JP2021033382A - Device, program and method for anonymizing individual data by secret transform processing of multi-dimensional cross-frequency table - Google Patents

Abstract

To provide a device, program and method for anonymizing individual data, which achieves ensuring security of individual data and maintaining reproducibility of aggregate results by aggregating multi-dimensional cross-frequency tables with respect to individual data from which information identifying individuals is excluded, to perform concealment processing and converting them to an individual data form while maintaining reproducibility of concealed frequency tables.SOLUTION: In the method, multi-dimensional cross frequency tables are aggregated with respect to all combinations of attribute items selected from individual data, and concealment processing of erasing attribute combinations including risk cells, rounding, and so on is performed, and differences between a sum total and breakdown totals are calculated with respect to each of the combinations of attribute items to output records corresponding to breakdown and frequencies of the differences, thereby anonymizing the individual data by converting frequency tables to an individual data form while maintaining reproducibility of the frequency tables.SELECTED DRAWING: Figure 2

Description

1. 1. Title of the invention Anonymization device, program, and method of individual data by concealment conversion processing of multidimensional cross frequency table

2. Technical Field The present invention aims to anonymize risk records including personal information for individual data such as statistical surveys and questionnaire surveys in the statistical field so that the data can be used safely from the viewpoint of privacy protection. It is about anonymization technology. By using the present invention, it is possible to anonymize risk records having isolated attributes for individuals, households, etc. in individual data such as statistical surveys and questionnaire surveys.

3. 3. Background technology When tabulating or analyzing statistical tables using individual data that includes personal information in statistical surveys and questionnaire surveys, it is necessary to remove information that can identify individuals and households before using it. .. However, simply removing the identification information of an individual or household from the individual data is not sufficient to conceal the personal information, and the frequency is as low as 1 or 2 in the attribute-specific frequency table of individuals or households. In this case, it becomes a risk cell that may identify an individual, so it is necessary to add further concealment processing.
In the field of statistics, the concealment processing of statistical tables is used as part of the table-making technology for aggregating statistics, and the method of anonymizing the risk records of individual data before aggregating the result table is pre-confidential. On the other hand, the method of safely processing risk cells in the statistical table after aggregation is called post-concealment.
Since the risk record in the individual data is detected after the result table is aggregated, the concealment process of the aggregated result table is generally performed as post-concealment on the aggregated result table after tabulation, but post-confidentiality is all. It is necessary to make sure that there is no inconsistency in the table. On the other hand, in advance concealment, there is no need to worry about inconsistencies between the summary tables by performing the risk record anonymization process on the individual form data before aggregation, and the publication result table when using the individual form data. There is a merit that the analysis can be performed without any contradiction.

3.1 General anonymization method When analyzing using individual statistical data, the most important thing is the safety of the data and the reproducibility of the results. From the viewpoint of privacy protection, it is necessary to maintain the reproducibility of the aggregated results while being safe. From the viewpoint of data security, the more information that is deleted by the anonymization process, the higher the security, but there is a problem that the usefulness of the data decreases, so while ensuring sufficient security, the result table A method for achieving reproducibility is required.
General anonymization methods for individual data including personal information include (1) rough classification, (2) record deletion (Suppression), and (3) transfer (attribute change to attributes with high frequency). (4) Swapping, (5) Sorting (Permutation), (6) Replacement (resampling), (7) Inflating, (8) Random number disturbance, (9) Synthesis method (replacement by random number synthesis value), etc. It has been known.

3.2 Problems with general anonymization methods
(1) Rough classification In individual data such as individuals and households, if the frequency for each attribute item is extremely low, there is a high risk that the individual will be identified. A method of anonymizing an isolated record by coarsely classifying and performing coarse classification is used. Top coding, which roughens the top edge of attribute classifications that include risk records, and bottom coating, which roughens the bottom edges, are included in the coarse classification method. When the coarse classification method is used, it is necessary to make the classification coarser as the number of combinations of attribute items increases, so that it becomes impossible to perform aggregation by fine attribute classification, and there is a problem in the reproducibility of the aggregation result.

(2) Record deletion For risk records with extremely low frequency for each attribute item, a method of simply deleting risk records may be used instead of rough classification. However, if the risk record is simply deleted, the risk record can be calculated back from the difference from the total value in the published result table, and there is a problem that the risk record cannot be concealed by simple deletion. In order to avoid this, a concealment method is used that makes it impossible to identify the risk record by deleting the randomly selected non-risk record together. However, since this method deletes even records that do not originally need to be deleted, there arises a problem that the same result table as the basic data cannot be obtained even if the data after concealment is aggregated. Furthermore, when the same table is repeatedly aggregated, different records are randomly deleted each time it is aggregated, so by collating multiple tables with different concealment patterns, the value of the deleted records can be found. There is a safety issue.
In addition, if records with less than a certain frequency are uniformly deleted so that the frequency for each attribute exceeds the standard and concealment processing is performed, the number of records deleted increases as the attributes of the combination become more detailed, and valid records Since the number is significantly reduced compared to the basic data and the aggregated results do not match, there is a problem in the reproducibility of the aggregated results.

(3) Transfer The transfer method of changing the attribute item of the risk record to the same attribute as the neighboring record may be used, but since the transfer causes distortion, the difference from the published result table (true value). The confidential content may be exposed, which poses a safety problem. In addition, since the data after the anonymization process contains distortion, there is a problem in the reproducibility of the aggregation result.

(4) Replacement (swapping)
A method of anonymizing risk records by exchanging non-common attribute items on a record-by-record basis for records that have partially common attribute items. There is an advantage that the number of records and the aggregated value of common attribute items do not change, but if the aggregated result table is published with a more detailed combination of attribute items, the exchange content can be found from the difference from the true value. It may end up. In addition, if the same individual form data is repeatedly anonymized, the risk record may be identified from the difference in the combination of exchange records, which poses a safety problem. In addition, if detailed tabulation other than common items is performed, it does not match the published result table (true value), which causes a problem in the reproducibility of the tabulation result.

(5) Sorting A method of anonymizing risk records by sorting within a group that has the same attribute items as risk records for swapping between two records. Sorting items within a group of multiple records can be expected to be more secure than swapping, but it does not completely eliminate the safety issue, so it is similar to swapping. However, there are problems with safety and reproducibility of aggregated results.

(6) Replacement (resampling)
Another method is to replace the risk record with another resampled record instead of deleting it, but if the same aggregation result table is created repeatedly, the risk record will be aggregated because it will be resampled with a combination of different random number patterns. There is a problem that it is specified by the difference in the result table, and there is a problem that the value of the replaced record is calculated back due to the difference from the published summary result table. Further, since the record replaced by resampling becomes noise, the same result table as the basic data cannot be obtained even if the data after concealment is aggregated, so that there is a problem in the reproducibility of the aggregated result.

(7) Instead of deleting the inflated risk record, there is a method to ensure the apparent safety by duplicating the records of the same attribute item and inflating them. There is a problem with the reproducibility of the results.

(8) Random number disturbance There is a random number disturbance method that ensures safety by adding noise due to random numbers for a combination of attribute items that include risk records. Noise may be added on a record-by-record basis or on an item-by-item basis. If noise is added only to the risk record, the noise can be identified by the difference from the publication result table, so it is necessary to add noise to multiple records or all records to improve safety, but the data mixed with noise is accurate. There is a problem in the reproducibility of the aggregated results because it is not possible to aggregate the results.

(9) Synthesis method As one of the methods by random number disturbance, there is a method of using a composite value in which a random number is generated so that the mean value (statistic) matches the basic data, but the standard deviation and phase other than the mean are used. Since the method of creating a composite value in which all the statistics such as the number of relations match is not realized, the reproducibility becomes insufficient. In addition, if the statistics are reproduced precisely, the risk record may be calculated back, or the risk record may be identified due to a contradiction between items or an abnormal value, which poses a safety problem.

3.3 Existing patents related to anonymization technology The methods used in existing patents related to anonymization are roughly divided into (1) coarse classification, (2) random number disturbance, (3) record padding, and (4) secret calculation. , (5) Divided into compound methods, etc.

33.1 Coarse classification The basic idea of coarse classification is called k-anonymization, and there is a risk that an individual will be identified if there are a small number of isolated records in the individual data including personal information. However, if there are k or more records with the same attribute, it will not be possible to identify an individual, so it is considered safe. k A method of coarsening the attribute classification so that there are multiple records of the same attribute in the individual data using anonymization is called coarse classification.
The following patents have been granted from 2013 to 2017 for patented technology using the rough classification method. The concept of coarse classification is a method that has been used in the field of statistical tablemaking technology even before the concept of k-anonymization was defined, and related patents do not perform simple rough classification. It is an applied technology based on it.
Patent documents (1) to (18) are examples of using methods related to rough classification (including automatic classification, deletion, etc.).

3.3.2 Random number disturbance As an anonymization method for data including personal information, a disturbance method is used in which anonymization is performed by including noise due to random numbers in the data. Random number disturbance due to noise has the advantage that it can be used without changing the classification classification of the underlying data, but there is a problem that the analysis results do not always match the correct values because the data contains noise. As a countermeasure, a method of disturbing the noise so that the average value becomes zero is used.
Anonymization technology by random number disturbance is used as a standard concealment method for statistical tables in other countries (Australia, etc.), but the following related patents have been obtained in Japan, and it is used as an alternative method for rough classification. Has been done.
Patent documents (19) to (21) are examples of using a method related to random number disturbance.

3.3.3 Record padding The random number disturbance method has a problem that abnormal values and outliers due to random numbers occur and the data have different properties from the actual data. Therefore, instead of adding noise and disturbing, a method is used in which records having the same properties as risk records are inflated to conceal L-diversity. By padding records with the same attributes as risk records, there is an advantage that data including duplicate IDs can be kept secret.
The following patents have been obtained for the inflated anonymization technology, but it cannot be used as an anonymization technology in the field of statistics because of the large demerit that the aggregated results of anonymized data will change.
Patent Document (22) is an example of using a method related to record padding.

3.3.4 Confidential calculation Confidential calculation is a method in which data containing personal information is encrypted, distributed and stored in multiple data, and then the statistics are calculated without compounding while still encrypted. Since the user performs the calculation process without looking at the individual form, it is possible to improve the security when using the data, but since the secret calculation itself does not have a function to anonymize the aggregated result, personal information can be obtained from the aggregated result. A separate output restriction function for aggregated results is required to prevent identification.
Patent Document (23) is an example of using a method related to secret calculation.

3.3.5 Combined method The combined method is a method that combines or selects the above-mentioned coarse classification, random number disturbance, secret calculation, replacement, deletion, etc., and performs anonymization processing, and is an example of using the combined method. Examples thereof include Patent Documents (24) to (27).

3.4 Problems with existing patents Each of the existing patents related to anonymization technology has the following problems.
(1) Coarse classification Of the existing patents related to anonymization technology, the classification used for tabulation is rough for rough classification, so for example, each age may be a coarse 10-year-old class, or prefectures may There is a problem that it is not possible to reproduce the aggregated result table of the basic data, such as by dividing into coarse regions.

(2) Random number disturbance Random number disturbance is not suitable for concealing statistical data because the reproducibility of the result table cannot be maintained due to the inclusion of noise (fake data). In addition, if it is used repeatedly, the confidentiality may be exposed due to the difference, and safety cannot be ensured.

(3) Inflated records There is a problem that inflated records are not suitable for concealing statistical data because the aggregated results after anonymization will change.

(4) Confidential calculation Confidential calculation is a technology that encrypts and performs statistical calculations, so it can contribute to improving security when using it, but it is not a technology to ensure the security of results, so anonymized data There is a problem that it cannot be used as a technique for creating.

Regarding the technology for anonymizing risk records for individual data in the field of statistics, the current situation is that the technology that can maintain the reproducibility of statistical tables equivalent to the basic data while ensuring safety has not been sufficiently established. There is.

3.5 Prior art documents Prior art documents related to anonymization of individual data include patent documents and non-patent documents other than patents.
3.5.1 Patent Documents The following are examples of prior art patent documents related to anonymization of individual data.

(1) Patent 6127774 (2017 NEC Corporation) Information processing equipment and data processing method (Characteristics: Rough classification of disease names by validity period and k-anonymization of personal attributes) (2) Patent 6097774 (2017 SoftBank Corp.) Anonymization processing method, anonymization processing program, and anonymization processing device (Features: Group data by spatial distance and classify additional records by group representative value) (3) Patent 6097983 (2017 NEC Corporation) Information processing device and anonymization method for performing anonymization, and a program (feature: concealment using the similarity of transition vectors of groups satisfying l-diversity) (4) Patent 6078437 (2017 Hitachi Solutions, Ltd.) Personal information anonymization system (Feature: Editing of generalized hierarchical tree for k-anonymization by abstraction (coarse classification)) (5) Patent 6065833 (2017 NEC Corporation) Distributed anonymization system, distributed anonymization device and distributed anonymization method (Characteristics: Rough classification of personal attributes so that dummy records added for each group are distributed) (6) Patent 6015658 (2016 NEC Corporation) Anonymization device and anonymization method (Characteristics: Concealment by rough classification of personal attributes) (7) Patent 6007969 (2016 NEC Corporation) Anonymization device and anonymization method (Feature: Coarse classification so that multiple data providers are not specified) (8) Patent 5974858 (2016 Fujitsu Limited) Anonymization processing method and equipment (Feature: Rough classification by distance calculation of data blocks) (9) Patent 5875536 (Nippon Telegraph and Telephone Corporation, 2016) Anonymization device, anonymization method, program (Feature: Concealment using transition probability matrix of character strings (coarse classification)) (10) Patent 5875535 (2016 Nippon Telegraph and Telephone Corporation) Anonymization device, anonymization method, program (Features: Concealment using character string transition probability or Hamming distance (coarse classification)) (11) Patent 5858292 (2016 NEC Corporation) Anonymization device and anonymization method (Feature: When a record is generalized (coarsely classified) and added, the same generalization rule is applied to a part of the basic data. Apply) (12) Patent 5782637 (2015 West Nippon Telegraph and Telephone Corporation) Attribute selection device, information anonymization device, attribute selection method, information anonymization method, attribute selection program, and information anonymization program (Feature: Appearance rate of generalized attributes) (Selection by survival rate and k-anonymization by rough classification) (13) Patent 5684165 (Hitachi, Ltd., 2015) Personal information anonymization device and method (Feature: Generalization of personal information with multiple selection attributes Abstraction by hierarchical tree (coarse classification)) (14) Patent 5626733 (2014, Hitachi, Ltd.) Personal information anonymization device and method (Feature: Anonymization of incremental records of data anonymized by generalized hierarchy tree) (15) Patent 5492296 (2014, Hitachi, Ltd.) Personal information anonymization device (Feature: Generalization of personal information Abstraction by hierarchical tree (coarse classification)) (16) Patent 5416614 (2014 KDDI Co., Ltd.) Public information privacy protection device, public information privacy protection method and program (Characteristics: Considering record flow n by generalization (coarse classification) (k + n) Anonymous ) (17) Patent 5288066 (2013 NEC Corporation) Anonymization device (Characteristics: Generalization processing by adding a part of other groups to the singular group by generalization (coarse classification)) (18) Patent 5292121 (2013 NEC (China) Company, Limited) Data anonymization method and device (Features: K-anonymization by generalization and deletion by calculating the distance between two records) (19) Patent 6002712 (2016 Nippon Telegraph and Telephone Corporation) Information processing system, information processing method, and program (Feature: Anonymization of database with dummy data) (20) Patent 5986311 (2016 NEC Corporation) Anonymization device, anonymization method, and a recording medium recording a program for that purpose (Feature: Outputs inaccurate analysis results modified so that anonymity satisfies the threshold value. ) (21) Patent 5962472 (Fujitsu Limited, 2016) Anonymized data generation method, device and program (Feature: Random number selection of points on the line segment connecting the latest data blocks) (22) Patent 6015777 (2016 Fujitsu Limited) Concealed data generation method and equipment (Feature: L-diversity concealment by padding records in data blocks) (23) Patent 6009698 (2016 Nippon Telegraph and Telephone Corporation) Secret calculation method, secret calculation system, random permutation device and program (Characteristics: Secret calculation by distributing data encrypted by random numbers) (24) Patent 6000175 (2016 Nippon Telegraph and Telephone Corporation) Anonymization system, anonymization device, user device, anonymization method, and program (Features: Individual information is divided into multiple parts, converted, replaced, deleted, etc.) Pk anonymization process) (25) Patent 5979004 (2016 NEC Corporation) Information processing system and anonymization method (Features: Select the processing order of generalization, cutoff, separation, replacement, perturbation, etc. according to the anonymization policy) (26) Patent 5758315 (2015 Nippon Telegraph and Telephone Corporation) Anonymous data provision system, anonymous data device, and the method they execute (Features: Anonymized data by deletion, replacement, random number disturbance, etc. is divided into fields. Secret calculation) (27) Patent 5670366 (2015 Nippon Telegraph and Telephone Corporation) Anonymous data provision system, anonymous data device, method of execution, and program (features: data anonymized by deletion, replacement, random number disturbance, etc.) for each field Divide and secret calculation (including empty set))

35.2 Non-patent documents There are many related documents other than patents, but the following are particularly mentioned. (1) Anonymization technology to reduce personal identification risk (2016, Senda, Operations Research Vol.61 No.5) (2) Verification of applicability of anonymization technique in micro data-using national consumption survey and household survey- (2014, Ito, Murata, Takano, Statistical Research Dictionary No. 71) (3) Cell concealment problem in summary table and its research trend (2003, Taki, Statistical Mathematics (2003) Vol. 51, No. 2)

4. Outline of the Invention The existing method for anonymizing individual data for privacy protection has not been sufficiently established as a technique for ensuring safety and maintaining reproducibility of aggregated results. Even if it can be secured, distortion and noise will occur in the distribution, so there is a problem that it is not possible to obtain a frequency table with a distribution equivalent to the original individual data when aggregated. The present invention can maintain the reproducibility of the confidentiality frequency table obtained by aggregating the basic individual data while ensuring the safety of the basic individual data from the viewpoint of privacy protection. The task is to provide a means for creating the conversion data.

In the present invention, the multidimensional cross frequency table is aggregated and concealed for the individual data, and then the difference between the total number and the total breakdown is calculated, and the individual data is maintained while maintaining the reproducibility of the multidimensional concealment frequency table. By converting to a format, a means of creating anonymized individual form data is used.
The method for anonymizing individual form data according to the present invention is to aggregate the individual form data to the multidimensional cross frequency table and convert the multidimensional cross frequency table to the individual form data for the individual form data and the multidimensional cross frequency table. By performing the processing reversibly, the concealment processing of the multidimensional cross concealment frequency table is reflected in the anonymized data, and the reproducibility of the multidimensional cross concealment frequency table is maintained for the frequency table obtained by aggregating the anonymized data. Make it possible.

5. Anonymization device An anonymization device is configured by installing an anonymization processing program on a commercially available personal computer (hereinafter referred to as a PC) and connecting a storage device that stores input data and output data. The program is installed via electronic media, but the installation method may be via a network such as the Internet or pre-installed on a PC.
The user starts the device by executing the program of the executable file installed on the PC, and specifies the file name of the individual data on the storage medium connected to the PC as input data from the menu of the execution screen. , Safety standard (K), rounding base (B), conversion scale (R), etc. are specified to execute the process, and the file name of the created anonymized data is specified and saved as output data (Fig.) 1).
As for the concealment method of the multidimensional cross frequency table, erasure concealment and round concealment are used as embodiments, but since there are various concealment methods of the frequency table, the total breakdown and total number of frequency tables by attribute. Any concealment method may be used as long as it is a method capable of performing the difference calculation of.

6. Anonymization processing program The anonymization processing program for concealing individual data is composed of (1) a multidimensional frequency table aggregation processing unit and (2) each program constituting the concealment conversion processing unit (Fig. 2). ).
The multidimensional frequency table aggregation processing unit uses individual data as input data and is configured by (1) a multidimensional cross frequency table aggregation program (Fig. 3.1). The concealment conversion processing unit uses a multidimensional cross frequency table as input data, and is composed of (2) erasure concealment, (3) rounding concealment, (4) difference calculation, and (5) individual form conversion programs (Fig.). 3.2).
(1) The multidimensional frequency table aggregation processing unit aggregates the multidimensional frequency table using individual data as input data, so it is assumed that it will be used in a closed environment blocked from external access. (2) The concealment conversion processing unit has a function to perform concealment processing and a function to convert the frequency table into individual form, and it is necessary to perform the concealment processing of the multidimensional frequency table in a closed environment. However, when converting the concealment frequency table after concealment processing into individual data format as input data, the design is made with a view to the possibility of using it in an open environment where external access is possible. Any programming language may be used for program creation.

6.1 Multidimensional cross frequency table tabulation program The multidimensional cross frequency table tabulation program calculates the total breakdown for each combination of attribute fields. As a calculation method, the data with the total key is combined with the base data, sorted by the attribute key, and then the frequency and weighted frequency are added up for each same attribute, and all are calculated recursively. The total calculation process for each combination is performed (Fig. 4.1).
(1) Pretreatment Perform the following pretreatment.
-Select the attribute item field to be processed-Remove unnecessary fields-If the field does not have a weight (Weight), add a weight (Weight) field and set the value of each record to 1-Freauency ) Add a field and set the value of each record to 1
(2) Field number j = 0
Initializes the counter j for the specified field.
(3) Processing field j = j + 1
The designated field to be processed is counted by the counter j.
(4) All record copy D1
Copy all records in the input file and output as file D1.
(5) Record number i = 0
Initialize the counter i of the input record.
(6) Record reading Read the record of individual data.
(7) i = i + 1
The record to be processed is counted by the counter i.
(8) Attribute jth classification = ”~”
For the record to be processed, the j-th attribute is replaced with the total code "~".
(9) Last record?
Judge whether the processing is completed for all records.
Yes ⇒ Processing (6)
No ⇒ processing (10)
(10) Combine D1 + All records Combine all the processed records for the i-th attribute into the file D1.
(11) Cross-attribute sorting Sort the combined files by attribute.
(12) Frequency summing by attribute Performs frequency summing processing for each same combination of attribute items.
(13) Addition of weighted frequencies by attribute The weighted frequencies (Weight) are added up for each same combination of attribute items.
(14) Substitution of data to be processed Replace the data to be processed with processed data in order to perform recursive calculation.
(15) Final field?
Judge whether the processing is completed for all fields.
Yes ⇒ end
No ⇒ processing (3)

6.2 Erasing concealment program The erasing concealment program assigns a classification code to each combination of attribute items and inspects the minimum frequency for each classification code. If the minimum frequency does not meet the safety standard K, the attribute item By replacing the breakdown of the combined records with zero values, the multidimensional cross frequency table is erased and concealed (Fig. 4.2).

Attribute combination code assignment (2A)
(1) Record number i = 0
Initialize the record number counter i.
(2) Record reading For the target file, record reading of attribute items (F1 to Fj), weighted frequency (Weight), and frequency (Frequency).
(3) i = i + 1
The counter i is incremented by +1.
(4) Attribute number j = 0
Initialize the attribute number j.
(5) j = j + 1
Attribute number j is incremented by +1.
(6) Number j Classification "~"?
It is determined whether or not the classification = "~" for the field of attribute number j.
Yes ⇒ Processing (8)
No ⇒ processing (7)
(7) Sign F0 jth digit = ”0”
Set the jth digit of the classification code F0 to "0".
(8) Code F0 jth digit = ”~”
Set the jth digit of the classification code F0 to "~".
(9) No. j All attributes?
It is determined whether all the attribute numbers j have been processed.
Yes ⇒ Processing (9)
No ⇒ processing (5)
(10) Record output Record output of classification code F0, attribute items (F1 to Fj), weighted frequency (Weight), and frequency (Frequency).
(11) All records?
For all records, it is determined whether the processing is completed.
Yes ⇒ Processing (12)
No ⇒ processing (2)
(12) Sort by code F0 Sort records by classification code F0.

Minimum frequency inspection by combination (2B)
(13) Record reading Record reading for classification code F0, attribute items (F1 to Fj), and frequency (Frequency)
(14) Key = F0
Substitute classification code F0 for Key
(15) Minimum frequency = frequency Substitute frequency for the minimum frequency
(16) Record reading Record reading for classification code F0, attribute items (F1 to Fj), and frequency (Frequency)
(17) Key = F0?
Match judgment of classification code F0 and Key
Yes ⇒ Processing (20)
No ⇒ processing (18)
(18) Key, minimum frequency output
Record output of Key and minimum frequency
(19) Key = F0
Substitute classification code F0 for Key
(20) Frequency> Minimum?
Frequency> Minimum frequency judgment
Yes ⇒ Processing (22)
No ⇒ processing (21)
(21) Minimum frequency = frequency Substitute frequency (Frequency) for the minimum frequency
(22) Last record?
End judgment of all records
Yes ⇒ Processing (23)
No ⇒ processing (16)
(23) Key, minimum frequency output
Record output of Key and minimum frequency

Elimination of risk table breakdown (2C)
(24) Reference value K setting Setting of the minimum frequency reference value K
(25) Record reading Classification code F0, attribute items (F1 to Fj), weighted frequency (Weight), frequency (Frequency) are read into records.
(26) Key = F0
Substitute F0 for Key
(27) Read the minimum frequency of F0 Read the minimum frequency with the classification code F0 as the key.
(28) Frequency> Minimum?
Frequency> Judgment of minimum frequency
Yes ⇒ Processing (30)
No ⇒ processing (29)
(29) Frequency = 0
Substitute 0 for Frequency
(30) Record output Record output of classification code F0, attribute items (F1 to Fj), weighted frequency (Weight), and frequency (Frequency)
(31) Record reading Classification code F0, attribute items (F1 to Fj), weighted frequency (Weight), frequency (Frequency) are read into records.
(32) Key = F0?
Judgment of Key = F0
Yes ⇒ Processing (35)
No ⇒ processing (33)
(33) Read the minimum frequency of F0 Read the minimum frequency with the classification code F0 as the key.
(34) Key = F0
Substitute F0 for Key
(35) Frequency> Minimum?
Frequency> Judgment of minimum frequency
Yes ⇒ Processing (37)
No ⇒ processing (36)
(36) Frequency = 0
Substitute 0 for Frequency
(37) Record output Record output of classification code F0, attribute items (F1 to Fj), weighted frequency (Weight), and frequency (Frequency)
(38) Last record?
Judgment of the last record
Yes ⇒ end
No ⇒ processing (31)

6.3 Rounding concealment program The rounding concealment program rounds the frequency and weighted frequency table by dividing the multidimensional cross frequency table that has been erased concealed by the rounding radix B and rounding off to the nearest whole number. Reinforce concealment (Fig. 4.3).

Rounding concealment
(1) Set radix B Set rounding radix B value
(2) Read record Read the record of the data to be rounded
(3) Frequency base B rounding Frequency (Frequency) is rounded by the base B value Calculation formula: Frequency = Int (Frequency / B) * B
The function Int () calculates integer values
(4) Weighted radix radix B rounding Weighted radix (Weight) is rounded by radix B value Calculation formula: Weight = Int (Weight / (Sum (Weight) / Sum (B))) * (Sum (Weight) / Sum ( B))
The function Int () calculates the integer value. The function Sum () calculates the sum of all records.
(5) Record output Record output of attribute items, weight (Weight), and frequency (Frequency)
(6) Last record?
Judgment of the last record
Yes ⇒ end
No ⇒ processing (2)

6.4 Difference calculation program The difference calculation program calculates the difference between the total breakdown and the total number. The difference calculation is calculated by the method of performing the reverse processing of the frequency table aggregation, and by reversing the positive and negative signs for each combination of attribute items and adding them to the total, each combination of attribute items The difference calculation of is performed by recursive calculation. For the breakdown of inverted positive and negative, replace the attribute field with the total code "~", combine it with the frequency table data of the base, sort by attribute item, and then divide the frequency and weighted frequency for each same attribute key. The difference is calculated by adding up (Fig. 4.4).

Difference calculation
(1) Field number j = 0
Initialization of field number j
(2) j = j + 1
+1 increment of field number j
(3) Target data copy C1
Copy input data to C1
(4) Record number i = 0
Initialization of record number i
(5) Record reading Attribute item (F1 to Fj), weighted frequency (Weight), frequency (Frequnecy) record reading
(6) i = i + 1
+1 increment of record number i
(7) Number j classification = ”~”?
Total code judgment for the attribute item of field number j
Yes ⇒ Processing (12)
No ⇒ processing (8)
(8) Attribute j classification = ”~”
Replace the attribute item of field number j with the total code "~"
(9) Positive / negative inversion of frequency Positive / negative inversion of frequency value
(10) Positive / negative inversion of weighted frequency Positive / negative inversion of the weighted frequency (Weight) value
(11) Record output D1
Record output of attribute items (F1 to Fj), weighted frequency (Weight), frequency (Frequnecy)
(12) Last record?
Judgment of the last record
Yes ⇒ Processing (13)
No ⇒ processing (5)
(13) Bond C1 + D1
Combining output data C1 and D1
(14) Sorting by attribute item Sorting by attribute item of combined data
(15) Total frequency by attribute item Total frequency by attribute item
(16) Addition of weighted frequencies by attribute Item Addition of weighted frequencies by attribute item
(17) Target data replacement Replace the target data with the combined data
(18) Final field?
Final field judgment
Yes ⇒ end
No ⇒ processing (2)

6.5 Individual form conversion program The individual form conversion program uses the number of output records as the number of output records by dividing the frequency or weighted frequency by the scale R and converting the breakdown and difference of the frequency table for which the difference is calculated into an integer. Alternatively, record output is performed for each attribute with the value obtained by dividing the weighted frequency by the number of output records as a weight (Fig. 4.5).

Individual form conversion
(1) Scale R setting Set the scale R by selecting whether it is frequency-based or weighted frequency-based.
(2) Record reading Attribute item (F1 to Fj), weighted frequency (Weight), frequency (Frequency) record reading
(3) Attribute "~" NULL replacement Replace the field whose attribute item of the record is "~" with NULL.
(4) Number of outputs n = Int (frequency / R)
Calculation of output number n Based on frequency: n = Int (Frequency / R)
Based on weighted frequency: n = Int (Weight / R)
The function Int () calculates integer values
(5) n> 1?
Judgment of n> 1
Yes ⇒ Processing (7)
No ⇒ processing (6)
(6) Number of outputs n = 1
Set n = 1
(7) Record number j = 0
Initialization of record number j
(8) j = j + 1
+1 increment of record number j
(9) Weight W = Weight / J
Calculation of output weight W Calculation formula: W = Weight / J
(10) Record output Record output of attribute items (F1 to Fj) and output weight (Weight = W)
(11) j = n?
Judgment of record number j> n
Yes ⇒ Processing (12)
No ⇒ processing (8)
(12) Last record?
Judgment of the last record
Yes ⇒ end
No ⇒ processing (2)

7. Individual data anonymization method Regarding the individual data anonymization method, as one of the embodiments in the present invention, (1) preprocessing of basic data, (2) multidimensional frequency table aggregation, and (3) all-item combination The processing is performed in the order of inspection and elimination of the breakdown of the risk table, (4) confidentiality reinforcement by rounding the multidimensional frequency table, and (5) conversion of the individual data format of the multidimensional frequency table.

7.1 Preprocessing of basic data The individual data used for input consists of personal attributes such as gender, age, and household type, and household attributes for which the contents of questionnaires such as statistical surveys and questionnaire surveys are entered. If identification information such as name, personal number, household number, etc. is included, it is necessary to delete the information in advance as preprocessing.

The individual data file may be in any format, but the apparatus of the present invention uses a CSV (comma-separated value) format file for convenience. The first line of the data is the field name, and the second and subsequent lines are the classification code and classification label data for each individual or household. For the field name, the final item is the Weight field, the restoration weight is set to 1 in the case of sample survey, and the weight is set to 1 in the case of 100% survey. If there is no Weight field, Weight is regarded as 1 and processing is performed. As preprocessing, parameters such as file reading and rounding radix are set. In addition, a Frequency field with one record as one frequency is set after the Weight field, and is used for totaling simple frequencies.

Example) CSV format individual data
F1 Gender, F2 Age, Weight, Frequency
a) man, a) 20-29 years old, 1, 1
a) man, b) 30-39 years old, 1, 1
b) Woman, d) 50-59 years old, 1, 1
b) Woman, e) 60-69 years old, 1, 1
a) man, c) 40-49 years old, 1, 1
(Omitted below)

Gender: Gender, Age: Age group, Weight: Restoration weight, Frequency: Simple frequency

7.2 Multidimensional cross frequency table aggregation For the frequency table, the frequency is aggregated for each selected attribute item, and the total value is calculated for each combination of items to aggregate the multidimensional cross frequency table.
The frequency table needs to be created three-dimensionally as a multidimensional cross frequency table, and total calculation is performed for all combinations of attribute items by recursive processing of input data. As a calculation method, the record in which the total code (“~”) is replaced with the total code (“~”) for the first attribute item is added to the input data and output, and then the second is performed by recursive processing using this output data as the input data. A record in which the attribute item of is replaced with a total code (“~”) is added to the input data and output, and this is repeated for all the attribute items to three-dimensionally aggregate the multidimensional cross frequency table.
The multidimensional cross frequency table needs to be converted to the cell data format of one cell and one record when performing the difference calculation described later, but in the program, the cell data is created by directly creating the multidimensional cross frequency table in the cell data format. The conversion to the format is omitted.
Although the multidimensional cross frequency aggregation by recursive calculation is described here, if the method is to obtain the total for all combinations of attribute items, the aggregation may be performed by a method that does not use recursive calculation.

Recursive calculation method of multidimensional cross frequency For j-dimensional data of attribute items F1, F2, ..., Fj, the frequency (Frequency or Weight) of each record is added up for each combination of attribute items to total the total frequency n. , Find the frequency ni for each attribute up to the i-th. The frequency ni for each attribute is obtained by adding up the Frequency for each record in the case of a simple frequency and the Weight for each record in the case of a weighted frequency for each combination of attribute items. For the obtained attribute-specific frequency ni, the multidimensional cross frequency for each combination of attribute items is totaled by the following recursive calculation.

Frequency by attribute ni
F1 F2 ・ ・ ・ Fjn (total of Frequency or Weight)
C1,1 C1,2 ・ ・ ・ C1, jn1
C2,1 C2,2 ・ ・ ・ C2, jn2
C3,1 C3,2 ・ ・ ・ C3, jn3
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, jni

First recursive calculation F1 F2 ・ ・ ・ Fjn (total of Frequency or Weight)
~ C1,2 ・ ・ ・ C1, jn1
~ C2,2 ・ ・ ・ C2, jn2
~ C3,2 ・ ・ ・ C3, jn3
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, jni
C1,1 C1,2 ・ ・ ・ C1, jn1
C2,1 C2,2 ・ ・ ・ C2, jn2
C3,1 C3,2 ・ ・ ・ C3, jn3
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, jni

For the above output data, the frequency n (total of Frequency or Weight) is added for each same attribute. Other symbols may be used for the classification code "~" indicating the total.

Second recursive calculation A calculation process is performed using the first recursive calculation result as input data.

F1 F2 ・ ・ ・ Fjn (total of Frequency or Weight)
~ ~ ・ ・ ・ C1, jn1
~ ~ ・ ・ ・ C2, jn2
~ ~ ・ ・ ・ C3, jn3
・ ・ ・
~ ~ ・ ・ ・ Ci, jni
C1,1 ~ ・ ・ ・ C1, jn1
C2,1 ~ ・ ・ ・ C2, jn2
C3,1 ~ ・ ・ ・ C3, jn3
・ ・ ・
Ci, 1 ~ ・ ・ ・ Ci, jni
~ C1,2 ・ ・ ・ C1, jn1
~ C2,2 ・ ・ ・ C2, jn2
~ C3,2 ・ ・ ・ C3, jn3
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, jni
C1,1 C1,2 ・ ・ ・ C1, jn1
C2,1 C2,2 ・ ・ ・ C2, jn2
C3,1 C3,2 ・ ・ ・ C3, jn3
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, jni

For the above output data, the frequency n (Frequency or Weight) is added for each same attribute.

Jth recursive calculation F1 F2 ・ ・ ・ Fj n (total of Frequency or Weight)
~ ~ ・ ・ ・ ~ N1
~ ~ ・ ・ ・ ~ N2
~ ~ ・ ・ ・ ~ N3
・ ・ ・
~ ~ ・ ・ ・ ~ Ni
C1,1 ~ ・ ・ ・ ~ n1
C2,1 ~ ・ ・ ・ ~ n2
C3,1 ~ ・ ・ ・ ~ n3
・ ・ ・
Ci, 1 ~ ・ ・ ・ ~ ni
~ C1,2 ・ ・ ・ ~ n1
~ C2,2 ・ ・ ・ ~ n2
~ C3,2 ・ ・ ・ ~ n3
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ ni
C1,1 C1,2 ・ ・ ・ ~ n1
C2,1 C2,2 ・ ・ ・ ~ n2
C3,1 C3,2 ・ ・ ・ ~ n3
・ ・ ・
Ci,1 Ci,2 ・ ・ ・ ~ ni

・ ・ ・ (Omitted in the middle)

~ ~ ・ ・ ・ C1, j n1
~ ~ ・ ・ ・ C2, j n2
~ ~ ・ ・ ・ C3, j n3
・ ・ ・
~ ~ ・ ・ ・ Ci, j ni
C1,1 ~ ・ ・ ・ C1, j n1
C2,1 ~ ・ ・ ・ C2, j n2
C3,1 ~ ・ ・ ・ C3, j n3
・ ・ ・
Ci, 1 ~ ・ ・ ・ Ci, j ni
~ C1,2 ・ ・ ・ C1, j n1
~ C2,2 ・ ・ ・ C2, j n2
~ C3,2 ・ ・ ・ C3, j n3
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, j ni
C1,1 C1,2 ・ ・ ・ C1, j n1
C2,1 C2,2 ・ ・ ・ C2, j n2
C3,1 C3,2 ・ ・ ・ C3, j n3
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, j ni
・ ・ ・ (Omitted below)

For the above output data, the frequency n (Frequency or Weight) is added for each same attribute. The recursive calculation is repeated j times, and the frequency is added up for each of the same attributes to calculate the total frequency for all combinations of items.

Result of recursive calculation F1 F2 ・ ・ ・ Fj n (total of Frequency or Weight)
~ ~ ・ ・ ・ ~ T (~, ~, ・ ・ ・, ~)
~ ~ ・ ・ ・ C1, jt (~, ~, ・ ・ ・, C1, j)
~ ~ ・ ・ ・ C2, jt (~, ~, ・ ・ ・, C2, j)
~ ~ ・ ・ ・ C3, jt (~, ~, ・ ・ ・, C3, j)
・ ・ ・
~ ~ ・ ・ ・ Ci, jt (~, ~, ・ ・ ・, Ci, j)
・ ・ ・
~ C1,2 ・ ・ ・ ~ t (~, C1,2, ・ ・ ・, ~)
~ C2,2 ・ ・ ・ ~ t (~, C2,2, ・ ・ ・, ~)
~ C3,2 ・ ・ ・ ~ t (~, C3,2, ・ ・ ・, ~)
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ t (~, Ci, 2, ・ ・ ・, ~)
・ ・ ・
~ C1,2 ・ ・ ・ C1, jt (~, C1,2, ・ ・ ・, C1, j)
~ C2,2 ・ ・ ・ C2, jt (~, C2,2, ・ ・ ・, C2, j)
~ C3,2 ・ ・ ・ C3, jt (~, C3,2, ・ ・ ・, C3, j)
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, jt (~, Ci, 2, ・ ・ ・ Ci, j)
・ ・ ・
C1,1 ~ ・ ・ ・ ~ t (C1,1, ~, ・ ・ ・, ~)
C2,1 ~ ・ ・ ・ ~ t (C2,1, ~, ・ ・ ・, ~)
C3,1 ~ ・ ・ ・ ~ t (C3,1, ~, ・ ・ ・, ~)
・ ・ ・
Ci, 1 ~ ・ ・ ・ ~ t (Ci, 1, ~, ・ ・ ・, ~)
・ ・ ・
C1,1 ~ ・ ・ ・ C1, jt (C1,1, ~, ・ ・ ・, C1, j)
C2,1 ~ ・ ・ ・ C2, jt (C2,1, ~, ・ ・ ・, C2, j)
C3,1 ~ ・ ・ ・ C3, jt (C3,1, ~, ・ ・ ・, C3, j)
・ ・ ・
Ci, 1 ~ ・ ・ ・ Ci, jt (Ci, 1, ~, ・ ・ ・, Ci, j)
・ ・ ・
C1,1 C1,2 ・ ・ ・ ~ t (C1,1, C1,2, ・ ・ ・, ~)
C2,1 C2,2 ・ ・ ・ ~ t (C2,1, C2,2, ・ ・ ・, ~)
C3,1 C3,2 ・ ・ ・ ~ t (C3,1, C3,2, ・ ・ ・, ~)
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ ~ t (Ci, 1, Ci, 2, ・ ・ ・, ~)
・ ・ ・
C1,1 C1,2 ・ ・ ・ C1, j n1
C2,1 C2,2 ・ ・ ・ C2, j n2
C3,1 C3,2 ・ ・ ・ C3, j n3
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, j ni

The total frequency t (Ci, 1, Ci, 2, ..., Ci, j) is the sum of the frequencies for the records of the attribute (Ci, 1, Ci, 2, ..., Ci, j). Shown.

Example)
Two-dimensional cross frequency spreadsheet calculation when the following frequencies are obtained for the two-dimensional data of attribute items F1 (a1, a2) and F2 (b1, b2, b3).

F1 F2 n (total of Frequency or Weight)
a1 b1 n1
a1 b2 n2
a1 b3 n3
a2 b1 n4
a2 b2 n5
a2 b3 n6

(1) First recursive calculation F1 F2 n (total of Frequency or Weight)
~ b1 n1
~ b2 n2
~ b3 n3
~ b1 n4
~ b2 n5
~ b3 n6
a1 b1 n1
a1 b2 n2
a1 b3 n3
a2 b1 n4
a2 b2 n5
a2 b3 n6

For the above output data, the frequency n (total of Frequency or Weight) is added up for each same attribute.

Calculation result F1 F2 n (total of Frequency or Weight)
~ b1 n1 + n4
~ b2 n2 + n5
~ b3 n3 + n6
a1 b1 n1
a1 b2 n2
a1 b3 n3
a2 b1 n4
a2 b2 n5
a2 b3 n6

(2) Second recursive calculation F1 F2 n (total of Frequency or Weight)
~ ~ n1 + n4
~ ~ n2 + n5
~ ~ n3 + n6
a1 ~ n1
a1 ~ n2
a1 ~ n3
a2 ~ n4
a2 ~ n5
a2 ~ n6
~ b1 n1 + n4
~ b2 n2 + n5
~ b3 n3 + n6
a1 b1 n1
a1 b2 n2
a1 b3 n3
a2 b1 n4
a2 b2 n5
a2 b3 n6

For the above output data, the frequency n (total of Frequency or Weight) is added for each same attribute.

Calculation result F1 F2 n (total of Frequency or Weight)
~ ~ n1 + n2 + n3 + n4 + n5 + n6
a1 ~ n1 + n2 + n3
a2 ~ n4 + n5 + n6
~ b1 n1 + n4
~ b2 n2 + n5
~ b3 n3 + n6
a1 b1 n1
a1 b2 n2
a1 b3 n3
a2 b1 n4
a2 b2 n5
a2 b3 n6

7.3 Concealment processing of multidimensional cross frequency table There are various methods for concealing the frequency table, but unlike the case of pre-concealment in which individual data is directly processed and anonymized, the frequency is performed after aggregation. Even if a part of the frequency table is concealed in the table concealment process, the concealed value may be calculated back by using the total of the vertical total, horizontal total, etc., or the value in combination with other items. is there. Therefore, in the present invention, a risk test is performed on all combinations of attribute items so that the values of risk cells in the frequency table cannot be calculated back, and the breakdown of the combinations of attribute items including risk cells is divided in cross table units. The method of erasing concealment is used. By using this method, it is possible to perform concealment processing so that the risk cell cannot be calculated back from other parts of the multidimensional cross frequency table.
However, while the method of erasing the breakdown in units of cross tables can be expected to have high security, there is a problem that the usefulness of the frequency table is significantly reduced because the number of cells to be erased is large. Therefore, in the present invention, a multidimensional cross concealment frequency table is performed by performing a complex concealment process by erasure concealment and rounding concealment, and by adding a rounding process to each cell of the multidimensional cross concealment table that has been subjected to the minimum erasure concealment. It uses a method to maintain the safety and usefulness of. It can be expected that a higher concealment effect can be obtained while maintaining the usefulness of the individual data by performing a complex concealment process by erasing concealment and rounding concealment.

7.3.1 All combination inspection and erasure concealment of attribute items For erasure concealment of multidimensional cross frequency table, the minimum cell of the multidimensional cross frequency table is inspected for each combination of attribute items, and the minimum cell is the standard. If it is less than that, it is a method of concealing the combination of the attribute items by replacing all the breakdown frequencies with zero values and erasing them.
Since the multidimensional cross frequency table includes the total and breakdown frequencies for all combinations of attribute items, risk inspection is performed for all combinations of the attribute items of the records to be aggregated. If a risk cell whose minimum cell is below the standard is included, the frequency table of the combination is determined as the risk table. For risk tables that include risk cells, it is not possible to ensure sufficient safety simply by deleting the relevant risk cells, so it is necessary to conceal by deleting the combination table that includes the risk cells on a table-by-table basis. is there. Therefore, when erasing concealment is performed, erasing concealment is performed by erasing the breakdown frequency of all cells for the combination of attribute items including the risk cell in the multidimensional cross frequency table.
For example, when the safety standard is 3 degrees or more, the minimum cell of the breakdown frequency of gender and the breakdown frequency of age is 3 or more by totaling the multidimensional cross frequency table for gender and age, but the gender and If the minimum cell of the breakdown frequency that crosses age is 1 and does not meet the safety criteria, the frequency table that crosses gender and age is a risk table that includes risk cells, so gender and age are crossed. The multidimensional cross frequency table is concealed by replacing all the breakdown frequencies with zero values and leaving the breakdown frequency only for the table that does not cross gender and age.
If the data to be erased and concealed contains a record whose attribute item is a null value, the frequency of the null value is excluded from the concealment target and processing is performed. This is because if the null value is targeted for concealment, if the null value is included only in one record and one attribute field, all combinations including that field will be targeted for erasure, and concealment will be performed normally. Because there is no such thing. Generally, a null value field is interpreted as a case where the attribute item is unknown, but the fact that the attribute item is unknown is not considered to be a confidential object and is processed. Even when the attribute item is unknown, if the isolated record is to be concealed, it is necessary to add an unknown sign to distinguish it from the null value instead of setting the unknown item as a null value.

Example)
It is assumed that the following cross frequency table is obtained when a three-dimensional cross table that crosses the employment status, gender, and age is aggregated for a certain individual data. Assuming that the safety standard is 3, the minimum cell in the cross table has a frequency of 1 for "woman aged 60-69" and a frequency of 2 for "man aged 60-69". It can be seen that a risk cell is generated by crossing the above three items.

Cross frequency table (in the case of 3D)
Gender Age Total a) Employed b) Unemployed Total 100 53 47
Total a) 20-29 years old 19 11 8
Total b) 30-39 years old 24 15 9
Total number c) 40-49 years old 23 15 8
Total d) 50-59 years old 18 9 9
Total number e) 60-69 years old 9 3 6
Total number f) 70 years old and over 7 0 7
a) Total number of men 50 32 18
a) Man a) 20-29 years old 10 6 4
a) Man b) 30-39 years old 13 10 3
a) Man c) 40-49 years old 12 9 3
a) Man d) 50-59 years old 8 5 3
a) Man e) 60-69 years old 4 2 2
a) Man f) Over 70 years old 3 0 3
b) Total number of women 50 21 29
b) Woman a) 20-29 years old 9 5 4
b) Woman b) 30-39 years old 11 5 6
b) Woman c) 40-49 years old 11 6 5
b) Woman d) 50-59 years old 10 4 6
b) Woman e) 60-69 years old 5 1 4
b) Woman f) Over 70 years old 4 0 4

This table is converted into a cell data format of one cell and one record (the total number is designated by the code "~"), and a classification code is assigned to each combination of attributes. The classification code represents the total item as "~" and the breakdown item as "0" for each attribute item.

Cross frequency table in cell data format (in the case of 3D)
F0 sign F1 Employment status F2 Gender F3 Age n (Frequency total)
~~~ ~ ~ ~ 100
~~ 0 ~ ~ a) 20-29 years old 19
~~ 0 ~ ~ b) 30 ~ 39 years old 24
~~ 0 ~ ~ c) 40 ~ 49 years old 23
~~ 0 ~ ~ d) 50 ~ 59 years old 18
~~ 0 ~ ~ e) 60 ~ 69 years old 9
~~ 0 ~ ~ f) Over 70 years old 7
~ 0 ~ ~ a) Man ~ 50
~ 00 ~ a) Man a) 20-29 years old 10
~ 00 ~ a) Man b) 30-39 years old 13
~ 00 ~ a) Man c) 40 ~ 49 years old 12
~ 00 ~ a) Man d) 50 ~ 59 years old 8
~ 00 ~ a) Man e) 60 ~ 69 years old 4
~ 00 ~ a) Man f) Over 70 years old 3
~ 0 ~ ~ b) Woman ~ 50
~ 00 ~ b) Woman a) 20-29 years old 9
~ 00 ~ b) Woman b) 30-39 years old 11
~ 00 ~ b) Woman c) 40-49 years old 11
~ 00 ~ b) Woman d) 50 ~ 59 years old 10
~ 00 ~ b) Woman e) 60-69 years old 5
~ 00 ~ b) Woman f) Over 70 years old 4
0 ~~ a) Working ~~ 53
0 ~ 0 a) Working ~ a) 20 ~ 29 years old 11
0 ~ 0 a) Working ~ b) 30 ~ 39 years old 15
0 ~ 0 a) Working ~ c) 40 ~ 49 years old 15
0 ~ 0 a) Working ~ d) 50 ~ 59 years old 9
0 ~ 0 a) Working ~ e) 60 ~ 69 years old 3
00 ~ a) Working a) Man ~ 32
000 a) Working a) Man a) 20-29 years old 6
000 a) Working a) Man b) 30-39 years old 10
000 a) Working a) Man c) 40-49 years old 9
000 a) Working a) Man d) 50-59 years old 5
000 a) Working a) Man e) 60-69 years old 2
00 ~ a) Working b) Woman ~ 21
000 a) Working b) Woman a) 20-29 years old 5
000 a) Working b) Woman b) 30-39 years old 5
000 a) Working b) Woman c) 40-49 years old 6
000 a) Working b) Woman d) 50-59 years old 4
000 a) Working b) Woman e) 60-69 years old 1
0 ~~ b) Unemployed ~ ~ 47
0 ~ 0 b) Unemployed ~ a) 20 ~ 29 years old 8
0 ~ 0 b) Unemployed ~ b) 30 ~ 39 years old 9
0 ~ 0 b) Unemployed ~ c) 40 ~ 49 years old 8
0 ~ 0 b) Unemployed ~ d) 50 ~ 59 years old 9
0 ~ 0 b) Unemployed ~ e) 60 ~ 69 years old 6
0 ~ 0 b) Unemployed ~ f) 70 years old and over 7
00 ~ b) Unemployed a) Man ~ 18
000 b) Unemployed a) Man a) 20-29 years old 4
000 b) Unemployed a) Man b) 30-39 years old 3
000 b) Unemployed a) Man c) 40-49 years old 3
000 b) Unemployed a) Man d) 50-59 years old 3
000 b) Unemployed a) Man e) 60-69 years old 2
000 b) Unemployed a) Man f) Over 70 years old 3
00 ~ b) Unemployed b) Woman ~ 29
000 b) Unemployed b) Woman a) 20-29 years old 4
000 b) Unemployed b) Woman b) 30-39 years old 6
000 b) Unemployed b) Woman c) 40-49 years old 5
000 b) Unemployed b) Woman d) 50-59 years old 6
000 b) Unemployed b) Woman e) 60-69 years old 4
000 b) Unemployed b) Woman f) Over 70 years old 4

When the risk check is performed on the minimum cell for each classification code, the following test results are obtained.

Test results (working status / gender / age)
Code minimum frequency
[000] 1
[~ 00] 3
[0 ~ 0] 3
[~~ 0] 7
[00 ~] 18
[0 ~~] 47
[~ 0 ~] 50
[~~~] 100

From this test result, it can be seen that the combination classification [000] is a risk table including a risk cell having a frequency of 1. Therefore, for the combination of classification [000], the erasure concealment is performed by replacing all the breakdown frequencies with zero values.

F0 sign F1 Employment status F2 Gender F3 Age n (Frequency total)
~~~ ~ ~ ~ 100
~~ 0 ~ ~ a) 20-29 years old 19
~~ 0 ~ ~ b) 30 ~ 39 years old 24
~~ 0 ~ ~ c) 40 ~ 49 years old 23
~~ 0 ~ ~ d) 50 ~ 59 years old 18
~~ 0 ~ ~ e) 60 ~ 69 years old 9
~~ 0 ~ ~ f) Over 70 years old 7
~ 0 ~ ~ a) Man ~ 50
~ 00 ~ a) Man a) 20-29 years old 10
~ 00 ~ a) Man b) 30-39 years old 13
~ 00 ~ a) Man c) 40 ~ 49 years old 12
~ 00 ~ a) Man d) 50 ~ 59 years old 8
~ 00 ~ a) Man e) 60 ~ 69 years old 4
~ 00 ~ a) Man f) Over 70 years old 3
~ 0 ~ ~ b) Woman ~ 50
~ 00 ~ b) Woman a) 20-29 years old 9
~ 00 ~ b) Woman b) 30-39 years old 11
~ 00 ~ b) Woman c) 40-49 years old 11
~ 00 ~ b) Woman d) 50 ~ 59 years old 10
~ 00 ~ b) Woman e) 60-69 years old 5
~ 00 ~ b) Woman f) Over 70 years old 4
0 ~~ a) Working ~~ 53
0 ~ 0 a) Working ~ a) 20 ~ 29 years old 11
0 ~ 0 a) Working ~ b) 30 ~ 39 years old 15
0 ~ 0 a) Working ~ c) 40 ~ 49 years old 15
0 ~ 0 a) Working ~ d) 50 ~ 59 years old 9
0 ~ 0 a) Working ~ e) 60 ~ 69 years old 3
00 ~ a) Working a) Man ~ 32
000 a) Working a) Male a) 20-29 years old 0 (zero value replacement)
000 a) Working a) Male b) 30-39 years old 0 (zero value replacement)
000 a) Working a) Male c) 40-49 years old 0 (zero value replacement)
000 a) Working a) Male d) 50-59 years old 0 (zero value replacement)
000 a) Working a) Male e) 60-69 years old 0 (zero value replacement)
00 ~ a) Working b) Woman ~ 21
000 a) Working b) Woman a) 20-29 years old 0 (zero value replacement)
000 a) Working b) Woman b) 30-39 years old 0 (zero value replacement)
000 a) Working b) Woman c) 40-49 years old 0 (zero value replacement)
000 a) Working b) Woman d) 50-59 years old 0 (zero value replacement)
000 a) Working b) Woman e) 60-69 years old 0 (zero value replacement)
0 ~~ b) Unemployed ~ ~ 47
0 ~ 0 b) Unemployed ~ a) 20 ~ 29 years old 8
0 ~ 0 b) Unemployed ~ b) 30 ~ 39 years old 9
0 ~ 0 b) Unemployed ~ c) 40 ~ 49 years old 8
0 ~ 0 b) Unemployed ~ d) 50 ~ 59 years old 9
0 ~ 0 b) Unemployed ~ e) 60 ~ 69 years old 6
0 ~ 0 b) Unemployed ~ f) 70 years old and over 7
00 ~ b) Unemployed a) Man ~ 18
000 b) Unemployed a) Man a) 20-29 years old 0 (zero value replacement)
000 b) Unemployed a) Male b) 30-39 years old 0 (zero value replacement)
000 b) Unemployed a) Male c) 40-49 years old 0 (zero value replacement)
000 b) Unemployed a) Man d) 50-59 years old 0 (zero value replacement)
000 b) Unemployed a) Male e) 60-69 years old 0 (zero value replacement)
000 b) Unemployed a) Male f) Over 70 years old 0 (zero value replacement)
00 ~ b) Unemployed b) Woman ~ 29
000 b) Unemployed b) Woman a) 20-29 years old 0 (zero value replacement)
000 b) Unemployed b) Woman b) 30-39 years old 0 (zero value replacement)
000 b) Unemployed b) Woman c) 40-49 years old 0 (zero value replacement)
000 b) Unemployed b) Woman d) 50-59 years old 0 (zero value replacement)
000 b) Unemployed b) Woman e) 60-69 years old 0 (zero value replacement)
000 b) Unemployed b) Woman f) Over 70 years old 0 (zero value replacement)

By performing the difference calculation of the total and the breakdown and the conversion to the individual form for the cross frequency table that has been erased and concealed by the above method, it is possible to obtain the individual form data that does not include the information on the risk cell.

7.3.2 Rounding concealment of multidimensional frequency table
(1) Concealment of rounding of multidimensional frequency table In a multidimensional cross frequency table, if the frequency does not meet the safety standard, the data contained in that cell becomes a risk cell in the frequency table and a risk record in individual data, so the frequency By rounding the table, the cell including the risk record can be concealed. As an example, when the rounding process is performed by rounding with a rounding radix of 5, the frequency table is rounded by dividing the frequency by the radix 5 and multiplying the value rounded to the nearest whole number by the radix 5.

Rounding formula

t (C1, C2,, ..., Ci)'= ROUND (t (C1, C2,, ..., Ci))

Note) ROUND () represents a function that performs rounding.

Rounding calculation result F1 F2 ・ ・ ・ Fj N'
~ ~ ・ ・ ・ ~ T (~, ~, ・ ・ ・, ~)'
~ ~ ・ ・ ・ C1, jt (~, ~, ・ ・ ・, C1, j)'
~ ~ ・ ・ ・ C2, jt (~, ~, ・ ・ ・, C2, j)'
~ ~ ・ ・ ・ C3, jt (~, ~, ・ ・ ・, C3, j)'
・ ・ ・
~ ~ ・ ・ ・ Ci, jt (~, ~, ・ ・ ・, Ci, j)'
・ ・ ・
~ C1,2 ・ ・ ・ ~ t (~, C1,2, ・ ・ ・, ~)'
~ C2,2 ・ ・ ・ ~ t (~, C2,2, ・ ・ ・, ~)'
~ C3,2 ・ ・ ・ ~ t (~, C3,2, ・ ・ ・, ~)'
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ t (~, Ci, 2, ・ ・ ・, ~)'
・ ・ ・
~ C1,2 ・ ・ ・ C1, jt (~, C1,2, ・ ・ ・, C1, j)'
~ C2,2 ・ ・ ・ C2, jt (~, C2,2, ・ ・ ・, C2, j)'
~ C3,2 ・ ・ ・ C3, jt (~, C3,2, ・ ・ ・, C3, j)'
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, jt (~, Ci, 2, ・ ・ ・ Ci, j)'
・ ・ ・
C1,1 ~ ・ ・ ・ ~ t (C1,1, ~, ・ ・ ・, ~)'
C2,1 ~ ・ ・ ・ ~ t (C2,1, ~, ・ ・ ・, ~)'
C3,1 ~ ・ ・ ・ ~ t (C3,1, ~, ・ ・ ・, ~)'
・ ・ ・
Ci, 1 ~ ・ ・ ・ ~ t (Ci, 1, ~, ・ ・ ・, ~)'
・ ・ ・
C1,1 ~ ・ ・ ・ C1, jt (C1,1, ~, ・ ・ ・, C1, j)'
C2,1 ~ ・ ・ ・ C2, jt (C2,1, ~, ・ ・ ・, C2, j)'
C3,1 ~ ・ ・ ・ C3, jt (C3,1, ~, ・ ・ ・, C3, j)'
・ ・ ・
Ci, 1 ~ ・ ・ ・ Ci, jt (Ci, 1, ~, ・ ・ ・, Ci, j)'
・ ・ ・
C1,1 C1,2 ・ ・ ・ ~ t (C1,1, C1,2, ・ ・ ・, ~)'
C2,1 C2,2 ・ ・ ・ ~ t (C2,1, C2,2, ・ ・ ・, ~)'
C3,1 C3,2 ・ ・ ・ ~ t (C3,1, C3,2, ・ ・ ・, ~)'
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ ~ t (Ci, 1, Ci, 2, ・ ・ ・, ~)'
・ ・ ・
C1,1 C1,2 ・ ・ ・ C1, j n1'
C2,1 C2,2 ・ ・ ・ C2, j n2'
C3,1 C3,2 ・ ・ ・ C3, j n3'
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, j ni'

Example) Rounding of multidimensional cross frequency table (in the case of 2D)
F1 F2 Nf (Frequency)
~ ~ (n1 + n2 + n3 + n4 + n5 + n6)'= ROUND (n1 + n2 + n3 + n4 + n5 + n6)
a1 ~ (n1 + n2 + n3)'= ROUND (n1 + n2 + n3)
a2 ~ (n4 + n5 + n6)'= ROUND (n4 + n5 + n6)
~ b1 (n1 + n4)'= ROUND (n1 + n4)
~ b2 (n2 + n5)'= ROUND (n2 + n5)
~ b3 (n3 + n6)'= ROUND (n3 + n6)
a1 b1 (n1)'= ROUND (n1)
a1 b2 (n2)'= ROUND (n2)
a1 b3 (n3)'= ROUND (n3)
a2 b1 (n4)'= ROUND (n4)
a2 b2 (n5)'= ROUND (n5)
a2 b3 (n6)'= ROUND (n6)

Note) ROUND () represents a function that performs rounding.

Example) When rounding to a rounding base of 5 Frequency Rounding value Rounding calculation 0 0 Round (0/5) * 5 = 0
10 Round (1/5) * 5 = 0
20 Round (2/5) * 5 = 0

3 5 Round (3/5) * 5 = 5
4 5 Round (4/5) * 5 = 5
5 5 Round (5/5) * 5 = 5
6 5 Round (6/5) * 5 = 5
7 5 Round (7/5) * 5 = 5

8 10 Round (8/5) * 5 = 10
9 10 Round (9/5) * 5 = 10
10 10 Round (10/5) * 5 = 10

Note) Round () indicates a function that rounds to the nearest whole number.

Example) Multidimensional cross frequency table (in the case of 2D)
Total age a) Male b) Total female 100 50 50
a) 20-29 years old 19 10 9
b) 30-39 years old 24 13 11
c) 40-49 years old 23 12 11
d) 50-59 years old 18 8 10
e) 60-69 years old 9 4 5
f) Over 70 years old 7 3 4

Rounding of frequency table (when rounding radix is 5)
Total age a) Male b) Total female 100 50 50
a) 20-29 years old 20 10 10
b) 30-39 years old 25 15 10
c) 40-49 years old 25 10 10
d) 50-59 years old 20 10 10
e) 60-69 years old 10 5 5
f) Over 70 years old 5 5 5

(2) Cardinal number and safety of rounding concealment The number of rounding radix used for rounding concealment by rounding must be 5 or more. This is because if the rounding process is performed with a radix of less than 5, sufficient concealment may not be possible. When the rounding radix is 5, the frequency of the group having the rounding value of 5 exists in the range of 3 to 7, and it is not possible to specify the number of the radix of the group only from the rounding value. In the frequency table, it is necessary to round not only the cell value for each attribute but also the total value, and even if the frequency of the base of the cell in the frequency table is 1 or 2, it is rounded down by rounding other cells. Since it is not possible to identify the cells that have been rounded down due to the mixture of rounding up, it is expected that the frequency table that has been rounded with a rounding radix of 5 or more can ensure a certain degree of safety from the viewpoint of the possibility of identifying risk data. it can. However, depending on the distribution of individual data by attribute, the concealment strength may be slightly insufficient even with a rounding radix of 5, so the safety standard for the rounding radix is set to 10 by default in the program. It is possible to ensure higher safety by setting a larger safety standard for the rounding radix.

Since rounding errors due to rounding occur with equal probability in the entire table, it can be expected that significant distortion will not occur although the accuracy of the statistical table will decrease if rounding is performed, and it is scientific if a sufficient number of effective digits can be secured. It can be used as a distortion-free table from the viewpoint.
The rounding process of the frequency table is a method generally used as a method of concealing the statistical table, but since the target is not the individual data but the aggregated statistical table, it is used as it is for concealing the individual data. You can't. Only by applying the method of converting the frequency table in the individual form in the present invention can it be diverted to the concealment of individual form data as an effective method.
In the present invention, concealment by a simple rounding process is used for the sake of simplicity, but other methods such as random number rounding can also be diverted. In addition, there are various methods for concealing statistical tables other than rounding concealment, and by applying the method of converting the frequency table into individual form according to the present invention, various methods for concealing statistical tables can be individually obtained. It can be diverted as a data concealment method.
In addition to "rounding", "rounding up" or "rounding down" can be used as the rounding method, but if a frequency table with different rounding processing is created, risk data may be identified by the difference. Therefore, it is necessary to use the same method for rounding the frequency table.

(3) Vulnerability of rounding concealment It can be expected that the multidimensional cross frequency table can be secured to some extent by performing rounding processing as a concealment method. However, if the result table without rounding concealment is published in advance, there are cases where the breakdown can be calculated back from the total value without rounding.
For example, in the case of a combination of 5 and 1 with a total of 6, the breakdown of rounding with a radix of 5 is 5 and 0, and the total is 5, but it is announced that the total without rounding is 6. If so, there is a problem that there is a possibility that a single cell may be specified because there are only breakdowns 5 and 1 or breakdowns 6 and 0 in the combination in which the rounded breakdown is 5 and 0. Similarly, there is a possibility that a cell of one frequency will be specified for a combination of 10 and 1 or 100 and 1.
For this reason, as the concealment processing of the frequency table, since the concealment strength is insufficient only by rounding concealment, it is necessary to reinforce the concealment by combining other concealment methods.

7.3.3 Complex concealment of multidimensional frequency table Erasing concealment of multidimensional cross frequency table is to improve the safety of concealment because attribute items including risk cells are erased in table units of item combinations. If the safety standard for erasure concealment is increased, the information contained in the multidimensional cross frequency table will be significantly deleted, and the usefulness of the data will be impaired. Therefore, it is necessary to keep the safety standard of erasure concealment to the minimum necessary and balance safety and usefulness by performing compound concealment in combination with reinforcement methods such as rounding concealment.
In the case of compound concealment, after totaling the multidimensional cross frequency table, (1) erasure concealment, (2) rounding concealment (composite concealment), (3) difference calculation, (4) individual form Concealed individual data is created by performing concealment processing in the order of conversion.

Example) Combined concealment by erasing concealment and rounding concealment
(1) Concealment of erasure of multidimensional cross frequency table (in the case of 3D)
F0 sign F1 Employment status F2 Gender F3 Age n (Frequency total)
~~~ ~ ~ ~ 100
~~ 0 ~ ~ a) 20-29 years old 19
~~ 0 ~ ~ b) 30 ~ 39 years old 24
~~ 0 ~ ~ c) 40 ~ 49 years old 23
~~ 0 ~ ~ d) 50 ~ 59 years old 18
~~ 0 ~ ~ e) 60 ~ 69 years old 9
~~ 0 ~ ~ f) Over 70 years old 7
~ 0 ~ ~ a) Man ~ 50
~ 00 ~ a) Man a) 20-29 years old 10
~ 00 ~ a) Man b) 30-39 years old 13
~ 00 ~ a) Man c) 40 ~ 49 years old 12
~ 00 ~ a) Man d) 50 ~ 59 years old 8
~ 00 ~ a) Man e) 60 ~ 69 years old 4
~ 00 ~ a) Man f) Over 70 years old 3
~ 0 ~ ~ b) Woman ~ 50
~ 00 ~ b) Woman a) 20-29 years old 9
~ 00 ~ b) Woman b) 30-39 years old 11
~ 00 ~ b) Woman c) 40-49 years old 11
~ 00 ~ b) Woman d) 50 ~ 59 years old 10
~ 00 ~ b) Woman e) 60-69 years old 5
~ 00 ~ b) Woman f) Over 70 years old 4
0 ~~ a) Working ~~ 53
0 ~ 0 a) Working ~ a) 20 ~ 29 years old 11
0 ~ 0 a) Working ~ b) 30 ~ 39 years old 15
0 ~ 0 a) Working ~ c) 40 ~ 49 years old 15
0 ~ 0 a) Working ~ d) 50 ~ 59 years old 9
0 ~ 0 a) Working ~ e) 60 ~ 69 years old 3
00 ~ a) Working a) Man ~ 32
000 a) Working a) Male a) 20-29 years old 0 (zero value replacement)
000 a) Working a) Male b) 30-39 years old 0 (zero value replacement)
000 a) Working a) Male c) 40-49 years old 0 (zero value replacement)
000 a) Working a) Male d) 50-59 years old 0 (zero value replacement)
000 a) Working a) Male e) 60-69 years old 0 (zero value replacement)
00 ~ a) Working b) Woman ~ 21
000 a) Working b) Woman a) 20-29 years old 0 (zero value replacement)
000 a) Working b) Woman b) 30-39 years old 0 (zero value replacement)
000 a) Working b) Woman c) 40-49 years old 0 (zero value replacement)
000 a) Working b) Woman d) 50-59 years old 0 (zero value replacement)
000 a) Working b) Woman e) 60-69 years old 0 (zero value replacement)
0 ~~ b) Unemployed ~ ~ 47
0 ~ 0 b) Unemployed ~ a) 20 ~ 29 years old 8
0 ~ 0 b) Unemployed ~ b) 30 ~ 39 years old 9
0 ~ 0 b) Unemployed ~ c) 40 ~ 49 years old 8
0 ~ 0 b) Unemployed ~ d) 50 ~ 59 years old 9
0 ~ 0 b) Unemployed ~ e) 60 ~ 69 years old 6
0 ~ 0 b) Unemployed ~ f) 70 years old and over 7
00 ~ b) Unemployed a) Man ~ 18
000 b) Unemployed a) Man a) 20-29 years old 0 (zero value replacement)
000 b) Unemployed a) Male b) 30-39 years old 0 (zero value replacement)
000 b) Unemployed a) Male c) 40-49 years old 0 (zero value replacement)
000 b) Unemployed a) Man d) 50-59 years old 0 (zero value replacement)
000 b) Unemployed a) Male e) 60-69 years old 0 (zero value replacement)
000 b) Unemployed a) Male f) Over 70 years old 0 (zero value replacement)
00 ~ b) Unemployed b) Woman ~ 29
000 b) Unemployed b) Woman a) 20-29 years old 0 (zero value replacement)
000 b) Unemployed b) Woman b) 30-39 years old 0 (zero value replacement)
000 b) Unemployed b) Woman c) 40-49 years old 0 (zero value replacement)
000 b) Unemployed b) Woman d) 50-59 years old 0 (zero value replacement)
000 b) Unemployed b) Woman e) 60-69 years old 0 (zero value replacement)
000 b) Unemployed b) Woman f) Over 70 years old 0 (zero value replacement)

(2) Concealment of rounding of multidimensional frequency table (when rounding radix is 5)
F0 sign F1 Employment status F2 Gender F3 Age n (Frequency total)
~~~ ~ ~ ~ 100
~~ 0 ~ ~ a) 20 ~ 29 years old 20
~~ 0 ~ ~ b) 30 ~ 39 years old 25
~~ 0 ~ ~ c) 40 ~ 49 years old 25
~~ 0 ~ ~ d) 50 ~ 59 years old 20
~~ 0 ~ ~ e) 60 ~ 69 years old 10
~~ 0 ~ ~ f) Over 70 years old 5
~ 0 ~ ~ a) Man ~ 50
~ 00 ~ a) Man a) 20-29 years old 10
~ 00 ~ a) Man b) 30-39 years old 15
~ 00 ~ a) Man c) 40 ~ 49 years old 10
~ 00 ~ a) Man d) 50 ~ 59 years old 10
~ 00 ~ a) Man e) 60-69 years old 5
~ 00 ~ a) Man f) Over 70 years old 5
~ 0 ~ ~ b) Woman ~ 50
~ 00 ~ b) Woman a) 20-29 years old 10
~ 00 ~ b) Woman b) 30-39 years old 10
~ 00 ~ b) Woman c) 40 ~ 49 years old 10
~ 00 ~ b) Woman d) 50 ~ 59 years old 10
~ 00 ~ b) Woman e) 60-69 years old 5
~ 00 ~ b) Woman f) Over 70 years old 5
0 ~~ a) Working ~~ 55
0 ~ 0 a) Working ~ a) 20 ~ 29 years old 10
0 ~ 0 a) Working ~ b) 30 ~ 39 years old 15
0 ~ 0 a) Working ~ c) 40 ~ 49 years old 15
0 ~ 0 a) Working ~ d) 50 ~ 59 years old 10
0 ~ 0 a) Working ~ e) 60 ~ 69 years old 5
00 ~ a) Working a) Man ~ 30
000 a) Working a) Man a) 20-29 years old 0
000 a) Working a) Man b) 30-39 years old 0
000 a) Working a) Man c) 40-49 years old 0
000 a) Working a) Man d) 50-59 years old 0
000 a) Working a) Man e) 60-69 years old 0
00 ~ a) Working b) Woman ~ 20
000 a) Working b) Woman a) 20-29 years old 0
000 a) Working b) Woman b) 30-39 years old 0
000 a) Working b) Woman c) 40-49 years old 0
000 a) Working b) Woman d) 50-59 years old 0
000 a) Working b) Woman e) 60-69 years old 0
0 ~~ b) Unemployed ~ ~ 45
0 ~ 0 b) Unemployed ~ a) 20 ~ 29 years old 10
0 ~ 0 b) Unemployed ~ b) 30 ~ 39 years old 10
0 ~ 0 b) Unemployed ~ c) 40 ~ 49 years old 10
0 ~ 0 b) Unemployed ~ d) 50 ~ 59 years old 10
0 ~ 0 b) Unemployed ~ e) 60 ~ 69 years old 5
0 ~ 0 b) Unemployed ~ f) 70 years old and over 5
00 ~ b) Unemployed a) Man ~ 20
000 b) Unemployed a) Man a) 20-29 years old 0
000 b) Unemployed a) Man b) 30-39 years old 0
000 b) Unemployed a) Man c) 40-49 years old 0
000 b) Unemployed a) Man d) 50-59 years old 0
000 b) Unemployed a) Man e) 60-69 years old 0
000 b) Unemployed a) Man f) Over 70 years old 0
00 ~ b) Unemployed b) Woman ~ 30
000 b) Unemployed b) Woman a) 20-29 years old 0
000 b) Unemployed b) Woman b) 30-39 years old 0
000 b) Unemployed b) Woman c) 40-49 years old 0
000 b) Unemployed b) Woman d) 50-59 years old 0
000 b) Unemployed b) Woman e) 60-69 years old 0
000 b) Unemployed b) Woman f) Over 70 years old 0

(3) Difference calculation of compound concealed multidimensional frequency table (attribute code "~" indicates difference)
F1 Employment status F2 Gender F3 Age n (Frequency total)
a) Working a) Man ~ 30
a) Working b) Woman ~ 20
a) Working ~ a) 20 ~ 29 years old 10
a) Working ~ b) 30 ~ 39 years old 15
a) Working ~ c) 40 ~ 49 years old 15
a) Employed ~ d) 50 ~ 59 years old 10
a) Employed ~ e) 60 ~ 69 years old 5
a) Working ~ ~ ~ -50
b) Unemployed a) Man ~ 20
b) Unemployed b) Woman ~ 30
b) Unemployed ~ a) 20 ~ 29 years old 10
b) Unemployed ~ b) 30 ~ 39 years old 10
b) Unemployed ~ c) 40 ~ 49 years old 10
b) Unemployed ~ d) 50 ~ 59 years old 10
b) Unemployed ~ e) 60 ~ 69 years old 5
b) Unemployed ~ f) 70 years old and over 5
b) Unemployed ~ ~ ~ -55
~ A) Man a) 20 ~ 29 years old 10
~ A) Man b) 30 ~ 39 years old 15
~ A) Man c) 40 ~ 49 years old 10
~ A) Man d) 50 ~ 59 years old 10
~ A) Man e) 60 ~ 69 years old 5
~ A) Man f) Over 70 years old 5
~ A) Man ~ -55
~ B) Woman a) 20 ~ 29 years old 10
~ B) Woman b) 30 ~ 39 years old 10
~ B) Woman c) 40 ~ 49 years old 10
~ B) Woman d) 50 ~ 59 years old 10
~ B) Woman e) 60 ~ 69 years old 5
~ B) Woman f) Over 70 years old 5
~ B) Woman ~ -50
~ ~ A) 20 ~ 29 years old -20
~ ~ B) 30 ~ 39 years old -25
~ ~ C) 40 ~ 49 years old -20
~ ~ D) 50 ~ 59 years old -20
~ ~ E) 60 ~ 69 years old -10
~ ~ F) 70 years old and over -10
~ ~ ~ 105

(4) Individual form data format conversion (when scale is 1)
F1 Employment Status F2 Gender F3 Age Weight
a) Working a) Man ~ 1 (30 record output)
a) Working b) Woman ~ 1 (20 records output)
a) Working ~ a) 20 ~ 29 years old 1 (10 record output)
a) Working ~ b) 30 ~ 39 years old 1 (15 record output)
a) Working ~ c) 40 ~ 49 years old 1 (15 record output)
a) Working ~ d) 50 ~ 59 years old 1 (10 record output)
a) Working ~ e) 60 ~ 69 years old 1 (5 record output)
a) Working ~ ~ -1 (50 record output)
b) Unemployed a) Man ~ 1 (20 records output)
b) Unemployed b) Woman ~ 1 (30 record output)
b) Unemployed ~ a) 20 ~ 29 years old 1 (10 record output)
b) Unemployed ~ b) 30 ~ 39 years old 1 (10 record output)
b) Unemployed ~ c) 40 ~ 49 years old 1 (10 record output)
b) Unemployed ~ d) 50 ~ 59 years old 1 (10 record output)
b) Unemployed ~ e) 60 ~ 69 years old 1 (5 record output)
b) Unemployed ~ f) 70 years old and over 1 (5 record output)
b) Unemployed ~ ~ -1 (55 record output)
~ A) Man a) 20 ~ 29 years old 1 (10 record output)
~ A) Man b) 30 ~ 39 years old 1 (15 record output)
~ A) Man c) 40 ~ 49 years old 1 (10 record output)
~ A) Man d) 50 ~ 59 years old 1 (10 record output)
~ A) Man e) 60 ~ 69 years old 1 (5 record output)
~ A) Male f) 70 years old and over 1 (5 record output)
~ A) Man ~ -1 (55 record output)
~ B) Woman a) 20 ~ 29 years old 1 (10 record output)
~ B) Woman b) 30 ~ 39 years old 1 (10 record output)
~ B) Woman c) 40 ~ 49 years old 1 (10 record output)
~ B) Woman d) 50 ~ 59 years old 1 (10 record output)
~ B) Woman e) 60 ~ 69 years old 1 (5 record output)
~ B) Woman f) 70 years old and over 1 (5 record output)
~ B) Woman ~ -1 (50 record output)
~ ~ A) 20 ~ 29 years old -1 (20 record output)
~ ~ B) 30 ~ 39 years old -1 (25 record output)
~ ~ C) 40 ~ 49 years old -1 (20 record output)
~ ~ D) 50 ~ 59 years old -1 (20 record output)
~ ~ E) 60 ~ 69 years old -1 (10 record output)
~ ~ F) 70 years old and over -1 (10 record output)
~ ~ ~ 1 (105 record output)

7.4 Conversion of individual data format of multidimensional cross concealment frequency table The multidimensional cross concealment frequency table that has undergone concealment processing is converted to individual data format after performing difference calculation.

(1) Difference calculation Due to the rounding error in the rounded frequency table, the total number and the total breakdown often do not match. Therefore, the difference between the total number and the total breakdown is calculated.
For the difference calculation, the recursive calculation is performed by the reverse processing of the multidimensional cross frequency table. That is, for the first attribute item, a record in which the frequency of the total code (“~”) is set to zero and the other frequencies are negative and the attribute item is replaced with the total code (“~”) is added to the input data record. Then, by recursive processing using this output data as input data, the frequency of the total code (“~”) for the second attribute item is set to zero, and the other frequencies are set to minus, and the attribute items are totaled. The record replaced with the code (“~”) is added to the input data record and output, and this is repeated up to the jth for all the attribute items to perform the three-dimensional difference calculation of the multidimensional cross frequency table. In the difference calculation, the total number code (“~”) is treated as a difference code indicating the difference, and is replaced with a null value after the calculation.
In addition, in order to save the calculation amount and the calculation time in the program, the frequency of the output data is added up for each record of the same attribute each time the recursive calculation is performed. In addition, although the difference calculation of the multidimensional cross frequency table by recursive calculation is explained here, if it is a method of obtaining the difference for all combinations of attribute items, the calculation may be performed by a method that does not use recursive calculation. ..

First recursive difference calculation The multidimensional cross frequency table data by recursive calculation is rounded and used as input data.

[Previous stage] Output without changing the input data F1 F2 ・ ・ ・ Fj n'
~ ~ ・ ・ ・ ~ T (~, ~, ・ ・ ・, ~)'The first term is ~
~ ~ ・ ・ ・ C1, jt (~, ~, ・ ・ ・, C1, j)'The first term is ~
~ ~ ・ ・ ・ C2, jt (~, ~, ・ ・ ・, C2, j)'The first term is ~
~ ~ ・ ・ ・ C3, jt (~, ~, ・ ・ ・, C3, j)'The first term is ~
・ ・ ・
~ ~ ・ ・ ・ Ci, jt (~, ~, ・ ・ ・, Ci, j)'The first term is ~
・ ・ ・
~ C1,2 ・ ・ ・ ~ t (~, C1,2, ・ ・ ・, ~)'The first term is ~
~ C2,2 ・ ・ ・ ~ t (~, C2,2, ・ ・ ・, ~)'The first term is ~
~ C3,2 ・ ・ ・ ~ t (~, C3,2, ・ ・ ・, ~)'The first term is ~
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ t (~, Ci, 2, ・ ・ ・, ~)'The first term is ~
・ ・ ・
~ C1,2 ・ ・ ・ C1, jt (~, C1,2, ・ ・ ・, C1, j)'The first term is ~
~ C2,2 ・ ・ ・ C2, jt (~, C2,2, ・ ・ ・, C2, j)'The first term is ~
~ C3,2 ・ ・ ・ C3, jt (~, C3,2, ・ ・ ・, C3, j)'The first term is ~
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, jt (~, Ci, 2, ・ ・ ・, Ci, j)'The first term is ~
・ ・ ・
C1,1 ~ ・ ・ ・ ~ t (C1,1, ~, ・ ・ ・, ~)'The first term is C1,1
C2,1 ~ ・ ・ ・ ~ t (C2,1, ~, ・ ・ ・, ~)'The first term is C2,1
C3,1 ~ ・ ・ ・ ~ t (C3,1, ~, ・ ・ ・, ~)'The first term is C3,1
・ ・ ・
Ci, 1 ~ ・ ・ ・ ~ t (Ci, 1, ~, ・ ・ ・, ~)'The first term is Ci, 1
・ ・ ・
C1,1 ~ ・ ・ ・ C1, jt (C1,1, ~, ・ ・ ・, C1, j)'The first term is C1,1
C2,1 ~ ・ ・ ・ C2, jt (C2,1, ~, ・ ・ ・, C2, j)'The first term is C2,1
C3,1 ~ ・ ・ ・ C3, jt (C3,1, ~, ・ ・ ・, C3, j)'The first term is C3,1
・ ・ ・
Ci, 1 ~ ・ ・ ・ Ci, jt (Ci, 1, ~, ・ ・ ・, Ci, j)'The first term is Ci, 1
・ ・ ・
C1,1 C1,2 ・ ・ ・ ~ t (C1,1, C1,2, ・ ・ ・, ~)'The first term is C1,1
C2,1 C2,2 ・ ・ ・ ~ t (C2,1, C2,2, ・ ・ ・, ~)'The first term is C2,1
C3,1 C3,2 ・ ・ ・ ~ t (C3,1, C3,2, ・ ・ ・, ~)'The first term is C3,1
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ ~ t (Ci, 1, Ci, 2, ・ ・ ・, ~)'The first term is Ci, 1
・ ・ ・
C1,1 C1,2 ・ ・ ・ C1, j n1'The first term is C1,1
C2,1 C2,2 ・ ・ ・ C2, j n2'The first term is C2,1
C3,1 C3,2 ・ ・ ・ C3, j n3'The first term is C3,1
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, j ni'The first term is Ci, 1

[Second stage] Change the input data and output (before change)
~ ~ ・ ・ ・ ~ 0 The first term is ~
~ ~ ・ ・ ・ C1, j 0 The first term is ~
~ ~ ・ ・ ・ C2, j 0 The first term is ~
~ ~ ・ ・ ・ C3, j 0 The first term is ~
・ ・ ・
~ ~ ・ ・ ・ Ci, j 0 The first term is ~
・ ・ ・
~ C1,2 ・ ・ ・ ~ 0 The first term is ~
~ C2,2 ・ ・ ・ ~ 0 The first term is ~
~ C3,2 ・ ・ ・ ~ 0 The first term is ~
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ 0 The first term is ~
・ ・ ・
~ C1,2 ・ ・ ・ C1, j 0 The first term is ~
~ C2,2 ・ ・ ・ C2, j 0 The first term is ~
~ C3,2 ・ ・ ・ C3, j 0 The first term is ~
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, j 0 The first term is ~
・ ・ ・
~ ~ ・ ・ ・ ~ ~ -T (C1,1, ~, ・ ・ ・, ~)'The first term is C1,1
~ ~ ・ ・ ・ ~ ~ -T (C2,1, ~, ・ ・ ・, ~)'The first term is C2,1
~ ~ ・ ・ ・ ~ ~ -T (C3,1, ~, ・ ・ ・, ~)'The first term is C3,1
・ ・ ・
~ ~ ・ ・ ・ ~ ~ -T (Ci, 1, ~, ・ ・ ・, ~)'The first term is Ci, 1
・ ・ ・
~ ~ ・ ・ ・ C1, j -t (C1,1, ~, ・ ・ ・, C1, j)'The first term is C1,1
~ ~ ・ ・ ・ C2, j -t (C2,1, ~, ・ ・ ・, C2, j)'The first term is C2,1
~ ~ ・ ・ ・ C3, j -t (C3,1, ~, ・ ・ ・, C3, j)'The first term is C3,1
・ ・ ・
~ ~ ・ ・ ・ Ci, j -t (Ci, 1, ~, ・ ・ ・, Ci, j)'The first term is Ci, 1
・ ・ ・
~ C1,2 ・ ・ ・ ~ -t (C1,1, C1,2, ・ ・ ・, ~)'The first term is C1,1
~ C2,2 ・ ・ ・ ~ -t (C2,1, C2,2, ・ ・ ・, ~)'The first term is C2,1
~ C3,2 ・ ・ ・ ~ -t (C3,1, C3,2, ・ ・ ・, ~)'The first term is C3,1
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ -t (Ci, 1, Ci, 2, ・ ・ ・, ~)'The first term is Ci, 1
・ ・ ・
~ C1,2 ・ ・ ・ C1, j -n1'The first term is C1,1
~ C2,2 ・ ・ ・ C2, j -n2'The first term is C2,1
~ C3,2 ・ ・ ・ C3, j -n3'The first term is C3,1
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, j -ni'The first term is Ci, 1

For the above output data, the frequency N is added for each same attribute.

As the second recursive difference calculation input data, the first recursive difference calculation result is used as an input.

[Previous stage] Output without changing the input data F1 F2 ・ ・ ・ Fj n'
~ ~ ・ ・ ・ ~ T (~, ~, ・ ・ ・, ~)'The second term is ~
~ ~ ・ ・ ・ C1, jt (~, ~, ・ ・ ・, C1, j)'The second term is ~
~ ~ ・ ・ ・ C2, jt (~, ~, ・ ・ ・, C2, j)'The second term is ~
~ ~ ・ ・ ・ C3, jt (~, ~, ・ ・ ・, C3, j)'The second term is ~
・ ・ ・
~ ~ ・ ・ ・ Ci, jt (~, ~, ・ ・ ・, Ci, j)'The second term is ~
・ ・ ・
~ C1,2 ・ ・ ・ ~ t (~, C1,2, ・ ・ ・, ~)'The second term is C1,2
~ C2,2 ・ ・ ・ ~ t (~, C2,2, ・ ・ ・, ~)'The second term is C2,2
~ C3,2 ・ ・ ・ ~ t (~, C3,2, ・ ・ ・, ~)'The second term is C3,2
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ t (~, Ci, 2, ・ ・ ・, ~)'The second term is Ci, 2
・ ・ ・
~ C1,2 ・ ・ ・ C1, jt (~, C1,2, ・ ・ ・, C1, j)'The second term is C1,2
~ C2,2 ・ ・ ・ C2, jt (~, C2,2, ・ ・ ・, C2, j)'The second term is C2,2
~ C3,2 ・ ・ ・ C3, jt (~, C3,2, ・ ・ ・, C3, j)'The second term is C3,2
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, jt (~, Ci, 2, ・ ・ ・, Ci, j)'The second term is Ci, 2
・ ・ ・
C1,1 ~ ・ ・ ・ ~ t (C1,1, ~, ・ ・ ・, ~)'The second term is ~
C2,1 ~ ・ ・ ・ ~ t (C2,1, ~, ・ ・ ・, ~)'The second term is ~
C3,1 ~ ・ ・ ・ ~ t (C3,1, ~, ・ ・ ・, ~)'The second term is ~
・ ・ ・
Ci, 1 ~ ・ ・ ・ ~ t (Ci, 1, ~, ・ ・ ・, ~)'The second term is ~
・ ・ ・
C1,1 ~ ・ ・ ・ C1, jt (C1,1, ~, ・ ・ ・, C1, j)'The second term is ~
C2,1 ~ ・ ・ ・ C2, jt (C2,1, ~, ・ ・ ・, C2, j)'The second term is ~
C3,1 ~ ・ ・ ・ C3, jt (C3,1, ~, ・ ・ ・, C3, j)'The second term is ~
・ ・ ・
Ci, 1 ~ ・ ・ ・ Ci, jt (Ci, 1, ~, ・ ・ ・, Ci, j)'The second term is ~
・ ・ ・
C1,1 C1,2 ・ ・ ・ ~ t (C1,1, C1,2, ・ ・ ・, ~)'The second term is C1,2
C2,1 C2,2 ・ ・ ・ ~ t (C2,1, C2,2, ・ ・ ・, ~)'The second term is C2,2
C3,1 C3,2 ・ ・ ・ ~ t (C3,1, C3,2, ・ ・ ・, ~)'The second term is ~
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ ~ t (Ci, 1, Ci, 2, ・ ・ ・, ~)'The second term is Ci, 2
・ ・ ・
C1,1 C1,2 ・ ・ ・ C1, j n1'The second term is C1,2
C2,1 C2,2 ・ ・ ・ C2, j n2'The second term is C2,2
C3,1 C3,2 ・ ・ ・ C3, j n3'The second term is C3,2
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, j ni'The second term is Ci, 2

~ ~ ・ ・ ・ ~ 0 The second term is ~
~ ~ ・ ・ ・ C1, j 0 The second term is ~
~ ~ ・ ・ ・ C2, j 0 The second term is ~
~ ~ ・ ・ ・ C3, j 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ Ci, j 0 The second term is ~
・ ・ ・
~ C1,2 ・ ・ ・ ~ 0 The second term is C1,2
~ C2,2 ・ ・ ・ ~ 0 The second term is C2,2
~ C3,2 ・ ・ ・ ~ 0 The second term is C3,2
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ 0 The second term is Ci, 2
・ ・ ・
~ C1,2 ・ ・ ・ C1, j 0 The second term is C1,2
~ C2,2 ・ ・ ・ C2, j 0 The second term is C2,2
~ C3,2 ・ ・ ・ C3, j 0 The second term is C3,2
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, j 0 The second term is Ci, 2
・ ・ ・
~ ~ ・ ・ ・ ~ ~ -T (C1,1, ~, ・ ・ ・, ~)'The second term is ~
~ ~ ・ ・ ・ ~ ~ -T (C2,1, ~, ・ ・ ・, ~)'The second term is ~
~ ~ ・ ・ ・ ~ ~ -T (C3,1, ~, ・ ・ ・, ~)'The second term is ~
・ ・ ・
~ ~ ・ ・ ・ ~ ~ -T (Ci, 1, ~, ・ ・ ・, ~)'The second term is ~
・ ・ ・
~ ~ ・ ・ ・ C1, j -t (C1,1, ~, ・ ・ ・, C1, j)'The second term is ~
~ ~ ・ ・ ・ C2, j -t (C2,1, ~, ・ ・ ・, C2, j)'The second term is ~
~ ~ ・ ・ ・ C3, j -t (C3,1, ~, ・ ・ ・, C3, j)'The second term is ~
・ ・ ・
~ ~ ・ ・ ・ Ci, j -t (Ci, 1, ~, ・ ・ ・, Ci, j)'The second term is ~
・ ・ ・
~ C1,2 ・ ・ ・ ~ -t (C1,1, C1,2, ・ ・ ・, ~)'The second term is C1,2
~ C2,2 ・ ・ ・ ~ -t (C2,1, C2,2, ・ ・ ・, ~)'The second term is C2,2
~ C3,2 ・ ・ ・ ~ -t (C3,1, C3,2, ・ ・ ・, ~)'The second term is C3,2
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ -t (Ci, 1, Ci, 2, ・ ・ ・, ~)'The second term is Ci, 2
・ ・ ・
~ C1,2 ・ ・ ・ C1, j -n1'The second term is C1,2
~ C2,2 ・ ・ ・ C2, j -n2'The second term is C2,2
~ C3,2 ・ ・ ・ C3, j -n3'The second term is C3,2
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, j -ni'The second term is Ci, 2

[Second stage] Change the input data and output (before change)
~ ~ ・ ・ ・ ~ 0 The second term is ~
~ ~ ・ ・ ・ C1, j 0 The second term is ~
~ ~ ・ ・ ・ C2, j 0 The second term is ~
~ ~ ・ ・ ・ C3, j 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ Ci, j 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ ~ ~ -T (~, C1,2, ・ ・ ・, ~)'The second term is C1,2
~ ~ ・ ・ ・ ~ ~ -T (~, C2,2, ・ ・ ・, ~)'The second term is C2,2
~ ~ ・ ・ ・ ~ ~ -T (~, C3,2, ・ ・ ・, ~)'The second term is C3,2
・ ・ ・
~ ~ ・ ・ ・ ~ ~ -T (~, Ci, 2, ・ ・ ・, ~)'The second term is Ci, 2
・ ・ ・
~ ~ ・ ・ ・ C1, j -t (~, C1,2, ・ ・ ・, C1, j)'The second term is C1,2
~ ~ ・ ・ ・ C2, j -t (~, C2,2, ・ ・ ・, C2, j)'The second term is C2,2
~ ~ ・ ・ ・ C3, j -t (~, C3,2, ・ ・ ・, C3, j)'The second term is C3,2
・ ・ ・
~ ~ ・ ・ ・ Ci, j -t (~, Ci, 2, ・ ・ ・, Ci, j)'The second term is Ci, 2
・ ・ ・
C1,1 ~ ・ ・ ・ ~ 0 The second term is ~
C2,1 ~ ・ ・ ・ ~ 0 The second term is ~
C3,1 ~ ・ ・ ・ ~ 0 The second term is ~
・ ・ ・
Ci, 1 ~ ・ ・ ・ ~ 0 The second term is ~
・ ・ ・
C1,1 ~ ・ ・ ・ C1, j 0 The second term is ~
C2,1 ~ ・ ・ ・ C2, j 0 The second term is ~
C3,1 ~ ・ ・ ・ C3, j 0 The second term is ~
・ ・ ・
Ci, 1 ~ ・ ・ ・ Ci, j 0 The second term is ~
・ ・ ・
C1,1 ~ ・ ・ ・ ~ -t (C1,1, C1,2, ・ ・ ・, ~)'The second term is C1,2
C2,1 ~ ・ ・ ・ ~ ~ -t (C2,1, C2,2, ・ ・ ・, ~)'The second term is C2,2
C3,1 ~ ・ ・ ・ ~ ~ -t (C3,1, C3,2, ・ ・ ・, ~)'The second term is ~
・ ・ ・
Ci, 1 ~ ・ ・ ・ ~ -t (Ci, 1, Ci, 2, ・ ・ ・, ~)'The second term is Ci, 2
・ ・ ・
C1,1 ~ ・ ・ ・ C1, j -n1'The second term is C1,2
C2,1 ~ ・ ・ ・ C2,j -n2'The second term is C2,2
C3,1 ~ ・ ・ ・ C3, j -n3'The second term is C3,2
・ ・ ・
Ci, 1 ~ ・ ・ ・ Ci, j -ni'The second term is Ci, 2

~ ~ ・ ・ ・ ~ 0 The second term is ~
~ ~ ・ ・ ・ C1, j 0 The second term is ~
~ ~ ・ ・ ・ C2, j 0 The second term is ~
~ ~ ・ ・ ・ C3, j 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ Ci, j 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ ~ -0 The second term is C1,2
~ ~ ・ ・ ・ ~ -0 The second term is C2,2
~ ~ ・ ・ ・ ~ -0 The second term is C3,2
・ ・ ・
~ ~ ・ ・ ・ ~ -0 The second term is Ci, 2
・ ・ ・
~ ~ ・ ・ ・ C1, j -0 The second term is C1,2
~ ~ ・ ・ ・ C2, j -0 The second term is C2,2
~ ~ ・ ・ ・ C3, j -0 The second term is C3,2
・ ・ ・
~ ~ ・ ・ ・ Ci, j -0 The second term is Ci, 2
・ ・ ・
~ ~ ・ ・ ・ ~ 0 The second term is ~
~ ~ ・ ・ ・ ~ 0 The second term is ~
~ ~ ・ ・ ・ ~ 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ ~ 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ C1, j 0 The second term is ~
~ ~ ・ ・ ・ C2, j 0 The second term is ~
~ ~ ・ ・ ・ C3, j 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ Ci, j 0 The second term is ~
・ ・ ・
~ ~ ・ ・ ・ ~-(-t (C1,1, C1,2, ・ ・ ・, ~)') The second term is C1,2
~ ~ ・ ・ ・ ~-(-t (C2,1, C2,2, ・ ・ ・, ~)') The second term is C2,2
~ ~ ・ ・ ・ ~-(-t (C3,1, C3,2, ・ ・ ・, ~)') The second term is C3,2
・ ・ ・
~ ~ ・ ・ ・ ~-(-t (Ci, 1, Ci, 2, ・ ・ ・, ~)') The second term is Ci, 2
・ ・ ・
~ ~ ・ ・ ・ C1, j-(-n1') The second term is C1,2
~ ~ ・ ・ ・ C2, j-(-n2') The second term is C2,2
~ ~ ・ ・ ・ C3, j-(-n3') The second term is C3,2
・ ・ ・
~ ~ ・ ・ ・ Ci, j-(-ni') The second term is Ci, 2

For the above output data, the frequency N'is added for each same attribute.

As the j-th recursive difference calculation input data, the j-1st recursive difference calculation result is used as input.

[Previous stage] Output without changing the input data F1 F2 ・ ・ ・ Fj n'
~ ~ ・ ・ ・ ~ T (~, ~, ・ ・ ・, ~)'Term j is ~
~ ~ ・ ・ ・ C1, jt (~, ~, ・ ・ ・, C1, j)'The j term is C1, j
~ ~ ・ ・ ・ C2, jt (~, ~, ・ ・ ・, C2, j)'The j term is C2, j
~ ~ ・ ・ ・ C3, jt (~, ~, ・ ・ ・, C3, j)'The j term is C3, j
・ ・ ・
~ ~ ・ ・ ・ Ci, jt (~, ~, ・ ・ ・, Ci, j)'The j term is Ci, j
・ ・ ・
~ C1,2 ・ ・ ・ ~ t (~, C1,2, ・ ・ ・, ~)'Term j is ~
~ C2,2 ・ ・ ・ ~ t (~, C2,2, ・ ・ ・, ~)'The j term is ~
~ C3,2 ・ ・ ・ ~ t (~, C3,2, ・ ・ ・, ~)'Term j is ~
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ t (~, Ci, 2, ・ ・ ・, ~)'Term j is ~
・ ・ ・
~ C1,2 ・ ・ ・ C1, jt (~, C1,2, ・ ・ ・, C1, j)'The j term is C1, j
~ C2,2 ・ ・ ・ C2, jt (~, C2,2, ・ ・ ・, C2, j)'The j term is C2, j
~ C3,2 ・ ・ ・ C3, jt (~, C3,2, ・ ・ ・, C3, j)'The j term is C3, j
・ ・ ・
~ Ci, 2 ・ ・ ・ Ci, jt (~, Ci, 2, ・ ・ ・, Ci, j)'The j term is Ci, j

・ ・ ・ (Omitted below)

[Second stage] Change the input data and output (before change)
~ ~ ・ ・ ・ ~ 0 Term j is ~
~ ~ ・ ・ ・ ~-(t (~, ~, ・ ・ ・, C1, j)') The j term is C1, j
~ ~ ・ ・ ・ ~-(t (~, ~, ・ ・ ・, C2, j)') The j term is C2, j
~ ~ ・ ・ ・ ~-(t (~, ~, ・ ・ ・, C3, j)') The j term is C3, j
・ ・ ・
~ ~ ・ ・ ・ ~-(t (~, ~, ・ ・ ・, Ci, j)') The j term is Ci, j
・ ・ ・
~ C1,2 ・ ・ ・ ~ 0 Term j is ~
~ C2,2 ・ ・ ・ ~ 0 Term j is ~
~ C3,2 ・ ・ ・ ~ 0 Term j is ~
・ ・ ・
~ Ci, 2 ・ ・ ・ ~ 0 Term j is ~
・ ・ ・
~ C1,2 ・ ・ ・ ~-(t (~, C1,2, ・ ・ ・, C1, j)') The j term is C1, j
~ C2,2 ・ ・ ・ ~-(t (~, C2,2, ・ ・ ・, C2, j)') The j term is C2, j
~ C3,2 ・ ・ ・ ~-(t (~, C3,2, ・ ・ ・, C3, j)') The j term is C3, j
・ ・ ・
~ Ci, 2 ・ ・ ・ ~-(t (~, Ci, 2, ・ ・ ・, Ci, j)') The j term is Ci, j

・ ・ ・ (Omitted below)

For the above output data, the frequency n'is added for each same attribute.

Example)
When performing difference calculation after rounding the two-dimensional cross frequency table of attribute items F1 (a1, a2) and F2 (b1, b2, b3)

F1 F2 n (Frequency total)
~ ~ (n1 + n2 + n3 + n4 + n5 + n6)'
a1 ~ (n1 + n2 + n3)'
a2 ~ (n4 + n5 + n6)'
~ b1 (n1 + n4)'
~ b2 (n2 + n5)'
~ b3 (n3 + n6)'
a1 b1 (n1)'
a1 b2 (n2)'
a1 b3 (n3)'
a2 b1 (n4)'
a2 b2 (n5)'
a2 b3 (n6)'

First recursive difference calculation F1 F2 n'
[First stage]
~ ~ + (n1 + n2 + n3 + n4 + n5 + n6)'
a1 ~ + (n1 + n2 + n3)'
a2 ~ + (n4 + n5 + n6)'
~ b1 + (n1 + n4)'
~ b2 + (n2 + n5)'
~ b3 + (n3 + n6)'
a1 b1 + (n1)'
a1 b2 + (n2)'
a1 b3 + (n3)'
a2 b1 + (n4)'
a2 b2 + (n5)'
a2 b3 + (n6)'

[Second stage]
~ ~ 0
~ ~-(n1 + n2 + n3)'
~ ~-(n4 + n5 + n6)'
~ b1 0
~ b2 0
~ b3 0
~ b1-(n1)'
~ b2-(n2)'
~ b3-(n3)'
~ b1-(n4)'
~ b2-(n5)'
~ b3-(n6)'

For the above output data, the frequency n'is added for each same attribute.

First recursive difference calculation result F1 F2 n'
~ ~ + (n1 + n2 + n3 + n4 + n5 + n6)'-(n1 + n2 + n3)'-(n4 + n5 + n6)'
~ b1 + (n1 + n4)'-(n1)'-(n4)'
~ b2 + (n2 + n5)'-(n2)'-(n5)'
~ b3 + (n3 + n6)'-(n3)'-(n6)'
a1 ~ + (n1 + n2 + n3)'
a2 ~ + (n4 + n5 + n6)'
a1 b1 + (n1)'
a1 b2 + (n2)'
a1 b3 + (n3)'
a2 b1 + (n4)'
a2 b2 + (n5)'
a2 b3 + (n6)'

Second recursive difference calculation F1 F2 n'
[First stage]
~ ~ + (n1 + n2 + n3 + n4 + n5 + n6)'-(n1 + n2 + n3)'-(n4 + n5 + n6)'
a1 ~ + (n1 + n2 + n3)'
a2 ~ + (n4 + n5 + n6)'
~ b1 + (n1 + n4)'-(n1)'-(n4)'
~ b2 + (n2 + n5)'-(n2)'-(n5)'
~ b3 + (n3 + n6)'-(n3)'-(n6)'
a1 b1 + (n1)'
a1 b2 + (n2)'
a1 b3 + (n3)'
a2 b1 + (n4)'
a2 b2 + (n5)'
a2 b3 + (n6)'

[Second stage]
~ ~ 0
a1 ~ 0
a2 ~ 0
~ ~-(+ (n1 + n4)'-(n1)'-(n4)')
~ ~-(+ (n2 + n5)'-(n2)'-(n5)')
~ ~-(+ (n3 + n6)'-(n3)'-(n6)')
a1 ~-(n1)'
a1 ~-(n2)'
a1 ~-(n3)'
a2 ~-(n4)'
a2 ~-(n5)'
a2 ~-(n6)'

For the above output data, the frequency n'is added for each same attribute.

Second recursive difference calculation result F1 F2 n'
~ ~ + (n1 + n2 + n3 + n4 + n5 + n6)'-(n1 + n2 + n3)'-(n4 + n5 + n6)'
-(N1 + n4)'+ (n1)'+ (n4)'-(n2 + n5)'+ (n2)'+ (n5)'
-(N3 + n6)'+ (n3)'+ (n6)'
a1 ~ + (n1 + n2 + n3)'-(n1)'-(n2)'-(n3)'
a2 ~ + (n4 + n5 + n6)'-(n4)'-(n5)'-(n6)'
~ b1 + (n1 + n4)'-(n1)'-(n4)'
~ b2 + (n2 + n5)'-(n2)'-(n5)'
~ b3 + (n3 + n6)'-(n3)'-(n6)'
a1 b1 + (n1)'
a1 b2 + (n2)'
a1 b3 + (n3)'
a2 b1 + (n4)'
a2 b2 + (n5)'
a2 b3 + (n6)'

(2) Conversion of individual data format Converts the multidimensional cross frequency table for which the difference is calculated to the individual data format. At that time, if the total breakdown is larger than the total number, the difference becomes a negative value. Therefore, for the cells with a negative value, the weight value is set to minus so that the total number and the total breakdown match.
To convert to the individual form format, create a difference table in the cell data format with one cell as one record using the attribute items and frequencies for each cell, and then output the attribute records for each cell for each cell for the frequency. Convert to individual form data format.

Difference table Cell data F1 F2 ・ ・ ・ Fj n'
C1,1 C1,2 ・ ・ ・ C1, j n1
C2,1 C2,2 ・ ・ ・ C2, j n2
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, j ni

Individual form data F1 F2 ・ ・ ・ Fj Weight
C1,1 C1,2 ・ ・ ・ C1, j 1
C1,1 C1,2 ・ ・ ・ C1, j 1
・ ・ ・
C1,1 C1,2 ・ ・ ・ C1, j 1 (record output n1 times)

C2,1 C2,2 ・ ・ ・ C2, j 1
C2,1 C2,2 ・ ・ ・ C2, j 1
・ ・ ・
C2,1 C2,2 ・ ・ ・ C2, j 1 (record output n2 times)

・ ・ ・

Ci, 1 Ci, 2 ・ ・ ・ Ci, j 1
Ci, 1 Ci, 2 ・ ・ ・ Ci, j 1
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, j 1 (record output ni times)

When the confidential data in the individual form data format obtained by the concealment processing is subjected to frequency aggregation, the basic individual data can be aggregated to obtain a frequency table that matches the frequency table obtained by the rounding process. Since the confidential data is created by converting the rounded frequency table, it can be said that the obtained confidential data is also safe if the rounded frequency table is safe.
In the example below, after totaling the cross frequency table for two-dimensional individual data, (1) rounding processing, (2) difference calculation, (3) difference table, (4) cell data format, (5) ) Concealment processing is performed in the order of individual data format.

Example) Multidimensional cross frequency table (in the case of 2D)
Total age a) Male b) Total female 100 50 50
a) 20-29 years old 19 10 9
b) 30-39 years old 24 13 11
c) 40-49 years old 23 12 11
d) 50-59 years old 18 8 10
e) 60-69 years old 9 4 5
f) Over 70 years old 7 3 4

(1) Rounding process of frequency table (in the case of rounding radix 5)
Total age a) Male b) Total female 100 50 50
a) 20-29 years old 20 10 10
b) 30-39 years old 25 15 10
c) 40-49 years old 25 10 10
d) 50-59 years old 20 10 10
e) 60-69 years old 10 5 5
f) Over 70 years old 5 5 5

(2) Difference calculation (in the case of two dimensions)
Total age a) Male b) Female Total difference 100 50 50 0
a) 20-29 years old 20 10 10 0
b) 30-39 years old 25 15 10 0
c) 40-49 years old 25 10 10 5
d) 50-59 years old 20 10 10 0
e) 60-69 years old 10 5 5 0
f) Over 70 years old 5 5 5 -5
Difference -5 -5 0 0

(3) Difference table Age a) Male b) Female Difference
a) 20-29 years old 10 10 0
b) 30-39 years old 15 10 0
c) 40-49 years old 10 10 5
d) 50-59 years old 10 10 0
e) 60-69 years old 5 5 0
f) Over 70 years old 5 5 -5
Difference -5 0 0

(4) Cell data format
F1 Gender F2 Age n (Frequency total)
a) Man a) 20-29 years old 10
a) Man b) 30-39 years old 15
a) man c) 40-49 years old 10
a) Man d) 50-59 years old 10
a) Man e) 60-69 years old 5
a) Man f) Over 70 years old 5
a) Man difference -5
b) Woman a) 20-29 years old 10
b) Woman b) 30-39 years old 10
b) Woman c) 40-49 years old 10
b) Woman d) 50-59 years old 10
b) Woman e) 60-69 years old 5
b) Woman f) Over 70 years old 5
Difference c) 40-49 years old 5
Difference f) Over 70 years old -5

(5) Individual form data format
F1 Gender F2 Age Weight
a) Man a) 20-29 years old 1 (10 record output)
a) Man b) 30-39 years old 1 (15 record output)
a) Male c) 40-49 years old 1 (10 record output)
a) Man d) 50-59 years old 1 (10 record output)
a) Male e) 60-69 years old 1 (5 record output)
a) Male f) 70 years old and over 1 (5 record output)
a) Male difference -1 (5 record output)
b) Woman a) 20-29 years old 1 (10 record output)
b) Woman b) 30-39 years old 1 (10 record output)
b) Woman c) 40-49 years old 1 (10 record output)
b) Woman d) 50-59 years old 1 (10 record output)
b) Woman e) 60-69 years old 1 (5 record output)
b) Woman f) 70 years old and over 1 (5 record output)
Difference c) 40-49 years old 1 (5 record output)
Difference f) Over 70 years old -1 (5 record output)

Note) For the difference, replace the attribute classification with a null value and output.

7.5 Concealment of weighted data In the case of individual sample data, it is necessary to handle weighted data for population restoration. In the case of weighted data, the weighted frequency table is aggregated and confidential processing is performed.

7.5.1 Rounding concealment of weighted data When a statistical survey is a sample survey, restoration weights for population estimation are given to the individual data. This restoration weight is calculated by multiplying the reciprocal of the extraction rate by the ratio estimation multiplication factor, and the population frequency can be estimated by multiplying the frequency by the restoration weight and integrating them. For example, in the case of a 1% sample sampling survey, the sample 1 frequency corresponds to the population 100 frequencies, and the weighted frequency calculated by multiplying the frequency by the weight is used as the estimated population frequency.

Weighted frequency data by attribute F1 F2 ・ ・ ・ Fj n (Weight total)
C1,1 C1,2 ・ ・ ・ C1, j n1 n1 = Σ (f1m * w1m)
C2,1 C2,2 ・ ・ ・ C2, j n2 n2 = Σ (f2m * w2m)
C3,1 C3,2 ・ ・ ・ C3, j n3 n3 = Σ (f3m * w3m)
・ ・ ・
Ci, 1 Ci, 2 ・ ・ ・ Ci, j ni ni = Σ (fim * wim)

ni: Total weighted frequencies of attribute i
fim: frequency of attribute i
wim: weight of attribute i

When the basic individual data is weighted data, the above-mentioned recursive calculation is performed for frequency table aggregation, rounding, difference calculation, and conversion to individual data format.

Since the population frequency can be used to estimate the sample frequency by dividing by the weight, it is necessary to conceal the risk record for the weighted frequency calculated using the weight. When concealing the weighted frequency, if the safety standard of the sample frequency is simply rounded to the radix, the concealment strength is insufficient, and it is necessary to perform the rounding process using the value obtained by multiplying the safety standard by the restoration weight as the rounding radix.
As a method of rounding the weighted frequency, a method of multiplying the maximum weight for each attribute category by the safety standard frequency to obtain a rounding radix, or a method of multiplying the average weight for each attribute category by the safety standard frequency for the rounding radix is used. , A method of rounding the value obtained by multiplying the overall average weight by the safety standard frequency can be considered.
If there is an attribute category with a high weight in the individual data of the group, the rounding process can be performed safely by setting the value obtained by multiplying the average weight for each attribute category by the safety standard frequency as the rounding radix. However, if the rounding radix is different for each attribute category, there is a demerit that the number of effective digits of the overall average becomes unclear. Therefore, in the concealment device of the present invention, the value obtained by multiplying the overall average weight by the safety reference frequency is processed as the rounding radix in the case of weighted individual data.

Rounding radix B = average weight W * Safety standard frequency S
Rounding frequency Nij'= ROUND (Nij / B) * B

However, since the overall average weight often contains fractions after the decimal point rather than an integer, the default candidate is calculated by rounding up the average weight from a power of 10 or a half of that value. It is designed to be displayed as a value on the program execution screen.

Example) CSV format data (when the weight is 100 uniformly)
F1Gender, F2 Age, Weight
a) man, a) 20-29 years old, 100
a) man, b) 30-39 years old, 100
b) Woman, d) 50-59 years old, 100
b) Woman, e) 60-69 years old, 100
a) man, c) 40-49 years old, 100
(Omitted below)

Gender: Gender, Age: Age Group, Weight: Restoration Weight

Example) Multidimensional cross frequency table (when the weight is uniformly 100 and two-dimensional)

Total age a) Male b) Total female 10000 5000 5000
a) 20-29 years old 1900 1000 900
b) 30-39 years old 2400 1300 1100
c) 40-49 years old 2300 1200 1100
d) 50-59 years old 1800 800 1000
e) 60-69 years old 900 400 500
f) 70 years old and over 700 300 400

Example) Rounding of frequency table (when weight is 100 and safety standard is 5)
Total age a) Male b) Total female 10000 5000 5000
a) 20-29 years old 2000 1000 1000
b) 30-39 years old 2500 1500 1000
c) 40-49 years old 2500 1000 1000
d) 50-59 years old 2000 1000 1000
e) 60-69 years old 1000 500 500
f) 70 years old and over 500 500 500

Rounding radix B = Average weight 100 * Safety standard 5
= 100 * 5
= 500

Rounding frequency nij'= ROUND (nij / B) * B = ROUND (nij / 500) * 500

7.5.2 Combined concealment of weighted data When erasing the multidimensional cross frequency table, if weights are given to the individual data to be concealed, the weighted frequencies are totaled and the average weight is applied. The value divided by is used to determine the smallest cell. Therefore, if the minimum cell does not meet the safety criteria for the value obtained by dividing the weighted frequency by the average weight in addition to the sample frequency, concealment processing by erasure concealment is performed. When performing concealment processing by erasure concealment, the safety standard of erasure concealment should be kept to the minimum necessary, and combined concealment should be performed in combination with round concealment to balance safety and usefulness.

Follow the procedure below for compound concealment of weighted data.
(1) Aggregation of multidimensional cross-weighted frequency table
(2) Assignment of cell data classification code
(3) Risk check
(4) Erase concealment
(5) Complex concealment (rounding concealment)
(6) Difference calculation
(7) Creating a difference table in cell data format
(8) Conversion to individual data format

(1) Example of multidimensional cross-weighted frequency table (when the weight is uniformly 100 and 3D)
Gender Age Total a) Employed b) Unemployed Total 10000 5300 4700
Total a) 20-29 years old 1900 1100 800
Total b) 30-39 years old 2400 1500 900
Total number c) 40-49 years old 2300 1500 800
Total d) 50-59 years old 1800 900 900
Total number e) 60-69 years old 900 300 600
Total number f) 70 years old and over 700 0 700
a) Total number of men 5000 3200 1800
a) Man a) 20-29 years old 1000 600 400
a) Man b) 30-39 years old 1300 1000 300
a) Man c) 40-49 years old 1200 900 300
a) Man d) 50-59 years old 800 500 300
a) Man e) 60-69 years old 400 200 200
a) Man f) Over 70 years old 300 0 300
b) Total number of women 5000 2100 2900
b) Woman a) 20-29 years old 900 500 400
b) Woman b) 30-39 years old 1100 500 600
b) Woman c) 40-49 years old 1100 600 500
b) Woman d) 50-59 years old 1000 400 600
b) Woman e) 60-69 years old 500 100 400
b) Woman f) Over 70 years old 400 0 400

(2) Assignment of cell data classification code
F0 classification F1 employment status F2 gender F3 age weighted frequency nw
~~~ Total total Total total 10000
~~ 0 Total Total Total a) 20-29 years old 1900
~~ 0 Total Total Total b) 30-39 years old 2400
~~ 0 Total Total Total c) 40-49 years old 2300
~~ 0 Total Total Total d) 50-59 years old 1800
~~ 0 Total Total Total e) 60-69 years old 900
~~ 0 Total total total f) 70 years old and over 700
~ 0 ~ Total number a) Total number of men 5000
~ 00 Total number a) Man a) 20-29 years old 1000
~ 00 Total number a) Man b) 30-39 years old 1300
~ 00 Total number a) Man c) 40-49 years old 1200
~ 00 Total number a) Male d) 50-59 years old 800
~ 00 Total number a) Male e) 60-69 years old 400
~ 00 Total number a) Male f) Over 70 years old 300
~ 0 ~ Total number b) Total number of women 5000
~ 00 Total number b) Woman a) 20-29 years old 900
~ 00 Total number b) Woman b) 30-39 years old 1100
~ 00 Total number b) Woman c) 40 ~ 49 years old 1100
~ 00 Total number b) Woman d) 50 ~ 59 years old 1000
~ 00 Total number b) Woman e) 60-69 years old 500
~ 00 Total number b) Woman f) 70 years old and over 400
0 ~~ a) Total number of employees Total number 5300
0 ~ 0 a) Total number of employees a) 20 ~ 29 years old 1100
0 ~ 0 a) Total number of employees b) 30 ~ 39 years old 1500
0 ~ 0 a) Total number of employees c) 40 ~ 49 years old 1500
0 ~ 0 a) Total number of employees d) 50 ~ 59 years old 900
0 ~ 0 a) Total number of employees e) 60 ~ 69 years old 300
0 ~ 0 a) Total number of employees f) 70 years old and over 0
00 ~ a) Working a) Total number of men 3200
000 a) Working a) Man a) 20-29 years old 600
000 a) Working a) Man b) 30-39 years old 1000
000 a) Working a) Man c) 40-49 years old 900
000 a) Working a) Man d) 50-59 years old 500
000 a) Working a) Man e) 60-69 years old 200
000 a) Employed a) Man f) Over 70 years old 0
00 ~ a) Working b) Total number of women 2100
000 a) Working b) Woman a) 20-29 years old 500
000 a) Working b) Woman b) 30-39 years old 500
000 a) Working b) Woman c) 40-49 years old 600
000 a) Working b) Woman d) 50-59 years old 400
000 a) Working b) Woman e) 60-69 years old 100
000 a) Working b) Woman f) Over 70 years old 0
0 ~~ b) Total number of unemployed Total 4700
0 ~ 0 b) Total number of unemployed a) 20 ~ 29 years old 800
0 ~ 0 b) Total number of unemployed b) 30 ~ 39 years old 900
0 ~ 0 b) Total number of unemployed c) 40 ~ 49 years old 800
0 ~ 0 b) Total number of unemployed d) 50 ~ 59 years old 900
0 ~ 0 b) Total number of unemployed e) 60 ~ 69 years old 600
0 ~ 0 b) Total number of unemployed f) 70 years old and over 700
00 ~ b) Unemployed a) Total number of men 1800
000 b) Unemployed a) Man a) 20-29 years old 400
000 b) Unemployed a) Man b) 30-39 years old 300
000 b) Unemployed a) Man c) 40-49 years old 300
000 b) Unemployed a) Man d) 50-59 years old 300
000 b) Unemployed a) Man e) 60-69 years old 200
000 b) Unemployed a) Man f) Over 70 years old 300
00 ~ b) Unemployed b) Total number of women 2900
000 b) Unemployed b) Woman a) 20-29 years old 400
000 b) Unemployed b) Woman b) 30-39 years old 600
000 b) Unemployed b) Woman c) 40-49 years old 500
000 b) Unemployed b) Woman d) 50-59 years old 600
000 b) Unemployed b) Woman e) 60-69 years old 400
000 b) Unemployed b) Woman f) Over 70 years old 400

(3) Risk check A risk check is performed for a combination whose minimum value is smaller than 300, which is multiplied by a weight of 100, with the safety standard set to 3. The risk check reveals that the item combination classification [000] includes risk cells.

Classification minimum value
[000] 100
[~ 00] 300
[0 ~ 0] 300
[~~ 0] 700
[00 ~] 1800
[0 ~~] 4700
[~ 0 ~] 5000
[~~~] 10000

(4) Erasure concealment For classification [000] including risk cells in the multidimensional cross-weighted frequency table, the weighted frequency is replaced with a zero value to perform erasure concealment.

F0 classification F1 employment status F2 gender F3 age weighted frequency nw
~~~ Total total Total total 10000
~~ 0 Total Total Total a) 20-29 years old 1900
~~ 0 Total Total Total b) 30-39 years old 2400
~~ 0 Total Total Total c) 40-49 years old 2300
~~ 0 Total Total Total d) 50-59 years old 1800
~~ 0 Total Total Total e) 60-69 years old 900
~~ 0 Total total total f) 70 years old and over 700
~ 0 ~ Total number a) Total number of men 5000
~ 00 Total number a) Man a) 20-29 years old 1000
~ 00 Total number a) Man b) 30-39 years old 1300
~ 00 Total number a) Man c) 40-49 years old 1200
~ 00 Total number a) Male d) 50-59 years old 800
~ 00 Total number a) Male e) 60-69 years old 400
~ 00 Total number a) Male f) Over 70 years old 300
~ 0 ~ Total number b) Total number of women 5000
~ 00 Total number b) Woman a) 20-29 years old 900
~ 00 Total number b) Woman b) 30-39 years old 1100
~ 00 Total number b) Woman c) 40 ~ 49 years old 1100
~ 00 Total number b) Woman d) 50 ~ 59 years old 1000
~ 00 Total number b) Woman e) 60-69 years old 500
~ 00 Total number b) Woman f) 70 years old and over 400
0 ~~ a) Total number of employees Total number 5300
0 ~ 0 a) Total number of employees a) 20 ~ 29 years old 1100
0 ~ 0 a) Total number of employees b) 30 ~ 39 years old 1500
0 ~ 0 a) Total number of employees c) 40 ~ 49 years old 1500
0 ~ 0 a) Total number of employees d) 50 ~ 59 years old 900
0 ~ 0 a) Total number of employees e) 60 ~ 69 years old 300
0 ~ 0 a) Total number of employees f) 70 years old and over 0
00 ~ a) Working a) Total number of men 3200
000 a) Working a) Male a) 20-29 years old 0 (zero value replacement)
000 a) Working a) Male b) 30-39 years old 0 (zero value replacement)
000 a) Working a) Male c) 40-49 years old 0 (zero value replacement)
000 a) Working a) Male d) 50-59 years old 0 (zero value replacement)
000 a) Working a) Male e) 60-69 years old 0 (zero value replacement)
000 a) Employed a) Male f) Over 70 years old 0 (zero value replacement)
00 ~ a) Working b) Total number of women 2100
000 a) Working b) Woman a) 20-29 years old 0 (zero value replacement)
000 a) Working b) Woman b) 30-39 years old 0 (zero value replacement)
000 a) Working b) Woman c) 40-49 years old 0 (zero value replacement)
000 a) Working b) Woman d) 50-59 years old 0 (zero value replacement)
000 a) Working b) Woman e) 60-69 years old 0 (zero value replacement)
000 a) Working b) Woman f) Over 70 years old 0 (zero value replacement)
0 ~~ b) Total number of unemployed Total 4700
0 ~ 0 b) Total number of unemployed a) 20 ~ 29 years old 800
0 ~ 0 b) Total number of unemployed b) 30 ~ 39 years old 900
0 ~ 0 b) Total number of unemployed c) 40 ~ 49 years old 800
0 ~ 0 b) Total number of unemployed d) 50 ~ 59 years old 900
0 ~ 0 b) Total number of unemployed e) 60 ~ 69 years old 600
0 ~ 0 b) Total number of unemployed f) 70 years old and over 700
00 ~ b) Unemployed a) Total number of men 1800
000 b) Unemployed a) Man a) 20-29 years old 0 (zero value replacement)
000 b) Unemployed a) Male b) 30-39 years old 0 (zero value replacement)
000 b) Unemployed a) Male c) 40-49 years old 0 (zero value replacement)
000 b) Unemployed a) Man d) 50-59 years old 0 (zero value replacement)
000 b) Unemployed a) Male e) 60-69 years old 0 (zero value replacement)
000 b) Unemployed a) Male f) Over 70 years old 0 (zero value replacement)
00 ~ b) Unemployed b) Total number of women 2900
000 b) Unemployed b) Woman a) 20-29 years old 0 (zero value replacement)
000 b) Unemployed b) Woman b) 30-39 years old 0 (zero value replacement)
000 b) Unemployed b) Woman c) 40-49 years old 0 (zero value replacement)
000 b) Unemployed b) Woman d) 50-59 years old 0 (zero value replacement)
000 b) Unemployed b) Woman e) 60-69 years old 0 (zero value replacement)
000 b) Unemployed b) Woman f) Over 70 years old 0 (zero value replacement)

(5) Complex concealment (rounding concealment)
The safety standard is set to 5, and 500, which is multiplied by the weight 100, is used as the rounding radix to conceal the rounding of the weighted frequency.

F1 Employment status F2 Gender F3 Age Weighted frequency nw
Total total total total 10000
Total total a) 20-29 years old 2000
Total total b) 30-39 years old 2500
Total Total Total c) 40-49 years old 2500
Total total total d) 50-59 years old 2000
Total total total e) 60-69 years old 1000
Total total total f) 70 years old and over 500
Total number a) Total number of men 5000
Total number a) Male a) 20-29 years old 1000
Total a) Male b) 30-39 years old 1500
Total number a) Male c) 40-49 years old 1000
Total number a) Male d) 50-59 years old 1000
Total number a) Male e) 60-69 years old 500
Total number a) Male f) Over 70 years old 500
Total number b) Total number of women 5000
Total number b) Woman a) 20-29 years old 1000
Total number b) Woman b) 30-39 years old 1000
Total number b) Woman c) 40-49 years old 1000
Total number b) Woman d) 50-59 years old 1000
Total number b) Woman e) 60-69 years old 500
Total number b) Woman f) 70 years old and over 500
a) Total number of employees Total number 5500
a) Total number of employees a) 20-29 years old 1000
a) Total number of employees b) 30-39 years old 1500
a) Total number of employees c) 40-49 years old 1500
a) Total number of employees d) 50-59 years old 1000
a) Total number of employees e) 60-69 years old 500
a) Working a) Total number of men 3000
a) Working a) Man a) 20-29 years old 0
a) Working a) Man b) 30-39 years old 0
a) Working a) Male c) 40-49 years old 0
a) Working a) Male d) 50-59 years old 0
a) Employed a) Male e) 60-69 years old 0
a) Working b) Total number of women 2000
a) Working b) Woman a) 20-29 years old 0
a) Working b) Woman b) 30-39 years old 0
a) Working b) Woman c) 40-49 years old 0
a) Working b) Woman d) 50-59 years old 0
a) Working b) Woman e) 60-69 years old 0
b) Total number of unemployed Total 4500
b) Total number of unemployed a) 20-29 years old 1000
b) Total number of unemployed b) 30-39 years old 1000
b) Total number of unemployed c) 40-49 years old 1000
b) Total number of unemployed d) 50-59 years old 1000
b) Total number of unemployed e) 60-69 years old 500
b) Total number of unemployed f) 70 years old and over 500
b) Unemployed a) Total number of men 2000
b) Unemployed a) Man a) 20-29 years old 0
b) Unemployed a) Man b) 30-39 years old 0
b) Unemployed a) Man c) 40-49 years old 0
b) Unemployed a) Man d) 50-59 years old 0
b) Unemployed a) Man e) 60-69 years old 0
b) Unemployed a) Man f) Over 70 years old 0
b) Unemployed b) Total number of women 3000
b) Unemployed b) Woman a) 20-29 years old 0
b) Unemployed b) Woman b) 30-39 years old 0
b) Unemployed b) Woman c) 40-49 years old 0
b) Unemployed b) Woman d) 50-59 years old 0
b) Unemployed b) Woman e) 60-69 years old 0
b) Unemployed b) Woman f) Over 70 years old 0

(6) Difference calculation Perform the difference calculation for the total number and the total breakdown.

Gender Age a) Employed b) Unemployed n'
a) Man a) 20-29 years old 0 0 1000
a) Man b) 30-39 years old 0 0 1500
a) Man c) 40-49 years old 0 0 1000
a) Man d) 50-59 years old 0 0 1000
a) Man e) 60-69 years old 0 0 500
a) Man f) Over 70 years old 0 0 500
a) Man difference 3000 2000 -5500
b) Woman a) 20-29 years old 0 0 1000
b) Woman b) 30-39 years old 0 0 1000
b) Woman c) 40-49 years old 0 0 1000
b) Woman d) 50-59 years old 0 0 1000
b) Woman e) 60-69 years old 0 0 500
b) Woman f) Over 70 years old 0 0 500
b) Woman difference 2000 3000 -5000
Difference a) 20-29 years old 1000 1000 -2000
Difference b) 30-39 years old 1500 1000 -2500
Difference c) 40-49 years old 1500 1000 -2000
Difference d) 50-59 years old 1000 1000 -2000
Difference e) 60-69 years old 500 500 -1000
Difference f) Over 70 years old 0 500 -1000
Difference Difference -5000 -5500 10500

(7) Creating a difference table in cell data format Create a difference table in cell data format. (The difference is represented by ~.)

F1 Employment Status F2 Gender F3 Age n'
a) Working a) Man ~ 3000
a) Working b) Woman ~ 2000
a) Working ~ a) 20 ~ 29 years old 1000
a) Employed ~ b) 30 ~ 39 years old 1500
a) Employed ~ c) 40 ~ 49 years old 1500
a) Employed ~ d) 50 ~ 59 years old 1000
a) Employed ~ e) 60 ~ 69 years old 500
a) Working ~ ~ ~ -5000
b) Unemployed a) Man ~ 2000
b) Unemployed b) Woman ~ 3000
b) Unemployed ~ a) 20 ~ 29 years old 1000
b) Unemployed ~ b) 30 ~ 39 years old 1000
b) Unemployed ~ c) 40 ~ 49 years old 1000
b) Unemployed ~ d) 50 ~ 59 years old 1000
b) Unemployed ~ e) 60 ~ 69 years old 500
b) Unemployed ~ f) 70 years old and over 500
b) Unemployed ~ ~ ~ -5500
~ A) Man a) 20 ~ 29 years old 1000
~ A) Man b) 30 ~ 39 years old 1500
~ A) Man c) 40 ~ 49 years old 1000
~ A) Man d) 50 ~ 59 years old 1000
~ A) Man e) 60 ~ 69 years old 500
~ A) Man f) Over 70 years old 500
~ A) Man ~ -5500
~ B) Woman a) 20 ~ 29 years old 1000
~ B) Woman b) 30 ~ 39 years old 1000
~ B) Woman c) 40 ~ 49 years old 1000
~ B) Woman d) 50 ~ 59 years old 1000
~ B) Woman e) 60 ~ 69 years old 500
~ B) Woman f) 70 years old and over 500
~ B) Woman ~ -5000
~ ~ A) 20-29 years old -2000
~ ~ B) 30 ~ 39 years old -2500
~ ~ C) 40-49 years old -2000
~ ~ D) 50 ~ 59 years old -2000
~ ~ E) 60 ~ 69 years old -1000
~ ~ F) 70 years old and over -1000
~ ~ ~ 10500

(8) Conversion to individual form data format Specify a weight (example: scale 100) and convert to individual form format.

F1 Employment Status F2 Gender F3 Age Weight
a) Working a) Man ~ 100 (30 record output)
a) Working b) Woman ~ 100 (20 records output)
a) Working ~ a) 20 ~ 29 years old 100 (10 record output)
a) Working ~ b) 30 ~ 39 years old 100 (15 record output)
a) Working ~ c) 40 ~ 49 years old 100 (15 record output)
a) Employed ~ d) 50 ~ 59 years old 100 (10 record output)
a) Employed ~ e) 60 ~ 69 years old 100 (5 record output)
a) Working ~ ~ -100 (50 record output)
b) Unemployed a) Man ~ 100 (20 records output)
b) Unemployed b) Woman ~ 100 (30 record output)
b) Unemployed ~ a) 20 ~ 29 years old 100 (10 record output)
b) Unemployed ~ b) 30 ~ 39 years old 100 (10 record output)
b) Unemployed ~ c) 40 ~ 49 years old 100 (10 record output)
b) Unemployed ~ d) 50 ~ 59 years old 100 (10 record output)
b) Unemployed ~ e) 60 ~ 69 years old 100 (5 record output)
b) Unemployed ~ f) 70 years old and over 100 (5 record output)
b) Unemployed ~ ~ -100 (55 record output)
~ A) Man a) 20 ~ 29 years old 100 (10 record output)
~ A) Man b) 30 ~ 39 years old 100 (15 record output)
~ A) Man c) 40 ~ 49 years old 100 (10 record output)
~ A) Man d) 50 ~ 59 years old 100 (10 record output)
~ A) Man e) 60 ~ 69 years old 100 (5 record output)
~ A) Male f) 70 years old and over 100 (5 record output)
~ A) Man ~ -100 (55 record output)
~ B) Woman a) 20 ~ 29 years old 100 (10 record output)
~ B) Woman b) 30 ~ 39 years old 100 (10 record output)
~ B) Woman c) 40 ~ 49 years old 100 (10 record output)
~ B) Woman d) 50 ~ 59 years old 100 (10 record output)
~ B) Woman e) 60 ~ 69 years old 100 (5 record output)
~ B) Woman f) 70 years old and over 100 (5 record output)
~ B) Woman ~ -100 (50 record output)
~ ~ A) 20 ~ 29 years old -100 (20 record output)
~ ~ B) 30 ~ 39 years old -100 (25 record output)
~ ~ C) 40 ~ 49 years old -100 (20 record output)
~ ~ D) 50 ~ 59 years old -100 (20 records output)
~ ~ E) 60 ~ 69 years old -100 (10 record output)
~ ~ F) 70 years old and over -100 (10 record output)
~ ~ ~ 100 (105 record output)

7.5.3 Conversion scale of output data When rounding the weighted frequency by the above method, the weighted frequency to be concealed is larger than the sampled frequency, so it is converted to individual form as it is. Conversion often results in a huge number of records. Therefore, by specifying the conversion scale, a function to convert to the number of records equivalent to the sample is added.
Specifically, the conversion scale is specified when converting to the individual data format, and in the case of population base, the value obtained by dividing the weighted frequency by the conversion scale is used as the number of records, and the value obtained by multiplying the weight 1.0 by the conversion scale is used. Convert as the weight of each record. In the case of sample base, the number of records is the number of samples of the basic individual data for each attribute category, and the weight divided by the number of samples of the basic individual data is used as the weight for conversion. When the rounding radix and the conversion scale match, if the rounding radix is an integer, the weight after conversion has the advantage of being the same integer value as the rounding radix.
Since the rounding process of weighted data is performed by dividing the weighted data by the rounding radix, and the conversion scale process is performed by dividing the weighted data by the conversion scale, there are many common parts between the rounding process and the conversion scale process. .. In the case of rounding processing, the attribute whose weight is zero value is not output as a record with zero weight value from the viewpoint of confidentiality. In addition, the conversion scale process is also a process that does not output a zero value from the viewpoint of confidentiality, and if the original individual data contains a record with a weight of zero value, the number of sample records after conversion is the basis. Does not match the number of records in.
Since the output data subjected to the concealment processing includes a difference record of rounding error due to rounding, the number of sample records after conversion is usually larger than the number of records before conversion.

Example) Difference table (when the weight is 100 and the rounding radix is 500)
Age a) Man b) Woman n'
a) 20-29 years old 1000 1000 0
b) 30-39 years old 1500 1000 0
c) 40-49 years old 1000 1000 500
d) 50-59 years old 1000 1000 0
e) 60-69 years old 500 500 0
f) Over 70 years old 500 500 -500
Difference -500 0 0

(1) Difference table in cell data format
F1 Gender F2 Age n'
a) Man a) 20-29 years old 1000
a) man b) 30-39 years old 1500
a) man c) 40-49 years old 1000
a) Man d) 50-59 years old 1000
a) Man e) 60-69 years old 500
a) Man f) Over 70 years old 500
a) Man difference -500
b) Woman a) 20-29 years old 1000
b) Woman b) 30-39 years old 1000
b) Woman c) 40-49 years old 1000
b) Woman d) 50-59 years old 1000
b) Woman e) 60-69 years old 500
b) Woman f) Over 70 years old 500
b) Woman difference 0
Difference a) 20-29 years old 0
Difference b) 30-39 years old 0
Difference c) 40-49 years old 500
Difference d) 50-59 years old 0
Difference e) 60-69 years old 0
Difference f) Over 70 years old -500
Difference Difference 0

(2) Individual form data format (when scale is 100)
F1 Gender F2 Age Weight
a) Man a) 20-29 years old 100 (10 record output)
a) Man b) 30-39 years old 100 (15 record output)
a) Man c) 40-49 years old 100 (10 record output)
a) Man d) 50-59 years old 100 (10 record output)
a) Man e) 60-69 years old 100 (5 record output)
a) Man f) 70 years old and over 100 (5 record output)
a) Male difference -100 (5 record output)
b) Woman a) 20-29 years old 100 (10 record output)
b) Woman b) 30-39 years old 100 (10 record output)
b) Woman c) 40-49 years old 100 (10 record output)
b) Woman d) 50-59 years old 100 (10 record output)
b) Woman e) 60-69 years old 100 (5 record output)
b) Woman f) 70 years old and over 100 (5 record output)
b) Woman difference 0
Difference a) 20-29 years old 0
Difference b) 30-39 years old 0
Difference c) 40-49 years old 100 (5 record output)
Difference d) 50-59 years old 0
Difference e) 60-69 years old 0
Difference f) Over 70 years old -100 (5 record output)
Difference Difference 0

Note) For the difference attribute, the classification classification is output as a null value.

8. Effect of the Invention The present invention provides a means for creating anonymized individual data by concealing risk records in individual data such as statistical surveys and questionnaire surveys, and identifies an individual when using the individual data. It is possible to reduce or exempt the risk. Further, by using the anonymization device according to the present invention, the following usage methods can be used for individual data and the like.

(1) Confidential data creation (standard function)
Individual form data ⇒ Anonymization device ⇒ Anonymization data Anonymization data is created from individual form data using the anonymization device.

(2) Reuse of confidential data Individual data ⇒ Anonymization device ⇒ Parent anonymization data ⇒ Item selection ⇒ Anonymization device ⇒ Anonymization data Create parent anonymization data using the anonymization device and use the anonymization device. Reapply to create anonymized data

(3) Creation of concealment frequency table Individual form data ⇒ Anonymization device ⇒ Concealment frequency table Create a concealment frequency table from individual form data using the anonymization device

(4) Reuse of concealment frequency table Individual data ⇒ anonymization device ⇒ concealment frequency table ⇒ anonymization device ⇒ anonymization data Create a concealment frequency table using the anonymization device and reapply the anonymization device Create anonymized data

(5) Confidential data conversion Multidimensional cross frequency table ⇒ Anonymization device ⇒ Anonymized data Anonymized data is created from an externally created multidimensional cross frequency table using the anonymization device.

(Fig. 1) Device configuration diagram A concealment device is configured by installing a program on a commercially available personal computer (PC) and connecting a storage device that stores input / output data and intermediate data. (Fig. 2) Program flow diagram (overall) The anonymization processing program for individual data is composed of a multidimensional frequency table aggregation processing unit and a secret conversion processing unit. (Fig. 3.1) Block diagram of the multidimensional frequency table aggregation processing unit The multidimensional frequency table aggregation processing unit reads individual data and performs aggregation processing, and the multidimensional cross frequency table used for input in the subsequent concealment conversion processing. To create. (Fig. 3.2) Block diagram of the concealment conversion processing unit The concealment conversion processing unit reads the multidimensional cross frequency table, performs deletion concealment, rounding concealment, difference calculation, and individual data format conversion, and creates it from the individual data. Performs concealment processing of the multidimensional cross frequency table and converts it to the individual data format. (Fig. 4.1) Flow diagram of multidimensional cross frequency totaling program The multidimensional cross frequency totaling program inputs individual data and totals the multidimensional cross frequency table. (Fig. 4.2A) Flow diagram of erasure concealment program processing 2A (attribute combination code assignment) (Fig. 4.2) Flow diagram of multidimensional cross frequency totaling program The erasure concealment program performs frequency check on the multidimensional cross frequency table. For combinations of attribute items that do not meet the safety standards, the breakdown is replaced with zero values to conceal the deletion. (Fig. 4.2B) Flow diagram of erasure concealment program processing 2B (minimum frequency inspection by combination) (Fig. 4.2) Flow diagram of multidimensional cross frequency totaling program The erasure concealment program checks the frequency of the multidimensional cross frequency table. , For combinations of attribute items that do not meet the safety standards, delete and conceal them by replacing the breakdown with zero values. (Fig. 4.2C) Flow diagram of erasure concealment program processing 2C (Risk table breakdown erasure) (Fig. 4.2) Flow diagram of multidimensional cross frequency totaling program The erasure concealment program checks the frequency of the multidimensional cross frequency table and is safe. For combinations of attribute items that do not meet the criteria, delete concealment is performed by replacing the breakdown with zero values. (Fig. 4.3) Flow diagram of rounding concealment program The rounding concealment program reinforces the concealment strength of the concealment table by rounding the multidimensional cross frequency table. (Fig. 4.4) Flow diagram of the difference calculation program The difference calculation program calculates the difference between the total breakdown and the total number of all combinations of attributes. (Fig. 4.5) Flow diagram of individual form conversion program The individual form conversion program converts the frequency table into individual form data by using the breakdown frequency and the difference frequency for each attribute combination.

7. Industrial Applicability By using the present invention, it can be expected that aggregation and analysis can be performed more safely in the use of individual data such as statistical surveys. Specifically, in the "Basic Plan for the Development of Official Statistics (Cabinet Decision on March 6, 2018)", on-site tabulation, on-demand tabulation, etc. are mentioned as secondary uses of statistical surveys. In addition to being able to be used for research and development work related to these, it may also be used for work such as custom-made aggregation and anonymous data creation performed by the Statistics Center.
In addition, it may be used as a concealment method when creating statistics using administrative records, and personal information can be protected even when using big data, which is rapidly increasing in use with the spread of the Internet. This is an important issue, and it is expected that the present invention can be used to improve the safety of data from the viewpoint of personal information protection.

Claims (3)

Multi-dimensional cross frequency table is aggregated from individual data composed of attribute items such as individuals and confidential processing is performed, and the difference between the total number and the total breakdown is calculated for each combination of attribute items according to the breakdown and the frequency of the difference. Anonymization processing device installed on a computer so that a program for realizing an anonymization method for individual data can be executed, which is characterized by converting the attribute record into an individual data format. Multi-dimensional cross frequency table is aggregated from individual data composed of attribute items such as individuals and confidential processing is performed, and the difference between the total number and the total breakdown is calculated for each combination of attribute items according to the breakdown and the frequency of the difference. A program for realizing an anonymization method of individual data on a computer, which is characterized by converting to individual data format by outputting the attribute record. Multi-dimensional cross frequency table is aggregated from individual data composed of attribute items such as individuals and confidential processing is performed, and the difference between the total number and the total breakdown is calculated for each combination of attribute items according to the breakdown and the frequency of the difference. Anonymization method of individual data, which is characterized by converting to individual data format by outputting the attribute record.

Images