JP2016151908A - Personal information anonymization support device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To allow a flexible procedure to obtain anonymization data required by users.SOLUTION: In a personal information anonymization support device, provided are: (1) an anonymization object data take-in unit that takes in anonymization object data; (2) a generalization hierarchy generation unit that generates generalization hierarchy data on the basis of the anonymization object data; (3) a first k-anonymization execution unit that k-anonymizes the anonymization object data using the generalization hierarchy data, and outputs anonymization data as a result of the k-anonymization and incidental information on the k-anonymization; (4) an anonymization map editing unit that displays an anonymization map underlining a value of a sub-identifier used in generation of the k-anonymization data on a screen on the generalization hierarchy data having a tree structure displayed, and receives an editing input with respect to the anonymization map; (5) a second k-anonymization execution unit that k-anonymizes the anonymization object data using the edited anonymization map; (6) a storage device that stores the anonymization object data, the generalization hierarchy data, the k-anonymization data, and the anonymization map.SELECTED DRAWING: Figure 4

Description

  The present invention relates to a technique for supporting anonymization work of personal information.

  At present, movements that analyze information related to individuals to create new services and lead to the development of society, including the information entity that provides such information, are becoming increasingly active in the fields of medicine and communication. On the other hand, if such information is handled incorrectly, the privacy of the information subject is infringed. As a technique for reducing such a risk, there is k anonymization. k anonymization blurs the value of the quasi-identifier so that every record of information about an individual appears with at least (k-1) or more records having the same quasi-identifier value combination Anonymization technology. The quasi-identifier is an attribute that cannot be used to specify an individual by itself, but is used to specify an individual by combining them, and includes, for example, age, gender, and residence prefecture. In k-anonymization, a generalized hierarchy that is a hierarchical structure for replacing the value of the quasi-identifier with a more general value is used. An example of a generalized hierarchy is shown in FIG.

  As shown in Non-Patent Document 1, there are two main implementation methods of k-anonymization: a hierarchical search method and a clustering method. The hierarchical search type method is a method for searching for a combination of hierarchical levels of a generalized hierarchy to satisfy k anonymity, and algorithms such as Incognito (Non-patent Document 2) and Flash (Non-patent Document 3) are known. ing. Among them, Flash is an algorithm that pursues high-speed search performance and is implemented in ARX (Non-patent Document 4), an open source software of k-anonymization. The clustering method is a method for satisfying k-anonymity by grouping values having close distances based on the distance between the values of the quasi-identifiers. . According to Non-Patent Document 6, since the problem of obtaining an optimal solution for k anonymization is NP-hard, these algorithms give approximate solutions.

2009 Ministry of Economy, Trade and Industry Information Grand Voyage Project (Development, improvement and verification of common infrastructure technology) Development, improvement and verification of personal information protection / analysis infrastructure Personal information anonymization platform External specifications (March 2010, Hitachi Consulting) ) Kristen LeFevre, David J. DeWitt, Raghu Ramakrishnan, Incognito: efficient full-domain K-anonymity, Proceedings of the 2005 ACM SIGMOD international conference on Management of data, June 14-16, 2005, Baltimore, Maryland Florian Kohlmayer, Fabian Prasser, Claudia Eckert, Alfons Kemper, Klaus.A. Kuhn, Flash: Efficient, Stable and Optimal K-Anonymity, Proceedings of the 4th IEEE International Conference on Information Privacy, Security, Risk and Trust (PASSAT), September 3-5, 2012, Amsterdam, Netherlands. ARX-Powerful Data Anonymization | k-Anonymity, l-Diversity, t-Closeness, δ-Presence Implementation in Java, http://arx.deidentifier.org/ (as of November 20, 2014) Jiuyong Li, Raymond Chi-Wing Wong, AdaWai-Chee Fu, and Jian Pei, Achieving k-Anonymity by Clustering in Attribute Hierarchical Structures, DaWaK 2006, LNCS 4081, pp.405-416, 2006. Adam Meyerson, Ryan Williams, On the complexity of optimal K-anonymity, Proceedings of the twenty-third ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems, June 14-16, 2004, Paris, France

  Although an approximate solution of the optimal solution is obtained by the k anonymization algorithm, the obtained solution may not be useful for analysis purposes. The technology shown in Non-Patent Document 4 provides a function for finding a solution suitable for analysis by selecting another solution from a lattice which is a Cartesian product set of a set of hierarchical levels of a generalized hierarchy in preparation for such a case. providing. In this function, instead of increasing the hierarchical level that generalizes the value of a certain semi-identifier, another solution can be selected, for example, by lowering the hierarchical level that generalizes the value of another semi-identifier.

  On the other hand, if the hierarchy level that generalizes the value of one quasi-identifier can be adjusted without changing it uniformly, it is considered that k anonymized data that is more convenient for the user can be obtained. For example, in the case of Fig. 2, it is possible to satisfy 2 anonymity by generalizing the hierarchy level by 1 for both the address and age, but the address is "Kawasaki City" or "Yokohama City" as shown in Fig. 3 Does not change the value of the address, and others can satisfy the 2 anonymity even if the same generalization as FIG. 2 is performed. At this time, the latter is easier to use for analysis because the address information remains in more detail.

  However, in the technique shown in Non-Patent Document 4 described above, when changing the hierarchical level of a value having a quasi-identifier, the hierarchical level of all values of the quasi-identifier must be changed to the same one. As shown in FIG. 3, the solution cannot be adjusted only for a specific quasi-identifier. Thus, the technique shown in Non-Patent Document 4 has a problem that trial and error for obtaining better anonymized data cannot be performed flexibly.

  In addition, in the clustering type method such as Non-Patent Document 5, it is not necessary to increase the hierarchical level of the same quasi-identifier as the frequency of appearance is high. Therefore, the clustering method has a feature that it is easier to obtain data suitable for analysis than the hierarchical search method. However, since the technique shown in Non-Patent Document 4 is specialized in the hierarchical search method as described above, this clustering method cannot be applied to the technique of Non-Patent Document 4. That is, depending on the technique shown in Non-Patent Document 4, there is a problem that even if a method for obtaining better anonymized data appears, it cannot be flexibly handled.

  In order to solve the above problems, in one invention, (1) anonymization target data capturing unit that captures anonymization target data, and (2) generalized hierarchical data that is created based on the anonymization target data (3) The anonymization execution unit that anonymizes the anonymization target data using the generalized hierarchy data, and outputs anonymization data that is the result of k anonymization and its accompanying information And (4) an anonymization map display unit that displays on the screen an anonymization map highlighting the value of the quasi-identifier used to create the k anonymization data, and (5) the anonymization target data, There is provided a personal information anonymization support device having generalized hierarchical data, the k anonymization data, and a storage device for storing the anonymization map.

  Further, in one invention, (1) an anonymization target data capturing unit that captures anonymization target data, and (2) a generalized hierarchy creating unit that creates generalized hierarchical data based on the anonymization target data; (3) a first k anonymization executing unit that anonymizes the anonymization target data using the generalized hierarchical data, and outputs anonymized data that is a result of k anonymization and its accompanying information; (4) On the screen, the anonymization map highlighting the value of the quasi-identifier used to create the k anonymization data on the generalized hierarchical data displayed in a tree structure is displayed on the screen. An anonymization map editing unit that accepts an edit input, and (5) a second k anonymization execution unit that anonymizes the anonymization target data using the anonymized map after editing, and (6) Anonymization target data, the generalized hierarchical data, the k Naka data, provides personal information anonymization support device having a storage device for storing said pseudonym map.

  According to one aspect of the invention, the user can easily confirm the value of the quasi-identifier and the hierarchy level used for creating the k-anonymized data on the generalized hierarchy data displayed in a tree structure. Moreover, according to one invention, a user can implement the adjustment for obtaining k anonymization data suitable for an analysis purpose more flexibly. Problems, configurations, and effects other than those described above will become apparent from the following description of embodiments.

The figure showing the example of a generalization hierarchy. The figure showing the example of execution of 2 anonymization. 2 is a diagram illustrating an example in which the value of the quasi-identifier is left in more detail than FIG. 2 while keeping anonymization. The block diagram showing the example of whole structure of a personal information anonymization assistance apparatus. The flowchart which shows the preparation procedure of k anonymization data by a personal information anonymization assistance apparatus. The figure which shows the example of a capture screen of the anonymization object data. The figure which shows the example of an input screen of k anonymization execution part. The figure showing the example of the anonymization map file of a semi-identifier. The figure for demonstrating "k anonymization threshold value which k anonymization data implement | achieves." The figure which shows the example of a confirmation screen of k anonymization result. The figure which shows the visualization image of the value before anonymization with respect to the value after anonymization. The figure which shows the visualization image of the value after anonymization with respect to the value before anonymization. The image figure in the case of editing and specializing the quasi-identifier anonymization map. The image figure in the case of editing and generalizing the anonymization map of a semi-identifier. The image figure of the screen which presents the reference information for editing the anonymization map of a semi-identifier.

  Embodiments of the invention will be described below with reference to the accompanying drawings. However, it should be noted that the embodiments described below are merely examples for realizing the invention and do not limit the technical scope of the invention. In the following embodiment, an example in which an anonymization map is represented by a GUI (Graphical User Interface) will be described, but it may be represented by a CUI (Character User Interface).

(1) Basic Embodiment (1-1) Overall Configuration FIG. 4 shows the overall configuration of a personal information anonymization support device presented as an embodiment. This trial and error support device includes an input / output device 400, an information processing device 410, and a storage device 420.

  The input / output device 400 is used to input / output information necessary for anonymization. The information necessary for anonymization includes anonymization target data, operation input input through the user interface, and various screens output through the user interface (for example, confirmation screens including an anonymization map).

  The information processing apparatus 410 is a computer that processes various types of information, and is realized as a computer (configured with a CPU, RAM, ROM, etc.) that executes a program. FIG. 4 shows only the function that supports the trial-and-error adjustment work of the k-anonymized data by the user among various functions realized through the execution of the program. The anonymization target data capturing unit 411 executes processing for capturing the anonymization target data 421 from the input / output device 400. The generalized hierarchy creating unit 412 creates a generalized hierarchy for the anonymization target data 421 and stores it as generalized hierarchy data 422 in the storage device 420. The k anonymization execution unit 413 anonymizes the anonymization target data 421 using the generalized hierarchy data 422 and stores the created anonymization data 423 in the storage device 420. The k anonymization result output unit 414 displays the created anonymized data 423, anonymized map data 424 indicating the correspondence between the values of the quasi-identifiers used for the creation, anonymized summary data 425, and the like on the screen. . In this specification, the display function of the anonymization map among the display functions of the k anonymization result output unit 414 is referred to as “anonymization map display unit”. The anonymized map editing unit 415 receives a user's editing input for the anonymized map and executes an anonymized map editing process. The post-adjustment anonymization execution unit 416 anonymizes the anonymization target data 421 using the edited anonymization map.

  The storage device 420 includes anonymization target data 421, generalized hierarchical data 422, anonymization data 423, anonymization map data 424 corresponding to the anonymization map, and anonymization summary data 425 expressing the data quality of the anonymization data 423. Is stored. The storage device 420 is configured by, for example, a hard disk drive or an SSD. As a file system operating on hardware, a local file system such as Linux ext3 or a distributed file system such as HDFS of distributed processing infrastructure Hadoop can be considered.

  In this specification, the “anonymization map” refers to an expression of a correspondence relationship between the value of the quasi-identifier before anonymization and the value of the quasi-identifier after anonymization. For example, FIG. 8 shows an example of anonymized map data in the CUI format (CSV file format) for the quasi-identifier of prefectures. In the case of FIG. 8, the value of the quasi-identifier before anonymization is arranged in the first column, and the value of the quasi-identifier after anonymization is arranged in the second column. However, the expression format of the anonymization map is not limited to the CUI format. For example, a GUI format as shown in the anonymization map column 1009 in FIG. 10 may be used. As will be described later, when the anonymization map is expressed by a tree structure corresponding to generalized hierarchical data, the correspondence relationship before and after anonymization is expressed by highlighting only the value of the quasi-identifier after anonymization.

(1-2) Procedure for creating k anonymized data FIG. 5 shows a procedure for creating k anonymized data by the personal information anonymization support device. The following processing is realized through execution of a program by the information processing apparatus 410.

[Step S501]
The anonymization target data capturing unit 411 captures the anonymization target data file from the input / output device 400. The anonymization target data capturing unit 411 stores the captured anonymization target data file in the anonymization target data 421 of the storage device 420 together with the definition information of the column of the file. Column definition information refers to metadata about a column such as the column name and data type.

[Step S502]
The generalized hierarchy creating unit 412 creates a generalized hierarchy corresponding to the anonymization target data 421. The generalized hierarchy is stored as generalized hierarchy data 422 in the storage device 420.

[Step S503]
The k anonymization execution unit 413 anonymizes the anonymization target data 421 using the generalized hierarchy data 422, and outputs the data after the anonymization and the accompanying information. The data after k anonymization is stored in the storage device 420 as anonymized data 423. Ancillary information of data after k anonymization means anonymization information such as anonymization map information defining rules for replacing quasi-identifier values in the implementation of k anonymization, and k value realized as a result of k anonymization It is summary information and is stored in the storage device 420 as anonymized map data 424 and anonymized summary data 425, respectively. Details of the anonymization map data 424 and the anonymization summary data 425 will be described later.

[Step S504]
The k anonymization result output unit 414 presents information corresponding to the created anonymization data 423, anonymization map data 424, anonymization summary data 425, and the like on a confirmation screen (for example, FIG. 10). The user of the personal information anonymization support device confirms the information on the confirmation screen.

[Step S505]
The anonymized map editing unit 415 determines whether or not the user has performed an editing operation on the anonymized map displayed on the operation screen. Here, when there is no editing instruction for the anonymization map (for example, when the “OK” button is operated), the anonymization map editing unit 415 ends this processing. On the other hand, when there is an editing instruction for the anonymization map (for example, when there is an instruction input), the anonymization map editing unit 415 proceeds to step S506.

[Step S506]
The anonymization map editing unit 415 changes the anonymization map based on an instruction input for the anonymization map received through the operation screen, and calculates information such as the k anonymization threshold and information loss that the anonymization map after the change satisfies. To do. By executing this process, the anonymized map data 424 and the anonymized summary data 425 stored in the storage device 420 are updated.

[Step S507]
The anonymization map editing unit 415 determines whether the anonymization map desired by the user has been created. If there is an instruction input for accepting the created anonymization map, the anonymization map editing unit 415 proceeds to step S508, and if there is no instruction input, the anonymization map editing unit 415 proceeds to step S509.

[Step S508]
The post-adjustment anonymization execution unit 416 anonymizes the anonymization target data 421 using the anonymization map created in step S506, and creates anonymization data 423. The anonymized data 423 in the storage device 420 is updated with the created anonymized data 423.

[Step S509]
The generalized hierarchy creating unit 412 executes a generalized hierarchy editing process. The editing contents of the generalized hierarchy are given by the user through the operation screen, for example. When the editing is completed, the generalized hierarchical data 422 of the storage device 420 is updated.

(1-3) Detailed Configuration Next, details of each unit or function unit configuring the personal information anonymization support device will be described.

(1-3-1) Input / Output Device The input / output device 400 inputs / outputs data to / from the information processing device 410. The input / output device 400 is realized by a mouse, a keyboard, a display, or the like, for example.

(1-3-2) Anonymization target data capturing unit The anonymization target data capturing unit 411 captures the anonymization target data and its column information in the storage device 420 as the anonymization target data 421. For example, in the anonymization target data capture screen 600 shown in FIG. 6, when the user presses the capture button 603, a comma-delimited character string written in the first line of the file specified in the anonymization target data column 601 is displayed. It is regarded as a column name, and the second and subsequent lines are written in the anonymization target data 421 as the main body of the anonymization target data. The anonymization target data 421 is identified by the name specified in the anonymization target data name column 602. The method for specifying column information is not limited to this. For example, a file in which data starts from the first line may be specified, and column information may be specified from another input field. Moreover, the character code at the time of reading the anonymization object data file may be designated. As a type of the anonymization target data file to be captured, personal data in a CSV file format obtained in advance by the user can be considered.

(1-3-3) Generalized Hierarchy Creation Unit The generalized hierarchy creation unit 412 creates a generalized hierarchy based on the anonymization target data 421 captured by the anonymization target data capture unit 411, and the created data To the generalized hierarchical data 422. When creating the generalized hierarchy, a part or all of the columns included in the column information of the anonymization target data 421 are designated as quasi-identifiers, and the quasi-identifier is performed. The generalized hierarchy may be automatically generated by the method described in Non-Patent Document 1, for example, or may be interactively created on the GUI as in the method described in Non-Patent Document 4.

(1-3-4) k anonymization execution unit The k anonymization execution unit 413 anonymizes the anonymization target data 421 by the generalized hierarchy data 422 and outputs the data as anonymization data 423. Further, the k anonymization execution unit 413 simultaneously outputs anonymization map data 424 and anonymization summary data 425 that are incidental information related to the execution result of k anonymization. The k anonymization execution unit 413 realizes k anonymization based on information input through the k anonymization execution screen 700 as illustrated in FIG. 7, for example.

  In the case of the k anonymization execution screen 700 shown in FIG. 7, the name of the anonymization target data stored in the anonymization target data 421 is designated through the anonymization target data name column 701. FIG. 7 shows a case where names, hierarchies, and the like registered in advance by a pull-down button operation are displayed as a list, and a specific name or the like can be selected from the displayed items. However, it is also possible to directly enter a name or the like. Through the k anonymization threshold field 702, the value of k that the k anonymization data should satisfy can be input. Although FIG. 7 shows an example in which a value is directly input, the value may be selected and input from items displayed by operating a pull-down button. Through the quasi-identifier field 703, a part or all of the quasi-identifier designated by the generalized hierarchy creating unit 412 is designated. Although FIG. 7 shows an example in which a value is directly input, it may be selected and input from a list.

  In the generalized hierarchy column 704, the name of the generalized hierarchy created by the generalized hierarchy creating unit 412 is input. In FIG. 7, a specific name can be selected from names registered in advance by operating a pull-down button. However, the name may be directly input. In the k anonymization technique column 705, a method used for k anonymization is input. In FIG. 7, the hierarchical search type method is selected, but of course, it is not limited to this method. For example, a clustering method may be used. In FIG. 7, a specific method can be selected from names registered in advance by operating a pull-down button. However, the method may be directly input. In the output data name column 706, a name for identifying the anonymized data 423 to be output is input. Although FIG. 7 shows an example in which a value is directly input, the value may be selected and input from items displayed by operating a pull-down button.

  When the execution button 707 at the lower right of the screen is pressed after inputting such information, k anonymization is executed by the method specified in the k anonymization method column 705. The data obtained by k anonymization is output as anonymized data 423 with the name specified in the output data name column 706. Further, incidental information regarding the execution result of k anonymization is also output.

  The items displayed in FIG. 7 are merely examples, and other items may be designated and input. For example, the number of plans, the allowable number of deleted records, a method used for generating a generalized hierarchy, and the like may be designated and input.

  Next, anonymized map data 424 and anonymized summary data 425, which are output supplementary information, will be described. The anonymization map data 424 is a correspondence table between pre-conversion values and post-conversion values of quasi-identifier values used when k anonymization is performed. For example, as shown in FIG. 8, the anonymization map data 424 is expressed as a CSV file in which values before conversion are described in the first column and values after conversion are described in the second column. In this embodiment, CSV files of the format shown in FIG. 8 are prepared separately for each quasi-identifier, but conversion information regarding all quasi-identifiers may be included in one file. For example, the CSV file may have a semi-identifier name in the first column, a value of the semi-identifier before conversion in the second column, and a value of the semi-identifier after conversion in the third column.

  Anonymization summary data 425 is statistical information about k anonymization data, k anonymization threshold specified when k anonymization is executed, k anonymization threshold realized by k anonymization data, information loss rate, anonymity There is a list of quasi-identifier values after conversion into the number of elements.

  The k anonymization threshold realized by k anonymized data is the minimum value of the number of records of classification when k anonymized data is classified by a combination of quasi-identifier values. This may be larger than the k anonymization threshold specified when executing k anonymization. For example, when the anonymization target data shown in FIG. 9 is anonymized by the generalization hierarchy shown in FIG. 9, the anonymization data is as shown in FIG. Since it is divided into a classification and a classification of gender = female and age = 20 in which the number of records is 4, the k anonymization threshold realized by the k anonymization data is 3.

  The information loss rate is an index representing the degree of information loss of anonymized data with respect to anonymization target data, and is defined by, for example, Expression 1 and Expression 2 shown below. In Equation 1 and Equation 2 described later, D is anonymization target data or anonymization data, q is a quasi-identifier, i is a subscript of the anonymization target data or anonymization data record, Q is the number of quasi-identifiers, R ( D) is the number of cases of data D, f (D, i, q) is the frequency of occurrence of the value r (D, i, q) in the record i of the semi-identifier q in the data D at the semi-identifier q of the data D. Represent. In addition, log represents a logarithmic function with a base of 2. However, the base of the logarithmic function may be any real number exceeding one, such as the base of the natural logarithm e = 2.71828..., The base 10 of the common logarithm, as long as the same definition expression is used.

  In this embodiment, the creation of the generalized hierarchy and the execution of k anonymization are described as separate screens. However, when generating the generalized hierarchy, the processes of the generalized hierarchy creating part and the k anonymization executing part are performed. It may be implemented as a continuous and unitary object.

  The input screen of the k-anonymization execution unit 413 may be the one shown in FIG. 7, but in addition to these, the number of deleted records that is the maximum number of exceptional records that can be deleted to satisfy k-anonymity May be specified. In addition, when the hierarchical search type method is selected in the k anonymization method column 705, there are generally a plurality of solutions, and therefore the upper limit of the number of solutions to be searched may be specified.

  As for the anonymization summary data 425, in addition to the above-mentioned ones, when specifying the number of deleted records, the number of records actually deleted when k anonymization is executed may be included.

(1-3-5) k anonymization result output unit In the k anonymization result output unit 414, anonymization data 423 that is an execution result of k anonymization, anonymization map data 424 that is incidental information, anonymization summary data 425 is output. In the present embodiment, these pieces of information are output according to the confirmation screen shown in FIG.

-Output of anonymized data 423 By selecting the name of the anonymized data in the post-anonymized data column 1001 in the confirmation screen shown in FIG. 10 and pressing the data output button 1002, the corresponding generalized hierarchical data 422 is The records are output as a CSV file in which the records are output line by line in the order of the columns described in the column information. The output destination file path is specified in the file dialog.

Output of anonymization map data 424 Anonymization based on the quasi-identifier selected in the quasi-identifier field 1006 in the confirmation screen shown in FIG. 10 and the generalized hierarchy of the quasi-identifier stored in the generalized hierarchy data 422 In the map field 1009, the tree structure of the generalized hierarchical data 422 is output. Further, based on the quasi-identifier anonymization map data 424, a node corresponding to the converted quasi-identifier value is highlighted. In this way, the anonymization map is the one in which the value of the quasi-identifier after anonymization is highlighted in the tree structure of the generalized hierarchical data 422. For leaf nodes that are leaf nodes that do not have a highlighted node in their ancestor nodes, they are attribute values that are output in the anonymized data, just like the quasi-identifier values after conversion, It is highlighted like the quasi-identifier value after conversion.

-Output of the anonymization summary data 425 The k anonymization threshold value specified when executing the anonymization stored in the anonymization summary data 425 is set to “k anonymization threshold field 1003”, and the anonymization summary data 425 is set. The k anonymization threshold realized by the stored k anonymization data is output to the “realized k anonymization threshold field 1004” and the information loss rate stored in the anonymization summary data 425 is output to the “information loss field 1005”. To do. Furthermore, based on the quasi-identifier selected in the quasi-identifier field 1006, all the values after the anonymization of the quasi-identifier stored in the anonymization summary data 425 are anonymized in the list display field 1007 of the values after anonymization. The number of anonymized values of the quasi-identifier stored in the conversion summary data 425 is output to the value number column 1008. The user determines the quality of the anonymized data by looking at these pieces of information, and determines whether the anonymized map needs to be edited.

(1-3-6) Anonymization map editing unit The anonymization map editing unit 415 confirms the correspondence between the value before anonymization and the value after anonymization based on the display of the anonymization map column 1009 by the user. Is presented in a possible manner. Methods for confirming the correspondence include navigation from a value after anonymization to a value before anonymization and navigation from a value before anonymization to a value after anonymization. After confirming the correspondence relationship with these navigation screens, the user specializes or generalizes the value after anonymization and edits the original anonymization map. The user can confirm how the numerical values of the “realized anonymization threshold field 1004” and “information loss field 1005” provided through the anonymization map editing unit 415 change, and the anonymization map suitable for the analysis requirements Can be obtained.

・ Navigation from the value after anonymization to the value before anonymization In the navigation from the value after anonymization to the value before anonymization, the anonymization map editor 415 starts with a certain value after anonymization. A screen indicating which value before anonymization (that is, the value of the quasi-identifier of the anonymization target data) is displayed. The screen change of the anonymized map column 1009 will be described with reference to FIG. In FIG. 11, the left figure represents the value of the quasi-identifier after anonymization, and the right figure represents the value of the quasi-identifier before anonymization. First, in the figure on the left, with the highlighted node (indicated by light shading) selected as the value after anonymization, the context menu is displayed by right-clicking the mouse button. Then, when the item “Display value before anonymization” is selected, the right figure is displayed. By this operation, the value before anonymization that is anonymized to the selected value after anonymization is highlighted in a different manner from the value after anonymization, and the display shifts to the corresponding value before anonymization. At this time, since there are generally a plurality of pre-anonymization values that are anonymized to the selected post-anonymization values, the value before the anonymization to which the display is first transferred is arbitrary, but in this embodiment such anonymity Of the values before conversion, the leftmost display in the anonymization map column 1009 is assumed.

  The value before anonymization that is anonymized by a node designated by the user (indicated by a bold line in the left figure) is confirmed as follows. First, a user displays a context menu by right-clicking a mouse button while designating a certain node, and selects an item “previous value” or “next value” therefrom. Thereby, an emphasis display moves between the values before anonymization made anonymous by the value after anonymization selected previously. Thereby, the value before anonymization made anonymous by the value after anonymization selected previously can be confirmed.

・ Navigation from the value before anonymization to the value after anonymization In the navigation from the value before anonymization to the value after anonymization, the anonymization map editor 415 determines that a certain value before anonymization is after anonymization. Display a screen that indicates which value will be anonymized. The screen change of the anonymization map column 1009 will be described with reference to FIG. In FIG. 12, the left figure represents the quasi-identifier value before anonymization, and the right figure represents the quasi-identifier value after anonymization. First, in the figure on the left, the user selects the node indicated by the bold line among the highlighted nodes (shown by dark shading) as the value before anonymization, and right-clicks the mouse button to display the context menu. Display and select the item “Display value after anonymization”. Thereby, a display shifts after the anonymization which is the anonymization destination of the value before the selected anonymization. That is, it moves to the right figure. At this time, highlighting of the value before anonymization is canceled.

Specialization In the navigation that specializes the value of the quasi-identifier used for anonymization, the anonymization map editing unit 415 generalizes the value of the quasi-identifier specified by the user among the quasi-identifiers used for anonymization. Display a screen to change to a more specific value of the level (value of the lower hierarchy). The screen change of the anonymization map column 1009 will be described with reference to FIG. In FIG. 13, the left figure represents the value of the quasi-identifier before specialization, and the right figure represents the value of the quasi-identifier after specialization. First, in the left diagram, the user right-clicks a highlighted node to display a context menu, and selects an item “specialization” therefrom. Thereby, the value of the quasi-identifier after anonymization is changed from the one value selected in the left figure to all values that are one level lower than the value. Further, all the changed values are highlighted, and the highlighting of the originally selected value is canceled. Furthermore, based on the result after editing, the realized k anonymization threshold value column 1004, the information loss column 1005, the list display column 1007 of values after anonymization, and the number of values column 1008 are updated. Note that an undo function may be provided for a case where editing is to be canceled because the edited result does not satisfy k anonymity.

Generalization In the navigation that generalizes the value of the quasi-identifier used for anonymization, the anonymization map editing unit 415 generalizes the value of the quasi-identifier specified by the user among the quasi-identifiers used for anonymization. Display a screen for changing to a more abstract value (higher level value) of the level. The screen change of the anonymization map column 1009 will be described with reference to FIG. In FIG. 14, the left figure represents the value of the quasi-identifier before generalization, and the right figure represents the value of the quasi-identifier after generalization. First, in the left diagram, the user right-clicks a highlighted node to display a context menu, and selects an item “generalization” from the context menu. Thereby, the value of the quasi-identifier after anonymization is changed from the value selected in the left figure to a value that is one level higher than the value. At this time, the value of the quasi-identifier before the generalization, and the value of the quasi-identifier in the descendant relationship (the relationship included as a lower hierarchy) of the quasi-identifier value after the generalization and the new anonymization value After the generalization, it will be changed to a new quasi-identifier value after anonymization. Furthermore, the value after the generalization is highlighted, and the highlighting of the value of the quasi-identifier that is a value before generalization and is a descendant of the value after the generalization is canceled. Furthermore, based on the result after editing, the realized k anonymization threshold value column 1004, the information loss column 1005, the list display column 1007 of values after anonymization, and the number of values column 1008 are updated.

  Note that an undo function may be provided in the case where it is desired to cancel the editing because the edited result has raised the generalization level too much and does not satisfy the analysis requirements.

(1-3-7) Recommended Editing Content Presentation Unit The recommended editing content presentation unit 417 presents the editing content to be executed next to the user based on a certain standard after the above-described specialization or generalization. This function becomes effective when, for example, the recommended editing content presentation button 1012 is pressed on the confirmation screen shown in FIG. FIG. 15 shows an example of a recommended editing means presentation screen 1500. The recommended editing means presentation screen 1500 displays editing contents that can be performed on the anonymization map on the recommended editing means 1501 in ascending order of information loss assumed after editing. Each row shown in the recommended editing means 1501 is realized by editing indicated by the quasi-identifier to be edited, the node indicating the anonymized value, the editing content to be performed on the node, and the information up to the previous stage. It represents anonymization threshold and information loss. When the number of deleted records is designated by the k anonymization execution unit 413, the number of deleted records to be realized may be displayed. By selecting one row of the recommended editing means 1501 and pressing the apply button 1502, the editing shown in the corresponding row is performed. Furthermore, after this editing is completed, editable contents that can be further implemented may be displayed based on the anonymized map after editing.

(1-3-8) Adjusted Anonymization Execution Unit The adjusted anonymization execution unit 416 outputs, as anonymized data 423, the value of the quasi-identifier of the anonymization target data 421 replaced by the edited anonymization map. To do. For example, it can be executed from the re-anonymization execution button 1011 in FIG.

(1-4) Summary If the personal information anonymization support apparatus described above is used, the value of the quasi-identifier and the hierarchy level used to create k anonymization data are emphasized on the generalized hierarchy data displayed in a tree structure. Since it is displayed, the user can easily confirm the value of the quasi-identifier and the hierarchical level used to create the k-anonymized data. Further, if the personal information anonymization support device described above is used, the value of the quasi-identifier for obtaining k anonymization data can be adjusted (for example, “specialization”, “generalization”) through operation on the GUI. Flexible and simpler adjustment work is realized.

(2) Other Embodiments The present invention is not limited to the above-described embodiments, and includes various modifications. For example, the above-described embodiment has been described in detail for easy understanding of the present invention, and it is not always necessary to include all the configurations described. It is also possible to add a known configuration to the above-described embodiment, delete a part of the above-described embodiment, or replace a part of the above-described embodiment with a known configuration.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them, for example, with an integrated circuit. Information such as programs, tables, and files that realize each function can be stored in a storage device such as a memory, a hard disk, and an SSD (Solid State Drive), or a storage medium such as an IC card, an SD card, and a DVD. Control lines and information lines indicate what is considered necessary for the description, and do not represent all control lines and information lines necessary for the product. In practice, it can be considered that almost all components are connected to each other.

400 ... I / O device 410 ... Information processing device 411 ... Anonymization target data capturing unit 412 ... Generalized hierarchy creation unit 413 ... k Anonymization execution unit 414 ... k Anonymization result output unit 415 ... Anonymization map editing unit 416 ... Post-adjustment anonymization execution unit 417 ... recommended editing content presentation unit
420 ... Storage device 421 ... Anonymization target data 422 ... Generalized hierarchical data 423 ... Anonymization data 424 ... Anonymization map data 425 ... Anonymization summary data 600 ... Anonymization target data capture screen 601 ... Anonymization target data column 602 ... anonymization target data name column 603 ... import button 700 ... k anonymization execution screen 701 ... anonymization target data name column 702 ... k anonymization threshold value column 703 ... semi-identifier column 704 ... generalized hierarchy column 705 ... k anonymization Method column 706 ... Output data name column 707 ... Execution button 1000 ... k anonymization result viewer screen 1001 ... Data field after anonymization 1002 ... Data output button 1003 ... k anonymization threshold column 1004 ... realized k anonymization threshold column 1005 ... Information loss column 1006 ... Semi-identifier column 1007 ... List of values after anonymization display column 1008 ... Number of values column 1009 ... Anonymous Map field 1010 ... anonymous map output button 1011 ... re-anonymous execution button 1012 ... Recommended edits presentation button 1500 ... Recommended editing means presentation screen 1501 ... Recommended editing means 1502 ... Apply button

Claims (8)

An anonymization target data capturing unit for capturing anonymization target data;
A generalized hierarchy creating unit for creating generalized hierarchy data based on the anonymization target data;
A first k anonymization execution unit that anonymizes the anonymization target data using the generalized hierarchical data, outputs k anonymization data that is a result of k anonymization, and accompanying information;
On the generalized hierarchical data displayed in a tree structure, an anonymization map highlighting the value of the quasi-identifier used to create the k anonymization data is displayed on the screen, and editing input to the anonymization map An anonymized map editor that accepts
A second k anonymization execution unit that anonymizes the anonymization target data using the anonymized map after editing;
A storage device for storing the anonymization target data, the generalized hierarchy data, the k anonymization data, and the anonymization map;
A trial and error support device for anonymizing personal information. In the trial and error support device for personal information anonymization according to claim 1,
The anonymization map editing unit displays the amount of information lost at the time of creating the k anonymization data as an information loss rate together with the anonymization map. In the trial and error support device for personal information anonymization according to claim 1,
The anonymization map editing unit, as the editing input, specifies a quasi-identifier to be edited, generalization from a specified quasi-identifier to a higher hierarchy, or specialization to a lower hierarchy than a specified quasi-identifier A trial and error support device for anonymizing personal information characterized by accepting designation. In the trial and error support device for personal information anonymization according to claim 1,
The anonymization map editing unit accepts a quasi-identifier to be edited through designation of a mouse pointer, generalizes from a quasi-identifier received as an object to be edited to a higher hierarchy, or specializes to a lower hierarchy than a designated quasi-identifier The personal information anonymization trial-and-error support device is characterized in that the designation of a personal information is received from a selection item candidate displayed by right-clicking the mouse. In the trial and error support device for personal information anonymization according to claim 1,
The anonymization map editing unit, when the display of the value after anonymization is selected for the quasi-identifier specified on the anonymization map displayed on the screen, the anonymity corresponding to the value of the specified quasi-identifier The quasi-identifier value before conversion is highlighted on the anonymization map. A personal information anonymization trial-and-error support device. In the trial and error support device for personal information anonymization according to claim 1,
The anonymization map editing unit, when the display of the value before anonymization is selected for the quasi-identifier designated on the anonymization map displayed on the screen, the anonymity corresponding to the value of the designated quasi-identifier A trial-and-error support device for personal information anonymization, wherein the value of the quasi-identifier after conversion is highlighted on the anonymization map. In the trial and error support device for personal information anonymization according to claim 1,
For each quasi-identifier used to create the anonymization data, the k-anonymization threshold assumed when the quasi-identifier used for anonymization is generalized to a higher hierarchy than the current quasi-identifier and the quasi-identifier after generalization Information loss rate indicating the amount of information lost when k anonymized data is created on the screen, and / or the quasi-identifier used for anonymization is special in the lower hierarchy than the current quasi-identifier Recommended edit content presentation that displays on the screen the information loss rate indicating the amount of information lost when k anonymization data is created using the k anonymization threshold and the quasi-identifier after specialization A trial and error support device for anonymizing personal information, further comprising: An anonymization target data capturing unit for capturing anonymization target data;
A generalized hierarchy creating unit for creating generalized hierarchy data based on the anonymization target data;
The anonymization target data is k anonymized using the generalized hierarchical data, and the k anonymization execution unit that outputs k anonymization data and its incidental information as a result of k anonymization,
An anonymization map display unit that displays on the screen an anonymization map highlighting the value of the quasi-identifier used to create the k anonymization data;
A storage device for storing the anonymization target data, the generalized hierarchy data, the k anonymization data, and the anonymization map;
A trial and error support device for anonymizing personal information.

Images