JP2014153944A - Information processing apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique which discloses sufficiently anonymized information of an individual in an auction form and enables the information to be used for an information distribution from a successful bidder to the individual.SOLUTION: An information processing apparatus acquires object data including a plurality of items corresponding to individuals, generates abstraction candidate data by changing a word which is a value of an item in the object data to an abstracted word, receives worth of a word included in the abstraction candidate data and obtains worth of the abstraction candidate data on the basis of the worth of the word, examines on condition that a combination of the values of the items of the abstraction candidate data is not limited to an individual of the object data, discloses the abstraction candidate data selected on the basis of the worth of the abstraction candidate data which satisfies the condition of the examination as anonymous information of a bid object, receives bid conditions to distribute distribution information to each of individuals for the anonymous information, determines a successful bid on the basis of the bid conditions of the bid data, and distributes the distribution information to each of individuals corresponding to the anonymous information of the successful bid.

Description

  The present invention relates to a technique for using personal information by making it anonymous or diversified.

  With the development of information processing technology, information is collected in many everyday situations, and processing using the collected information is performed. For example, when a consumer purchases a product as a member of a store, the consumer's name, age, gender, address, e-mail address, etc. are often registered at the time of membership registration. When a consumer purchases a product, the store-side system records the consumer and the purchased product information in association with each other. By accumulating and analyzing information on purchased products in this way, it is possible to estimate the consumer's preferences and perform a service such as sending a direct mail when a new product preferred by the consumer is released. it can. Furthermore, by analyzing information on many consumers, classified consumer information such as products preferred by women in their 20s and products preferred in the Kanto area can be derived and used for marketing and the like.

  Such information has high utility value not only for the store but also for the manufacturer of the product and other companies, and there has been a demand to use it for recommendations such as advertisements and coupons.

  However, it is impossible to provide (secondary use) the personal information of the consumer in the store to each other without obtaining the consent of each consumer. Similarly, there is a request to use information (medical information) when a user has received medical care at a medical institution, etc., but providing medical information, which is also sensitive information, to another person without obtaining permission from each user. I can't.

  For this reason, a system has been proposed in which information collected from individuals is anonymized and provided to other businesses and the like, and advertisements from other businesses are mediated to each individual. For example, in Japanese Patent Laid-Open No. 2005-346248 (Patent Document 1), anonymized personal information is provided to a registered business operator by excluding a name from medical information (personal identification information and diagnosis result information). In addition, an information mediating apparatus that accepts an advertisement mail for the anonymized personal information from a registered company and forwards the advertisement mail to each individual mail address corresponding to the anonymized personal information has been proposed.

  In addition, there has also been proposed an apparatus that enables exhibitors and successful bidders to trade anonymously when exchanging electronic values in an auction format (Patent Document 2).

JP 2005-346248 A JP 2003-316974 A

  The system of Patent Document 1 performs anonymization by excluding a name and the like, but anonymization may be insufficient by simply hiding the name.

  For example, if the age and disease name data is 25 years old and there is only one person with the disease name X, the person can be identified when he / she knows that the 25-year-old acquaintance is the user with the disease name X become. That is, if there is only one person with the attribute of disease name X at the age of 25, there is a high possibility that an individual can be identified by comparing with other information.

  Therefore, if the age description in the user data is abstracted into 10-year breaks and there are multiple people with the same attribute, such as three people with a disease name X in their 20s, whoever of the three It becomes impossible to specify whether or not. A state in which there are k or more people having the same attribute in this way is referred to as “k-anonymity” and processing such data is referred to as “k-anonymization”.

  In conventional anonymization devices, when abstracting the value of each item to satisfy k-anonymity, data is simply separated so that the same attribute value becomes multiple, so even if anonymity is satisfied Sometimes it becomes worthless data. For example, when data is used to study growth, the age item is important, and if the age item is too abstract for anonymization, the utility value is lost. In this case, the operator specifies the priority of the items to be abstracted, reduces the abstraction of the items of age, and satisfies the k-anonymity by abstracting items other than the age. For anonymization, if the age item is divided into 17 years old or older and less than 22 years old, adults and minors may be mixed in the same group, and high school students and adults may be mixed. Depending on the situation, it will be worthless data. In this case, the operator specifies the age item separator according to the purpose of use, and abstracts other items so as to satisfy anonymity.

  As described above, when k-anonymization is performed by a conventional anonymization apparatus, there are many occasions that require an operator's judgment, which is not practical.

  Therefore, personal information is mechanically anonymized with a conventional device and output to the outside, and in systems used for other companies, anonymization that satisfies k-anonymity cannot be performed, and sufficient anonymization is not possible. It was not done.

  In addition, an apparatus for exchanging the electronic value of Patent Document 2 in an auction format (hereinafter referred to as an exchange apparatus) simply hides the names and addresses of exhibitors, successful bidders, etc. An exchange device receives an electronic ticket or electronic money from a user and relays it to the other user, and does not abstract personal information. That is, the exchange apparatus of patent document 2 ensures a user's anonymity, and does not trade anonymous information.

  Therefore, the present invention provides a technique for disclosing sufficiently anonymized personal information in an auction format and making it available for information distribution from the successful bidder to the individual.

In order to solve the above problems, an information processing apparatus of the present invention provides:
A data receiving unit for acquiring target data including a plurality of items associated with an individual;
An abstraction unit that generates abstraction candidate data by replacing a word that is a value of an item in the target data with an abstracted word;
A value determination unit that receives the value of the word included in the abstraction candidate data and obtains the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
A test unit that tests on condition that a combination of values of items of the abstraction candidate data is not limited to one individual of the target data;
A public part that publishes abstract candidate data selected based on the value of the abstract candidate data that satisfies the test condition as anonymous information for bidding;
A bid accepting unit for receiving bid conditions for distributing distribution information to each individual for the anonymous information;
A successful bid determination unit for determining a successful bid based on the bid conditions of the bid data;
A distribution unit that distributes the distribution information to each individual corresponding to the anonymous information that has been awarded;
Is provided.

In order to solve the above-mentioned problem, an information processing method according to the present invention includes:
Obtaining target data including a plurality of items associated with an individual;
Generating abstract candidate data by replacing words that are values of items in the target data with abstract words;
Receiving the value of the word included in the abstraction candidate data, and determining the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
Testing a condition that a combination of values of the abstraction candidate data items is not limited to one individual of the target data;
Publishing abstraction candidate data selected based on the value of the abstraction candidate data satisfying the test condition as anonymous information of a bid object;
Receiving bid conditions for distributing distribution information to each individual for the anonymous information;
Determining a successful bid based on bid conditions of the bid data;
Distributing the distribution information to each individual corresponding to the bid anonymous information;
Is executed by the computer.

  The present invention may be a program for causing a computer to execute the above method. Furthermore, the program may be recorded on a computer-readable recording medium.

  Here, the computer-readable recording medium refers to a recording medium that accumulates information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read from the computer. . Examples of such a recording medium that can be removed from the computer include a flexible disk, a magneto-optical disk, a CD-ROM, a CD-R / W, a DVD, a DAT, an 8 mm tape, and a memory card.

  Further, there are a hard disk, a ROM (read only memory), and the like as a recording medium fixed to the computer.

  The present invention can provide a technique for disclosing sufficiently anonymized personal information in an auction format and making it available for information distribution from the successful bidder to the individual.

FIG. 1 is an explanatory diagram of anonymization processing. FIG. 2 is a functional block diagram of the information processing system. FIG. 3 is a diagram illustrating a hardware configuration of the store information server. FIG. 4 is a diagram illustrating an example of the shopping information DB. FIG. 5 is a diagram illustrating an example of the anonymous information DB. FIG. 6 is a schematic configuration diagram of the anonymous value evaluation system. FIG. 7 is a diagram showing an example of the search information storage DB. FIG. 8 is a diagram showing an example of a part of the age item in the target data. FIG. 9 is a diagram showing an example of value data acquired from the search information storage DB for age. FIG. 10 shows the value of the age item. FIG. 11 shows the value of the age item. FIG. 12 is a diagram illustrating an example of a part of the age item in the abstraction candidate. FIG. 13 is a diagram showing an example of value data of each word acquired for the age. FIG. 14 is a diagram showing the value of the item of the age. FIG. 15 is a diagram showing the value of the item of the age. FIG. 16 is a schematic configuration diagram of a distribution information management system. FIG. 17 is a diagram illustrating an example of an auction DB. FIG. 18 is a diagram illustrating an example of a moral DB. FIG. 19 is an explanatory diagram of anonymization processing by the information processing system. FIG. 20 is an explanatory diagram of candidate patterns. FIG. 21 is an explanatory diagram of processing in which the information processing system outputs distribution information to the user. FIG. 22 is an explanatory diagram of processing in which the information processing system outputs distribution information to the user. FIG. 23 is a functional block diagram of the information processing system according to the second embodiment. FIG. 24 is a hardware configuration diagram of the information processing system. FIG. 25 is a diagram illustrating an example of a user information DB according to the second embodiment. FIG. 26 is a functional block diagram of the information processing system according to the third embodiment. FIG. 27 is a diagram illustrating an example of the user information DB according to the third embodiment. FIG. 28 is a functional block diagram of the information processing system according to the third embodiment. FIG. 29 is a diagram illustrating an example of the user information DB according to the third embodiment.

Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. The configuration of the following embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.
<Embodiment 1>
FIG. 1 is an explanatory diagram of anonymization processing, and FIG. 2 is a functional block diagram of the information processing system.

  FIG. 1A shows an example in which the last name item is deleted from the member information including the last name, age, and gender items. As shown in Fig. 1 (A), if there is only one 16-year-old woman in the member information in which the age is described, when the 16-year-old woman is found to be this member, the person is identified. it can. That is, if there is only one person with the attribute of 16 years old and female, there is a possibility that an individual can be identified by comparing with other information.

  In FIG. 1 (B), the description of the age in the member list is abstracted and classified by age, such as 0's (under 10 years), 10's, and 20's. However, even in this case, there is only one female teenager, and an individual can be identified as in FIG. 1A, which is insufficient for anonymization.

  Therefore, in FIG. 1 (C), it was further abstracted and the age divisions were changed to those in their teens (under 19 years old) and those in their 20s. In the case of FIG. 1C, there are two women in their teens or less, and the attributes of “10 or less” and [female] are not single. For this reason, even if it turns out that a 16-year-old woman is this member as mentioned above, it cannot be specified which is the data of the 16-year-old woman. A state in which there are k or more people having the same attribute in this way is referred to as “k-anonymity” and processing such data is referred to as “k-anonymization”.

  As illustrated in FIG. 2, the information processing system 100 includes a store system 10, an anonymous value evaluation system 20, and a distribution information management system 30. The store system 10 is a system that is provided in a store that sells goods and provides services, and manages information (personal information) of a person who purchases the goods and services (hereinafter also referred to as a user). The anonymous value evaluation system 20 is a system that calculates the value of an abstracted word based on the keyword statistical information used for the search by the search engine 40 and calculates the value of anonymous information composed of the abstracted word. is there. The distribution information management system 30 publishes anonymous information as a bid object to other business operators (distributor information sender), determines the winning bidder based on the bidding conditions, and from the successful bidder to the user corresponding to the anonymous information. It is a system that mediates distribution information.

  The information processing system 100 according to the first exemplary embodiment acquires the value when the store system 10 abstracts shopping information and sets a plurality of abstraction candidate data (hereinafter simply referred to as abstraction candidates) from the anonymous value evaluation system 20. Then, the abstraction candidate selected based on the value after the abstraction is set as anonymous information, and the distribution information management system 30 discloses the anonymous information as a bid object and performs an auction. And the delivery information management system 30 determines a successful bidder based on the bid conditions received from the other terminals 50, and delivers the delivery information by the successful bidder to each individual corresponding to the anonymous information.

  As described above, the information processing system 100 according to the first embodiment abstracts shopping information. For example, a woman who purchased a detergent, a woman in his 30s who bought ingredients for cooking pots, a man who passed one month after buying a body soap A bid for anonymous information including an attribute value is accepted, and a successful bidder is determined based on the accepted bid conditions. Then, the information processing system 100 distributes information targeting the users having the attribute information, for example, advertisements for cleaning tools for users who have purchased detergent, and recipes for hot pot dishes for users who have purchased ingredients for hot pot dishes. Then, distribution information such as a coupon for newly released body soap is received from a successful bidder for a user who has purchased a body soap for one month, and is distributed to a user having the attribute information. That is, the information processing system 100 publishes sufficiently anonymized shopping information (user personal information) in an auction format so that it can be used for information distribution from the successful bidder to the user.

  The store system 10 manages the cash register 101 for paying out the products purchased by the user, the input / output terminal 102 for inputting / outputting user-related information such as user membership registration, the cash register 101, etc. The store information server 103 is provided.

  The cash register 101 displays a reading device that reads information on a product purchased by a user, a printer that prints a receipt describing a settlement amount, an input unit such as a keyboard, an accounting amount, etc. It is also an information processing device including a display device.

  The store information server 103 includes functional units such as a shopping information DB (database) 19, an anonymous information DB 18, a data update unit 15, a data reception unit 16, and an output control unit 17.

  The data reception unit 16 reads target data including a plurality of items associated with an individual from the shopping information DB 19 and stores it in the anonymous information DB 18.

  The data update unit 15 updates the value of each item of the target data (personal information) stored in the anonymous information DB 18 to a value that is abstracted based on an abstraction candidate described later, thereby making the target data anonymous information. .

  The output control unit 17 causes the distribution information received from the distribution information management system 30 to be output to the user. Here, output of distribution information includes display output by a display device, print output by a printer, transmission to another device, writing to a storage medium, and the like. For example, the output control unit 17 transmits the distribution information to the cash register 101 and causes the printer of the cash register 101 to print the distribution information on a receipt. In the present embodiment, the output control unit 17 is a form of a distribution unit that distributes distribution information to a user (individual).

  The output to the user is not limited to this, and display output to the display device of the cash register 101 or transmission of an e-mail to the mail address of the user may be used. Further, the output to the user is not limited to outputting only to the user as long as the user can receive the distribution information, and may be output to an unspecified person including the user.

  For example, the user's membership information is displayed in the cash register 101 at the time of accounting, such as displaying and outputting an advertisement with a digital signage installed on a wall while the purchased product is being packed in a bag after the user has settled in the supermarket. May then be output by digital signage at a predetermined location or timing where the user is estimated to be present. The distribution information may be data in a format that can be output by the above output method, and may be, for example, text, an image, a moving image, sound data, or the like.

  The shopping information DB 19 stores shopping information of each user input by the cash register 101. For this shopping information, for example, the reading device of the cash register 101 reads the identification information (user ID) of the user's membership card or the identification information (for example, JAN code) attached to the product as a bar code at the time of payment. It is the information which shows the log | history of the purchased purchased goods matched. The shopping information in the shopping information DB 19 is read by the data reception unit 16 as anonymization target data.

  The anonymous information DB 18 receives personal information (target data), and the data update unit 15 rewrites the value of each item of the target data to an abstracted value based on the abstraction candidate and holds it as anonymous information. The anonymous information DB 18 retains destination information such as an e-mail address and a FAX number in the personal information in association with the anonymous information so that the output control unit 17 can read it as a delivery destination of the delivery information. Also good.

  The anonymous value evaluation system 20 includes an abstraction unit 11, a test unit 13, a selection unit 14, a value data acquisition unit 21, a value determination unit 22, a word category analysis unit 23, a value calculation unit 24, a search information storage DB 25, and the like. It has a functional part.

  When the target data is anonymized or diversified, the abstraction unit 11 generates abstract candidates by replacing words (words) that are values of items in the target data with abstracted words. In this embodiment, a word (word) is a group of words such as a word or a phrase, a numerical value such as location information or a telephone number, identification information such as an e-mail address or an IP address, a symbol having the same meaning as the word, or the like. May be included.

  The test unit 13 does not limit the combination of the item values of the abstraction candidate data to one individual of the target data. That is, the combination of the value of the item corresponding to one individual of the abstraction candidate is a single candidate among the abstraction candidates. It is tested on the condition that it is not. For example, the test unit 13 tests whether the abstraction candidate satisfies k-anonymity.

  The selection unit 14 selects an abstraction candidate based on the value calculated by the anonymous value evaluation system 20 for the abstraction candidate that satisfies the test condition. For example, the selection unit 14 selects a predetermined number of abstraction candidates in descending order of value from a plurality of abstraction candidates that satisfy k-anonymity.

  The value data acquisition unit 21 acquires (receives) word value data included in the abstraction candidate from the search information storage DB. In addition, when the value data of the word is not registered in the search information storage DB 25, the value data acquisition unit 21 makes a request to another device, for example, the search engine 40, and registers the acquired value data in the search information storage DB 25. It has a function (data request) and a function (data crawler) that periodically visits other devices to acquire the latest value data and updates the value data registered in the search information storage DB 25.

In this embodiment, the statistical information of each word is received from the search engine 40 as this value data. Here, the statistical information of each word includes, for example, an SEM (Search Engine Marketing) advertising unit price (CPC unit price), a click rate, an average ranking, the number of display times per day, the number of clicks per day, and the like. Note that the value acquisition destination is not limited to a search engine, and may be a web page, an SNS, or the like. In this case, for example, the use frequency of each word in a web page or SNS may be used as the value.

  The value determination unit 22 obtains the value of the abstraction candidate based on the value of the word included in the abstraction candidate, and notifies the store information server 103 of the value.

  The word category analysis unit 23 analyzes data on a website or the like, obtains a new word or a word (category) obtained by abstracting the word, and registers it in the search information accumulation DB.

  Based on the value of the word acquired by the value data acquisition unit 21, the value calculation unit 24 obtains statistical information on the value of the word such as an annual average, a monthly average, and a weekly average of the word value.

  The search information storage DB 25 stores the value of the word acquired by the value data acquisition unit 21, information of the word and category obtained by the word category analysis unit 23, statistical information of the value obtained by the value calculation unit 24, and the like.

  The distribution information management system 30 includes an anonymous data output unit 31, a distribution data reception unit (distribution information reception unit) 32, and a moral DB 33.

  The anonymous data output unit 31 reads anonymous information from the anonymous information DB 18 of the store information server 103 and transmits it to the terminal 50 of another business operator. Here, the transmission to the terminal 50 may be one that transmits an e-mail or the like to the address of each terminal 50, or may provide anonymous information as a web page.

  For example, when an information condition requested by another business operator (hereinafter also referred to as a request condition) is received from the terminal 50, the anonymous data output unit 31 conforms to the request condition and conflicts with the moral of the moral DB 33. The anonymous information that is not read is read from the anonymous information DB 18 and transmitted by e-mail or the like.

  Further, the anonymous data output unit 31 may return, as a response, a web page in which anonymous information is described, that is, a file described in HTML or the like, in response to a browsing request from the terminal 50.

  The distribution data reception unit 32 receives distribution information for a specific attribute value of the anonymous information from the terminal 50 of another business operator, and transmits this distribution information to the store information server 103.

  In FIG. 2, a search engine 40 is a site (computer) that provides a search function for information existing on a network such as the Internet. That is, when the search engine 40 receives a keyword to be searched from the user terminal, the search engine 40 provides a list such as a URL of a web page including the keyword as a search result, and displays the list on the user terminal.

  In addition, the search engine 40 uses this search function to display an advertisement linked to a keyword in a search result, or to display a link to a sponsor site that has paid an advertisement fee according to the keyword. This advertisement fee is determined by, for example, presenting the value of each keyword (statistical information of each word) and bidding for each keyword (advertisement auction). For this reason, the search engine 40 performs the number of searches per day (display count), the number of clicks on the search result advertisement (clicks), the advertising fee per click (cost per click), etc. Are stored as word statistics.

  Also, based on this information, the search engine 40 determines the click rate obtained by dividing the number of times of display by the number of clicks, the value obtained by multiplying the number of clicks per day by the cost per click (cost per day), the time of application for advertisement (advertisement) Also ask for the ranking of the advertisement according to the cost presented at the time of the auction.

  The search engine 40 provides the anonymous value evaluation system 20 with the data output unit 41 that provides information such as the number of clicks, the number of display times, the ranking, the cost of the day, the click rate, the cost per click, and the information about these words. A search word storage DB 42 for storing is provided.

  FIG. 3 is a diagram illustrating a hardware configuration of the store information server 103. The store information server 103 is a so-called information processing device (computer) having an arithmetic processing unit 1, a communication control unit 3, a storage device 4, and an input / output interface 5.

  The arithmetic processing unit 1 includes a CPU and a main memory, and the CPU executes a program expanded in an executable manner in the main memory, so that the data updating unit 15, the data receiving unit 16, and the output control unit 17 described above are executed. Provide functionality.

  The main memory can also be called a main storage device. The main memory stores, for example, a program executed by the CPU, data received via the communication control unit 3, data read from the storage device 4, and other data.

  The communication control unit 3 is connected to another device, for example, the cash register 101 or the input / output terminal 102 via the network, and controls communication with the device.

  The input / output interface 5 is appropriately connected to output means such as a display device and a printer, input means such as a keyboard and pointing device, and input / output means such as a drive device. The drive device is a removable storage medium read / write device, such as an input / output device for a flash memory card, a USB adapter for connecting a USB memory, or the like. The removable storage medium may be a disk medium such as a CD (Compact Disc), a DVD (Digital Versatile Disk), or a Blu-ray Disc. The drive device reads the program from the removable storage medium and stores it in the storage device 4.

The storage device 4 can also be called an external storage device (auxiliary storage device). The storage device 4 may be an SSD (Solid State Drive), an HDD, or the like. The storage device 4 exchanges data with the drive device. For example, the storage device 4 stores an information processing program installed from the drive device. In the storage device 4, the program and data are read by the arithmetic processing unit 1 and delivered to the main memory. In the present embodiment, the storage device 4 stores the shopping information DB 19 and the anonymous information DB 18 described above.

  Note that the basic hardware configuration of the cache register 101 is the same as that in FIG. 3, and the cache register 101 is an information processing apparatus having an arithmetic processing unit, a communication control unit, a storage device, and an input / output interface.

  For example, in the cash register 101, a member card or a barcode reading device of a product is connected to the input / output interface, and an arithmetic processing unit controls the reading device to read user identification information from the member card or the product, and a communication control unit Is sent to the store information server 103 and stored in the shopping information DB 19.

The cash register 101 is connected to a printer with an input / output interface, and outputs a receipt on which the amount of purchased merchandise is printed. The cash register 101 may print out the distribution information on the receipt. Further, the cash register 101 may be connected to a display device to the input / output interface and display and output distribution information on the display device.

  FIG. 4 is a diagram illustrating an example of the shopping information DB 19. The shopping information DB 19 of FIG. 4 stores items of user ID, name, age, sex, mail address (distribution destination), and purchase history in association with each other as shopping information.

  The user ID is information that uniquely identifies the user. Since the user ID is a bar code that can be read by the reading device of the cash register 101, it is a user-specific number in this example. However, any user ID can be used as long as it is information that can identify each user. It may be used.

  The mail address is information indicating a distribution destination of distribution information, and may be a telephone number or an address.

  The purchase history is history information in which the name of a product purchased in the past is recorded together with the price and the purchase date, and FIG. 4 shows the purchase history for the latest three times. It should be noted that the medical history may be one in which the entire history is recorded, or a part of history (for example, history for a predetermined period) may be extracted. Further, the purchase history may include the name of the purchase store, the color, size, quantity, etc. of the product.

  FIG. 5 is a diagram illustrating an example of the anonymous information DB 18, FIG. 5A is a diagram illustrating an example immediately after the target data is written, and FIG. 5B is a diagram illustrating an example after anonymization. As shown in FIG. 5B, the anonymous information DB 18 stores gender, age group, and purchase history as anonymous information in association with the user ID and the safety category. Here, the safety category is information indicating that anonymity is satisfied among the categories described later.

  FIG. 6 is a schematic configuration diagram of the anonymous value evaluation system 20. The anonymous value evaluation system 20 is a so-called information processing apparatus (computer) including an arithmetic processing unit 201, a communication control unit 203, a storage device 204, and an input / output interface 205.

  The arithmetic processing unit 201 includes a CPU and a main memory, and the CPU executes a program expanded in an executable manner in the main memory, so that the abstraction unit 11, the test unit 13, the selection unit 14, and the value data described above are executed. The function of the acquisition part 21, the value determination part 22, the word category analysis part 23, and the value calculation part 24 is provided.

  The main memory can also be called a main storage device. The main memory stores, for example, programs executed by the CPU, data received via the communication control unit 203, data read from the storage device 204, and other data.

  The communication control unit 203 is connected to another device such as the store information server 103 via the network, and controls communication with the device.

  The input / output interface 205 is appropriately connected to output means such as a display device and a printer, input means such as a keyboard and pointing device, and input / output means such as a drive device.

The storage device 204 can also be called an external storage device (auxiliary storage device). The storage device 204 may be an SSD (Solid State Drive), an HDD, or the like. Storage device 204
Transmits and receives data to and from the drive device. For example, the storage device 204 stores an information processing program installed from the drive device. When the storage device 4 receives a program read command, the storage device 4 delivers the program to the memory.

  Further, the storage device 204 of the present embodiment stores a search information accumulation DB 25.

FIG. 7 is a diagram illustrating an example of the search information accumulation DB 25. The search information accumulation DB 25 stores the word acquired from the search engine 40 and its price (unit price) in association with each other as value data. Based on the value data of each word, the value of each abstraction candidate is calculated,
Next, the value of data in the present embodiment will be described with reference to FIGS. FIG. 8 is a diagram showing an example of a part of the age item in the target data. As shown in FIG. 8, the target data has the number of people ci for each age si. For example, the number of people (c1) at the age of 18 (s1) is 30, and the number of people (c2) at the age of 19 (s2) is 10.

  FIG. 9 shows an example of value data acquired from the search information storage DB 25 for the age si. The value data in FIG. 9 has a SEM unit price ei for each age si. Here, the SEM unit price ei is a price that the search engine 40 presents for SEM such as an advertisement auction.

The value of this age si is a value obtained by multiplying the SEM unit price ei by the number of people ci, and is represented by Equation 1.
si = ci × ei (Formula 1)
As shown in FIG. 10, the value of the age item S (e) is the total of each age si, and is expressed by Equation 2. In FIG. 10, n is 5. Therefore, the value of the age item S (e) is 2446 yen as shown in FIG. The value of the target data is the sum of the values of all items in the target data.

  On the other hand, FIG. 12 is a diagram showing an example of a part of the age item in the abstraction candidate. As shown in FIG. 12, the abstraction candidates have the number of people ci for each age ki. For example, the number of teenagers (k1) (c1) is 40, and the number of people in their 20s (k2) (c2) is 22.

  FIG. 13 shows an example of value data of each word acquired for the age ki. The value data in FIG. 13 has a SEM unit price ei for each age ki.

The value of this age ki is a value obtained by multiplying the SEM unit price ei by the number of people ci, and is expressed by Equation 3.
ki = ci × ei (Formula 3)
Then, as shown in FIG. 14, the value of the item S (k) of the age is the total of each age ki, and is expressed by Equation 4. In FIG. 14, n is 2. Therefore, the value of the item S (k) of the age is 2134 yen as shown in FIG. In other words, the value was lost by 312 yen by abstracting the age item into the age. Thus, the sum of the values of all items in the abstraction candidate is the value of the abstraction candidate.

  Then, as the value of the abstraction candidate obtained in step S150, for example, as shown in Equation 5, an impairment rate M (k) obtained by dividing the value of the abstraction candidate by the sum of the value of the abstraction candidate and the value of the target data is obtained. .

M (k) = S (k) / (S (k) + S (e)) (Formula 5)
FIG. 16 is a schematic configuration diagram of the distribution information management system 30. The distribution information management system 30 is a so-called information processing apparatus (computer) including an arithmetic processing unit 301, a communication control unit 303, a storage device 304, and an input / output interface 305.

The arithmetic processing unit 301 has a CPU and a main memory, and the CPU provides the functions of the above-described anonymous data output unit 31 and the distribution data receiving unit 32 by executing a program that is executable on the main memory. To do.

  The main memory can also be called a main storage device. The main memory stores, for example, a program executed by the CPU, data received via the communication control unit 303, data read from the storage device 204, other data, and the like.

  The communication control unit 303 is connected to another device, for example, the store information server 103 or another business operator's terminal 50 via the network, and controls communication with the device.

  The input / output interface 305 is appropriately connected to output means such as a display device and a printer, input means such as a keyboard and pointing device, and input / output means such as a drive device.

The storage device 304 can also be called an external storage device (auxiliary storage device). The storage device 304 may be an SSD (Solid State Drive), an HDD, or the like. Storage device 304
Transmits and receives data to and from the drive device. For example, the storage device 304 stores an information processing program installed from the drive device. When the storage device 4 receives a program read command, the storage device 4 delivers the program to the memory. In addition, the storage device 304 of the present embodiment stores an auction DB 34 and a moral DB 33.

  FIG. 17A is a diagram illustrating an example of auction information stored in the auction DB. The auction information is information released by the distribution information management system 30 in an auction, and is information including a category number, a category, the number of existence, the number of accesses, the number of clicks, a price, an action, and the like as shown in FIG.

  The category is a unit of anonymous information for conducting an auction, for example, a combination of attribute values for which a bid is invited. The category number is information for identifying the category.

  The existence number is the number of users belonging to the category.

  The number of accesses is the number of users per day who access this system.

  The price is a price paid to the information processing system 100 side from the sender of the distribution information when the distribution information is distributed to the user, and is a price determined by an auction. In the example of FIG. 17, the amount per click is distributed, information is distributed by e-mail or the like, and when the user clicks, the user is directed to an advertisement page or an advertisement is displayed, and the sender pays the amount. Not limited to this, the sender may pay the price when the delivery information is delivered by e-mail, printed on a receipt, or displayed on digital signage.

  The action is information indicating a distribution information distribution method. For example, an e-mail with a hyperlink is sent to the user's terminal, and when the user clicks on the hyperlink, the user is directed to the linked advertisement page, that is, a web page on which distribution information such as an advertisement is posted is displayed. Let In addition, when a hyperlink is clicked, a banner or a moving image may be displayed.

  Further, the action (distribution information distribution method) may be printing on a receipt, display by digital signage, or the like.

FIG. 17B is a diagram illustrating an example of a distribution table of the auction DB. The distribution table is a table in which each user and a category to which anonymity is confirmed among the categories to which the user belongs are stored in association with each other.

  FIG. 18 is a diagram illustrating an example of a moral DB. For example, it is not desirable to distribute advertisements for liquor and cigarettes to minor users. Also, it is not desirable to distribute information on unreliable companies or antisocial groups. In this way, the moral DB 33 stores the distribution information object and the attribute value that are against the morals in association with each other so that the distribution is not performed against the morals.

  In the example of FIG. 18, information on improper objects and attribute values such as information on liquor and cigarettes for minors, gambling information for minors and students, information on Company X (a company with low reliability) for all users, etc. Remember the combination.

  As described above, in the first embodiment, the store system 10, the anonymous value evaluation system 20, and the distribution information management system 30 are configured by different information processing devices. However, these store system 10, anonymous value evaluation system 20, distribution information management The system 30 may be configured with a single information processing apparatus.

  FIG. 19 is an explanatory diagram of anonymization processing by the information processing system 100. The store information server 103 starts a program at a predetermined timing such as nighttime batch processing, and starts the processing of FIG.

  The store information server 103 first reads target data from the shopping information DB 19 (step S10). That is, the CPU receives target data from the storage device 4. Note that the store information server 103 is not limited to the configuration in which the target data is read from the internal storage device 4, but may be configured to receive the target data from an external file server or the like. The target data may be extracted from shopping information within a predetermined period such as one day, one month, or one year, or may be extracted from data having a predetermined attribute value such as food, sundries, and clothing.

  Next, the store information server 103 normalizes the notation of the read target data and the data length and order of each item in a predetermined format, registers them in the anonymous information DB 18, and notifies the anonymous value evaluation system 20. (Step S20).

  The anonymous value evaluation system 20 reads the target data from the anonymous information DB 18 (step S30), and determines whether or not the value data exists in the search information storage DB 25 for each word in the target data (step S40). The anonymous value evaluation system 20 proceeds to step S60 when the value data of all words exist in the search information storage DB 25 (step S40, Yes), and when there is insufficient value data (step S40, No), Value data of the word is acquired from an external device, in this example, the search engine 40 (step S50). Note that the value information of the words existing in the search information storage DB 25 other than the value data acquired from the search engine is acquired from the search information storage DB 25 (step S60).

  Further, the anonymous value evaluation system 20 creates abstraction candidates by replacing each item of the target data with an abstracted word (category) to satisfy anonymity (step S70). When there are a plurality of items that can be abstracted, all patterns are created when each item is abstracted and when it is not abstracted. For example, if the target data includes three items A, B, and C and all items can be abstracted, and the abstracted items are A ′, B ′, and C ′, as shown in FIG. Seven candidate patterns can be created, such as A ′, B, C when only A is abstracted, and A ′, B ′, C when items A and B are abstracted.

Next, the anonymous value evaluation system 20 calculates the value of the abstraction candidate of each pattern based on the value data of each word included in the abstraction candidate (step S80), and performs the test based on the value of this abstraction candidate. The order is determined (step S90). For example, the test order is determined in descending order of the value. Although it is desirable to test all candidate patterns, abstract candidates that are too low in value may be removed from the order based on the values of the abstract candidates. For example, you may remove the abstraction candidates of less than a predetermined ratio, such as after a predetermined number or less than half, in order of high value. Moreover, you may remove the abstraction candidate from which the value of the abstraction candidate became less than the predetermined ratio with respect to the value of object data. This reduces the number of tests and shortens the processing time.

  According to the order of this test, the anonymous value evaluation system 20 tests the anonymity of the abstraction candidate (step S100). For example, in order to test k-anonymity, the number (existence number) of combinations of different item values associated with one individual in the abstraction candidate is obtained. Alternatively, in order to test l diversity, the number (existence number) of combinations of values of the same item associated with one individual in the abstraction candidate is obtained. Then, the smallest of the existence numbers is obtained as the minimum number of appearances (k value) (step S110), and it is determined whether or not the minimum number of appearances exceeds 1 (step S120). That is, if the k value exceeds 1, k-anonymity is satisfied, and if it is 1, k-anonymity is not satisfied. Similarly, if the l value exceeds 1, l-diversity is satisfied, and if l value is 1, l-diversity is not satisfied.

  When the minimum number of appearances (k value / l value) does not exceed 1 (step S120, No), the anonymous value evaluation system 20 further abstracts the value of at least one item among the abstraction candidates, that is, Replacing with the abstracted word (step S130), the process returns to step S100. For example, when there is only one user having the attribute value of “male, 15 years old, shoes”, it is abstracted as “male, teens, shoes”.

  On the other hand, when the minimum number of appearances (k value / l value) exceeds 1 (step S120, Yes), the anonymous value evaluation system 20 calculates the difference between the value of the abstraction candidate and the value of the original target data. Determining (step S140), and determining the difference, a value based on the difference, for example, the ratio of the difference to the value of the target data, and the ratio of the value of the abstraction candidate to the value of the target data as the value of the abstraction candidate (step S150).

  Further, the anonymous value evaluation system 20 determines whether there is a candidate pattern that has not been verified (step S160), and if there is a candidate pattern that has not been verified (step S160, Yes), the order determined in step S90. Then, the next abstraction candidate is identified (step S170), and the process returns to step S100 to test the next abstraction candidate.

  In this way, when the test is repeated for the abstraction candidates of each pattern and the next candidate pattern disappears (No in step S160), the anonymous value evaluation system 20 determines in step S150 based on the value of each abstraction candidate. Abstraction candidates to be adopted are selected and notified to the store information server 103 (step S180).

  For selection of abstraction candidates, for example, a predetermined number of abstraction candidates are selected in descending order of value among all candidate patterns. That is, the anonymization information is not limited to one pattern, and a plurality of patterns may be created.

  Further, the anonymous value evaluation system 20 may acquire request information from the distribution information management system 30 and select a predetermined number of abstraction candidates in descending order of value among candidate patterns that match the request information. Furthermore, the anonymous value evaluation system 20 outputs a plurality of abstraction candidates in descending order of value from all candidate patterns, and designates an abstraction candidate that the operator thinks appropriate from the output abstraction candidates. The designated abstraction candidate may be selected.

  The anonymous information DB 18 may be updated by overwriting the target data with the selected abstraction candidate to be anonymized data, or abstracting a word in the target data in the same way as the selected abstraction candidate. It may be anonymized data.

  The store information server 103 updates the target data in the anonymous information DB 18 based on the selected abstraction candidate and notifies the distribution information management system 30 (step S190).

  The distribution information management system 30 reads anonymous information such as a category and the number of existences from the anonymous information DB 18, assigns a category number, and stores it in the auction DB 34 as auction information. When there is a category that matches the category in the past and there is a record of the number of accesses and the number of clicks, the category is added to the auction information. The number of accesses and the number of clicks may be updated as needed when a user belonging to the category accesses or clicks. Also, the distribution information management system 30 records each user's ID in the distribution table in association with the category number of the category to which the user belongs.

  Then, the distribution information management system 30 publishes this auction information as a bid target (step S195). For example, the distribution information management system 30 reads auction information from the auction DB 34, inserts it into a predetermined template, and provides it as a web page (auction web page) for soliciting bids. In other words, the distribution information management system 30 functions as a WWW (World Wide Web) web server, and receives an anonymous information from the sender's terminal 50 when receiving a browsing request specifying a web page for the bid by URL. The auction information is read from the DB 18 to generate the web page and transmit it to the terminal 50.

  FIG. 21 is a diagram showing an example of a web page 51 that invites bids. The web page 51 is described in a markup language such as HTML, and auction information is posted in the display field 52 as shown in FIG. The web page 51 is generated by storing a part other than the auction information as a template in the storage device 304 in advance, and when there is a browsing request, the auction information is read from the anonymous information DB 18 and inserted into the display field 52. Is done.

  The information displayed in the display column 52 is, for example, a category number, a category, the number of existence, the number of accesses, the number of clicks, and a price (current price). Auction button 53 is provided for each category of auction information. When the bidder (sender) selects the bid button 53, a bid dialog 54 is opened. When the bid amount 54 is entered, the amount, ID, and action are input in the input fields 55-57, and the confirmation button 58 is selected. Information (bid conditions) related to bidding such as the amount of money, ID, and action is transmitted from the terminal 50 to the distribution information management system 30, and bidding is performed.

  The distribution information management system 30 that has received the bid condition determines a successful bid based on the bid condition. The successful bid may be determined at the timing of distributing the distribution information, for example, when the user accesses the system 100, the bidding condition with the highest price may be determined as the successful bidding, or the bidding condition bid for the predetermined bidding period may be determined. Of these, the highest bid condition may be determined as a successful bid.

  FIG. 22 is an explanatory diagram of processing in which the information processing system 100 outputs distribution information to the user.

When the user accesses the system 100, the distribution information management system 30 detects the user's access and identifies the user based on the user ID (step S210). Here, the access to the system 100 means that, for example, when a user presents a membership card at a store and performs shopping, the cash register 101 reads shopping information such as purchased product information and a user ID, and stores information server Since the shopping information including the user ID is input to 103, when the shopping information of the user is input to the system 100, the system 100 is accessed, and the store information server 103 sends the information to the distribution information management system 30. The distribution information management system 30 may detect the access of the user by notifying the access. In addition, the distribution information management system 30 of the present system 100 publishes a website that provides product advertisements and coupons, and the user operates the user terminal 80 to connect to the distribution information management system 30, and the user ID, etc. May be detected as access to the system 100 when logging in to the website.

  Next, the distribution information management system 30 refers to the distribution table of the auction DB, and maintains the anonymity even if the distribution information is distributed to the user corresponding to the category number corresponding to the user ID of the user who detected the access. A category that has been confirmed to be acquired is acquired (step S220).

  The distribution information management system 30 selects a category for distributing distribution information from among the acquired categories for which a successful bid has been made (step S230). Here, for the selection of categories, for example, a predetermined number is selected in order from the highest price for which a successful bid is made or the highest price obtained by multiplying the successful bid price by the existence number. The configuration is not limited to this, and a configuration in which all the successful bid categories are selected or a configuration in which the categories are selected in order may be used. Here, the distribution information management system 30 refers to the moral DB 33 to select a category in which the combination of the attribute value of the patient and the distribution information for the category does not correspond to the moral DB (that is, a category that distributes distribution information that does not contradict the moral). select. Therefore, when the combination of the patient attribute value and the distribution information corresponds to the moral DB, the category is not selected.

  And the delivery information management system 30 will transmit the information which shows the action (delivery method) input at the time of a bid about the selected category, and the user ID of delivery object to the store information server 103, Based on these information, store information The server 103 distributes distribution information (step S240).

  For example, if the action is printing on a receipt such as “print information of URL: http://abcd.com on a receipt”, the store information server 10 starts from the URL: http://abcd.com. Information is acquired, this information is sent to the cash register 101, and printed on a receipt by the printer. If the action is “URL: http://abcd.com displays information on digital signage”, the store information server 10 acquires information from the URL: http://abcd.com, Display information on digital signage installed on a wall.

  Also, the user can use "URL: direct to http://abcd.com", "URL: display banner of http://abcd.com", "URL: display video of http://abcd.com", etc. In the case of an action for providing information to the terminal 80, for example, an e-mail describing these links is transmitted as distribution information to the e-mail address of the user. When this mail is received by the user terminal 80 and the user selects a link of this mail, the user is guided to the linked web page according to the description of the link, or the display of the linked banner, the linked video, etc. Is displayed.

  As described above, when the user visits the store and accesses the system 100 at the time of payment, distribution information is distributed to the user from the digital signage or the cash register 101 of the store.

When the user accesses the system 100 by operating the user terminal 80 and browsing the website of the distribution information management system 30, the linked page is displayed in the advertisement area of the browsed web page, or An operation such as displaying a banner or a moving image may be performed.

  In FIG. 22, distribution information is distributed when a user accesses the information processing system 100. However, the present invention is not limited to this, and distribution information for a category to which each user belongs is periodically distributed by e-mail or the like. Alternatively, when the successful bid is determined, the distribution information may be distributed to each user who belongs to the category for which a successful bid is made.

  As described above, the information processing system 100 according to the first embodiment anonymizes shopping information with a high utility value, determines distribution information for the shopping information anonymized by bidding, and anonymizes the distribution information. Deliver to each individual corresponding to the information. As a result, the information processing system 100 can use personal shopping information for information distribution in which a distribution target is determined in an auction format.

  Further, since the information processing system 100 according to the first embodiment calculates the value of anonymous information based on the keyword statistical information used for the search by the search engine 40, sufficient anonymity is not required without requiring judgment by the operator. And can provide anonymous information and mediate distribution information mechanically.

<Embodiment 2>
FIG. 23 is a functional block diagram of the information processing system 200 according to the second embodiment, and FIG. 24 is a hardware configuration diagram of the information processing system 200. As shown in FIGS. 23 and 24, the information processing system 200 is a system that distributes recommendation information and the like using the usage status of home appliances.

  In recent years, an increasing number of home appliances are called Internet home appliances, smart home appliances, and the like, which can communicate with other devices, manage power consumption, check operation statuses, set operation modes, and the like. The system 200 collects usage status of home appliances and distributes distribution information such as advertisements and coupons according to the usage status to each user.

  In the second embodiment, as shown in FIG. 24, the information processing system 200 is configured by a single piece of hardware. However, the present invention is not limited to this, and is configured by a plurality of pieces of hardware as in the first embodiment. Also good. In the second embodiment, the same elements as those of the first embodiment are denoted by the same reference numerals and the description thereof is omitted.

  The information processing system 200 according to the second embodiment includes a user information DB 19, an anonymous information DB 18, a usage status acquisition unit 210, a status determination unit 211, an abstraction unit 11, a test unit 13, a selection unit 14, an encryption unit 15, and data reception. Unit 16, output control unit 17, value data acquisition unit 21, value determination unit 22, value calculation unit 24, and search information storage DB 25.

  The status collection unit 210 collects the usage status of each home appliance from a management device that manages the usage status of the home appliance, such as a smart meter or a router at the user's house. For example, information such as the time at which home appliances such as a TV and an air conditioner are turned on and off, the number of times the refrigerator is opened and closed, and the recipe acquired by the microwave oven are received from the management device on the user side and recorded in the user information DB 19.

  The status determination unit 211 determines the status of the user based on the usage status acquired from the user side. For example, it is determined that the user has returned home when a predetermined usage situation occurs, such as lighting or an air conditioner being turned on after the user is away and power consumption continues. In addition, it is determined that meal preparation has started when the cooker is turned on in a predetermined time zone such as noon or evening.

FIG. 25 is a diagram illustrating an example of the user information DB 19 according to the second embodiment. As shown in FIG. 25, the user information DB 19 stores, as user information, the user ID, name, age, gender, mail address (delivery destination), and usage status of home appliances in association with each user. Yes.

  Anonymization processing by the information processing system 200 according to the second embodiment will be described with reference to FIG. The information processing system 200 starts a program at a predetermined timing such as nighttime batch processing and starts the processing of FIG.

  The information processing system 200 first reads target data from the user information DB 19 (step S10). The target data may be obtained by extracting user information within a predetermined period such as one day, one month, or one year, or may be obtained by extracting data having predetermined attribute values such as power consumption and air conditioner usage status. good.

  Next, the information processing system 200 normalizes the read target data notation fluctuation, the data length and order of each item in a predetermined format, registers them in the anonymous information DB 18, and notifies the information processing system 200 ( Step S20).

  The information processing system 200 reads the target data from the anonymous information DB 18 (step S30), and determines whether value data exists in the search information storage DB 25 for each word in the target data (step S40). The information processing system 200 proceeds to step S60 when the value data of all words exist in the search information storage DB 25 (step S40, Yes), and when there is insufficient value data (step S40, No), Word value data is acquired from an external device, in this example, the search engine 40 (step S50). Note that the value information of the words existing in the search information storage DB 25 other than the value data acquired from the search engine is acquired from the search information storage DB 25 (step S60).

  Further, the information processing system 200 creates abstraction candidates by replacing each item of the target data with an abstracted word (category) in order to satisfy anonymity (step S70). When there are a plurality of items that can be abstracted, all patterns are created when each item is abstracted and when it is not abstracted.

  Next, the information processing system 200 calculates the value of the abstraction candidate of each pattern based on the value data of each word included in the abstraction candidate (step S80), and the order of the verification based on the value of the abstraction candidate Is determined (step S90). For example, the test order is determined in descending order of the value.

  In accordance with the order of the verification, the information processing system 200 verifies the anonymity of the abstraction candidate (step S100). Then, the smallest one of the existence numbers is obtained as the minimum appearance number (k value or l value) (step S110), and it is determined whether or not the minimum appearance number exceeds 1 (step S120).

  If the minimum number of appearances (k value / l value) does not exceed 1 (No in step S120), the information processing system 200 further abstracts the value of at least one item among the abstraction candidates, that is, abstraction. The converted word is replaced (step S130), and the process returns to step S100. For example, if there is only one user having the attribute value of “male, air conditioning heating ON, TV 3ch viewing”, it is abstracted as “male, air conditioning heating ON, TV ON”.

On the other hand, when the minimum number of appearances (k value / l value) exceeds 1 (step S120, Yes), the information processing system 200 obtains the difference between the value of the abstraction candidate and the value of the original target data. (Step S140), this difference, a value based on this difference, for example, a ratio of the difference to the value of the target data, and a ratio of the value of the abstraction candidate to the value of the target data are determined as the value of the abstraction candidate (Step S150). ).

  Further, the information processing system 200 determines whether there is a candidate pattern that has not been verified (step S160). If there is a candidate pattern that has not been verified (step S160, Yes), the information processing system 200 follows the order determined in step S90. Then, the next abstraction candidate is identified (step S170), and the process returns to step S100 to test the next abstraction candidate.

  In this manner, when the test is repeated for each pattern abstraction candidate, and the next candidate pattern disappears (step S160, No), the information processing system 200 adopts based on the value of each abstraction candidate in step S150. An abstraction candidate to be selected is selected (step S180).

  The information processing system 200 updates the target data in the anonymous information DB 18 based on the selected abstraction candidate (step S190).

  The information processing system 200 reads anonymous information such as a category and the number of existences from the anonymous information DB 18, assigns a category number, and stores it in the auction DB 34 as auction information. When there is a category that matches the category in the past and there is a record of the number of accesses and the number of clicks, the category is added to the auction information. The number of accesses and the number of clicks may be updated as needed when a user belonging to the category accesses or clicks. Further, the information processing system 200 records each user's ID in the distribution table in association with the category number of the category to which the user belongs.

  Then, the information processing system 200 publishes this auction information as a bid object (step S195). For example, the information processing system 200 reads auction information from the auction DB 34, inserts it into a predetermined template, and provides it as a web page (auction web page) for soliciting bids.

  Next, processing in which the information processing system 200 outputs distribution information to the user will be described with reference to FIG.

  When the function of the situation determination unit 211 determines that the user is in a predetermined situation, for example, when it is determined that the user has returned home, got up, or started preparing meals, the information processing system 200 The user is identified based on the user ID of the user who has become the situation (step S210), and the category number corresponding to the user ID of the user, that is, the distribution information for the user, with reference to the distribution table of the auction DB A category for which anonymity is confirmed to be maintained even if is distributed is acquired (step S220).

  The information processing system 200 selects a category for distributing distribution information from among the acquired categories for which a successful bid has been made (step S230). Here, for the selection of categories, for example, a predetermined number is selected in order from the highest price for which a successful bid is made or the highest price obtained by multiplying the successful bid price by the existence number. The configuration is not limited to this, and a configuration in which all the successful bid categories are selected or a configuration in which the categories are selected in order may be used.

  Then, when the information processing system 200 transmits information indicating the action (distribution method) input at the time of bidding for the selected category and the user ID to be distributed to the information processing system 200, the information processing system is based on the information. 200 distributes distribution information (step S240).

For example, an e-mail describing a link based on an action input to the auction DB is transmitted as distribution information to the e-mail address of the user. When this mail is received by the user terminal 80 and the user selects a link of this mail, the user is guided to the linked web page according to the description of the link, or the display of the linked banner, the linked video, etc. Is displayed.

  In this way, when the user gets up or starts preparing a meal, the information processing system 200 reads “Today is the release date of XX”. The distribution information is distributed to the user like “...

  In this example, distribution information is distributed in response to the user's determination as a predetermined situation. However, the present invention is not limited to this, and distribution information for a category to which each user belongs may be periodically distributed by e-mail or the like. The distribution information may be distributed to each user who belongs to the successful bid category when a successful bid is determined.

  As described above, the information processing system 200 according to the second embodiment anonymizes the usage status (personal information) of home appliances in a state of high usage value, determines distribution information for the usage status that has been anonymized by bidding, and distributes the distribution information. Distribute information to each individual corresponding to anonymized usage status. Accordingly, the information processing system 200 can use the usage status of home appliances for information distribution in which a distribution target is determined in an auction format.

<Embodiment 3>
FIG. 26 is a functional block diagram of the information processing system 300 according to the third embodiment. The information processing system 300 according to the third embodiment is a system that distributes recommendation information and the like using a user's position situation.

  In recent years, with the widespread use of car navigation systems, car navigation systems are installed in many users' automobiles, and route guidance and the like can be used using position information such as GPS. In addition, the number of mobile phones and smartphones that can use location information is increasing. The system 300 collects location information from a user terminal 80 such as a car navigation system, a mobile phone, or a smartphone, and delivers delivery information such as advertisements and coupons according to the location information to each user.

  In the third embodiment, the same elements as those in the first and second embodiments are denoted by the same reference numerals and the description thereof is omitted.

  The information processing system 300 according to the third embodiment includes a user information DB 19, an anonymous information DB 18, a position information acquisition unit 310, a situation determination unit 211, an abstraction unit 11, a test unit 13, a selection unit 14, an encryption unit 15, and data reception. Unit 16, output control unit 17, value data acquisition unit 21, value determination unit 22, value calculation unit 24, and search information storage DB 25.

  The position information collection unit 210 collects position information from the user terminal 80 and records it in the user information DB 19. The position information may include information indicating the date and time when the position information is acquired in addition to information indicating the position such as latitude and longitude.

  The situation determination unit 211 determines the situation of the user based on the position information acquired from the user side. For example, when the position of the user registered in advance, such as the home or work location, and the acquired position information match, it is determined that the user is at home or is working. Further, if the terminal 80 that transmitted the position information is a navigation system, it is determined that the vehicle is moving in a car. Furthermore, it may be determined that the user is moving on foot or moving on a railroad from the moving speed or moving route.

FIG. 27 is a diagram illustrating an example of the user information DB 19 according to the third embodiment. As shown in FIG. 27, the user information DB 19 stores, as user information, items of user ID, name, age, sex, mail address (delivery destination), and position information for each user in association with each other. The location information is not limited to the raw data such as latitude and longitude, but the place name obtained from the latitude and longitude (near Higashi Nihonbashi 1-chome, on the expressway) and the location (home) related to the user obtained by the situation determination unit 211 Or work place).
Anonymization processing by the information processing system 300 according to the third embodiment will be described with reference to FIG. The information processing system 300 starts a program at a predetermined timing, such as nighttime batch processing, and starts the processing of FIG.

  The information processing system 300 first reads target data from the user information DB 19 (step S10). The target data may be obtained by extracting user information within a predetermined period, such as one day, one month, or one year.

  Next, the information processing system 300 normalizes the notation of the read target data and the data length and order of each item in a predetermined format, registers them in the anonymous information DB 18, and notifies the information processing system 300 ( Step S20).

  The information processing system 300 reads the target data from the anonymous information DB 18 (step S30), and determines whether value data exists in the search information storage DB 25 for each word in the target data (step S40). The information processing system 300 proceeds to step S60 when the value data of all words are present in the search information storage DB 25 (step S40, Yes), and when there is insufficient value data (step S40, No), Word value data is acquired from an external device, in this example, the search engine 40 (step S50). Note that the value information of the words existing in the search information storage DB 25 other than the value data acquired from the search engine is acquired from the search information storage DB 25 (step S60).

  Further, the information processing system 300 creates abstraction candidates by replacing each item of the target data with an abstracted word (category) in order to satisfy anonymity (step S70). For example, the latitude / longitude is abstracted such as a place name such as Nihonbashi 1-chome, the vicinity of Nihonbashi 1-chome, Chuo-ku, and the central ward 23-ku. When there are a plurality of items that can be abstracted, all patterns are created when each item is abstracted and when it is not abstracted.

  Next, the information processing system 300 calculates the value of the abstraction candidate of each pattern based on the value data of each word included in the abstraction candidate (step S80), and the order of the verification based on the value of the abstraction candidate Is determined (step S90). For example, the test order is determined in descending order of the value.

  In accordance with the order of the verification, the information processing system 300 verifies the anonymity of the abstraction candidates (step S100). Then, the smallest one of the existence numbers is obtained as the minimum appearance number (k value or l value) (step S110), and it is determined whether or not the minimum appearance number exceeds 1 (step S120).

  If the minimum number of appearances (k value / l value) does not exceed 1 (No in step S120), the information processing system 300 further abstracts the value of at least one item among the abstraction candidates, that is, abstraction. The converted word is replaced (step S130), and the process returns to step S100. For example, if there is only one user who has the attribute value “Man, near Nihonbashi 1-chome, traffic jam”, the user is abstracted as “Man, Chuo-ku, traffic jam”.

On the other hand, when the minimum number of appearances (k value / l value) exceeds 1 (step S120, Yes)
The information processing system 300 obtains a difference between the value of the abstraction candidate and the value of the original target data (step S140), and the difference or a value based on the difference, for example, the ratio of the difference to the value of the target data, The ratio of the value of the abstraction candidate to the value of the target data is determined as the value of the abstraction candidate (step S150).

  Further, the information processing system 300 determines whether there is a candidate pattern that has not been verified (step S160). If there is a candidate pattern that has not been verified (step S160, Yes), the information processing system 300 follows the order determined in step S90. Then, the next abstraction candidate is identified (step S170), and the process returns to step S100 to test the next abstraction candidate.

  In this manner, when the test is repeated for the abstraction candidates of each pattern and the next candidate pattern disappears (No in step S160), the information processing system 300 employs the value based on the value of each abstraction candidate in step S150. An abstraction candidate to be selected is selected (step S180).

  The information processing system 300 updates the target data in the anonymous information DB 18 based on the selected abstraction candidate (step S190).

  The information processing system 300 reads anonymous information such as a category and the number of existences from the anonymous information DB 18, assigns a category number, and stores it as auction information in the auction DB 34. When there is a category that matches the category in the past and there is a record of the number of accesses and the number of clicks, the category is added to the auction information. The number of accesses and the number of clicks may be updated as needed when a user belonging to the category accesses or clicks. In addition, the information processing system 300 records each user's ID in the distribution table in association with the category number of the category to which the user belongs.

  Then, the information processing system 300 publishes this auction information as a bid target (step S195). For example, the information processing system 300 reads auction information from the auction DB 34, inserts it into a predetermined template, and provides it as a web page (auction web page) for soliciting bids.

  Next, processing in which the information processing system 300 outputs distribution information to the user will be described with reference to FIG.

  When it is determined that the user is in a predetermined situation by the function of the situation determination unit, for example, when it is determined that the user is on a train, is stuck in a traffic jam, or is in the middle of work, the information processing system 300 The user is identified based on the user ID of the user who has become the situation (step S210), and the distribution number of the user ID corresponding to the user ID of the user is referred to by referring to the distribution table of the auction DB. A category in which anonymity is confirmed to be maintained even if distributed is acquired (step S220).

  The information processing system 300 selects a category for distributing distribution information from among the acquired categories for which a successful bid has been made (step S230). Here, for the selection of categories, for example, a predetermined number is selected in order from the highest price for which a successful bid is made or the highest price obtained by multiplying the successful bid price by the existence number. The configuration is not limited to this, and a configuration in which all the successful bid categories are selected or a configuration in which the categories are selected in order may be used.

When the information processing system 300 transmits information indicating the action (distribution method) input at the time of bidding for the selected category and the user ID to be distributed to the information processing system 300, the information processing system is based on these information. 300 distributes distribution information (step S240).

  For example, an e-mail describing a link based on an action input to the auction DB is transmitted as distribution information to the e-mail address of the user. When this mail is received by the user terminal 80 and the user selects a link of this mail, the user is guided to the linked web page according to the description of the link, or the display of the linked banner, the linked video, etc. Is displayed.

  In this way, when the user gets on a train or gets in a traffic jam, the information processing system 300 “clears sale at store A at XX station.” “Would you like to take a break, discount coupon for restaurant B? The distribution information is distributed to the user.

  In this example, distribution information is distributed in response to the user's determination as a predetermined situation. However, the present invention is not limited to this, and distribution information for a category to which each user belongs may be periodically distributed by e-mail or the like. The distribution information may be distributed to each user who belongs to the successful bid category when a successful bid is determined.

  As described above, the information processing system 300 according to the third embodiment anonymizes the user's position information (personal information) in a state where the utility value is high, determines distribution information for the anonymized usage situation by bidding, and distributes the distribution information. Distribute information to each individual corresponding to anonymized usage status. As a result, the information processing system 300 can use the position information of the user for information distribution in which a distribution target is determined in an auction format.

<Embodiment 4>
FIG. 28 is a functional block diagram of an information processing system 400 according to the fourth embodiment. The information processing system 400 of the fourth embodiment is a system that distributes recommendation information and the like using business documents.

  The information processing system 400 according to the fourth embodiment collects business documents such as business trip plans and opening notes, and distributes distribution information corresponding to the documents to each user.

  In the fourth embodiment, the same elements as those in the first to third embodiments are denoted by the same reference numerals and the description thereof is omitted.

  The information processing system 400 according to the fourth embodiment includes a business document DB 19, an anonymous information DB 18, a business document acquisition unit 210, a situation determination unit 211, an abstraction unit 11, a test unit 13, a selection unit 14, an encryption unit 15, and data reception. Unit 16, output control unit 17, value data acquisition unit 21, value determination unit 22, value calculation unit 24, and search information storage DB 25.

  The business document collection unit 410 collects business documents from the user terminal 80 and records them in the business document DB 19.

  The situation determination unit 211 determines the situation based on the business document acquired from the user side. For example, for the acquired business document, it is determined whether or not a predetermined condition is met, for example, an introductory document has been submitted or a destination has been submitted for a business trip in Osaka.

  FIG. 29 is a diagram illustrating an example of the business document DB 19 according to the second embodiment. As shown in FIG. 27, the business document DB 19 stores, as business document information, the user ID, name, age, gender, mail address (delivery destination), and business document items in association with each user. .

  Anonymization processing by the information processing system 400 according to the fourth embodiment will be described with reference to FIG. The information processing system 400 starts a program at a predetermined timing such as nighttime batch processing, and starts the processing of FIG.

  The information processing system 400 first reads out target data from the business document DB 19 (step S10). The target data may be data obtained by extracting business document information within a predetermined period such as one day, one month, or one year.

  Next, the information processing system 400 normalizes the notation of the read target data and the data length and order of each item in a predetermined format, registers them in the anonymous information DB 18, and notifies the information processing system 400 ( Step S20).

  The information processing system 400 reads the target data from the anonymous information DB 18 (step S30), and determines whether value data exists in the search information storage DB 25 for each word in the target data (step S40). The information processing system 400 proceeds to step S60 when the value data of all words exist in the search information accumulation DB 25 (step S40, Yes), and when there is insufficient value data (step S40, No), Word value data is acquired from an external device, in this example, the search engine 40 (step S50). Note that the value information of the words existing in the search information storage DB 25 other than the value data acquired from the search engine is acquired from the search information storage DB 25 (step S60).

  In addition, the information processing system 400 creates abstraction candidates by replacing each item of the target data with an abstracted word (category) to satisfy anonymity (step S70). For example, the intellectual property department first section is abstracted as the intellectual property department, and the Osaka A branch business trip is abstracted as an Osaka business trip. When there are a plurality of items that can be abstracted, all patterns are created when each item is abstracted and when it is not abstracted.

  Next, the information processing system 400 calculates the value of the abstraction candidate of each pattern based on the value data of each word included in the abstraction candidate (step S80), and the order of verification based on the value of the abstraction candidate Is determined (step S90). For example, the test order is determined in descending order of the value.

  In accordance with the order of this test, the information processing system 400 tests the anonymity of the abstraction candidate (step S100). Then, the smallest one of the existence numbers is obtained as the minimum appearance number (k value or l value) (step S110), and it is determined whether or not the minimum appearance number exceeds 1 (step S120).

  When the minimum number of appearances (k value / l value) does not exceed 1 (No in step S120), the information processing system 400 further abstracts the value of at least one item among the abstraction candidates, that is, abstraction. The converted word is replaced (step S130), and the process returns to step S100. For example, if there is only one user having the attribute value “Men, Osaka A branch business trip”, it is abstracted as “Men, Osaka business trip”.

  On the other hand, when the minimum number of appearances (k value / l value) exceeds 1 (step S120, Yes), the information processing system 400 obtains the difference between the value of the abstraction candidate and the value of the original target data. (Step S140), this difference, a value based on this difference, for example, a ratio of the difference to the value of the target data, and a ratio of the value of the abstraction candidate to the value of the target data are determined as the value of the abstraction candidate (Step S150). ).

  Further, the information processing system 400 determines whether there is a candidate pattern that has not been verified (step S160). If there is a candidate pattern that has not been verified (step S160, Yes), the information processing system 400 follows the order determined in step S90. Then, the next abstraction candidate is identified (step S170), and the process returns to step S100 to test the next abstraction candidate.

  In this manner, when the test is repeated for the abstraction candidates for each pattern and the next candidate pattern is lost (No in step S160), the information processing system 400 adopts the value based on the value of each abstraction candidate in step S150. An abstraction candidate to be selected is selected (step S180).

  The information processing system 400 updates the target data in the anonymous information DB 18 based on the selected abstraction candidate (step S190).

  The information processing system 400 reads anonymous information such as the category and the number of existences from the anonymous information DB 18, assigns a category number, and stores it in the auction DB 34 as auction information. When there is a category that matches the category in the past and there is a record of the number of accesses and the number of clicks, the category is added to the auction information. The number of accesses and the number of clicks may be updated as needed when a user belonging to the category accesses or clicks. Further, the information processing system 400 records the ID of each user and the category number of the category to which the user belongs in the distribution table.

  Then, the information processing system 400 discloses this auction information as a bid object (step S195). For example, the information processing system 400 reads auction information from the auction DB 34, inserts it into a predetermined template, and provides it as a web page (auction web page) for soliciting bids.

  Next, processing in which the information processing system 400 outputs distribution information to the user will be described with reference to FIG.

  When it is determined that the situation is a predetermined situation by the function of the situation determination unit, for example, when it is determined that an opening letter is submitted, a business trip plan is submitted, etc., the information processing system 400 is the user of the user who has entered the situation Even if the user is identified based on the ID (step S210) and the distribution table of the auction DB is referred to and the category number corresponding to the user ID of the user, that is, the distribution information is distributed to the user, anonymity remains. A category that is confirmed to be maintained is acquired (step S220).

  The information processing system 400 selects a category for distributing distribution information from among the acquired categories that have been successfully bid (step S230). Here, for the selection of categories, for example, a predetermined number is selected in order from the highest price for which a successful bid is made or the highest price obtained by multiplying the successful bid price by the existence number. The configuration is not limited to this, and a configuration in which all the successful bid categories are selected or a configuration in which the categories are selected in order may be used.

  Then, when the information processing system 400 transmits information indicating the action (distribution method) input at the time of bidding for the selected category and the distribution target user ID to the information processing system 400, the information processing system is based on the information. 400 distributes distribution information (step S240).

For example, an e-mail describing a link based on an action input to the auction DB is transmitted as distribution information to the e-mail address of the user. When this mail is received by the user terminal 80 and the user selects a link of this mail, the user is guided to the linked web page according to the description of the link, or the display of the linked banner, the linked video, etc. Is displayed.

  In this way, the information processing system 400, when a user submits a closing document, submits a business trip plan, “There has been such a case in the past.” “Osaka flights are profitable with A Airlines. The distribution information is distributed to the user like

  In this example, distribution information is distributed in response to the user's determination as a predetermined situation. However, the present invention is not limited to this, and distribution information for a category to which each user belongs may be periodically distributed by e-mail or the like. The distribution information may be distributed to each user who belongs to the successful bid category when a successful bid is determined.

  As described above, the information processing system 400 according to the fourth embodiment anonymizes a user's business document (personal information) in a state where the utility value is high, determines distribution information for the anonymized usage situation by bidding, and distributes the distribution information. Distribute information to each individual corresponding to anonymized usage status. As a result, the information processing system 400 can use the user's business document status for information distribution in which a distribution target is determined in an auction format.

<Others>
The present invention is not limited to the illustrated examples described above, and various modifications can be made without departing from the scope of the present invention.

3 Communication Control Unit 4 Storage Device 5 Input / Output Interface 10 Store System 11 Abstraction Unit 13 Verification Unit 14 Selection Unit 15 Data Update Unit 16 Data Acceptance Unit 17 Output Control Unit 20 Anonymous Value Evaluation System 21 Value Data Acquisition Unit 22 Value Determination Unit 23 Word category analysis unit 24 Value calculation unit 30 Distribution information management system 31 Anonymous data output unit 32 Distribution data reception unit 40 Search engine 41 Data output unit 50 Terminal 60 System of other business operator 70 Security company system 71 Detection device 80 User Terminal 100 Information processing system 101 Cash register 102 Input / output terminal 103 Store information server 200, 300, 400 Information processing system

Claims (3)

A data receiving unit for acquiring target data including a plurality of items associated with an individual;
An abstraction unit that generates abstraction candidate data by replacing a word that is a value of an item in the target data with an abstracted word;
A value determination unit that receives the value of the word included in the abstraction candidate data and obtains the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
A test unit that tests on condition that a combination of values of items of the abstraction candidate data is not limited to one individual of the target data;
A public part that publishes abstract candidate data selected based on the value of the abstract candidate data that satisfies the test condition as anonymous information for bidding;
A bid accepting unit for receiving bid conditions for distributing distribution information to each individual for the anonymous information;
A successful bid determination unit for determining a successful bid based on the bid conditions of the bid data;
A distribution unit that distributes the distribution information to each individual corresponding to the anonymous information that has been awarded;
An information processing apparatus comprising: Obtaining target data including a plurality of items associated with an individual;
Generating abstract candidate data by replacing words that are values of items in the target data with abstract words;
Receiving the value of the word included in the abstraction candidate data, and determining the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
Testing a condition that a combination of values of the abstraction candidate data items is not limited to one individual of the target data;
Publishing abstraction candidate data selected based on the value of the abstraction candidate data satisfying the test condition as anonymous information of a bid object;
Receiving bid conditions for distributing distribution information to each individual for the anonymous information;
Determining a successful bid based on bid conditions of the bid data;
Distributing the distribution information to each individual corresponding to the bid anonymous information;
An information processing method in which a computer executes. Obtaining target data including a plurality of items associated with an individual;
Generating abstract candidate data by replacing words that are values of items in the target data with abstract words;
Receiving the value of the word included in the abstraction candidate data, and determining the value of the abstraction candidate data based on the value of the word included in the abstraction candidate data;
Testing a condition that a combination of values of the abstraction candidate data items is not limited to one individual of the target data;
Publishing abstraction candidate data selected based on the value of the abstraction candidate data satisfying the test condition as anonymous information of a bid object;
Receiving bid conditions for distributing distribution information to each individual for the anonymous information;
Determining a successful bid based on bid conditions of the bid data;
Distributing the distribution information to each individual corresponding to the bid anonymous information;
Processing program for causing a computer to execute.

Images