JP2016184213A - Method for anonymizing numeric data, and numeric data anonymization server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To suppress the degradation of data quality before and after the anonymization of numeric data.SOLUTION: An anonymization server 100 generates, in a process to create the first hierarchy of a generalization hierarchy, a combination of a first node included in a zeroth hierarchy that is one hierarchy below the first hierarchy and each of nodes adjacent to the first node in the magnitude correlation of numeric values; calculates, for each of the generated combinations, a deviation between the statistical indicator of numeric data anonymized using the first hierarchy when a node into which the nodes of the combination are integrated is determined to be the node of the first hierarchy corresponding to each of the nodes of the combination, and the statistical indicator of the numeric data; and determines a node into which the nodes of a combination where the calculated deviation is minimal are integrated to be the node of the first hierarchy corresponding to each of the nodes of the combination.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a method for anonymizing numerical data and a numerical data anonymization server.

  In recent years, cloud computing has been rapidly spreading in order to aggregate inexpensive services and information. However, security and privacy considerations in cloud computing are not always sufficient.

  There is k-anonymity as an index for evaluating the anonymity of anonymous information that cannot identify an individual. As a background art in this technical field, there is International Publication No. 2011/145401 (Patent Document 1). In this publication, “each individual's information includes attribute values of the individual with respect to a plurality of attributes. Anonymization is achieved by obscuring this attribute value. What is expressed in a tree structure depending on the degree is called a generalized hierarchical tree.This personal information anonymization device achieves an automatic configuration by constructing a tree using frequency information of attribute values. By defining the quantity measuring means, a generalized hierarchical tree is used to quantitatively determine the amount of information loss between two anonymous data or data in the middle of anonymization ”(see summary). ).

International Publication No. 2011/145401

  The technique described in Patent Document 1 creates a Hu-Tucker code tree for each attribute of anonymization target data, and generalizes the attribute value of each attribute using a generalization hierarchy indicated by the Hu-Tucker code tree. Thus, k-anonymization is executed. The Hu-Tucker code tree is generated from frequency information of attribute values and order information. However, the attribute value itself is not considered in creating the Hu-Tucker code tree. Therefore, the statistical index calculated from the attribute value generalized by the technique described in Patent Document 1 using the Hu-Tucker code tree may be significantly different from the statistical index of the attribute value before generalization. That is, there is a possibility that the data quality is significantly deteriorated by k-anonymization in the technique described in Patent Document 1.

  In order to solve the above problems, one embodiment of the present invention employs the following configuration, for example. A numerical data anonymization server that holds numerical data including a plurality of numerical values is a method for anonymizing the numerical data, wherein the numerical data anonymization server includes a processor that executes a program and a memory that the processor accesses In the method, the processor creates a generalized hierarchy including a plurality of hierarchies based on numerical values included in the numerical data, and the processor uses the generalized hierarchies to The numerical data is anonymized, and in the process of creating the first layer of the generalized layer, the first node included in the 0th layer, which is one layer below the first layer, and the first node A combination of each node adjacent to the node is generated, and for each of the generated combinations, a node obtained by integrating the combination node is Calculate the divergence between the statistical index of the numerical data anonymized using the first hierarchy and the statistical index of the numerical data when the first hierarchical node corresponding to each of the matching nodes is determined And determining a node obtained by integrating the combination nodes having the smallest calculated divergence as the first layer node corresponding to each of the combination nodes.

  According to one embodiment of the present invention, deterioration of data quality due to anonymization can be suppressed.

  Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

It is a block diagram which shows the structural example of the anonymization server in Example 1. FIG. It is an example of the anonymization object data in Example 1. FIG. 4 is an example of generalized hierarchical data in the first embodiment. It is an example of the anonymization result data in Example 1. 3 is a flowchart illustrating an example of an overall process of k-anonymization in the first embodiment. 10 is a flowchart illustrating an example of a generalized hierarchy generation process for numerical type quasi-identifiers according to the first exemplary embodiment. It is an example of the age hierarchy data in a conventional method. It is a figure which shows an example of a comparison with the anonymization of the numerical type semi-identifier using the generalized hierarchy of Example 1, and the anonymization of the numerical type semi-identifier using the conventional generalized hierarchy.

  Embodiments of the present invention will be described below with reference to the accompanying drawings. The anonymization server of this embodiment creates a generalized hierarchy of quasi-identifiers indicated by numerical values so as to reduce the divergence between the statistical indicators of the quasi-identifiers before and after anonymization. The anonymization server can suppress degradation of data quality due to anonymization by anonymizing the value included in the quasi-identifier using the generalized hierarchy.

  FIG. 1 shows a configuration example of the anonymization server of this embodiment. An anonymization server 100 according to the present embodiment is configured by a computer having a processor (CPU) 101, a memory 102, an auxiliary storage device 103, and a communication interface 104.

  The processor 101 executes a program stored in the memory 102. The memory 102 includes a ROM that is a nonvolatile storage element and a RAM that is a volatile storage element. The ROM stores an immutable program (for example, BIOS). The RAM is a high-speed and volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores a program executed by the processor 101 and data used when the program is executed.

  The auxiliary storage device 103 is a large-capacity non-volatile storage device such as a magnetic storage device (HDD) or a flash memory (SSD), and stores a program executed by the processor 101 and data used when the program is executed. To do. That is, the program is read from the auxiliary storage device 103, loaded into the memory 102, and executed by the processor 101.

  The anonymization server 100 may have an input interface 105 and an output interface 108. The input interface 105 is an interface that is connected to a keyboard 106, a mouse 107, and the like and receives input from an operator. The output interface 108 is an interface to which a display device 109, a printer, or the like is connected, and the execution result of the program is output in a form that can be visually recognized by the operator.

  The communication interface 104 is a network interface device that controls communication with other devices according to a predetermined protocol. The communication interface 104 includes, for example, a serial interface such as a USB.

  A program executed by the processor 101 is provided to the anonymization server 100 via a removable medium (CD-ROM, flash memory, etc.) or a network, and is stored in a nonvolatile auxiliary storage device 103 which is a non-temporary storage medium. . Therefore, the anonymization server 100 may have an interface for reading data from the removable media.

  The anonymization server 100 is a computer system configured on a single computer or a plurality of computers configured logically or physically, and operates in a separate thread on the same computer. It may be possible to operate on a virtual machine constructed on a plurality of physical computer resources.

  The processor 101 includes an anonymization target data capturing unit 111, a generalized hierarchy creation unit 112, a statistical index calculation unit 113, a k-anonymization execution unit 114, and a k-anonymization result output unit 115. For example, the processor 101 operates as the anonymization target data capturing unit 111 by operating in accordance with the anonymization target data capturing program loaded in the memory 102, and operates in accordance with the generalized hierarchy creation program loaded in the memory 102. By doing so, it functions as the generalized hierarchy creating unit 112. The same applies to the other units included in the processor 101.

  The anonymization target data capturing unit 111 captures the anonymization target data 121 via the communication interface 104 or the input interface 105 and stores the captured data in the auxiliary storage device 103 as the anonymization target data 121. The generalized hierarchy creating unit 112 creates a generalized hierarchy for k-anonymization for each quasi-identifier of the anonymization target data 121. The generalized hierarchy is given by a tree structure, for example, and hierarchically shows the relationship between data values before and after anonymization. The generalized hierarchy creating unit 112 stores information indicating each created generalized hierarchy in the auxiliary storage device 103 as generalized hierarchy data 122.

  The k-anonymization execution unit 114 refers to the generalized hierarchy data 122, anonymizes the anonymization target data 121, and stores the k-anonymized data in the auxiliary storage device 103 as anonymization result data 123. . For example, the k-anonymization result output unit 115 outputs the anonymization result data 123 to the display device 109 via the output interface 108 or to another device via the communication interface 104.

  The auxiliary storage device 103 holds anonymization target data 121, generalized hierarchy data 122, and anonymization result data 123. The anonymization target data 121 is original data that is an object of k-anonymization. The generalized hierarchy data 122 is data indicating a hierarchy that generalizes each quasi-identifier included in the anonymization target data 121. The quasi-identifier is information that can indirectly identify an individual in combination with another quasi-identifier. On the other hand, an identifier is information that can directly identify an individual by itself. The anonymization result data 123 is the anonymization target data 121 that has been k-anonymized based on the generalized hierarchy data 122.

  In the present embodiment, the information used by the anonymization server 100 may be expressed in any data structure without depending on the data structure. For example, a data structure appropriately selected from a table, list, database or queue can store the information. 3 to 6 described later show examples in which each data held in the auxiliary storage device 103 is expressed in a table structure.

  FIG. 2 shows an example of the anonymization target data 121. The anonymization target data 121 includes one or more types of quasi-identifiers. In the example of FIG. 2, the anonymization target data 121 includes an age 1210 and an address 1211 that are quasi-identifiers. Age 1210 stores the age of the individual corresponding to the record. The address 1211 stores an individual address corresponding to the record.

  The quasi-identifier included in the anonymization target data 121 is not limited to the example in FIG. 2 and may be arbitrary. The anonymization target data 121 may further include one or more types of identifiers. At this time, for example, the anonymization target data 121 includes information indicating whether each column is an identifier or a quasi-identifier. The anonymization target data 121 may be composed of a plurality of tables.

  FIG. 3 shows an example of the generalized hierarchy data 122. The generalized hierarchy data 122 is information indicating a generalized hierarchy represented by a tree structure in each quasi-identifier included in the anonymization target data 121. FIG. 3 is an example of the generalized hierarchical data 122 corresponding to the quasi-identifier included in the anonymization target data 121 of FIG.

  The generalized hierarchy data 122 includes age hierarchy data 1220 and address hierarchy data 1224. The age hierarchy data 1220 indicates a generalized hierarchy represented by a tree structure of the age 1210. The age hierarchy data 1220 includes a 0th hierarchy 1221, a first hierarchy 1222, and a root node 1223.

  The 0th hierarchy 1221 is the lowest hierarchy in the tree structure, and each node of the 0th hierarchy 1221 is a leaf node in the tree structure. Each leaf node of the 0th layer 1221 corresponds to each value excluding duplication included in the age 1210.

  The first hierarchy 1222 is a hierarchy above the 0th hierarchy 1221 in the tree structure. Each node of the first hierarchy 1222 is a parent node of the corresponding node of the 0th hierarchy 1221, and the same node as the corresponding node or the corresponding node and one of the nodes adjacent to the corresponding node are It is an integrated node. That is, the value included in the node of the 0th hierarchy 1221 is included in the corresponding node of the 1st hierarchy 1222. Each node of the first hierarchy 1222 has the same or higher degree of anonymization than the corresponding node of the 0th hierarchy 1221.

  The root node 1223 is the highest hierarchy in the tree structure, and each node of the root node 1223 is a node in which all the nodes of the 0th hierarchy 1221 are integrated. That is, each node of the root node 1223 is the most abstract concept including all the values included in the nodes of other layers. For example, according to the number of types of values included in the age 1210, the number of layers in the age layer data 1220 increases.

  The address hierarchy data 1224 indicates a generalized hierarchy represented by a tree structure of the address 1211. The address hierarchy data 1224 includes a 0th hierarchy 1225, a first hierarchy 1226, and a route node 1227. Since each column of the address hierarchy data 1224 is the same as each column of the age hierarchy data 1220, description thereof is omitted.

  In the age hierarchy data 1220, for example, a node whose range is displayed as “20 to 25” indicates that the age is 20 years old or more and 25 years old or less. In the address hierarchy data 1224, for example, a node in which a plurality of values are separated by “;”, such as “Kanagawa Prefecture; Tokyo; Okinawa Prefecture”, has an address in Kanagawa Prefecture, Tokyo, or Okinawa. Indicates a prefecture.

  FIG. 4 shows an example of the anonymization result data 123. Anonymization result data 123 is k-anonymized anonymization target data 121. FIG. 4 shows an example in which the anonymization target data 121 of FIG. 2 is k-anonymized.

  Each of the quasi-identifiers included in the anonymization result data 123 is a k-anonymized quasi-identifier based on the hierarchy data corresponding to the quasi-identifier included in the generalized hierarchy data 122. In the example of FIG. 4, the anonymization result data 123 includes an age 1230 and an address 1231. Age 1230 is k-anonymized age 1210 based on age hierarchy data 1220. The address 1231 is an address 1211 that is k-anonymized based on the address hierarchy data 1224.

  FIG. 5 shows an example of a process in which the anonymization server 100 of this embodiment anonymizes the anonymization target data 121. First, the anonymization target data capturing unit 111 captures the anonymization target data 121 via the input interface 105 or the communication interface 104, for example, and stores it in the auxiliary storage device 103 (S501). Subsequently, the generalized hierarchy creating unit 112 calculates the number of records of the anonymization target data 121 (S502).

  Subsequently, the generalized hierarchy creating unit 112 creates a generalized hierarchy for each quasi-identifier included in the anonymization target data 121 (S503). For example, a generalized hierarchy creating method for quasi-identifiers (for example, age 1210 in the example of FIG. 2) that is an order scale and represented by numerical values will be described later with reference to FIG. Further, for example, the generalized hierarchy creating method of FIG. 6 may be applied to all quasi-identifiers indicated by numerical values. Hereinafter, the quasi-identifier to which the generalized hierarchy creating method of FIG. It is assumed that the anonymization server 100 holds information about whether each quasi-identifier is a numerical quasi-identifier. The information may be included in the anonymization target data 121, for example, or may be stored in the auxiliary storage device 103 as other data.

  For each quasi-identifier other than the numerical quasi-identifier (address 1211 in the example of FIG. 2), the generalized hierarchy creating unit 112 constructs a Hu-Tucker code tree from frequency information of values included in the quasi-identifier, for example. This is the generalized hierarchy.

  Subsequently, the k-anonymization execution unit 114 refers to the generalized hierarchy data 122 and, for example, an operator or the like designates each column of the anonymization target data 121 based on a predetermined anonymization plan. The k-anonymization that satisfies k is performed (S504). The k-anonymization plan indicates a process for anonymizing a value included in the quasi-identifier.

  Hereinafter, a specific example of the k-anonymization execution process in step S504 will be described. For example, the k-anonymization execution unit 114 creates a node list including a root node and nodes other than leaf nodes of each hierarchy of all hierarchy data included in the generalized hierarchy data 122. The k-anonymization execution unit 114 sorts the nodes in the node list in ascending order of information loss when the value of the anonymization target data 121 is generalized using the node. For example, the smaller the frequency of the value of the anonymization target data 121 belonging to the node, the smaller the information loss amount when the value of the anonymization target data 121 is generalized using the node.

  For example, the k-anonymization execution unit 114 selects a node with the smallest amount of information loss from the node list and adds it to the empty selected node list. The k-anonymization execution unit 114 determines whether or not the anonymization result obtained by generalizing the value of the anonymization target data 121 using the nodes of the selected node list satisfies k. When the anonymization result satisfies k, the anonymization result is stored in the auxiliary storage device 103 as anonymization result data 123.

  When the anonymization result does not satisfy k, the k-anonymization execution unit 114 selects the node with the smallest amount of information loss from the unselected nodes included in the node list, adds it to the selected node list, and newly Based on the selected node list, it is determined whether or not k described above is satisfied. The same process is repeated until the anonymization result satisfies k. When the selected node list includes a node having a parent-child relationship, the k-anonymization execution unit 114 generalizes the value of the anonymization target data 121 using a node having the highest hierarchy.

  Note that when the anonymization target data 121 includes an identifier, for example, the k-anonymization execution unit 114 performs processing such as deleting the identifier or replacing each value of the identifier with another value.

  Subsequently, the k-anonymization result output unit 115 outputs the anonymization result data 123 to, for example, the display device 109, another computer, or the like (S505).

  FIG. 6 shows an example of processing in which the generalized hierarchy creating unit 112 creates a generalized hierarchy for each numerical type quasi-identifier. The generalized hierarchy creating unit 112 starts a loop composed of step S602 to step S606 for each numerical quasi-identifier included in the anonymization target data 121 (S601). The generalized hierarchy creating unit 112 acquires the frequency of each value included in the numerical type quasi-identifier and sorts the values from which duplicates are deleted in ascending order (S602). The generalized hierarchy creating unit 112 determines the sorting result as the 0th hierarchy in the hierarchy data of the numerical type quasi-identifier.

  The generalized hierarchy creating unit 112 creates a node of the highest hierarchy in the hierarchy data until the root node in the hierarchy data of the numerical type quasi-identifier is created, that is, until a node in which all nodes in the 0th hierarchy are integrated is created. For the node, a loop composed of step S604 to step S605 is started (S603).

  The generalized hierarchy creating unit 112 calculates, for each or all of the nodes in the hierarchy, a statistical index deviation A in combination with each adjacent node (S604). The statistical index divergence A is a statistical index of the numerical quasi-identifier before anonymization, a statistical index of anonymization result data in which the value of the numerical quasi-identifier is anonymized at a node obtained by integrating the adjacent nodes, and Shows the divergence.

  The following mathematical formula (1) is a calculation formula for the divergence A of the statistical index in the combination of two adjacent nodes when the statistical index is an average value.

In Equation (1), n is the total frequency of values belonging to the node of the combination, l _i is the value of the anonymization target data 121 corresponding to each node of the combination, and V is the minimum value included in the node of the combination The average value of the value and the maximum value, R is the number of records of the anonymization target data 121. For example, when the combination nodes are “5” and “10”, the minimum value included in the combination node is “5” and the maximum value is “10”, so V = (5 + 10) / 2 = 7.5. When the combination nodes are “1 to 5” and “6 to 10”, the minimum value included in the combination node is “1” and the maximum value is “10”, so V = (1 + 10) / 2 = 5.5.

Further, for example, consider a case where the combination nodes are “5” and “6-10”, respectively. At this time, the numerical type quasi-identifier of the anonymization target data 121 is “5” as a value corresponding to “5”, “6”, “8”, “10” as values corresponding to “6-10”. ”And the frequencies of“ 5 ”,“ 6 ”,“ 8 ”,“ 10 ”are“ 3 ”,“ 1 ”,“ 2 ”,“ 1 ”, respectively, n = 3 + 1 + 2 + 1 = 7, l _{1 = 5, l 2 = 5} , l 3 = 5, l 4 = 6, l 5 = 8, l 6 = 8, a l 7 = 10.

  Subsequently, the generalized hierarchy creating unit 112 determines a node obtained by integrating the combination nodes having the smallest statistical index divergence A as a node in the hierarchy one level higher corresponding to each node of the combination, that is, a parent node. Then, the sum of the frequencies of the nodes of the combination is set as the frequency of the parent node (S605). For the nodes other than the combination, the generalized hierarchy creating unit 112 determines, for example, a node that is the same as the node as a node in the next higher hierarchy corresponding to the node.

  In addition, when there are a plurality of combinations having the smallest statistical index deviation A, for example, the generalized hierarchy creating unit 112 integrates nodes of one combination selected from the plurality of combinations. In the selection, for example, the generalized hierarchy creating unit 112 may select one combination at random, or select the combination with the maximum or minimum value of the values included in the plurality of combinations being the maximum or minimum. May be.

  When the generalized hierarchy creating unit 112 determines that the statistical index deviation A in a certain combination is equal to or less than a predetermined threshold in the process of calculating the statistical index deviation A, the generalized hierarchy creating unit 112 integrates the nodes of the combination. The calculation of A in other combinations may be stopped. Thereby, the generalization hierarchy preparation part 112 can reduce the amount of calculations, reducing the divergence of the statistical index before and behind anonymization. When the predetermined threshold value is 0, the divergence of the statistical index before and after anonymization can be particularly reduced.

  Subsequently, after creating the root node, the generalized hierarchy creating unit 112 ends the hierarchy data creation for the numerical type quasi-identifier (S606). If the root node has not been created, the generalized hierarchy creating unit 112 performs the processes of steps S604 to S605 for the highest hierarchy.

  When the generalized hierarchy creating unit 112 has created the hierarchy data for all the numerical quasi-identifiers, the generalized hierarchy creating process ends (S607). When there is a numerical type quasi-identifier for which hierarchical data has not been created, the generalized hierarchy creating unit 112 performs the processing from step S602 to step S606 on the numerical type quasi-identifier for which hierarchical data has not been created.

  Hereinafter, an example of a process (corresponding to steps S602 to S606) in which the generalized hierarchy creating unit 112 creates the age hierarchy data 1220 from the age 1210 of the anonymization target data 121 will be described. An example in which the statistical index is an average value is shown. The generalized hierarchy creating unit 112 acquires the frequencies “3”, “2”, and “1” of the values “25”, “5”, and “20” included in the age 1210, respectively. The generalized hierarchy creating unit 112 sorts the values included in the age 1210 in ascending order, that is, in the order of “5”, “20”, “25”, and sets the sorting result as the 0th hierarchy 1221.

The generalized hierarchy creating unit 112 calculates the statistical index deviation A ₁ of the combination of the adjacent nodes “5” and “20” and the statistical index of the combination of the adjacent nodes “20” and “25”. to calculate the deviation of _{a 2.}

Hereinafter, a process for calculating _{A 1.} Since R = 6 and V = (5 + 20) /2=12.5, A ₁ = | {(5-12.5) + (5-12.5) + (20-12.5)} / 6 | = 1.25.

Hereinafter, a process for calculating _{A 2.} Since R = 6 and V = (20 + 25) /2=22.5, A ₂ = | {(20-22.5) + (25-22.5) + (25-22.5) + (25 -22.5)} / 6 | = 0.833.

Since A ₁ > A ₂ , the generalized hierarchy creating unit 112 creates nodes “20 to 25” obtained by integrating “20” and “25”. The generalized hierarchy creating unit 112 assigns the created nodes “20 to 25” to the parent nodes of the nodes “20” and “25” of the 0th hierarchy 1221, that is, the first corresponding to “20” and “25”, respectively. It is determined as a node of the hierarchy 1222. Also, the generalized hierarchy creating unit 112 determines “5” itself as the node of the first hierarchy 1222 corresponding to “5” of the 0th hierarchy 1221 for the node “5” that is not the integration target. .

  Since the first hierarchy 1222 includes two types of nodes “5” and “20-25”, the generalized hierarchy creation unit 112 assigns the nodes “5-25” obtained by integrating these to all of the first hierarchy 1222. The root node 1223 corresponding to the node is determined.

  FIG. 7 is an example of age hierarchy data for the age 1210 of the anonymization target data 121 of FIG. 2 created using a conventional method such as a Hu-Tucker code tree. The age hierarchy data 700 includes a 0th hierarchy 701, a first hierarchy 702, and a root node 703. In the conventional generalized hierarchy creation process, nodes with low frequency are integrated to create a higher hierarchy node. Since the frequencies of the values “5”, “20”, and “25” are “2”, “1”, and “3”, respectively, “5” and “20” are integrated in the first layer 702. In this respect, the age hierarchy data 700 is different from the age hierarchy data 1220 of the present embodiment.

  FIG. 8 shows an example of comparison between anonymization of numerical quasi-identifiers using the generalized hierarchy of this embodiment and anonymization of numerical quasi-identifiers using a conventional generalized hierarchy. Specifically, FIG. 8 shows an example in which the anonymization server 100 performs k-anonymization satisfying k = 2 on data consisting only of the age 1210 using the age hierarchy data 700 of the conventional method, and the present embodiment. The example given using the age hierarchy data 1220 is shown. Further, FIG. 8 shows an example in which the difference between the average value and variance of the age 1210 and the average value and variance of the result data subjected to k-anonymization are compared between this example and the conventional method. . Here, the average value of the age 1210 is 17.5, and the variance is 81.25.

  First, k-anonymization using the age hierarchy data 700 in the conventional method will be described. The k-anonymization execution unit 114 can execute k-anonymization satisfying k = 2 by anonymizing the age 1210 using the first hierarchy 702. The k-anonymization executing unit 114 obtains result data 802 by anonymizing the age 1210 using the first hierarchy 702. In the range-converted data 803, the range-displayed value of the result data 802, that is, “5 to 20” is converted into the average value 12.5 of the range in order to calculate the average value and variance of the result data 802. It is data.

  Here, the average value of the range-converted data 803 is 18.75, and the variance is 39.0625. Further, the average value divergence between the age 1210 and the range-converted data 803 is 1.25, and the variance divergence is 42.1875.

  Next, k-anonymization using the age hierarchy data 1220 of the present embodiment will be described. The k-anonymization execution unit 114 can execute k-anonymization satisfying k = 2 by anonymizing the age 1210 using the first hierarchy 1222. The k-anonymization executing unit 114 obtains result data 804 by anonymizing the age 1210 using the first hierarchy 1222. In the range-converted data 805, the range-displayed value of the result data 804, that is, “20 to 25” is converted into the average value 22.5 of the range in order to calculate the average value and variance of the result data 804. It is data.

  Here, the average value of the range-converted data 805 is 16.6667, and the variance is 68.0556. Also, the average value divergence between the age 1210 and the range-converted data 805 is 0.83333, and the variance divergence is 13.1944. Therefore, the deviation of the average value before and after anonymization in this embodiment is smaller than the deviation of the average value before and after anonymization in the conventional method. The same applies to the variance deviation.

  As described above, the anonymization server 100 according to the present embodiment can reduce the divergence of the statistical index of the numerical quasi-identifier before and after k-anonymization in the creation of the generalized hierarchy of numerical quasi-identifiers. Degradation of data quality can be suppressed. Moreover, since the anonymization server 100 calculates the divergence of the statistical index without calculating the statistical index itself before and after k-anonymization, it is possible to suppress the deterioration of the data quality with a small amount of calculation.

  Moreover, the anonymization server 100 can reduce the deviation before and after k-anonymization of the average value, which is one of important basic statistics, by using the average value as a statistical index with a small amount of calculation. .

  Moreover, the data quality after k-anonymization by the existing anonymization server can be improved at low cost by replacing the process of creating the generalized hierarchy in the existing anonymization server with step S503 of the present embodiment. it can.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Also, a part of the configuration of a certain embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of a certain embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

DESCRIPTION OF SYMBOLS 100 Anonymization server, 101 Processor, 102 Memory, 103 Auxiliary storage device, 111 Anonymization object data acquisition part, 112 Generalization hierarchy preparation part, 113 Statistical index calculation part, 114 k-anonymization execution part, 121 Anonymization object Data, 122 generalized hierarchy data, 123 anonymization result data

Claims (5)

A numerical data anonymization server that holds numerical data including a plurality of numerical values is a method of anonymizing the numerical data,
The numerical data anonymization server includes a processor that executes a program, and a memory that the processor accesses.
The method
The processor creates a generalized hierarchy consisting of a plurality of hierarchies based on numeric values included in the numeric data,
The processor anonymizes the numerical data using the generalized hierarchy;
In the process of creating the first hierarchy of the generalized hierarchy,
Generating a combination of the first node included in the 0th hierarchy, which is one level below the first hierarchy, and each of the nodes adjacent to the first node in a numerical magnitude relationship;
For each of the generated combinations, the numerical value anonymized using the first hierarchy when a node obtained by integrating the nodes of the combination is determined as a node of the first hierarchy corresponding to each of the nodes of the combination Calculate the divergence between the statistical index of the data and the statistical index of the numerical data,
A method of determining a node obtained by integrating a combination of nodes having the smallest calculated divergence as a node of the first hierarchy corresponding to each node of the combination. The method of claim 1, comprising:
The statistical index is an average value,
The method
The processor calculates the divergence for each of the generated combinations using the following equation:

In the above formula, A is the divergence with respect to the combination, n is the total frequency in the numerical data of the numerical values corresponding to the nodes of the combination, V is the average value of the minimum and maximum values included in the nodes of the combination, l _i is a numerical value corresponding to a leaf node that is a descendant node of each node of the combination, and R is the number of records of the numerical data. The method of claim 1, comprising:
The processor is
In the creation process of the first hierarchy,
Calculating the divergence for a first combination of the first node and one of the nodes adjacent to the first node in a numerical magnitude relationship;
When the calculated deviation is not more than a threshold value,
Calculating the divergence for the second combination of the first node and the other of the nodes adjacent to the first node;
A method in which a node obtained by integrating the first combination of nodes is determined as a node of the first hierarchy corresponding to each of the first combination of nodes. The method of claim 1, comprising:
The processor is
Repeat the creation process of creating the generalized hierarchy level one by one in order from the lowest level until the level indicating the root node is created,
The numerical data excluding duplication is determined as the lowest hierarchy of the generalized hierarchy,
A method in which, in the creation process of each hierarchy other than the lowest hierarchy, the hierarchy is the first hierarchy. A numerical data anonymization server that anonymizes numerical data including a plurality of numerical values,
A processor and a storage device;
The storage device holds the numerical data,
The processor is
Create a generalized hierarchy consisting of multiple hierarchies based on the numeric values contained in the numeric data,
Using the generalized hierarchy, the numerical data is anonymized,
In creating the first hierarchy of the generalized hierarchy,
For each combination of the first node included in the 0th hierarchy, which is one hierarchy below the first hierarchy, and each of the nodes adjacent to the first node in the magnitude relation, A statistical index of the numerical data that is anonymized using the first hierarchy when a node obtained by integrating the nodes of the combination is determined as a node of the first hierarchy corresponding to each node of the combination; , The difference between
A numerical data anonymization server that determines a node obtained by integrating the first combination of nodes having the smallest calculated deviation as a node of the first hierarchy corresponding to each of the first combination of nodes.

Images