unit 111 (step S37). For example, if the attribute value after conversion is “M1”, the calculation of H (M1, k) is performed. When data as shown in FIG. 12 is obtained, an operation as schematically shown in FIG. 13A is performed to generate encrypted data as shown in FIG. 13B. As can be seen from FIG. 13B, if “M1”, “abc25432” is generated. Since “abc25432” is generated for all records in which “M1” appears, the number of records with “1” with disease and the number of records with “0” without disease for “M1” even if cross tabulation is performed. Can be counted. However, since the relationship with “a 34565” corresponding to “M2” is unknown in the encrypted data, “abc 25432” and “a 34565” are not identified with each other.

  Then, the conversion processing unit 107 determines whether there is an unprocessed record (step S39). If there is an unprocessed record, the process returns to step S31. On the other hand, if there is no unprocessed record, the process returns to the caller process.

  By performing such processing, the distribution of the appearance frequency of the attribute value in a specific attribute item is converted into a different distribution, and further concealed data can be generated.

  Returning to the description of the processing in FIG. 6, the transmission unit 112 transmits the data stored in the encrypted data storage unit 111 to the aggregation server 300 (step S <b> 7).

  As for the processing in the totaling server 300, as described above, the encrypted data is received and stored in the data storage unit 320, and a predetermined totaling process (for example, cross tabulation) is automatically performed in response to a request. To implement.

  For example, in the case of data (partly) as shown in FIG. 1A, it is assumed that distribution conversion data is generated in which gender “M” is expanded from “M1” to “M6” and gender “F” is converted to “F1”. To do. Then, for example, data as shown in FIG. 14A is obtained. Further, in the case of data (partial) as shown in FIG. 1B, distribution conversion data is generated in which gender “M” is converted to “M1” and gender “F” is expanded to “F1” to “F5”. To do. Then, for example, data as shown in FIG. 14B is obtained. Further, in the case of data (partial) as shown in FIG. 1C, distribution conversion data in which gender “M” is expanded from “M1” to “M3” and gender “F” is expanded from “F1” to “F3”. Is generated. Then, for example, data as shown in FIG. 14C is obtained. Further, when encryption is performed using the key k and the hash function H, the data in FIG. 14A becomes as shown in FIG. 15A, the data in FIG. 14B becomes as in FIG. 15B, and the data in FIG. 14C becomes as shown in FIG. Become. 15A, 15B, and 15C are transmitted to the aggregation server 300 and stored in the data storage unit 320 by the data reception unit 310.

  Thereafter, the totalization processing unit 330 performs cross-tabulation that totals the occurrence status of diseases for each gender, for example, on the data stored in the data storage unit 320 automatically or upon request. Then, the total results as shown in FIGS. 16A to 16D are obtained. The example of FIG. 16A shows the results of counting the appearance frequency of the disease attribute value “0” and the appearance frequency of the attribute value “1” for each department for each gender. In the example of FIG. 16B, the result of counting the appearance frequency of the disease attribute value “1” for each department for each gender is shown. Further, the example of FIG. 16C shows the result of counting the appearance frequency of the disease attribute value “0” and the appearance frequency of the attribute value “1” for every gender regardless of the faculty. Furthermore, in the example of FIG. 16D, the result of counting the appearance frequency of the attribute value “1” for each gender is shown for all faculties regardless of the faculty.

  As described above, the minimum value of the appearance frequency may be adopted as the reference value for calculating the number of expansions. For example, in the case of FIG. 8, when the minimum value “3” is used as a reference value and the number of expansions is calculated for the attribute value “M” from the appearance frequency “10” by the method described above, as shown in FIG. The expansion number “4” is obtained. On the other hand, for the attribute value “F”, when the number of expansions is calculated as described above from the appearance frequency “3”, the number of expansions “0” is obtained. In the case of such an expansion number, the attribute value “M” is expanded into attribute values “M1” to “M4”, and the attribute value “F” is converted into the attribute value “F1”. That is, distribution conversion data as shown in FIG. 18 is generated. Even if the appearance frequency is “10” and the conversion probability is “25”%, the converted attribute value appears an integer number of times, so “M1” is three times, “M2” is two times, “M3”, for example. Appears three times and “M4” appears twice.

  That is, as shown in FIG. 19, the appearance frequency distribution is converted so that the appearance frequency is less biased. That is, the distribution is converted from the distribution shown on the left side of FIG. 19 so that the appearance frequency is equal to or lower than the minimum value that is the reference value, as shown on the right side of FIG.

  In the example described above, an example is shown in which the distribution is converted in a direction in which the appearance frequency becomes flat. However, it is only necessary that the distribution before conversion cannot be estimated from the distribution after conversion. When a distribution that is not a normal distribution is obtained, conversion may be performed so that a normal distribution is obtained.

  Further, in the example described above, an example in which an attribute item to be processed is specified in advance is shown, but the attribute item to be processed may be specified from the distribution of the appearance frequency of attribute values. For example, the distribution detection unit 102 calculates not only the average value but also the standard deviation σ. Then, the distribution conversion data generation unit 104 checks whether there is an attribute value having an appearance frequency that exceeds the range of plus or minus 3σ from the average value. If such an attribute value exists, the attribute item of the attribute value is selected. Select as target for processing.

  Next, processing when the totaling result is acquired from the totaling server 300 will be described with reference to FIGS. The aggregation request processing unit 121 transmits, for example, an aggregation request for requesting specific aggregation processing to the aggregation server 300 according to a request from the user, for example. The aggregation processing unit 330 of the aggregation server 300 performs aggregation processing according to the aggregation request, and returns the aggregation result to the requesting information processing apparatus.

  Then, the aggregation request processing unit 121 receives the aggregation result from the aggregation server 300 and stores it in the aggregation result storage unit 122 (FIG. 20: Step S41). Next, in response to an instruction from the aggregation request processing unit 121, the attribute value generation unit 124 stores unprocessed specific attribute items to be processed that are stored in the distribution data storage unit 103 or the attribute value storage unit 125. One attribute value is specified (step S43). Further, the attribute value generation unit 124 initializes the counter N to 1 (step S45).

  The attribute value generation unit 124 determines the Nth post-conversion attribute value from the identified attribute value from the rule data stored in the rule storage unit 105 (step S47). For example, if the specified attribute value by sex is “M”, “M1” is determined first according to the rule data.

  Thereafter, the attribute value generation unit 124 calculates a converted attribute value encrypted from the key k stored in the key storage unit 110 and a predetermined hash function H for the Nth converted attribute value ( Step S49). For example, as shown in FIG. 21A, when “M1” is generated for the attribute value “M”, an operation H (M1, k) is performed to calculate an encrypted converted attribute value. Similarly, with respect to the attribute value “F”, as shown in FIG. 21B, when “F1” is generated, an operation of H (F1, k) is performed to calculate an encrypted attribute value after conversion. . The attribute value generation unit 124 outputs the encrypted post-conversion attribute value to the restoration processing unit 123.

  The restoration processing unit 123 searches the aggregation result stored in the aggregation result storage unit 122 with the encrypted attribute value after conversion (step S51). For example, when the totaling result as shown in FIG. 16C is acquired, the totaling result as shown in FIG. 16C is searched by “abc25432” corresponding to “M1”, for example. Then, the first item is hit.

  Then, the restoration processing unit 123 determines whether or not the converted attribute value encrypted in the aggregation result exists (step S53). If the converted attribute value encrypted in the aggregation result exists, step S43 is performed. The count of the attribute value specified in (1) is incremented by the total value (step S55). The calculation result is stored in the restoration count result storage unit 126. For example, when the first record of FIG. 16C is specified, “2” is added to the count value of the disease “0” and “1” is added to the count value of the disease “1” for the attribute value “M”. To do. Here, since the count value is initially “0”, the count value of the disease “0” is “2”, and the count value of the disease “1” is “1”. The attribute value generation unit 124 increments N by 1 (step S57) and returns to step S47.

  For example, in the case of the attribute value “M”, “M2” is then determined as the converted attribute value, and the encrypted converted attribute value “away 34565” is calculated as shown in FIG. 21A. Then, the search result of FIG. 16C is searched with “away 34565”. Then, the record in the second row is specified, and “2” is added to the count value of the disease “0” to obtain “4”, and “1” is added to the count value of the disease “1” to obtain “2”. Is obtained.

  On the other hand, if the converted attribute value encrypted in the aggregation result does not exist, the process proceeds to the process of FIG.

  Moving to the description of the processing in FIG. 22, the attribute value generation unit 124 determines whether N is equal to or greater than a predetermined maximum value of N (step S <b> 59). If N is not equal to or greater than the maximum value of N, the attribute value generation unit 124 increments N by 1 (step S61), and returns to step S47 of FIG. On the other hand, if N is greater than or equal to the maximum value of N, the attribute value generation unit 124 determines whether there is an unprocessed attribute value in the distribution data storage unit 103 or the attribute value storage unit 125 (step S63). When there is an unprocessed attribute value, the process returns to step S43 in FIG.

  On the other hand, when there is no unprocessed attribute value, for example, the restoration processing unit 123 transmits the restoration tabulation result stored in the restoration tabulation result storage unit 126 to the terminal of the user of the information processing apparatus (step S110). S65).

  When such processing is performed, the result shown in FIG. 23 is obtained for FIG. 16C. As shown in FIG. 23, for attribute values “M” and “F” of the attribute item “sex”, a count value of disease “0” and a count value of disease “1” are obtained. Similarly, when processing is performed on FIG. 16B, the result shown in FIG. 24 is obtained. In the example of FIG. 24, the result of counting the count value of the disease “1” for each faculty for the sexes “M” and “F” is obtained.

  If the processing as described above is performed, the aggregation server 300 is encrypted and the distribution is also changed, so it is impossible to estimate the original data. The correct result can be restored in the information processing apparatus. Therefore, even sensitive information is registered in the tabulation server 300, and tabulation processing such as cross tabulation is performed. In addition, the information processing apparatus can restore and effectively use the counting result such as the cross tabulation.

  Although the embodiments of the present technology have been described above, the present technology is not limited to these embodiments. For example, in the functional block diagram of FIG. 5, the actual program module configuration may not match. As for the processing flow, as long as the processing result does not change, the processing order may be changed or the processing flow may be executed in parallel. For example, there is no problem if the processing result does not change even if the loop is divided or the loops are integrated. For example, in the processing flow of FIG. 20 and FIG. 22, the calculation result may be searched after all the converted attribute values encrypted previously are calculated. Similarly, in the process of FIG. 11, the encryption process may be removed from the loop.

  In addition, when a converted attribute value is generated by serially adding a number to the attribute value, the processing flow may be such that steps S59 and S61 are not provided.

  Alternatively, the encrypted attribute value after conversion may be registered in the distribution conversion data storage unit 106 so that the attribute value after conversion directly encrypted can be extracted from the attribute value before conversion. For example, distribution conversion data as shown in FIG. 18 is registered up to an encrypted converted attribute value as shown in FIG. 25, and the converted attribute value directly encrypted by the conversion processing unit 107 is provided as provided data. You may make it allocate to each inside record.

  In the example described above, the case where all the information processing apparatuses A to C perform distribution conversion on the same attribute item has been described. However, in some cases, only some information processing apparatuses are specified. In some cases, distribution conversion may or may not be performed for attribute items. Therefore, when there is a record that has not been processed in the aggregation result storage unit 122, the restoration processing unit 123 stores the record in the restoration aggregation process result storage unit 126 as it is.

  In addition, the same attribute value set may not appear for a specific attribute item in all the information processing apparatuses A to C. In this case, if the attribute value generation unit 124 performs processing based on the distribution data storage unit 103, an encrypted converted attribute value cannot be generated for an unknown attribute value. Even in such a case, since a record that has not been processed remains in the totalization result storage unit 122, the record is stored in the restoration totalization processing result storage unit 126 as it is. However, if all the attribute values that may be used in the information processing apparatuses A to C are stored in the attribute value storage unit 125 and this data is used by the attribute value generation unit 124, such an attribute value is used. There is no problem.

  The information processing apparatus and the aggregation server 300 described above are computer apparatuses, and as shown in FIG. 26, a memory 2501, a CPU (Central Processing Unit) 2503, and a hard disk drive (HDD: Hard Disk Drive) 2505. A display control unit 2507 connected to the display device 2509, a drive device 2513 for the removable disk 2511, an input device 2515, and a communication control unit 2517 for connecting to a network are connected by a bus 2519. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing content of the application program, and performs a predetermined operation. Further, data in the middle of processing is mainly stored in the memory 2501, but may be stored in the HDD 2505. In an embodiment of the present technology, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed from the drive device 2513 to the HDD 2505. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above and programs such as the OS and application programs. .

  The above-described embodiment can be summarized as follows.

  In the conversion processing method according to the first aspect of the present embodiment, (A) a plurality of attribute items for a plurality of records stored in the first data storage unit and having attribute values for a plurality of attribute items, respectively. Of these, (B) a first process for detecting a first distribution of the appearance frequency of an attribute value that appears for a specific attribute item, and (B) the first distribution to be a second distribution different from the first distribution. And a second process for converting each of at least some of the attribute values into one of a plurality of second attribute values specified according to a predetermined first rule.

  In this way, it is difficult to estimate the original data from the distribution even if the processed data is viewed, so that data leakage can be prevented or suppressed.

  In the second process described above, (b1) a plurality of second attributes according to a second rule in which attribute values having a bias greater than or equal to a predetermined reference in the first distribution of attribute value appearance frequencies are determined. A third process that expands the value and stores a correspondence relationship between the attribute value having a bias equal to or greater than the predetermined reference and the plurality of second attribute values in the second data storage unit; and (b2) stores in the second data storage unit According to the correspondence relationship, a fourth process for converting an attribute value for a specific attribute item in a plurality of records into a second attribute value of any of the plurality of second attribute values may be included. If an attribute value having a bias in appearance frequency is converted into any one of a plurality of attribute values in this way, the bias in the appearance frequency can be corrected and the distribution feature can be eliminated. That is, data leakage from the distribution can be prevented or suppressed.

  The second process described above may further include a fifth process for encrypting the second attribute value for a specific attribute item in the plurality of records. In some cases, the second attribute value after encryption is also associated with the correspondence, and the encryption process may be performed on the record in this way. As for encryption, a key and a hash function may be used, or another encryption method may be used.

  Furthermore, the third process described above calculates the number of expansions based on the appearance frequency of the attribute value and the reference value for the attribute value whose appearance frequency exceeds the reference value among the attribute values that appear for the specific attribute item, According to the second rule, the second attribute value of the expansion number may be generated for the attribute value whose appearance frequency exceeds the reference value. For example, when the distribution is converted so that the second attribute value appears uniformly, the number of expansions may be calculated so that the appearance frequency is lower than the reference value. In this way, it is possible to apparently eliminate the attribute value with a prominent appearance frequency.

  Further, the third process described above may include a process of calculating an appearance probability for each of the second attribute values in accordance with the number of expansions and storing the probability of association in the second data storage unit. In that case, in the fourth process described above, the attribute value for the specific attribute item in the plurality of records is changed to any one of the plurality of second attribute values according to the correspondence and the appearance probability. You may make it convert. By setting the appearance probability, the second attribute value can be selected flexibly. For example, by changing the appearance probability so that the appearance frequency fluctuates in a natural manner, the conversion of the distribution can be made difficult to understand by a third party.

  Furthermore, in the first aspect of the present embodiment, a process of transmitting a plurality of records after the first process to the computer that performs the aggregation process may be further included. As described above, the computer that performs the totaling process can perform the totaling process on the data obtained from various devices.

  The restoration processing method according to the second aspect of the present embodiment includes: (A) a plurality of second attributes according to a predetermined rule from a first attribute value that appears for a first attribute item in a plurality of records to be counted. A first result for generating an attribute value; and (B) a total result including a count value for each attribute value of the second attribute item or a total value of the attribute values for each of the third attribute values that appear for the first attribute item. In each of the plurality of second attribute values, it is determined whether there is a third attribute value that matches the second attribute value, and if it exists, it corresponds to the third attribute value The count value for each attribute value of the attached second attribute item or the total value of the attribute values is read from the first data storage unit, and accumulated for each attribute value of the second attribute item, or the second attribute The attribute value of the item is accumulated and the accumulated result is the second attribute. And a second process of storing the second data storage unit in association with. In this way, even when the attribute value of a specific attribute item is divided into a plurality of attribute values, the original aggregation result can be restored by aggregating the results.

  The first process described above is a process of expanding the first attribute value into a plurality of fourth attribute values according to a predetermined second rule, and encrypts each of the plurality of fourth attribute values. Thus, a process of generating a plurality of second attribute values may be included.

  It is possible to create a program for causing a computer to carry out the processing described above, such as a flexible disk, an optical disk such as a CD-ROM, a magneto-optical disk, and a semiconductor memory (for example, ROM). Or a computer-readable storage medium such as a hard disk or a storage device. Note that data being processed is temporarily stored in a storage device such as a RAM.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Appendix 1)
A plurality of records stored in the first data storage unit and having attribute values for each of the plurality of attribute items, the first of the appearance frequency of the attribute value appearing for a specific attribute item among the plurality of attribute items A first process for detecting a distribution;
Each of at least some of the attribute values is specified according to a predetermined first rule so that the first distribution becomes a second distribution different from the first distribution. A second process for converting into any of a plurality of second attribute values;
Is a conversion processing program for causing a computer to execute.

(Appendix 2)
The second process includes
An attribute value having a bias greater than or equal to a predetermined reference in the first distribution of the appearance frequency of the attribute value is developed into a plurality of second attribute values according to a predetermined second rule, and has a bias greater than or equal to the predetermined reference A third process for storing a correspondence relationship between an attribute value and the plurality of second attribute values in a second data storage unit;
In accordance with the correspondence relationship stored in the second data storage unit, an attribute value for the specific attribute item in the plurality of records is changed to any one of the plurality of second attribute values. A fourth process to convert;
A conversion processing program according to appendix 1, including:

(Appendix 3)
The second process includes
The conversion processing program according to supplementary note 2, further comprising: a fifth process for encrypting the second attribute value for the specific attribute item in the plurality of records.

(Appendix 4)
The third process includes
Of the attribute values that appear for the specific attribute item, for the attribute value whose appearance frequency exceeds the reference value, calculate the number of expansions based on the appearance frequency of the attribute value and the reference value,
The conversion processing program according to appendix 2 or 3, including a process of generating the second attribute value of the number of expansions for an attribute value whose appearance frequency exceeds a reference value according to the second rule.

(Appendix 5)
The third process includes
A process of calculating an appearance probability for each of the second attribute values according to the number of expansions, and storing it in the second data storage unit in association with the correspondence relationship;
In the fourth process, an attribute value for the specific attribute item in the plurality of records is converted into a second attribute value of any of the plurality of second attribute values according to the correspondence relationship and the appearance probability. The conversion processing program according to attachment 4.

(Appendix 6)
The conversion processing program according to any one of appendices 1 to 5 for causing the computer to further execute a process of transmitting the plurality of records after the first process to the computer that performs the aggregation process.

(Appendix 7)
A first process for generating a plurality of second attribute values according to a predetermined rule from a first attribute value that appears for a first attribute item in a plurality of records to be counted;
In the first data storage unit for storing a count result for each attribute value of the second attribute item or a total result of the attribute values for each of the third attribute values that appear for the first attribute item, the plurality of For each of the second attribute values, it is determined whether there is a third attribute value that matches the second attribute value. If there is, the second attribute value associated with the third attribute value is determined. The count value for each attribute value or the total value of the attribute values is read from the first data storage unit, accumulated for each attribute value of the second attribute item, or the attribute value of the second attribute item is accumulated, and accumulated A second process for storing the result in the second data storage unit in association with the second attribute value;
Is a restoration processing program for causing a computer to execute.

(Appendix 8)
The first process includes
A process of expanding the first attribute value into a plurality of fourth attribute values according to a predetermined second rule;
A process of generating the plurality of second attribute values by encrypting each of the plurality of fourth attribute values;
The restoration processing program according to appendix 7, including:

(Appendix 9)
A plurality of records stored in the first data storage unit and having attribute values for each of the plurality of attribute items, the first of the appearance frequency of the attribute value appearing for a specific attribute item among the plurality of attribute items A first process for detecting a distribution;
Each of at least some of the attribute values is specified according to a predetermined first rule so that the first distribution becomes a second distribution different from the first distribution. A second process for converting into any of a plurality of second attribute values;
A conversion processing method executed by a computer.

(Appendix 10)
A first process for generating a plurality of second attribute values according to a predetermined rule from a first attribute value that appears for a first attribute item in a plurality of records to be counted;
In the first data storage unit for storing a count result for each attribute value of the second attribute item or a total result of the attribute values for each of the third attribute values that appear for the first attribute item, the plurality of For each of the second attribute values, it is determined whether there is a third attribute value that matches the second attribute value. If there is, the second attribute value associated with the third attribute value is determined. The count value for each attribute value or the total value of the attribute values is read from the first data storage unit, accumulated for each attribute value of the second attribute item, or the attribute value of the second attribute item is accumulated, and accumulated A second process for storing the result in the second data storage unit in association with the second attribute value;
A restoration processing method executed by the computer.

(Appendix 11)
A plurality of records stored in the first data storage unit and having attribute values for each of the plurality of attribute items, the first of the appearance frequency of the attribute value appearing for a specific attribute item among the plurality of attribute items A distribution detector for detecting the distribution;
Each of at least some of the attribute values is specified according to a predetermined first rule so that the first distribution becomes a second distribution different from the first distribution. A conversion processing unit for converting into any of a plurality of second attribute values;
An information processing apparatus.

(Appendix 12)
An attribute value generation unit that generates a plurality of second attribute values according to a predetermined rule from a first attribute value that appears for a first attribute item in a plurality of records to be counted;
In the first data storage unit for storing a count result for each attribute value of the second attribute item or a total result of the attribute values for each of the third attribute values that appear for the first attribute item, the plurality of For each of the second attribute values, it is determined whether there is a third attribute value that matches the second attribute value. If there is, the second attribute value associated with the third attribute value is determined. The count value for each attribute value or the total value of the attribute values is read from the first data storage unit, accumulated for each attribute value of the second attribute item, or the attribute value of the second attribute item is accumulated, and accumulated A restoration processing unit that stores a result in the second data storage unit in association with the second attribute value;
An information processing apparatus.

101 Provided Data Storage Unit 102 Distribution Detection Unit 103 Distribution Data Storage Unit 104 Distribution Conversion Data Generation Unit 105 Rule Storage Unit 106 Distribution Conversion Data Storage Unit 107 Conversion Processing Unit 108 Converted Data Storage Unit 109 Encryption Processing Unit 110 Key Storage Unit 111 Encrypted data storage unit 112 Transmission unit 121 Total request processing unit 122 Total result storage unit 123 Restoration processing unit 124 Attribute value generation unit 125 Attribute value storage unit 126 Restoration total result storage unit

Claims (12)

A plurality of records stored in the first data storage unit and having attribute values for each of the plurality of attribute items, the first of the appearance frequency of the attribute value appearing for a specific attribute item among the plurality of attribute items A first process for detecting a distribution;
Each of at least some of the attribute values is specified according to a predetermined first rule so that the first distribution becomes a second distribution different from the first distribution. A second process for converting into any of a plurality of second attribute values;
Is a conversion processing program for causing a computer to execute. The second process includes
An attribute value having a bias greater than or equal to a predetermined reference in the first distribution of the appearance frequency of the attribute value is developed into a plurality of second attribute values according to a predetermined second rule, and has a bias greater than or equal to the predetermined reference A third process for storing a correspondence relationship between an attribute value and the plurality of second attribute values in a second data storage unit;
In accordance with the correspondence relationship stored in the second data storage unit, an attribute value for the specific attribute item in the plurality of records is changed to any one of the plurality of second attribute values. A fourth process to convert;
The conversion processing program according to claim 1 including: The second process includes
The conversion processing program according to claim 2, further comprising: a fifth process for encrypting the second attribute value for the specific attribute item in the plurality of records. The third process includes
Of the attribute values that appear for the specific attribute item, for the attribute value whose appearance frequency exceeds the reference value, calculate the number of expansions based on the appearance frequency of the attribute value and the reference value,
4. The conversion processing program according to claim 2, further comprising: generating a second attribute value of the number of expansions for an attribute value whose appearance frequency exceeds a reference value according to the second rule. 5. The third process includes
A process of calculating an appearance probability for each of the second attribute values according to the number of expansions, and storing it in the second data storage unit in association with the correspondence relationship;
In the fourth process, an attribute value for the specific attribute item in the plurality of records is converted into a second attribute value of any of the plurality of second attribute values according to the correspondence relationship and the appearance probability. The conversion processing program according to claim 4. The conversion processing program according to any one of claims 1 to 5, further causing the computer to execute a process of transmitting the plurality of records after the first process to a computer that performs an aggregation process. A first process for generating a plurality of second attribute values according to a predetermined rule from a first attribute value that appears for a first attribute item in a plurality of records to be counted;
In the first data storage unit for storing a count result for each attribute value of the second attribute item or a total result of the attribute values for each of the third attribute values that appear for the first attribute item, the plurality of For each of the second attribute values, it is determined whether there is a third attribute value that matches the second attribute value. If there is, the second attribute value associated with the third attribute value is determined. The count value for each attribute value or the total value of the attribute values is read from the first data storage unit, accumulated for each attribute value of the second attribute item, or the attribute value of the second attribute item is accumulated, and accumulated A second process for storing the result in the second data storage unit in association with the second attribute value;
Is a restoration processing program for causing a computer to execute. The first process includes
A process of expanding the first attribute value into a plurality of fourth attribute values according to a predetermined second rule;
A process of generating the plurality of second attribute values by encrypting each of the plurality of fourth attribute values;
The restoration processing program according to claim 7 including: A plurality of records stored in the first data storage unit and having attribute values for each of the plurality of attribute items, the first of the appearance frequency of the attribute value appearing for a specific attribute item among the plurality of attribute items A first process for detecting a distribution;
Each of at least some of the attribute values is specified according to a predetermined first rule so that the first distribution becomes a second distribution different from the first distribution. A second process for converting into any of a plurality of second attribute values;
A conversion processing method executed by a computer. A first process for generating a plurality of second attribute values according to a predetermined rule from a first attribute value that appears for a first attribute item in a plurality of records to be counted;
In the first data storage unit for storing a count result for each attribute value of the second attribute item or a total result of the attribute values for each of the third attribute values that appear for the first attribute item, the plurality of For each of the second attribute values, it is determined whether there is a third attribute value that matches the second attribute value. If there is, the second attribute value associated with the third attribute value is determined. The count value for each attribute value or the total value of the attribute values is read from the first data storage unit, accumulated for each attribute value of the second attribute item, or the attribute value of the second attribute item is accumulated, and accumulated A second process for storing the result in the second data storage unit in association with the second attribute value;
A restoration processing method executed by the computer. A plurality of records stored in the first data storage unit and having attribute values for each of the plurality of attribute items, the first of the appearance frequency of the attribute value appearing for a specific attribute item among the plurality of attribute items A distribution detector for detecting the distribution;
Each of at least some of the attribute values is specified according to a predetermined first rule so that the first distribution becomes a second distribution different from the first distribution. A conversion processing unit for converting into any of a plurality of second attribute values;
An information processing apparatus. An attribute value generation unit that generates a plurality of second attribute values according to a predetermined rule from a first attribute value that appears for a first attribute item in a plurality of records to be counted;
In the first data storage unit for storing a count result for each attribute value of the second attribute item or a total result of the attribute values for each of the third attribute values that appear for the first attribute item, the plurality of For each of the second attribute values, it is determined whether there is a third attribute value that matches the second attribute value. If there is, the second attribute value associated with the third attribute value is determined. The count value for each attribute value or the total value of the attribute values is read from the first data storage unit, accumulated for each attribute value of the second attribute item, or the attribute value of the second attribute item is accumulated, and accumulated A restoration processing unit that stores a result in the second data storage unit in association with the second attribute value;
An information processing apparatus.

Images