JP5382599B2 - Confidential address matching processing system - Google Patents

Description

The present invention provides software for concealing address information constituting personal information on a computer when the personal information is concealed and provided externally, and address matching using the concealment software The present invention relates to a system that performs information processing by the system.

Since personal information such as customer data requires strict management based on the Personal Information Protection Law, analysis (data mining) using such a large amount of data can be handled by some companies within the organization. Except for, it is in an untouched state, and a lot of data is not analyzed and remains asleep. When data related to personal information is provided externally, the personal data is separated from the personal information at the institution that holds the data, and the remaining personal identification information is provided to the trust organization and managed by the identifier to make it non-personal And how to provide it to external organizations was known.

JP 2000-324094 A

However, it is expected that it takes time and cost to externally provide personal information under a system composed of such complicated processes. In addition, even when performing advanced analysis within the organization, costs are incurred, including securing specialized staff, and it is difficult to carry out data mining related to marketing etc. inside the organization except for some companies. Furthermore, regarding the concealment when data is provided externally, there are currently no established rules for ensuring personal information protection.

On the other hand, when conducting spatial analysis related to marketing etc. from a large amount of data, by changing the address information held by the individual into address coordinates, using the kernel density function etc., based on the information attached to the individual GIS ( A method of creating a distribution map of a specific group by a geographic information system) has been put into practical use, and in this case, it is not necessary to specify individual address information accurately . Therefore, when concealing personal information under such conditions, it is considered possible to convert the address information into address coordinates so that the individual is not identified after the name is deleted.

In order not to identify an individual from the address coordinates obtained by the conversion, the characteristics of the area where the individual exists are greatly involved. For example, strict abstraction is required for position information of individuals in a depopulated area as compared with position information in a depopulated area. For example, in Town △ Chome X address □, when the address coordinates that represent ○ Town △ Chome X address are sufficiently concealed, and when the address coordinates that represent ○ Town △ Chome are not sufficiently concealed For example, various processing levels of the address matching required depending on regional characteristics and analysis purposes are assumed.

Therefore, when concealing personal information to a state where it can be provided externally , the present invention adds an optimal address information abstraction process that takes into account regional characteristics on a computer, and does not interfere with analysis at an external organization. The purpose is to realize a system for concealing personal information.

In order to solve the above problems, multiple abstraction levels of location information are set based on density distribution maps such as chome units based on population density and household density announced by the national census, etc., and address matching processing is performed It can be implemented separately. Based on these basic data, the system automatically determines the processing level of address matching according to the characteristics of the region according to the purpose of analysis and performs data processing using various abstraction methods on the computer system. By executing the above, concealment processing is performed so that individuals are not specified when externally provided.

By introducing the system based on the present invention, not only companies but also personal information held by local governments, it becomes possible to perform spatial analysis of data attached to personal information at an outsource organization at low cost, in compliance with the law, Many departments can expect to make effective use of stored data, such as grasping the current situation and intervening in problems to be solved.

It is a flow of data including personal information in this system. This is an abstraction processing method from address information to address coordinate data. It is an example of the abstraction processing method of the address information based on a regional density level. It is an example of the address coordinate which processed address information and was made secret. This is an abstraction processing method in the position specifying processing means.

The implementation method of this invention is demonstrated using figures. FIG. 1 shows a flow until the internal data including personal information managed by the data holding organization a is provided to the external organization b that performs analysis. The organization a holding personal information loads software used in the system for purchase or rental into the server device 1 in the organization in advance, and receives an instruction from the private LAN terminal for the confidential information processing. To do.

In response to an instruction from a terminal connected to the LAN, the name is deleted from the target file data from the database 2, and a data file with a management ID is created instead. After this operation, the server apparatus 1 performs an address information abstraction process using concealment software loaded in advance.

The process of address data processing by the concealment software is shown in FIG. The target data is sent from the input means 20 that receives an instruction for the address matching process to the position specifying processing means 21 that specifies address coordinates, and is stored on the address reference table provided in the position specifying processing means 21 using the position dictionary 22. After address coordinate data is specified and necessary abstraction processing is performed, it is output from the output means 23 as address coordinate data.

  Address matching that abstracts and converts personal address information into address coordinates corresponding to regional density will be described. The position coordinate data corresponding to the address and the density level data of the area obtained from the population density and the household density based on the national census are stored in the position dictionary 22 and provided in the position specifying processing means 21 as shown in FIG. In the address reference table including the address field, the area density field, and the coordinate field, the personal address information is associated with the address coordinates (latitude and longitude, etc.) for each area density.

An example of the abstraction of address coordinates is shown in FIG. Address coordinates as detailed as possible, including town letters, chomes, street addresses, and numbers, are set in advance. In areas where the area density is standard, after performing detailed address matching, the decimal point N of latitude and longitude (N in Figure 3) = 5) Perform random number conversion (C, D) on (A, B) digits. Since it is difficult to identify an individual in an area where the population density is high, after performing detailed address matching processing, the coordinates of the latitude and longitude of the decimal point of N + 1 digits or less are randomly converted as necessary. On the other hand, in an area where the population density is low, in consideration of the fact that an individual can be easily identified, after performing the same address matching process, the coordinates of the latitude and longitude of the decimal point of N-1 digits or less are randomly converted. In this way, it is necessary to automatically determine the address matching accuracy based on the density level data of the area obtained from the population density and household density based on the national census on the computer, so that the individual is not identified and does not hinder the analysis Abstract address information at a sufficient level.

Assuming that the position coordinates (x coordinate, y coordinate) corresponding to the actual address are (x1, y1), the distance deviation S from the coordinate (x2, y2) after the abstraction processing is obtained from the following formula: An approximate value is determined. R0: Average radius of curvature (argument is) m0: Scale factor at the origin of the coordinate system

In the latitude and longitude displayed in decimal notation, if a random number is displayed at the fifth digit after the decimal point, as shown in FIG. When performing spatial analysis from a large amount of data by converting the coordinates of an address so that an individual is not identified, depending on the purpose of the analysis, if this value is not exceeded, the result will be greatly affected when analyzing by prefecture. Except for depopulated areas, it is considered to be information processing suitable as an abstraction level for address information. Furthermore, if analysis is performed in units of municipalities including densely populated areas, it is possible to perform highly accurate spatial analysis by minimizing deviation from the actual by displaying a random number with six digits after the decimal point. The setting of the address matching level can be changed according to the purpose of analysis and regional characteristics such as population density and household density.

FIG. 5 shows another method for abstracting the address information based on the density level data of the area in the position specifying processing means 21. As shown in C, in addition to the actual coordinate A1 being randomly converted to a position A within a certain range r, the actual coordinate B1 is a coordinate represented by an area at the address or issue level as shown in D. There is a method of converting to B (center of gravity coordinates, etc.).

If the first address matching cannot match the address and issue number, the data at the nearest level is temporarily output, and it is made non-matching data so that it can be judged whether there is an influence on the spatial analysis, and can be reprocessed as necessary. Group like

The data that has been concealed is verified by an anonymization database 3 using a shared ID after verifying an address matching process error, etc., and is analyzed by a recording medium such as the Internet or flash memory. Provide the database 4.

Spatial analysis is performed at an external institution b, and data that is suspected of being inappropriately concealed, including outliers and non-matching data, is inquired by a shared ID and is stored on the system of the institution a holding personal information as necessary. Then, the data is reprocessed and the anonymized database 3 is corrected. The external organization b uses the database 4 created from the completed anonymization database 3 to analyze the requested marketing and the like.

1 Server device 2 Database containing personal information 3 Anonymization database 4 External organization database 5 Confidential external organization
a Data holding organization
b External engine for analysis 20 Input means 21 Position specifying processing means 22 Position dictionary 23 Output means
r A certain range
A1 Actual coordinates
A coordinates after conversion
B1 Actual coordinates
B coordinates after transformation
C Abstraction placed randomly within a certain range
D Abstraction placed in coordinates representing area

Claims (1)

According to the characteristics of population density and household density of the area to which the address subject to address matching processing belongs, the level of concealment related to the output address coordinate data is automatically judged so that individuals are not specified Address matching processing system.