JP5835745B2 - Information distribution system and information distribution method - Google Patents

Description

  The present invention relates to a technique for efficiently performing statistical processing on data including individual privacy information while keeping the privacy information secret, and processing in a server.

  In order to perform statistical processing such as averaging, variance, correlation, etc., it is necessary to collect the data of individual persons (or mobile terminals owned by individual persons, hereinafter referred to as nodes) in a statistical analyzer (statistical processing server) and then process them. Therefore, in order to provide data including privacy, there is a great sense of resistance unless it is a reasonably reliable research institution, and various considerations are also required for the data to be operated safely every time the investigator conducts the survey. Was necessary.

  Therefore, in order to perform statistical processing of data including privacy, a method of exchanging data in a state where privacy information of a node is concealed is considered.

  In the prior art, the data is distributed and stored by dividing the statistical processing server into three units, and the privacy is concealed (for example, see Non-Patent Documents 1 and 2). This method is a lightweight algorithm that allows basic operations such as addition, constant multiplication, and multiplication while keeping the data itself secret.

  Although this method guarantees that data cannot be restored unless the collusion of the statistical processing server is considered, it is not considered to anonymize who sent the data. This makes it possible for the statistical processing server and the main body analyzing the data to perform several attacks on the node.

  For example, when the statistical processing server considers sending a query including a condition to be answered to a node, it is determined that the respondent is included or not included in the query condition depending on whether or not there is an answer to the query. Without knowing, the statistical processing server can know. In addition, the data analysis subject collects statistical information with a query that narrows the query condition to a condition that only one respondent subject to attack, so that the data of the respondent subject to attack is subjected to fake statistical processing as it is. Will be output.

  When considering such problems, it can be said that the information of respondents should be kept secret. A communication technique for almost completely concealing the address and transmitting the data anonymously is enabled by a technique such as Tor using p2p (for example, see Non-Patent Document 3). However, if anonymization is performed and the sender is anonymized until it cannot be completely identified, it becomes difficult to pay the data sender, that is, the respondent of the query, and the motivation that the respondent provides the data Difficult to get. As a result, the survey itself may be unsuccessful.

  In addition, when considering dividing and storing data, another problem occurs when the data is completely anonymous. That is, when a part of the divided data is missing, if statistical processing is performed as it is, there is a possibility that the statistical data is incorrect. Even if it turns out that the data is missing from the difference in the number of data between the statistical processing servers, the data to be removed is unknown because each data is anonymous, and all the data becomes unavailable. End up.

Koji Senda, Dai Igarashi, Hiroki Hirota, Katsumi Takahashi: Proposal and implementation evaluation of lightweight three-party secret function calculation with error detection, IPSJ Transactions, Vol. 52, no. 9, pp2674-2685 (2011) Koji Senda, Dai Igarashi, Katsumi Takahashi: Proposal of efficient three-party secret function calculation and consideration of its operation model, DPS-142-1, pp1-7, 2010. https: // www. torproject. org /

  Therefore, an object of the present invention is to provide an information distribution system and an information distribution method capable of distributing data including privacy information in an anonymized state while being distributed in a plurality.

  In order to achieve the above-described object, the information distribution system and the information distribution method of the present invention provide that the data owner divides the data and returns each data (divided data) to the collection server based on different pseudonyms. The kana server stores the kana set of each data owner, answers to the inquiry from the statistical processing server whether or not the kana set is prepared, and the statistical processing server kana the kana of the received divided data. The server is notified and statistical processing is performed when the kana set is complete.

  Specifically, the information distribution system of the present invention receives a kana issuance request from a node, issues a kana set consisting of a plurality of kana to the node, and receives a notification when receiving a kana notification from the statistical processing server. The pseudonym is included in the pseudonym set, and when all the pseudonyms in the pseudonym set have been notified, the pseudonym server that notifies the statistical processing server that the pseudonym has been confirmed, and the pseudonym server The data having the issued pseudonym as the transmission source is accumulated, the accumulated pseudonym is notified to the pseudonym server, and when the confirmation is received, the confirmed pseudonym of the accumulated data is set as the transmission source. A statistical processing server that performs statistical processing using the data to be processed.

  In the information distribution system of the present invention, the statistical processing server determines a calculation process for restoring the original data of the node, generates a query for requesting data that can be restored by the calculation process, and adds the query to the accumulated data. The original data of the node may be restored by performing arithmetic processing.

  In the information distribution system of the present invention, the kana server may notify the statistical processing server that the kana has been confirmed by notifying all kana of which kana has not been notified. .

  In the information distribution system of the present invention, the kana server does not issue a kana set until the number of nodes for which a kana issue request has been made reaches a predetermined number, and the number of nodes for which a kana issue request has been made is predetermined. A kana set may be issued when the specified number is reached.

  Specifically, in the information distribution method of the present invention, the kana server receives a kana issuance request from a node and issues a kana set including a plurality of kana to the node, and the statistical processing server Is acquired, the kana and data pairs are accumulated, the accumulated kana is notified to the kana server, and when the kana server receives notification that the kana has been confirmed, And a statistical processing procedure for performing statistical processing using data whose sender is a confirmed pseudonym.

  In the information distribution method of the present invention, in the pseudonym issuing procedure, the statistical processing server determines a calculation process for restoring the original data of the node, generates a query for requesting data that can be restored by the calculation process, In the statistical processing procedure, the statistical processing server may restore the original data of the node by performing the arithmetic processing on the accumulated data.

  In the information distribution method of the present invention, in the statistical processing procedure, the kana server notifies the statistical processing server that the kana has been confirmed by notifying all kana of which kana has not been notified. May be.

  In the information distribution method of the present invention, in the kana issue procedure, the kana server does not issue a kana set until the number of nodes for which a kana issue request has been made reaches a predetermined number, and the node for which a kana issue request has been made A kana set may be issued when the number reaches the predetermined number.

  The above inventions can be combined as much as possible.

  According to the present invention, the kana server issues a plurality of kana to one node, and the statistical processing server statistically processes the data transmitted using the kana, so that the node transmits data different from the original data. In addition, the original data of the node can be restored by statistical processing. For this reason, data including privacy information can be distributed in an anonymized state while being distributed in a plurality.

An example of the functional block diagram of the system concerning this embodiment is shown. The sequence diagram of the information distribution system concerning this embodiment is shown. The sequence diagram in case there are a plurality of statistical processing servers is shown. 6 is an explanatory diagram from query generation to issuance of a pseudonym set in Embodiment 1. FIG. It is explanatory drawing from the division | segmentation of the data in Embodiment 1 to a statistical process. It is explanatory drawing from the query production | generation in Embodiment 2 to issuance of a kana set. FIG. 10 is an explanatory diagram from data division to statistical processing in the second embodiment.

  Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiments described below are examples of the present invention, and the present invention is not limited to the following embodiments. In the present specification and drawings, the same reference numerals denote the same components.

(Embodiment 1)
An information distribution system and an information distribution method according to the present embodiment include a server (a pseudonym server) that performs anonymization of a sender and statistical processing in order to save a plurality of distributed data in a state where both the numerical value and the sender cannot be restored. The server is divided and a different pseudonym is assigned to each divided data. It is also possible to divide the server that performs processing by dividing the server according to the role of pseudonym issuance and statistical processing, and increase the confidentiality of privacy information by making the situation that data will not be restored unless both are deposited .

  Further, in the information distribution system and the information distribution method according to the present embodiment, the kana server has a function of simultaneously managing the number of respondents in order to prevent an attack by the statistical processing server alone. Specifically, this is a function that does not allow each node to reply, that is, does not issue a pseudonym until a statistically sufficient number of answers are expected.

  In order to prevent incorrect statistical processing due to the loss of the divided data, the information distribution system and the information distribution method according to the present embodiment also have a function of the pseudonym server as a function of the query of the pseudonym set collected in the statistical processing server.

  A functional block diagram of the information distribution system according to the present embodiment is shown in FIG. The information distribution system according to the present embodiment includes a plurality of nodes 10 having data including individual privacy information, a query distribution server 40, a pseudonym server 30, and a statistical processing server 20. The node 10 includes a query processing unit 11, a data dividing unit 12, and a data storage unit 13. The statistical processing server 20 includes a query generation unit 21 and an answer collection / processing unit 22. The kana server 30 includes a kana issuing unit 31, a kana generation / management unit 32, and a kana confirmation unit 33. The query distribution server 40 includes a query storage unit 41.

FIG. 2 shows a sequence diagram of the information distribution method according to the present embodiment. The information distribution method according to the present embodiment includes a kana issue procedure, a query processing procedure, and a statistical processing procedure in this order.
In the kana issue procedure, the kana server 30 receives a kana issue request from the node 10 and issues a kana set including a plurality of kana to the node 10. Specifically, steps S201 to S206 are performed.
In the query processing procedure, the node 10 performs query processing. Specifically, steps S207 to S208 are performed.
In the statistical processing procedure, when the statistical processing server 20 acquires the data having the pseudonym as the transmission source, the pseudonym and the data pair are accumulated, the accumulated pseudonym is notified to the kana server 30, and a notification that it has been confirmed is sent. Upon receipt, the statistical processing is performed using the data having the confirmed pseudonym as the transmission source among the accumulated data. Specifically, steps S209 to S213 are performed.

  First, in step S201, the query generation unit 21 of the statistical processing server 20 generates a query for obtaining requested statistical data. The statistical processing server 20 determines a calculation process for restoring the original data of the node, and generates a query for requesting data that can be restored by the calculation process. The arithmetic processing is, for example, summation.

In order to prevent direct exchange between the node 10 and the statistical processing server 20, the generated query is not directly distributed to the node 10 but is installed in the query storage unit 41 of the query distribution server 40 in a state where it can be acquired from each node 10. The As a result, the query is distributed to each node 10 (S202).
The query generation unit 21 notifies the pseudonym server 30 that the query is installed in the query distribution server 40 (S204). From this time, the pseudonym issuing unit 31 starts counting the number of nodes for which a pseudonym issuance application has been made for the query.

  The query processing unit 11 of each node 10 periodically inquires the query distribution server 40, and if there is a new arrival query, makes a query distribution request to obtain a new arrival query (S203). If it is determined that the user wants to reply from the query conditions, the node 10 applies to the kana server 30 for issuance of a kana (S205), and waits until the issuance process is performed.

  The kana issuer 31 of the kana server 30 waits for issuance of a kana until a predetermined number N or more (for example, 1000) of issuance requests for the same query ID are generated in response to the kana issuance request. As a result, the pseudonym server 30 can guarantee the number of sample groups of statistics as a third-party organization, and a mechanism for preventing the node 10 from answering a malicious query that corresponds to only one respondent described above. It becomes. When the number of nodes for which a pseudonym is issued has reached a predetermined number N, the pseudonym issuing unit 31 of the pseudonym server 30 generates and issues a kana set consisting of n pseudonyms to each node 10 ( S206). The kana generation / management unit 32 of the kana server 30 stores a set of the kana set and the node 10.

Depending on the number n of kana constituting the issued pseudonym set, the data dividing unit 12 of each node 10 is arbitrarily divided the value D ₁ of the own data (S207). However, the division method differs depending on the statistical information of the data requested from the statistical processing server 20. If statistical processing an average of a statistical processing server 20, in any division method if divided as the sum of the values d ₁₁ to d _n1 which divides the value D ₁ of the data is equal to the value D ₁ of the data Good. For example, when the kana number n of the kana set is 3, random numbers r ₁ and r ₂ are generated and the original values x are converted to x ₁ = r ₁ , x ₂ = −r ₂ , x ₃ = x−r ₁ + r ₂ A division method such as The query processing unit 11 transmits the data x ₁ , x _2, and x ₃ to the statistical processing server 20 as values d _{11 to} d _n1 using the respective pseudonyms (S208). Thereby, the query processing unit 11 transmits an answer to the query.

  The query processing unit 11 of the node 10 does not send the divided data at the same time, but sends it to the statistical processing server 20 after waiting for a time determined by random numbers (for example, a uniform distribution from 10 minutes to 10 hours). May be. With these methods, it is possible to make it more difficult to match the divided data.

  In addition, when considering the case where the statistical processing in the statistical processing server 20 is variance or correlation, the statistical processing server 20 is used for a plurality of statistical processing such as a divided value of a value, a divided value of a square of a value, and a divided value of a product of a plurality of element values. It is also possible to divide the values to be used and transmit them together in the same packet. Even when the pseudonym is used, if the data transmission protocol itself follows normal packet transmission, the node 10 can know that the data transmission has failed because the ACK response does not return.

  The answer collection / processing unit 22 of the statistical processing server 20 that has received the result does not immediately process the result, but transmits the transmitted kana information to the kana confirmation unit 33 of the kana server 30 to inquire about the kana ( S209). This prevents the statistical data from being incorrect because it is added to the statistical processing before all the divided data of each node 10 is collected.

  The pseudonym confirmation unit 33 of the pseudonym server 30 that has transmitted the pseudonym information from the statistical processing server 20 registers in the pseudonym generation / management unit 32 that the pseudonym received from the statistical processing server 20 has been confirmed. Then, it is confirmed whether or not all n kana characters of the kana set issued to a certain node 10 have been received (S210), and a response to the statistical processing server 20 is waited until the kana sets are prepared. After it is confirmed that the kana set of a certain node 10 is prepared, the kana confirmation unit 33 of the kana server 30 returns an acknowledgment to the authenticated kana to the statistical processing server 20 (S211).

  Here, the positive response may be a response in which the statistical processing server 20 cannot uniquely identify the kana set, and after the statistical processing server 20 receives a sufficient amount of kana corresponding to the plurality of nodes 10, May be notified to the statistical processing server 20, or instead of notifying the kana, the kana server 30 may respond with an irregular kana that should not be added to the statistics. In addition, when there is consideration for the sender from the node 10, the statistical processing server 20 deposits the consideration to the kana server 30 in advance, and the kana server 30 is in order from the node 10 where the kana set is prepared during this response waiting. A possible way to complete the payment.

The answer collection / processing unit 22 of the statistical processing server 20 performs statistical processing in the order in which an affirmative response is obtained from the pseudonym server 30 (S213). The statistical processing can be performed by using the data in which all of the kana included in the kana set are prepared by the affirmative response. For example, response collection and processing unit 22, when the kana _{f 35, f n6, f 11} , data _d 35 transmitted by _{f 52, d n6, d 11} , the _{d 52} receives the acknowledgment, the data _d 35, d _n6, performs statistical processing using the _{d 11, d 52,} calculates a provisional statistics S. Next, when the response collection / processing unit 22 receives an affirmative response for the data d ₅₁ , d ₁₇ , d ₇₇ , d ₂₁ transmitted in the pseudonyms f ₅₁ , f ₁₇ , f ₇₇ , f ₂₁ , provisional statistics Statistical processing is performed using the data S and the data d ₅₁ , d ₁₇ , d ₇₇ , and d ₂₁ , and further provisional statistical data S is calculated. Repeat this. Here, the statistical process is a statistical process determined by the query generation unit 21 when a query is generated.

  When the number of confirmed kana sets finally reaches N nodes 10 determined at the time of query generation, the kana confirmation unit 33 notifies the statistical processing server 20 that the number of samples N has been reached (S212). The response collection / processing unit 22 receives a sample number arrival notification from the pseudonym server 30 when the number of responses reaches, finishes statistical processing by the notification, and obtains statistical data. Then, the answer collection / processing unit 22 transmits the statistical data to the statistical data request source (S213).

  For simplicity, the sequence diagram describes a method for obtaining an average in statistical processing, but the variance and covariance for calculating the correlation can be similarly calculated.

  Moreover, when the node 10 in these contents is considered as a wireless terminal, a usage form on each smartphone is also conceivable. The node 10 can also return an answer to the statistical processing server 20 using a different IP address given when the terminal belongs to a different wireless network. Thereby, it can avoid matching using the IP address used for communication.

Moreover, although the case where there was one statistical processing server 20 was described, it is also possible to divide into a plurality of statistical processing servers 20. A sequence diagram in that case is shown in FIG.
One of the plurality of statistical processing servers 20 becomes a statistical processing entity (parent server), and the statistical processing entity (parent server) generates a query, communicates with the query distribution server, sends a query distribution notification to the pseudonym server, and finally. Perform statistical processing. Therefore, the statistical processing entity (parent server) is determined before the query generation step S201 (S301). For example, the first statistical processing server 20 out of the first statistical processing server 20 and the second statistical processing server 20 is determined as a statistical processing entity. The method of determining the statistical processing subject (parent server) is arbitrary.

In the sequence shown in FIG. 3, in step S <b> 208, the node 10 may send the divided data to any statistical processing server 20. Each statistical processing server 20 deposits the sum and total summed up by the statistical processing entity. For example, when the first statistical processing server 20 is a statistical processing entity, in step S211, the first statistical processing server 20 uses the data d ₃₅ , d _n6 , d ₁₁ , d ₅₂ to provisional statistical data S _1. calculating a second statistical processing server 20 calculates a provisional statistics _{S 2} using the data _{d 21, d 17, d 77} .
When the first statistical processing server 20 receives the sample number arrival notification from the pseudonym server 30 (S212), the first statistical processing server 20 transmits an end notification and a statistical value request to the second statistical processing server 20 (S302). Then, the second statistical processing server 20 transmits a provisional statistics S ₂ calculated in the second statistical processing server 20 to the first statistical processing server 20 (S303).
Then, step S213 is executed. At this time, the first statistical processing server 20 to obtain the final statistical data by performing statistical processing using the temporary statistical data S ₁ and S _2.

  4 and 5 show an example in which statistical processing is correctly performed by actually receiving data divided from a plurality of nodes. Now, data with a height of 160 cm is stored in the data storage unit 13 of the node A, and data with a height of 188 cm is stored in the data storage unit 13 of the node B. Think about what you want without knowing. In this case, the statistical data requests are average and variance.

The processing from S201 to S206 shown in FIG. 4 is as described in detail in the sequence diagram shown in FIG.
The query distributed in step S202 includes, for example, that the sender name of the query is M, the query ID is M-1, the condition is all nodes, and the content of the query is height h. Of the average ave _h and variance var _h , the fact that the necessary data is the height h and the height h squared, and the fact that the calculation performed by the statistical processing is the sum.
In step S205, when the node A makes a pseudonym issue request, the node A transmits to the pseudonym server 30 that the sender name is A and the query ID is M-1. When the node B makes a kana issuance request, the node B transmits to the kana server 30 that the sender name is B and the query ID is M-1. At the time of generating the kana set in step S205, the kana server 30 is waiting to issue a kana set.
In step S206, the kana server 30 issues a kana set consisting of kana W and Y for the node A, and issues a kana set consisting of the kana X and Z for the node B.

The processing from S207 to S213 shown in FIG. 5 is as described in detail in the sequence diagram shown in FIG.
In the answer division of step S207, since there are two pseudonyms, the required data obtained by the query is the average ave _h and the variance var _h , and the restoration method of the original data is the sum, the nodes A and B Divides height h and the square of height h into two arbitrary values so as to be restored as a sum. For example, when the height is 160 cm, the height h is divided into 77 and 83, and the height squared 25600 is divided into 15600 and 10,000. In the case of a height of 188 cm, the height h is divided into 90 and 98, and 35344, which is the square of the height, is divided into -15331 and 50675.

  Subsequently, in the reply transmission in step S208, the reply having the sender W and the reply having the sender Y are transmitted from the node A to the statistical processing server 20, and the reply having the sender X and the sender are transmitted from the node B. An answer as Z is transmitted to the statistical processing server 20. At this time, as a reply with the query ID M-1, from the sender X, the fact that the height h is 90 and the square of the height h is 15331 is transmitted, and from the sender Z, the height h is 98. , The fact that the height h square is 50675, and the sender W sends a message that the height h is 77 and the height h square is 15600. And the fact that the square of height h is 10,000 is transmitted. Here, the divided data is transmitted using each pseudonym, but here, the divided value of height h and the square of height h is transmitted in the same packet. In this way, different data types can be included in the same packet.

In the confirmed kana notification in step S211, since the kana server 30 knows that the current total number of samples, that is, the number of nodes N to which the query is distributed is 2, from the kana server 30, the kana X to the statistical processing server 20 is known. , Z, W, and Y (S211), the end notification and the total number of samples (S212) are transmitted to the statistical processing server 20.
Finally, average ave _h and variance var _h are obtained by statistical processing in step S213. For example, the average ave _h can be obtained by calculating (77 + 90 + 83 + 98) / 2 = 174 to obtain an average ave _{h of} 174 cm and height of 188 cm. The variance var _h can be obtained by calculating (15600-15331 + 10000 + 50675) / 2-174 ² = 196, and the variance var _h 196 of 160 cm and 188 cm in height can be obtained. As described above, the statistical processing server 20 does not know the true values of the nodes A and B, but it has been confirmed that the statistical processing is correctly performed.

  Data processing is performed between a plurality of servers. In this embodiment, the original data including privacy is not restored unless the pseudonym server 30 and the statistical processing server 20 are all collocated. As a result, if the kana server 30 is a reliable organization, the subject analyzing the data can easily issue a query by itself. In addition, privacy information “matching / does not satisfy the query condition” may be leaked only by whether or not there is a response, but privacy information may be specified by not answering by concealing the respondent by the kana server 30. Disappear. As a specific example, when three question queries are prepared and the conditions are divided into “20s”, “male”, and “height of 170 cm or more”, even if the result is distributed, the address of the node 10 Is the same every time, the amount of information including privacy is gradually increased by the query itself, and it is possible in the prior art that an individual can be identified without performing collusion. However, in this embodiment, if data is transmitted with a different pseudonym each time and the content is not specified by a single question, that is, if the situation is not the same as an attack where the respondent is alone, the privacy Information is not leaked, and such a situation can be dealt with by managing the number of issued queries.

  Furthermore, even when an attack is performed in which the respondent is alone, the attack can be prevented by waiting for issuance of a pseudonym for the query of the pseudonym server 30.

  The pseudonym server 30 manages the number of issued queries and the number of answers and performs queuing to guarantee a sufficient number of respondents, and to maintain resistance against the loss of distributed data. For example, in the case where only a query (a, c) is received from the statistical processing server 20 in the kana set (a, b, c) issued to the same node, b is not obtained. An instruction not to perform calculation processing for the kana set of this node, or standby processing until b is obtained can be performed.

  By concealing the connection between the distributed data and the owner's information using the Kana server, it becomes possible to conceal the privacy information, and statistical analysis can be performed even if the analysis subject or the statistical processing server is not reliable. It becomes possible. In addition, a robust system can be configured in terms of accuracy and reliability of statistical information.

(Embodiment 2)
In the secret statistical processing technique described in the first embodiment, it is possible to calculate statistical values represented by average / variance. On the other hand, in statistical surveys, there are also knowledge that can be obtained from the trend of the total data collected. The frequency distribution and the histogram that graphs it are effective for finding features that cannot be discriminated from values such as average and variance, and for finding the mode and median. It is also possible to grasp the statistical tendency of data that cannot be averaged or has no meaning, such as the prefecture where you live, by using a histogram. In this embodiment, such data is anonymized and accumulated.

  A functional block diagram of the system is shown in FIG. There is no difference in configuration from the functional blocks in the first embodiment, and it includes a plurality of nodes 10 having data including individual privacy information, a query distribution server 40, a pseudonym server 30, and a statistical processing server 20. Similar to the first embodiment, a different kana is assigned to each of the divided data. In this embodiment, the data is converted into a binary determinant to enable frequency distribution. The statistical processing server 20 restores the obtained frequency distribution to the original data set, and obtains the mode value and the median value.

  In this embodiment, in step S207, each node arbitrarily divides its own data value according to the number of issued kana sets. However, the division method differs according to the statistical information. In the division for counting the frequency distribution, for example, in the case of gender, [male, female] is used as a matrix and [1,0] or [0,1] is converted, and each element is divided using random numbers. . For example, a matrix of [1, 0] is divided into [−2, 1] and [3, −1] in a form that can be restored by addition. The correspondence between the matrix and the element is represented by a query to ensure consistency.

  In step S208, the node transmits data to the statistical processing server 20 using each pseudonym. The node 10 may send the divided data to the statistical processing server 20 after waiting for a time determined by random numbers (for example, a uniform distribution of 10 minutes to 10 hours) instead of sending the divided data at the same time. With these methods, it is possible to make it more difficult to match the divided data. Even when the pseudonym is used, if the data transmission protocol itself follows normal packet transmission, the node 10 can know that the data transmission has failed because the ACK response does not return.

  The statistical processing server 20 that has received the result does not immediately process the result, but transmits the transmitted kana information to the kana server 30 (step S209). This prevents the statistical data from being incorrect because it is added to the statistical processing before all the divided data of each node 10 is collected.

  The pseudonym server 30 that has transmitted the pseudonym information from the statistical processing server 20 waits for a response to the statistical processing server 20 until a set of pseudonyms issued to a certain node 10 is prepared. After confirming that a set of a certain node 10 has been prepared, the kana server 30 returns an acknowledgment to the authenticated kana to the statistical processing server 20. Note that this may be a response that the statistical processing server 20 cannot uniquely identify the kana set, and after the statistical processing server 20 receives a sufficient amount of sample sets, it should not add to the statistics. A format in which the kana server 30 responds may be used. Further, when there is consideration for the sender, the statistical processing server 20 deposits the consideration in advance in the kana server 30, and the kana server 30 finishes paying in order from the node 10 in which the kana set is prepared while waiting for this response. Can be considered.

  The statistical processing server 20 performs statistical processing in the order in which an affirmative response is obtained from the kana server 30. When the number finally determined at the time of generating the query is reached, the process is terminated and statistical data is obtained.

  The fact that the histogram processing is correctly performed by receiving data actually divided from a plurality of nodes will be described with reference to FIGS. Now, consider obtaining the sex distribution of male node A and female node B without knowing the gender of the two. The processes from S201 to S206 shown in FIG. 6 are the same as those in the first embodiment.

  In the answer division shown in step S207 of FIG. 7, since there are two pseudonyms and the frequency distribution matrix of the gender that is obtained by the query, the nodes A and B are restored with their respective genders as sums. In this way, it is divided into two arbitrary values. In the confirmed kana notification shown in step S211, the kana server 30 knows that the current total number of samples is 2 at the time of issuance of the kana, so the end notification and the total number of samples are simultaneously transmitted to the statistical processing server 20. ing. Finally, the sum of each element of the matrix was obtained by the statistical processing shown in step S213, and it was confirmed that the statistical distribution server correctly obtained the frequency distribution although the genders of the nodes A and B were not known.

  The mode value can be obtained by classifying numerical values into several groups according to bin width when the variable is a continuous value. In the same way, an approximate value can be obtained depending on which group the median is included in. If it is a discrete value, an accurate mode value and median value can be obtained by making each numerical value one element of the matrix.

  For example, a query such as “average height of men and women in each prefecture” can be realized by combining the average of variables so far and a histogram. Each individual's information is expressed by expressing the matrix of each prefecture and the pair of men and women as a 47 x 2 matrix, entering the height in the corresponding matrix element part of the node, and setting the other elements to 0 . Since the histogram can be processed in this way, statistical analysis with a higher degree of freedom than the previous application can be performed.

  According to this embodiment, individual data including privacy cannot be restored by cooperation of a plurality of subjects, and not only the average and variance in the state where the owner of the data is anonymized, but also the measurement of the frequency distribution It becomes possible.

  The present invention can be applied to the information communication industry.

10: Node 11: Query processing unit 12: Data division unit 13: Data storage unit 20: Statistical processing server 21: Query generation unit 22: Answer collection / processing unit 30: Kana server 31: Kana issuer 32: Kana generation / management Unit 33: Kana confirmation unit 40: Query distribution server 41: Query storage unit

Claims (8)

In response to a kana issue request from a node, a kana set consisting of multiple kana is issued to the node, and when a kana notification is received from the statistical processing server, it is confirmed whether or not the kana received is included in the kana set. A kana server for notifying the statistical processing server that kana has been confirmed when all kana in the kana set has been notified;
Accumulating data whose source is the pseudonym issued by the pseudonym server, notifying the pseudonym server of the stored pseudonym, and receiving confirmation that the confirmation has been made, confirming the pseudonym of the accumulated data A statistical processing server that performs statistical processing using data with
An information distribution system comprising   The statistical processing server determines a calculation process for restoring the original data of the node, generates a query for requesting data that can be restored by the calculation process, and applies the calculation process to the accumulated data 2. The information distribution system according to claim 1, wherein the original data of the data is restored.   The said kana server notifies the said statistical processing server to the said statistical processing server by notifying that the kana which all kana of the kana set has not been notified has been notified to the said statistical processing server, The Claim 1 or 2 characterized by the above-mentioned. The information distribution system described.   The kana server does not issue a kana set until the number of nodes having a kana issue request reaches a predetermined number, and when the number of nodes having a kana issue request reaches a predetermined number, the kana set The information distribution system according to any one of claims 1 to 3, wherein the information distribution system is issued. A kana server that receives a kana issue request from a node and issues a kana set consisting of a plurality of kana to the node;
When the statistical processing server obtains the data having the kana as the transmission source, the kana and the data pair are accumulated, the kana is notified to the kana server, and the kana server is notified that the kana has been confirmed. And a statistical processing procedure for performing statistical processing using data having a confirmed pseudonym of the accumulated data as a transmission source,
The information distribution method which has in order. In the pseudonym issuing procedure, the statistical processing server determines a calculation process for restoring the original data of the node, generates a query for requesting data that can be restored by the calculation process,
6. The information distribution method according to claim 5, wherein in the statistical processing procedure, the statistical processing server restores the original data of the node by performing the arithmetic processing on the accumulated data.   In the statistical processing procedure, the kana server notifies the statistical processing server that the kana has been confirmed by notifying all the kana not yet notified of all kana in the kana set. 5. The information distribution method according to 5 or 6. In the kana issue procedure, the kana server does not issue the kana set until the number of nodes having a kana issue request reaches a predetermined number, and the number of nodes having a kana issue request is a predetermined number. The information distribution method according to any one of claims 5 to 7, wherein a kana set is issued when the value reaches.

Images