JP5691936B2 - Information processing method and apparatus - Google Patents

Description

  The present technology relates to data privacy protection technology.

  Recently, GPS (Global Positioning System) receivers embedded in car navigation systems and mobile phones acquire current positions that change from moment to moment, and services such as introducing navigation and nearby shops based on the current location. It has been put into practical use. However, as a user, there is a demand for using the service without knowing so much by the service provider about the position data which is his privacy data.

  On the other hand, the service provider wants to collect data as close as possible to the actual data of the user to realize various services. For example, if you can only get the aggregate value of people and cars in a certain place, you can only do traffic information provision, but if you can not identify someone but you can get the action history of the same person, it looks similar It is possible to perform detailed processing such as predicting the behavior of people who are taking various routes. In addition, if an individual can be identified, it is possible to recommend a store in accordance with the personal travel route.

  In relation to this, there is a technique for distributing advertisements according to the attributes of people within a certain range. In this technique, information on passers-by having a specific attribute is collected by a server at a certain time interval and aggregated, and an appropriate advertisement is selected based on the collected information. However, in this case, each individual's actual data is transmitted to the server, so that the personal action history is specified by combining the data stored in the server, which may infringe privacy. In addition, if real data of a specific individual is obtained and held as it is, there is a high risk of leakage for some reason.

  There is also a technique for efficiently dispatching a taxi even when there is no direct request from a taxi user. In this technology, information notified to base stations from mobile terminals such as mobile phones possessed by an unspecified number of users is collected, and there are many mobile terminals distributed around which base stations. Get the distribution status. When a request is received from the in-vehicle device, the distribution information of the portable terminals in a predetermined range including the current position of the in-vehicle device is displayed on the in-vehicle device. Since the distribution of portable terminals is known, it is possible to grasp how many potential users of a taxi are. According to this technique, distribution information is available, but no more data can be used.

  As described above, it is highly risky to obtain and hold actual data of a specific individual as it is, and therefore it is preferable to perform concealment processing on the data. This concealment technology includes k-anonymization technology. In this technique, even if personal data included in a database is searched by combining specified attributes (data items according to identifiers, address, age, sex, etc.), k records (k is a numerical value given in advance) or less. It is a technology to obscure data so that it cannot be narrowed down. By processing the database in this way, it is possible to protect the privacy of individuals by making it impossible to narrow down the records of specific individuals.

  In Datafly which is one of k-anonymization technologies, the following processing is performed. For example, it is assumed that a database as shown in FIG. 1 exists in advance. (1) First, the number of combinations of attribute values of designated attributes (for example, Birthdate, Gender and ZIP) is counted. Here, as shown by the appearance frequency “1” in FIG. 2, each of the 12 records is different. If the number of records having the same combination of attribute values of the specified attributes is equal to or greater than the threshold value k (here, 2), the processing for the record is anonymized. For convenience of the following description, a record ID is given in FIG.

  (2) For a record in which the number of records having the same combination of attribute values of designated attributes is less than k, the attribute having the largest value type is selected from the designated attributes, and the value is generalized. The number of types is shown under each column of Birthdate, Gender, and ZIP, but the number of types of Birthdate is the largest with 12 types. Therefore, the Birthdate value is generalized according to a predetermined rule. For example, 9/20/65 is born in 1965 and is generalized to 1965. If the other generalizations are similarly generalized, data as shown in FIG. 3 is obtained. In FIG. 3, the records having the same combination of attribute values of the designated attributes are merged. Specifically, the records with the record IDs t1 and t2 are the same, the records with the record IDs t3 and t4 are the same, the records with the record IDs t5 and t6 are the same, and the record IDs are t9 and t10. The records with the record IDs t11 and t12 are the same. For these records, the appearance frequency is 2, and since it is equal to or greater than the threshold value k, anonymization is completed.

  (3) Repeat step (2) for other attributes until the number of remaining records is equal to or less than k.

  (4) If the number of remaining records is k or less, the remaining records are deleted. In the case of the example in FIG. 3, the records with record IDs t7 and t8 cannot be merged and are discarded.

  In order to apply such technology to personal information and the like sent one after another, after all, a database storing actual data is generated, so there are privacy problems and risk of leakage. Further, if the process (2) is repeated many times, there is a problem that the processing cost is high.

JP 2002-312673 A JP 2007-249918 A

Sweeney, Achieving k-anonymity privacy protection using Genralization and suppression, International Journal on Uncertainty, Fuzziness and Knowledge-based Systems, 2002

  Accordingly, an object of the present technology is, in one aspect, to provide a new technology for protecting privacy when a data set including personal information is used.

  In the information processing method according to the present technology, (A) the number of data sets received from the terminal device within a predetermined time, stored in the data storage unit, and including personal information of the user of the terminal device is determined in advance. A first step for determining whether the number of data sets is equal to or greater than the threshold value, and (B) if it is determined in the first step that the number of data sets is not equal to or greater than the threshold value, by communicating with another anonymization processing device A second step of determining or confirming whether the number of data sets is equal to or greater than a threshold when combined with a data set held in at least one of the data processing devices, and (C) in at least one of other anonymization processing devices If it is determined or confirmed in the second step that the number of data sets is equal to or greater than the threshold when combined with the data sets to be stored, the data storage unit stores them. A third step of performing a first anonymization process on at least a part of the data set being performed, and (D) a data set after the first anonymization process is obtained from a plurality of anonymization processing devices. And a fourth step of transmitting the data set to a computer that stores the data set.

  Privacy protection can be achieved when using a data set including personal information.

FIG. 1 is a diagram for explaining the prior art. FIG. 2 is a diagram for explaining the related art. FIG. 3 is a diagram for explaining the prior art. FIG. 4 is a diagram illustrating a system configuration example according to the embodiment. FIG. 5 is a functional block diagram of the terminal device. FIG. 6 is a functional block diagram of the anonymization processing device. FIG. 7 is a diagram illustrating an example of data stored in the adjacent device data storage unit. FIG. 8 is a functional block diagram of the server. FIG. 9 is a schematic diagram for explaining the first embodiment. FIG. 10 is a schematic diagram for explaining the first embodiment. FIG. 11 is a diagram for explaining the processing according to the first embodiment. FIG. 12 is a diagram illustrating a processing flow according to the first embodiment. FIG. 13 is a diagram illustrating a processing flow according to the first embodiment. FIG. 14 is a diagram illustrating a processing flow according to the first embodiment. FIG. 15 is a diagram illustrating a processing flow according to the first embodiment. FIG. 16 is a diagram illustrating a process flow of the anonymization process. FIG. 17 is a diagram illustrating an example of data stored in the cache. FIG. 18 is a diagram illustrating an example of data after the anonymization process. FIG. 19 is a diagram illustrating a processing flow according to the second embodiment. FIG. 20 is a diagram illustrating an example of data representing a correspondence relationship between a confidential level and a threshold value. FIG. 21 is a diagram illustrating a processing flow according to the second embodiment. FIG. 22 is a diagram illustrating a processing flow according to the second embodiment. FIG. 23 is a diagram illustrating a processing flow according to the second embodiment. FIG. 24 is a diagram illustrating a processing flow according to the second embodiment. FIG. 25 is a diagram for explaining the effect of the second embodiment. FIG. 26 is a functional block diagram of a computer.

[Embodiment 1]
FIG. 4 shows an overview of a system according to the first embodiment of the present technology. In the present embodiment, position data is received from a terminal device 5 (5a to 5d in FIG. 4) such as a mobile phone having a wireless communication function and a position data acquisition function (for example, a GPS function) or a car navigation device mounted on an automobile. The data set including the above is not transmitted to the server 7 as it is, but is transmitted from the server 7 to the anonymization processing device 3 (3a and 3b in FIG. 4) installed closer to the terminal device. And it transmits to the server 7 after performing the anonymization process demonstrated below in the anonymization processing apparatus 3. FIG. The server 7 performs a predetermined analysis process on a large number of data sets.

  The anonymization processing device 3 is integrated with, for example, a base station for wireless communication by the terminal device 5 or connected to the base station, and neighboring anonymization processing devices 3 communicate with each other according to a predetermined rule. To do. Furthermore, the anonymization processing device 3 is connected to the server 7 via the Internet 1 or other network 1.

  FIG. 5 shows a functional block diagram of the terminal device 5. The terminal device 5 includes a position data acquisition unit 51 such as GPS, an attribute data storage unit 52 that stores attribute data such as personal information of the user of the terminal device 5, and position data and attribute data acquired by the position data acquisition unit 51. And a data transmission unit 53 that periodically transmits a data set including at least a part of the data stored in the storage unit 52 to the base station. In the example described below, the data set to be transmitted includes data such as the identifier (ID) of the terminal device 5, position data including latitude and longitude, the user's age, gender, and presence / absence of infectious disease. And

  In FIG. 6, the functional block diagram of the anonymization processing apparatus 3 is shown. The anonymization processing device 3 includes a communication unit 31, a cache 32, a queue 33, a control unit 34, an anonymization processing unit 35, and an adjacent device data storage unit 36. The communication unit 31 receives a data set from the terminal device 5 and communicates with another anonymization processing device 3. The communication unit 31 communicates with another anonymization processing device 3, but the transmission destination of the inquiry message is determined using data stored in the adjacent device data storage unit 36 as shown in FIG. 7, for example. In the example of FIG. 7, the device name and the device ID are associated with each other.

  The cache 32 stores a data set from the terminal device 5 for every Δt time, for example. There are cases where there are a plurality of caches 32 because they are used by switching every Δd. The queue 33 is a queue that stores messages received from other anonymization processing devices 3. The control unit 34 determines the number of data sets stored in the cache 32, or the number of data sets stored in the cache 32 + the number of data sets held by another anonymization processing device 3, and other Based on the message from the anonymization processing device 3, the anonymization processing device 3 is controlled. The anonymization processing unit 35 performs anonymization processing such as value identification and masking according to attributes and the like. It has a hash function, and attribute values may be hashed.

  FIG. 8 shows a functional block diagram of the server 7. The server 7 analyzes the data receiving unit 71 that receives the data set from the anonymization processing device 3, the database 73 that stores the data set received by the data receiving unit 71, and the data set accumulated in the database 73. And an analysis processing unit 75 for performing a predetermined service. The processing result of the analysis processing unit 75 may be automatically distributed to the terminal device 5 or distributed in response to a request. Furthermore, it may be transmitted to other terminals.

  In the present embodiment, as schematically shown in FIG. 9, a data set is transmitted from the seven terminal devices 5 indicated by small circles to the anonymization processing device 3a between time T1 and unit time Δt. Is coming. However, if K = 10 is set as the threshold, the number of data sets is insufficient. On the other hand, the data set is transmitted from the three terminal devices 5 indicated by small circles between the time T1 and the unit time Δt to the adjacent anonymization processing device 3b, but the threshold value K = 10 is also set. If so, the number of data sets is insufficient. Here, in this embodiment, if the anonymization processing devices 3a and 3b communicate and add each other's number of data sets, and know that there are K = 10 or more data sets, each of the data sets After performing the predetermined anonymization process, the data set after the anonymization process is transmitted to the server 7. At this time, the position data included in the data set is made the same as the position data of the intermediate point as indicated by a cross in FIG. Further, when the reception time is included in the data set, for example, it is made identical at time T1. Other attributes may be the same or may be partially masked. Other ambiguities may occur.

  On the other hand, as shown in FIG. 10, the anonymization processing device 3a receives a data set from 10 terminal devices 5 indicated by small circles between time T2 and unit time Δt. The number of sets has reached the threshold value K = 10. On the other hand, data sets are transmitted to the adjacent anonymization processing device 3b from the three terminal devices 5 indicated by small circles between the time T2 and the unit time Δt, but the number of data sets is the threshold K = 10 has not been reached. In such a case, the data set is transmitted to the server 7 after a predetermined anonymization process. For example, the position data is made the same as the position data of the anonymization processing device 3a, the time data is made the same at time T2, and the other attributes are made the same or partially masked. There may be other obscurations. The anonymization processing device 3b communicates with another anonymization processing device 3 and discards the data sets from the three terminal devices 5 when the number of data sets does not reach the threshold value K = 10.

  The process described with reference to FIG. 9 will be described in more detail with reference to FIG. For example, it is assumed that the anonymization processing device 3a has ID = 10, the position is Pa, and five data sets (N = 5) are received from the terminal device 5 between the start time t1 and the unit time Δt. . Further, it is assumed that the anonymization processing device 3b has ID = 8, the position is Pb, and three data sets (N = 3) are received from the terminal device 5 during the unit time Δt. It is assumed that the anonymization processing device 3c has ID = 18, the position is Pc, and seven data sets (N = 7) are received from the terminal device 5 during the unit time Δt. It is assumed that the anonymization processing device 3d has ID = 6, the position is Pd, and six data sets (N = 6) are received from the terminal device 5 during the unit time Δt.

  Assuming that the threshold value K = 10, the number N of data sets received by any anonymization processing device 3 does not reach the threshold value K = 10. Therefore, when paying attention to the anonymization processing device 3a, the anonymization processing devices 3b and 3d having an ID smaller than ID = 10 of the anonymization processing device 3a are notified to the inquiry message q (T, P, N) (specifically, q (t1, Pa, 5)) is transmitted. T represents the start time, P represents the position, and N represents the number of data sets. The anonymization processing device 3c also transmits the inquiry message q (t1, Pc, 7) to the anonymization processing device 3a (and 3b, 3d, and 3e), and the anonymization processing device 3e also transmits the inquiry message q (t1, Pe, 2) is transmitted to the anonymization processing device 3a (and 3b and 3d).

  Note that sending an inquiry message only to an anonymization processing device having an ID smaller than its own ID avoids sending an inquiry message and a response message indicating the possibility of satisfying a condition (message loop). It is to do.

  For example, if the anonymization processing device 3a first receives the inquiry message q (t1, Pc, 7) from the anonymization processing device 3c, it is an inquiry message with the number of data sets N = 7. When combined with the number of data sets N = 5, the threshold value K = 10 is exceeded. Therefore, a response message yes (t1, Pa) representing the possibility of condition satisfaction is returned to the anonymization processing device 3c. On the other hand, since neither the inquiry message nor the response message indicating the possibility of satisfying the condition has been received from the other anonymization processing device 3, the anonymization processing device 3c sends an acknowledgment message ok (t1) to the anonymization processing device 3a. , Pc), and as described with reference to FIG. 9, the data sets to be held are anonymized and then transmitted to the server 7.

  On the other hand, when the anonymization processing device 3d receives the inquiry message q (t1, Pa, 5) from the anonymization processing device 3a, the anonymization processing device 3a sends a response message yes (t1, Pd) indicating the possibility of condition satisfaction. Reply to However, the anonymization processing device 3a that has already returned the response message yes (t1, Pa) indicating the possibility of satisfying the condition to the anonymization processing device 3c is sent to the anonymization processing device 3d as a rejection message ng ( t1, Pa).

  The anonymization processing device 3a ignores the inquiry message from the anonymization processing device 3e, and the anonymization processing device 3b ignores the inquiry message from the anonymization processing device 3a. Therefore, the anonymization processing devices 3b, 3d, and 3e discard the data set.

  The processing described in FIG. 11 will be described in detail with reference to FIGS. The communication unit 31 of the anonymization processing device 3 stores the received data set in the cache 32 for one unit time Δt from the start time T (FIG. 12: step S1). In addition, the control unit 34 initializes the queue 33 (step S3). Then, the control unit 34 counts the number of data sets stored in the cache 32, and sets the number of data sets in the cache 32 to N (step S5). And the control part 34 judges whether N became more than the preset threshold value K (step S7). If N ≧ K, the process proceeds to step S41 in FIG. The data set after the anonymization process is transmitted to the server 7 after performing the anonymization process on the data set without performing communication with another anonymization processing device 3.

  On the other hand, if N is less than K, the control unit 34 identifies to the communication unit 31 one of the adjacent anonymization processing devices 3 whose ID is smaller than its own ID, and sends an inquiry message q (T, P, N ) Is transmitted (step S9). T is, for example, the measurement start time of unit time, but may be the measurement end time of unit time. P is the position of the anonymization processing device 3, and N is the number of data sets. As described above, the communication unit 31 specifies the anonymization processing device 3 to which the inquiry message should be transmitted from the data stored in the adjacent device data storage unit 36. If an ID smaller than its own ID is not stored in the adjacent device data storage unit 36, the inquiry message may not be transmitted. The control unit 34 starts measuring a predetermined timeout time, for example, at this timing. After this timing, when the communication unit 31 receives a message from another anonymization processing device 3, the communication unit 31 stores the message in the queue 33.

  Then, the control unit 34 determines whether the time-out period has elapsed and a time-out has occurred (step S11). If the timeout has occurred, the process proceeds to step S49 in FIG. On the other hand, if the time-out has not occurred, the control unit 34 determines whether it is in an OK waiting state (step S13). The OK waiting state is a state in which an acknowledgment message is waited for from another anonymization processing device 3, and the OK waiting flag is set to Yes. If OK, the process proceeds to step S27 in FIG.

  On the other hand, if not in the OK waiting state, the control unit 34 reads the received message from the head of the queue 33 and sets it to Q (step S15). Then, the processing shifts to the processing in FIG.

  Shifting to the description of the processing in FIG. 13, the control unit 34 receives an inquiry message q (T, P1, N1) in Q (the inquiry message q includes the ID of the transmission source anonymization processing device 3 and the like). It is determined whether it is set (step S17). Also in FIG. 11, since the anonymization processing device 3c has sent the inquiry message q (t1, Pc, 7) to the anonymization processing device 3a, it is determined whether or not this situation is applicable. When the inquiry message q (T, P1, N1) is set in Q, the control unit 34 determines whether (N + N1) is equal to or greater than K (step S19). In the present embodiment, in order to simplify the processing, only when the number of data sets held in the two anonymization processing devices 3 is equal to or greater than the threshold value K, the data sets from the two anonymization processing devices 3 are used. Is transmitted to the server 7. However, in general, three or more anonymization processing apparatuses 3 may be used. If (N + N1) is less than K, the process returns to step S11 in FIG.

  On the other hand, if (N + N1) is equal to or greater than K, the control unit 34 sends a response message yes (T) indicating the possibility of satisfying the condition to the communication unit 31 to the source anonymization processing device 3 of the inquiry message. , P) (P is the position data of the self-anonymization processing device 3) is returned (step S21). And the control part 34 sets an OK waiting flag to Yes, and is changed to an OK waiting state (step S23). Then, the processing returns to step S11 in FIG.

  On the other hand, Q is not an inquiry message q (T, P1, N1) but a response message yes (T, P1) indicating the possibility of condition satisfaction (the response message includes the ID of the source anonymization processing device 3) If it is set, the control unit 34 causes the communication unit 31 to return an acknowledgment message ok (T, P) to the transmission source anonymization processing device 3 of the response message (step S25). ). And it transfers to step S31 of FIG. In this situation, the anonymization process in which the transmission source anonymization processing device 3 of the response message yes (T, P1) has determined that (N + N2) ≧ K and the acknowledgment message ok (T, P) has been transmitted. The device 3 does not judge directly. However, since the response message yes (T, P1) notifies the situation of (N + N2) ≧ K, it can be said that (N + N2) ≧ K is determined or confirmed in this response message.

  In the example of FIG. 11, the response message yes (t1, Pd) is transmitted from the anonymization processing device 3d to the anonymization processing device 3a. Before that, the anonymization processing device 3a waits for OK in step S23. Since the state is changed, the process of step S25 is not performed.

  Next, processing after the terminal C will be described with reference to FIG. In other words, when in the OK waiting state, the control unit 34 reads the received message from the head of the queue 33 and sets it to Q (step S27). Then, the control unit 34 determines whether an acknowledgment message ok (T, P1) is set in Q (step S29). T and P1 must be the same as T and P1 in the inquiry message. When the approval message ok (T, P1) is set in Q, this corresponds to the case where the anonymization processing device 3a receives the approval message ok (t1, Pc) from the anonymization processing device 3c in FIG. Accordingly, the sum of the number N1 of the data sets of the transmission source anonymization processing device 3 of ok (T, P1) and the number N of the data sets of the self-anonymization processing device 3 is K or more, and these anonymization processing The data set of the apparatus 3 is handled as collected at the same position.

  Then, the control unit 34 outputs the position data P1 to the anonymization processing unit 35, replaces the position data of the data set in the cache 32 with (P + P1) / 2, and makes the data anonymous (step S31). The processing described with reference to FIG. 9 is performed. And it transfers to step S43 of FIG.

  On the other hand, when the acknowledgment message ok (T, P1) is not set in Q, the control unit 34 sends a response message yes (T, P2) (P2 is P1) indicating the possibility of satisfying the condition to Q. It is determined whether or not a response message from a different anonymization processing device 3 is set (step S33). This corresponds to the case where the anonymization processing device 3d transmits a response message yes (t1, Pd) to the anonymization processing device 3a in FIG. When the response message yes (T, P2) is set in Q, the control unit 34 sends the rejection message ng (T, P) to the communication unit 31 to the response message transmission source anonymization processing device 3. Is transmitted (step S35). This corresponds to the case in FIG. 11 in which the anonymization processing device 3a transmits a rejection message ng (t1, Pa) to the anonymization processing device 3d. Then, the processing returns to step S11 in FIG.

  On the other hand, when the response message yes (T, P2) is not set in Q, the control unit 34 determines whether or not a rejection message ng (T, P1) is set in Q (step S37). When a message other than the messages determined in steps S29, S33, and S37 is set in Q, the process returns to step S11 in FIG.

  On the other hand, when the rejection message ng (T, P1) (reject message from the anonymization processing device 3 that is the transmission destination of the response message (T, P)) is set in Q, the control unit 34 waits for OK. The flag is set to NO, and the normal state is restored from the OK waiting state (step S39). Then, the process returns to step S11 in FIG.

  Next, processing after the terminal A will be described with reference to FIG. In addition, the process after the terminal F and the terminal B is also demonstrated simultaneously.

  After the terminal A, that is, when the number N of data sets in the self-anonymization processing device 3 is K or more, the control unit 34 automatically sends the position data of the data set in the cache 32 to the anonymization processing unit 35. It anonymizes by making it the same in the position P of the anonymization processing apparatus 3 (step S41). Further, the control unit 34 causes the anonymization processing unit 35 to anonymize other attributes of the data set in the cache 32 (step S43). The reception time is made the same as the measurement start time T, the ID is converted into H (ID) by the hash function H, and the anonymization of other attributes is performed for each attribute, for example, as shown below.

  Specifically, the anonymization processing unit 35 calculates the attribute value distribution in the data set in the cache 32 (FIG. 16: step S51). For example, the appearance frequency of attribute values is counted. And the anonymization process part 35 judges whether there exists a singular value (step S53). The singular value is, for example, an attribute value whose appearance frequency is very small with respect to the number of data sets, and is an attribute value that appears less than a predetermined threshold value. If a singular value exists, the anonymization processing unit 35 masks the singular value by replacing it with NULL (step S55). Then, control goes to a step S57.

  On the other hand, when there is no singular value or after step S55, the anonymization processing unit 35 determines whether all attribute values are the same value (step S57). If all the attribute values are the same value, the anonymization processing unit 35 masks partly by randomly replacing with NULL (step S59). Then, the process returns to the calling process. On the other hand, if all the attribute values are not the same value, the process returns to the calling process.

  By performing the above process, information that seems to be a clue to identify individuals, such as when all the attribute values of users in the same spacetime are the same, or when there is a user with a unique attribute value for only one person Can be hidden. Depending on the content to be analyzed and the privacy level described below, only singular value removal may be performed, only identical value removal may be performed, or attribute value anonymization processing may not be performed.

  For example, consider a case where a data set as shown in FIG. The ID is the ID of the terminal device 5 that is the transmission source, the date and time is the reception time of the data set, the latitude and longitude are the position data of the terminal device 5 that is the transmission source, and age, sex, and presence / absence of infectious disease ( Y / N) is attribute data of the user of the terminal device 5.

  As shown in FIG. 18, the anonymization processing unit 35 in the present embodiment converts the ID by the hash function H, makes the date and time the same by the measurement start time, and makes the position data (latitude and longitude) anonymized. The identification is performed using the position data of the processing device 3 or the position data of the intermediate point of the anonymization processing device 3. Furthermore, since the anonymization processing unit 35 has the same value for all sexes, it randomly sets NULL and partially masks it. Furthermore, since there is a singular value “Y” for the presence or absence of infection, the singular value is partially masked by setting NULL.

  Returning to the description of FIG. 15, the control unit 34 causes the communication unit 31 to transmit the anonymized data set stored in the cache 32 to the server 7 (step S <b> 45). If the processing is not finished (step S47: No route), the control unit 34 clears the cache 32 and updates the time T with T + Δt (step S49). Then, the process returns to step S1 in FIG. On the other hand, if the process is completed (step S47: Yes route), the process is terminated.

  By performing such processing, the server 7 is not notified of the exact position of each user, and at least K data sets are collected at the same position. Therefore, privacy protection is also achieved for the position. Furthermore, since the exact position of each user is not notified to the adjacent anonymization processing device 3, privacy protection is also achieved here and locally. Further, since the anonymization process is performed by the anonymization processing device 3, the server 7 does not need to perform the anonymization process, and thus the processing load on the server 7 can be reduced.

[Embodiment 2]
In the first embodiment, the data set from any terminal device 5 is processed in the same manner. However, depending on the user of the terminal device 5, there is a case where it is desired to increase the secrecy level for a data set including its own attribute data, and there is a case where it is desired to transmit the data set to the server as much as possible without being particularly concerned.

  In the present embodiment, it is assumed that the user sets a secret level for the data transmission unit 53 of the terminal device 5 in advance. Specifically, the concealment level L = 3 corresponds to the threshold value K = 50 and is transmitted to the server when 50 data sets are prepared, and the concealment level L = 2 corresponds to the threshold value K = 10. It is assumed that the data set is transmitted to the server, and the concealment level L = 1 corresponds to the threshold value K = 1, and the data set is always transmitted to the server. This is an example, and the number of levels can be increased or decreased to change the threshold value K to another value.

  Even when the user sets such a concealment level, the basic system configuration and the configuration of each device are the same as those in the first embodiment, and only the functions thereof are partially changed. Therefore, in 2nd Embodiment, the description about a system, the structure of the terminal device 5, the structure of the anonymization processing apparatus 3, and the structure of the server 7 is abbreviate | omitted.

  Next, a processing flow in the present embodiment will be described with reference to FIGS.

  The communication unit 31 of the anonymization processing device 3 stores the received data set in the cache 32 for one unit time Δt from the measurement start time T (FIG. 19: step S101). Further, the control unit 34 initializes the queue 33 (step S103). Further, the control unit 34 specifies the highest secret level L in the data set in the cache 32 (step S105).

  Further, the control unit 34 counts the number of data sets stored in the cache 32 and sets the number of data sets in the cache 32 to N (step S107). Further, the control unit 34 sets a threshold corresponding to the confidentiality level L specified in step S105 to K (step S109). For example, a table as shown in FIG. 20 is held, and a threshold value is registered in association with the confidentiality level.

  And the control part 34 judges whether N became K or more (step S111). If N ≧ K, the process proceeds to step S155 in FIG. The data set after the anonymization process is transmitted to the server 7 after performing the anonymization process on the data set without performing communication with another anonymization processing device 3.

  On the other hand, if N is less than K, the control unit 34 identifies to the communication unit 31 one of the adjacent anonymization processing devices 3 whose ID is smaller than its own ID, and sends an inquiry message q (T, P, N , L) is transmitted (step S113). T is, for example, the measurement start time of unit time, but may be the measurement end time of unit time. P is the position of the anonymization processing device 3, N is the number of data sets, and L is the secret level. Note that the communication unit 31 specifies the anonymization processing device 3 to which the inquiry message should be transmitted from the data stored in the adjacent device data storage unit 36. If an ID smaller than its own ID is not stored in the adjacent device data storage unit 36, the inquiry message may not be transmitted. The control unit 34 starts measuring a predetermined timeout time, for example, at this timing. After this timing, when the communication unit 31 receives a message from another anonymization processing device 3, the communication unit 31 stores it in the queue 33.

  Then, the control unit 34 determines whether the time-out period has elapsed and a time-out has occurred (step S115). If the timeout has occurred, the process proceeds to step S147 in FIG. In the present embodiment, the loop is repeated as many times as the maximum concealment level, so that the length of one time-out time is shorter than that in the first embodiment.

  On the other hand, if the time-out has not occurred, the control unit 34 determines whether it is in an OK waiting state (step S117). The OK waiting state is a state of waiting for an acknowledgment message from another anonymization processing device 3, and the OK waiting flag is set to Yes. If OK, the process proceeds to step S133 in FIG. On the other hand, if it is not in the OK waiting state, the processing shifts to the processing in FIG.

  Shifting to the description of the processing in FIG. 21, the control unit 34 reads the received message from the head of the queue 33 and sets it to Q (step S119). Then, the control unit 34 determines whether an inquiry message q (T, P1, N1, L1) is set in Q (the inquiry message q includes the ID of the transmission source anonymization processing device 3) (step S121). ).

  When the inquiry message q (T, P1, N1, L1) is set in Q, the control unit 34 determines whether or not L of the self-anonymization processing device 3 is equal to or greater than L1 included in the inquiry message (step) S123). When L of the self-anonymization processing device 3 is less than L1, the source anonymization processing device 3 of the inquiry message includes a data set requesting a higher secrecy level. This is because if the processing is performed based on the concealment level L in the data processing apparatus 3, a problem arises from the viewpoint of privacy protection. If the condition of L ≧ L1 is not satisfied, the process returns to step S115 in FIG.

  On the other hand, when the condition L ≧ L1 is satisfied, the control unit 34 determines whether (N + N1) is equal to or greater than K (step S125). Also in this embodiment, in order to simplify the processing, only when the number of data sets held in the two anonymization processing devices 3 is equal to or more than the threshold value K, the data sets from the two anonymization processing devices 3 are used. Is transmitted to the server 7. However, in general, three or more anonymization processing apparatuses 3 may be used. If (N + N1) is less than K, the process returns to step S115 in FIG.

  On the other hand, if (N + N1) is equal to or greater than K, the control unit 34 sends a response message yes (T) indicating the possibility of satisfying the condition to the communication unit 31 to the source anonymization processing device 3 of the inquiry message. , P) (P is the position data of the self-anonymization processing device 3) is returned (step S127). And the control part 34 sets an OK waiting flag to Yes, and makes it transfer to an OK waiting state (step S129). Then, the process returns to step S115 in FIG.

  On the other hand, Q is not an inquiry message q (T, P1, N1, L1) but a response message yes (T, P1) indicating the possibility of condition satisfaction (the response message contains the ID of the source anonymization processing device 3). Is included), the control unit 34 causes the communication unit 31 to return an acknowledgment message ok (T, P) to the response message transmission source anonymization processing device 3 (step S131). . Then, the process proceeds to step S137 in FIG. In this situation, the anonymization process in which the transmission source anonymization processing device 3 of the response message yes (T, P1) has determined that (N + N2) ≧ K and the acknowledgment message ok (T, P) has been transmitted. The device 3 does not judge directly. However, since the response message yes (T, P1) notifies the situation of (N + N2) ≧ K, it can be said that (N + N2) ≧ K is determined or confirmed in this response message.

  Next, processing after the terminal L will be described with reference to FIG. In other words, when in the OK waiting state, the control unit 34 reads the received message from the head of the queue 33 and sets it to Q (step S133). Then, the control unit 34 determines whether an acknowledgment message ok (T, P1) is set in Q (step S135). T and P1 must be the same as T and P1 in the inquiry message. As a result, the sum of the number N1 of data sets of the transmission source anonymization processing device 3 of ok (T, P1) and the number N of data sets of the self-anonymization processing device 3 is equal to or greater than the current threshold value K, and The data set of the anonymization processing device 3 is treated as collected at the same position.

  Then, the control unit 34 outputs the position data P1 to the anonymization processing unit 35, and makes the position data of the data set in the cache 32 anonymized by (P + P1) / 2 (step S137). The processing described with reference to FIG. 9 is performed. Then, the process proceeds to step S157 in FIG.

  On the other hand, when the acknowledgment message ok (T, P1) is not set in Q, the control unit 34 sends a response message yes (T, P2) (P2 is P1) indicating the possibility of satisfying the condition to Q. It is determined whether a response message from a different anonymization processing device 3 is set (step S139). When the response message yes (T, P2) is set in Q, the control unit 34 sends the rejection message ng (T, P) to the communication unit 31 to the response message transmission source anonymization processing device 3. Is transmitted (step S141). Then, the process returns to step S115 in FIG.

  On the other hand, when the response message yes (T, P2) is not set in Q, the control unit 34 determines whether or not a rejection message ng (T, P1) is set in Q (step S143). If a message other than the messages determined in steps S135, S139, and S143 is set in Q, the process returns to step S115 in FIG.

  On the other hand, when the rejection message ng (T, P1) (reject message from the anonymization processing device 3 that is the transmission destination of the response message (T, P)) is set in Q, the control unit 34 waits for OK. The flag is set to NO, and the normal state is restored from the OK waiting state (step S145). Then, the process returns to step S115 in FIG.

  Next, processing after terminal K, that is, processing when a timeout occurs will be described with reference to FIG. If a timeout occurs, the current level of secrecy L is high and a corresponding data set of threshold value K or higher cannot be collected. Therefore, the control unit 34 caches a data set of level of secrecy L or higher. (Step S147). This protects the privacy of a data set with a high level of secrecy. Thereafter, the control unit 34 determines whether or not the data set remains in the cache 32 (step S149). If no data set remains in the cache 32, the process proceeds to step S163 in FIG.

  On the other hand, when the data set remains in the cache 32, the control unit 34 sets the highest secret level in the data set in the cache 32 to the secret level L (step S151). Then, the control unit 3 determines whether L is 1 (step S153). If L is 1, the processing shifts to the processing in FIG. On the other hand, if L is 2 or more, the process returns to step S107 in FIG.

  In the present embodiment, when L is 1, the corresponding threshold value is 1. Therefore, the process proceeds to the process in FIG. 24 via the terminal J, and the data set stored in the cache 32 is transmitted to the server 7. However, generally, even if L is 1, the threshold value may be 2 or more. In such a case, the process returns to step S107 in FIG.

  Next, the processing after the terminal J will be described with reference to FIG. The processing after the terminal S and the terminal W will also be described at the same time.

  After the terminal J, that is, when the number N of data sets in the self-anonymization processing device 3 is K or more, the control unit 34 automatically sends the position data of the data set in the cache 32 to the anonymization processing unit 35. It anonymizes by making it the same at the position P of the anonymization processing device 3 (step S155). Furthermore, the control unit 34 causes the anonymization processing unit 35 to anonymize other attributes of the data set in the cache 32 (step S157). The reception time is made the same as the measurement start time T, the ID is converted into H (ID) by the hash function H, and the anonymization of other attributes is performed for each attribute, for example, as shown in FIG.

  Then, the control part 34 makes the communication part 31 transmit the data set after the anonymization process stored in the cache 32 to the server 7 (step S159). If the processing is not finished (step S161: No route), the control unit 34 clears the cache 32 and updates the time T with T + Δt (step S163). Then, the process returns to step S101 in FIG. On the other hand, if the process is finished (step S161: Yes route), the process is finished.

  By performing such processing, the data set corresponding to the confidential level is transmitted. For example, as shown in FIG. 25, since a large number of users transmit the data set to the concealment processing device 3 on the main street such as the area A, the data set is transmitted to the server 7 even if the concealment level L = 3. . On the other hand, when entering a little from the main street such as area B, the data set with the concealment level L = 3 is not transmitted, and the data set with the concealment level L = 2 or less is transmitted to the server 7. Is done. Further, on the street with few people in front of the house, the data set with the concealment level L = 3 and L = 2 is not transmitted, and the data set with the concealment level L = 1 is transmitted to the server 7. Is done.

  According to the present embodiment, in addition to the effects of the first embodiment, transmission of each user's data set to the server can be controlled according to the confidentiality level designated by the user.

  Note that the timeout time may be changed according to the level of secrecy.

  Although the embodiment of the present technology has been described above, the present technology is not limited to this. For example, the functional block diagrams shown in FIG. 5, FIG. 6, and FIG. 8 are examples, and may not necessarily match the actual program module configuration. Also in the processing flow, as long as the processing result does not change, the order of the steps may be changed or executed in parallel.

  Note that the anonymization processing device 3 is not necessarily in a one-to-one relationship with the base station. For example, one anonymization processing device 3 may be provided for a plurality of base stations. In the case of a base station that receives a large number of data sets, a plurality of anonymization processing devices 3 may perform parallel processing for one base station.

  In the above-described example, the example in which the position data is replaced at the midpoint between the two anonymization processing devices 3 has been described. Moreover, the deformation | transformation which makes the position data the point which divides the line segment which connects between the two anonymization processing apparatuses 3 by ratio of the number of the data sets to hold | maintain may be sufficient.

  Further, in the example described above, the example in which the position data is sent from the terminal device 5 is shown. However, the position data is replaced with the position data of the anonymization processing device 3 as shown in the processing described above. End up. Therefore, the processing described above is effective even when the position data is not sent from the terminal device 5. That is, even if the position data is not sent from the terminal device 5, the anonymization processing device 3 may add the position data determined by the above-described processing and transmit the position data.

  The anonymization processing device 3 and the server 7 described above are computer devices, and as shown in FIG. 26, a memory 2501, a CPU (Central Processing Unit) 2503, and a hard disk drive (HDD: Hard Disk Drive). A bus 2519 connects a display control unit 2507 connected to 2505, a display device 2509, a drive device 2513 for the removable disk 2511, an input device 2515, and a communication control unit 2517 for connecting to a network. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing content of the application program, and performs a predetermined operation. Further, data in the middle of processing is mainly stored in the memory 2501, but may be stored in the HDD 2505. In an embodiment of the present technology, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed from the drive device 2513 to the HDD 2505. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above and programs such as the OS and application programs. .

  Further, the terminal device 5 has a flash memory instead of the HDD 2505, and the communication control unit 2517 performs wireless communication. Note that the anonymization processing device 3 may use a flash memory instead of the HDD 2505 in the same manner as the terminal device 5.

  The above-described embodiment can be summarized as follows.

  In the information processing method according to the present embodiment, (A) the number of data sets received from a terminal device within a predetermined time, stored in a data storage unit, and including personal information of the user of the terminal device is A first process for determining whether the threshold is equal to or greater than a predetermined threshold; and (B) if it is determined in the first process that the number of data sets is not equal to or greater than the threshold, the other is performed by communicating with another anonymization processing apparatus. A second process for determining or confirming whether the number of data sets is equal to or greater than a threshold when combined with a data set held in at least one of the anonymization processing apparatuses; and (C) at least one of other anonymization processing apparatuses If it is determined or confirmed in the second process that the number of data sets is equal to or greater than the threshold when combined with the data sets held in the above, the data sets are stored in the data storage unit. A third process for performing the first anonymization process on at least a part of the data set, and (D) a data set after the first anonymization process, a data set from a plurality of anonymization processing devices. And a fourth process to be transmitted to the storing computer.

  By executing such processing, privacy protection is achieved because the data set itself is not transmitted to the computer. Furthermore, it becomes unnecessary to perform anonymization processing in the computer. In addition, even if one anonymization processing device has a shortage of data sets, a plurality of anonymization processing devices can send data sets to a computer if the conditions for the number of data sets are satisfied. Effective use is made.

  Note that in the information processing method according to the present embodiment, (E) in the first process, when it is determined that the number of data sets is equal to or greater than the threshold value, at least a part of the data sets stored in the data storage unit For example, a fifth process for performing the second anonymization process and (F) a sixth process for transmitting the data set after the second anonymization process to the computer may be further included. If the number of data sets is equal to or greater than the threshold value, it is easy to protect privacy.

  In addition, the information processing method according to the present embodiment (G) determines in the second process that the number of data sets does not exceed the threshold when combined with the data sets held in at least one of the other anonymization processing devices. Alternatively, when it is confirmed, a seventh process of discarding the data set stored in the data storage unit may be further included. This is to ensure privacy protection.

  Furthermore, in the fourth process described above, a data set including data of a position calculated from the position of the anonymization processing device and at least one of the other anonymization processing devices is transmitted. Also good. For example, even when position data is not transmitted from the terminal device, the position data protected from the viewpoint of privacy protection can be used on the computer side.

  In addition, when the position data is included in the data set described above, the first anonymization process calculates the position data from the position of the anonymization processing device and the position of at least one of the other anonymization processing devices. It is also possible to include a process of replacing the data at the position to be performed.

  Furthermore, in the sixth process described above, a data set including the position of the anonymization processing device may be transmitted. For example, even when position data is not transmitted from the terminal device, the position data protected from the viewpoint of privacy can be used on the computer side.

  Furthermore, when position data is included in the data set described above, the second anonymization process may include a process of replacing the position data with the position of the anonymization processing device.

  In addition, the second processing described above stores data for an anonymization processing device having an identifier smaller than the identifier of the self-anonymization processing device among other anonymization processing devices registered in advance (b1). (B2) receiving an inquiry message from the second anonymization processing device which is one of other anonymization processing devices, and sending the inquiry message If the sum of the number of data sets included in the message and the number of data sets stored in the data storage unit is equal to or greater than the threshold value, a message indicating the possibility of satisfying the condition is returned, and the second When an acknowledgment message is received from the anonymization processing device, it may be determined that the number of data sets is equal to or greater than a threshold value. By performing communication using such a protocol, it can be determined or confirmed that the number of data sets is equal to or greater than a threshold value.

  Furthermore, the data set may have a secret level of the data set added thereto. In such a case, the first process described above is a process for specifying a threshold value corresponding to the first secret level that is the highest secret level among the secret levels of the data set stored in the data storage unit. May be included. In that case, at least one of the other anonymization processing devices may be at least one of other anonymization processing devices having a second secrecy level equal to or lower than the first secrecy level. In this way, it becomes possible to appropriately determine whether the threshold value is set according to the level of secrecy and the condition for the number of data sets is satisfied.

  In addition, the information processing method according to the present embodiment (H) determines in the second process that the number of data sets does not exceed the threshold when combined with the data sets held in at least one of the other anonymization processing devices. If it is, the eighth process of discarding the data set of the first secret level in the data storage unit, and (I) the highest secret level among the secret levels of the data set stored in the data storage unit, In the case of a secret level associated with a threshold value that is 2 or more, a ninth process for performing the first process shift may be further included. In this way, as many data sets as possible can be sent to the computer according to the level of secrecy.

  Furthermore, in the information processing method according to the present embodiment, (J) the confidentiality level associated with a threshold having a highest confidentiality level of 1 among the confidentiality levels of the data sets stored in the data storage unit. In this case, the first concealment process may be performed on the data set stored in the data storage unit, and a tenth process for performing the fourth process may be further included.

  It is possible to create a program for causing a computer to carry out the processing described above, such as a flexible disk, an optical disk such as a CD-ROM, a magneto-optical disk, and a semiconductor memory (for example, ROM). Or a computer-readable storage medium such as a hard disk or a storage device. Note that data being processed is temporarily stored in a storage device such as a RAM.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Appendix 1)
An information processing method executed by an anonymization processing device,
First processing for determining whether the number of data sets received from a terminal device within a predetermined time and stored in a data storage unit and including personal information of a user of the terminal device is equal to or greater than a predetermined threshold value When,
When it is determined in the first process that the number of the data sets is not equal to or greater than the threshold, the data sets are held in at least one of the other anonymization processing devices by communicating with the other anonymization processing devices. And a second process for determining or confirming whether the number of data sets is equal to or greater than the threshold value;
When it is determined or confirmed in the second process that the number of the data sets is equal to or more than the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data A third process for performing the first anonymization process on at least a part of the data set stored in the storage unit;
A fourth process for transmitting the data set after the first anonymization process to a computer that accumulates data sets from a plurality of anonymization processing apparatuses;
An information processing method including:

(Appendix 2)
When it is determined in the first process that the number of the data sets is equal to or greater than the threshold value, a second anonymization process is performed on at least a part of the data sets stored in the data storage unit. A fifth process;
A sixth process of transmitting the data set after the second anonymization process to the computer;
The information processing method according to appendix 1, further comprising:

(Appendix 3)
When it is determined or confirmed in the second process that the number of the data sets does not exceed the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data storage unit stores the data sets. The information processing method according to supplementary note 1 or 2, further comprising: a seventh process of discarding the data set being processed.

(Appendix 4)
In the fourth process, a data set including data of a position calculated from the position of the anonymization processing device and at least one of the other anonymization processing devices is transmitted. An information processing method according to claim 1.

(Appendix 5)
If the data set contains location data,
The first anonymization process includes a process of replacing the position data with data of a position calculated from the position of the anonymization processing device and at least one of the other anonymization processing devices. Any one of the information processing methods 1 to 3.

(Appendix 6)
The information processing method according to claim 2, wherein a data set including a position of the anonymization processing device is transmitted in the sixth process.

(Appendix 7)
If the data set contains location data,
The information processing method according to supplementary note 2, wherein the second anonymization process includes a process of replacing the position data with a position of the anonymization processing device.

(Appendix 8)
The second process includes
Inquiry message including the number of data sets stored in the data storage unit for anonymization processing devices having an identifier smaller than the identifier of the self-anonymization processing device among other anonymization processing devices registered in advance Send
Receiving the inquiry message from the second anonymization processing device which is one of the other anonymization processing devices, and the number of data sets included in the inquiry message and the data set stored in the data storage unit If the number is greater than or equal to the threshold when the number is added, a message indicating the possibility of satisfying the condition is returned, and when an acknowledgment message is received from the second anonymization processing device, the number of the data sets becomes the threshold The information processing method according to any one of appendices 1 to 7, including a process of determining that it is the above.

(Appendix 9)
A secret level of the data set is added to the data set,
The first process includes
Including a process of specifying a threshold value corresponding to the first secret level that is the highest secret level among the secret levels of the data set stored in the data storage unit,
The information processing method according to claim 1, wherein at least one of the other anonymization processing devices is at least one of other anonymization processing devices having a second secrecy level equal to or lower than the first secrecy level.

(Appendix 10)
When it is determined in the second process that the number of the data sets does not exceed the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data storage unit performs the first An eighth process of discarding the secret level data set of
When the highest level of the secret level of the data set stored in the data storage unit is a secret level associated with the threshold value which is a value of 2 or more, the first process A ninth process for carrying out the migration;
The information processing method according to appendix 9, further comprising:

(Appendix 11)
If the highest level of the secret level of the data set stored in the data storage unit is a secret level associated with the threshold value of 1, the data level is stored in the data storage unit. The information processing method according to supplementary note 10, further comprising: a tenth process for performing the first concealment process on the existing data set and performing the fourth process.

(Appendix 12)
In the anonymization processing device,
First processing for determining whether the number of data sets received from a terminal device within a predetermined time and stored in a data storage unit and including personal information of a user of the terminal device is equal to or greater than a predetermined threshold value When,
When it is determined in the first process that the number of the data sets is not equal to or greater than the threshold, the data sets are held in at least one of the other anonymization processing devices by communicating with the other anonymization processing devices. And a second process for determining or confirming whether the number of data sets is equal to or greater than the threshold value;
When it is determined or confirmed in the second process that the number of the data sets is equal to or more than the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data A third process for performing the first anonymization process on at least a part of the data set stored in the storage unit;
A fourth process for transmitting the data set after the first anonymization process to a computer that accumulates data sets from a plurality of anonymization processing apparatuses;
A program for running

(Appendix 13)
An anonymization processing device,
Determining whether the number of data sets received from the terminal device within a predetermined time and stored in the data storage unit and including the personal information of the user of the terminal device is equal to or greater than a predetermined threshold, When the number of data sets is determined to be not greater than or equal to the threshold value, the number of the data sets is combined with the data set held in at least one of the other anonymization processing devices by communicating with the other anonymization processing device. A control unit for judging or confirming whether it is above,
When the control unit determines or confirms that the number of the data sets is equal to or greater than the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data storage unit An anonymization processing unit that performs the first anonymization process on at least a part of the data set stored in
A communication unit that transmits the data set after the first anonymization processing to a computer that accumulates data sets from a plurality of anonymization processing devices;
An anonymization processing device.

1 Network 3 Anonymization Processing Device 5 Terminal Device 7 Server 31 Communication Unit 32 Cache 33 Queue 34 Control Unit 35 Anonymization Processing Unit 36 Adjacent Device Data Storage Unit

Claims (11)

An information processing method executed by an anonymization processing device,
First processing for determining whether the number of data sets received from a terminal device within a predetermined time and stored in a data storage unit and including personal information of a user of the terminal device is equal to or greater than a predetermined threshold value When,
When it is determined in the first process that the number of the data sets is not equal to or greater than the threshold, the data sets are held in at least one of the other anonymization processing devices by communicating with the other anonymization processing devices. And a second process for determining or confirming whether the number of data sets is equal to or greater than the threshold value;
When it is determined or confirmed in the second process that the number of the data sets is equal to or more than the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data A third process for performing the first anonymization process on at least a part of the data set stored in the storage unit;
A fourth process for transmitting the data set after the first anonymization process to a computer that accumulates data sets from a plurality of anonymization processing apparatuses;
An information processing method including: When it is determined in the first process that the number of the data sets is equal to or greater than the threshold value, a second anonymization process is performed on at least a part of the data sets stored in the data storage unit. A fifth process;
A sixth process of transmitting the data set after the second anonymization process to the computer;
The information processing method according to claim 1, further comprising: When it is determined or confirmed in the second process that the number of the data sets does not exceed the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data storage unit stores the data sets. The information processing method according to claim 1, further comprising: a seventh process of discarding the data set being processed. If the data set contains location data,
The first anonymization process includes a process of replacing the position data with data at a position calculated from a position of the anonymization processing device and at least one of the other anonymization processing devices. Item 4. The information processing method according to any one of Items 1 to 3. If the data set contains location data,
The information processing method according to claim 2, wherein the second anonymization process includes a process of replacing the position data with a position of the anonymization processing device. The second process includes
Inquiry message including the number of data sets stored in the data storage unit for anonymization processing devices having an identifier smaller than the identifier of the self-anonymization processing device among other anonymization processing devices registered in advance Send
Receiving the inquiry message from the second anonymization processing device which is one of the other anonymization processing devices, and the number of data sets included in the inquiry message and the data set stored in the data storage unit If the number is greater than or equal to the threshold when the number is added, a message indicating the possibility of satisfying the condition is returned, and when an acknowledgment message is received from the second anonymization processing device, the number of the data sets becomes the threshold The information processing method according to any one of claims 1 to 6, including a process of determining that the above is true. A secret level of the data set is added to the data set,
The first process includes
Including a process of specifying a threshold value corresponding to the first secret level that is the highest secret level among the secret levels of the data set stored in the data storage unit,
The information processing method according to claim 1, wherein at least one of the other anonymization processing devices is at least one of other anonymization processing devices having a second secrecy level equal to or lower than the first secrecy level. When it is determined in the second process that the number of the data sets does not exceed the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data storage unit performs the first An eighth process of discarding the secret level data set of
When the highest level of the secret level of the data set stored in the data storage unit is a secret level associated with the threshold value which is a value of 2 or more, the first process A ninth process for carrying out the migration;
The information processing method according to claim 7, further comprising: If the highest level of the secret level of the data set stored in the data storage unit is a secret level associated with the threshold value of 1, the data level is stored in the data storage unit. The information processing method according to claim 8, further comprising: a tenth process for performing the first concealment process on a data set and performing the fourth process. In the anonymization processing device,
First processing for determining whether the number of data sets received from a terminal device within a predetermined time and stored in a data storage unit and including personal information of a user of the terminal device is equal to or greater than a predetermined threshold value When,
When it is determined in the first process that the number of the data sets is not equal to or greater than the threshold, the data sets are held in at least one of the other anonymization processing devices by communicating with the other anonymization processing devices. And a second process for determining or confirming whether the number of data sets is equal to or greater than the threshold value;
When it is determined or confirmed in the second process that the number of the data sets is equal to or more than the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data A third process for performing the first anonymization process on at least a part of the data set stored in the storage unit;
A fourth process for transmitting the data set after the first anonymization process to a computer that accumulates data sets from a plurality of anonymization processing apparatuses;
A program for running An anonymization processing device,
Determining whether the number of data sets received from the terminal device within a predetermined time and stored in the data storage unit and including the personal information of the user of the terminal device is equal to or greater than a predetermined threshold, When the number of data sets is determined to be not greater than or equal to the threshold value, the number of the data sets is combined with the data set held in at least one of the other anonymization processing devices by communicating with the other anonymization processing device. A control unit for judging or confirming whether it is above,
When the control unit determines or confirms that the number of the data sets is equal to or greater than the threshold when combined with the data sets held in at least one of the other anonymization processing devices, the data storage unit An anonymization processing unit that performs the first anonymization process on at least a part of the data set stored in
A communication unit that transmits the data set after the first anonymization processing to a computer that accumulates data sets from a plurality of anonymization processing devices;
An anonymization processing device.

Images