JP6283519B2 - Control device, control method, and control program - Google Patents

Description

  The present invention relates to a control device, a control method, and a control program.

  In recent years, the handling of personal information has become a problem due to the problem of information leakage and the enactment of the Personal Information Protection Law. Personal information is collected not only by public institutions but also by various companies. For example, a consumer who purchases a product or service (hereinafter sometimes referred to as “individual”) may register as a member when purchasing the product or service. At the time of membership registration, data such as an individual's name, age, gender, address, and e-mail address are usually registered (stored) in a company system in a state in which the data is associated with an individual ID assigned to the individual. . That is, the company system stores “personal information data”. Here, the “personal information data” includes, for example, a name, age, sex, address, e-mail address, and personal ID. Furthermore, every time an individual whose personal information data is already registered purchases a product or service, the company system stores information related to the purchased product or service in association with the ID of the individual. As a result, the company can use the collected personal information data for corporate activities.

  On the other hand, for example, a second company other than the first company that collected personal information data may desire to use the personal information data. That is, there is a possibility that the data collection entity and the data utilization entity are different. However, from the viewpoint of personal information protection, personal information data itself cannot be provided without obtaining personal permission. Therefore, it is considered that personal information data is converted into data in a state where an individual cannot be specified (hereinafter, sometimes referred to as “anonymized data”) and anonymized data is used.

JP 2003-196391 A

Computer Security Symposium 2009 (CSS2009) Proceedings, page 1-6, “Expansion to probabilistic index of k-anonymity and its application example”, 2011-10-12

  However, in the conventional technology for providing and using anonymized data, the anonymized data reaches a level (ie, “anonymity target level”) in which the risk of identifying an individual (ie, “personal identification risk”) is sufficiently reduced. There is a possibility that it is provided as a usage target in a state where it is not.

  The disclosed technology has been made in view of the above, and an object thereof is to provide a control device, a control method, and a control program that can reduce the personal identification risk of anonymized data that is a usage target. To do.

  In the aspect of an indication, the control device which controls utilization of anonymization data has an acquisition part and a selection part. The acquisition unit acquires anonymized data obtained by anonymizing personal information data including at least one item value related to personal information according to an abstract pattern. When the abstraction pattern corresponding to the acquired anonymized data satisfies the anonymity requirement based on k-anonymity, the selecting unit selects the acquired anonymized data as a candidate for use target data.

  According to the aspect of an indication, the individual specific risk of the anonymization data which is a utilization object can be reduced.

FIG. 1 is a block diagram illustrating an example of a control device according to the first embodiment. FIG. 2 is a diagram for explaining an example of calculating a risk index. FIG. 3 is a flowchart illustrating an example of a processing operation of the control device according to the first embodiment. FIG. 4 is a block diagram illustrating an example of a control device according to the second embodiment. FIG. 5 is a diagram for explaining the qualitative index of the second embodiment. FIG. 6 is a diagram for explaining the state of anonymized data. FIG. 7 is a block diagram illustrating an example of a control device according to the third embodiment. FIG. 8 is a diagram illustrating an example of a system for using anonymized data according to the fourth embodiment. FIG. 9 is a diagram illustrating an example of the personal information table. FIG. 10 is a diagram for explaining the abstraction pattern. FIG. 11 is a diagram illustrating an example of the anonymization data table. FIG. 12 is a diagram illustrating an example of the identification information correspondence table. FIG. 13 is a diagram for explaining the abstraction pattern selection processing. FIG. 14 is a diagram illustrating an example of a usage pattern candidate table. FIG. 15 is a flowchart illustrating an example of a processing operation of the control device according to the fourth embodiment. FIG. 16 is a flowchart illustrating an example of a processing operation of the control device according to the fourth embodiment. FIG. 17 is a diagram illustrating an example of the anonymized data use system according to the fifth embodiment. FIG. 18 is a diagram illustrating an example of a public table. FIG. 19 is a flowchart illustrating an example of a processing operation of the control device according to the fifth embodiment. FIG. 20 is a flowchart illustrating an example of a processing operation of the control device according to the fifth embodiment. FIG. 21 is a diagram illustrating a hardware configuration example of the control device.

  Hereinafter, embodiments of a control device, a control method, and a control program disclosed in the present application will be described in detail with reference to the drawings. In addition, the control apparatus, the control method, and the control program which this application discloses are not limited by this embodiment. Moreover, the same code | symbol is attached | subjected to the structure which has the same function in embodiment, and the overlapping description is abbreviate | omitted. Further, in the embodiment, the same processing steps are denoted by the same reference numerals, and redundant description is omitted.

[Example 1]
[Configuration example of control device]
FIG. 1 is a block diagram illustrating an example of a control device according to the first embodiment (for example, see FIG. 11 described later). In FIG. 1, the control device 10 includes a storage unit 11, an acquisition unit 12, and a selection unit 13.

  The storage unit 11 stores an “anonymized data table”. In the “anonymized data table”, “anonymized data group” is stored. The “anonymization data group” includes a plurality of anonymization data obtained by abstracting personal information data based on a plurality of “abstraction patterns” for item values. For example, personal information including individual IDs and item values corresponding to the items age and gender, personal ID “111”, age item value “18 years”, and gender item value “male” In the case of data, in the “anonymized data group”, anonymized data corresponding to the individual with the personal ID “111” includes “10's, male”, “10's and below, male”, “student, male”, etc. include. Here, “teens and men”, “teens and unders, men”, and “students and men” are different “abstraction patterns”. That is, in the case of personal information data whose personal ID is “111”, age “18 years”, and sex “male”, the anonymized data abstracted by the first abstract pattern “10th male” is personal ID data. The data is “teen, male” corresponding to “111”. Further, the anonymization data abstracted by the second abstraction pattern “10 or younger, male” becomes data “10 or younger, male” corresponding to the personal ID “111”. Further, the anonymized data abstracted by the third abstraction pattern “student, male” becomes data “student, male” corresponding to the personal ID “111”. In the “anonymized data table”, a different number (that is, “anonymized data identification information”) is assigned to each anonymized data.

  The acquisition unit 12 acquires the anonymized data group stored in the storage unit 11 and outputs the acquired anonymized data group to the selection unit 13.

  The selection unit 13 selects anonymized data corresponding to an abstract pattern that satisfies the “anonymity requirement” among a plurality of abstract patterns as candidates for “use target data”. That is, the selection unit 13 identifies an abstract pattern that satisfies the “anonymity requirement” among a plurality of abstract patterns as a candidate for “use pattern”. Then, the selection unit 13 selects anonymized data corresponding to the specified usage pattern candidate as a usage target data candidate. Here, the “anonymity requirement” is based on at least “k-anonymity”. Furthermore, the “anonymity requirement” may be based on at least one of “l-diversity” and “Pk-anonymity” in addition to k-anonymity. The selection unit 13 may cause the storage unit 11 to store a “pattern correspondence table” that is stored in association with the identification information of the usage pattern candidate and the identification information of the anonymized data anonymized by the candidate. Further, the selection unit 13 causes the storage unit 11 to store a “use pattern candidate table” that stores identification information of use pattern candidates and personal IDs of personal information data corresponding to the use pattern candidates in association with each other. (For example, refer to FIG. 14 described later).

  For example, when the “anonymity requirement” is based only on “k-anonymity”, the “anonymity requirement” is “the number of anonymization data corresponding to the abstract pattern is equal to or greater than the“ first threshold ””. . In this case, the selection unit 13 compares the number of anonymized data corresponding to each abstract pattern with the first threshold value, and selects an abstract pattern whose number is equal to or greater than the first threshold as a candidate for “use pattern”. And the anonymized data corresponding to the usage pattern candidate is selected as a candidate for “use target data”. Note that “k-anonymity” refers to a state where there are k or more individuals having the same attribute. Further, “l-diversity” refers to a state where there are at least 1 or more combinations of attributes. “Pk-anonymity” refers to a state in which an individual cannot be hit with a probability of 1 / k or more from personal information data.

  Further, for example, when the “anonymity requirement” is based on k-anonymity, l-diversity, and Pk-anonymity, the “anonymity requirement” indicates that the “risk index” representing the individual identification risk is “second threshold value”. "Being below". For example, the “risk index” is based on a probability value for identifying an individual calculated for each of k-anonymity, l-diversity, and Pk-anonymity in a risk calculation unit (not shown). Is calculated. In this case, the selection unit 13 compares the risk index of the anonymized data corresponding to each abstract pattern with the second threshold value, and selects an abstract pattern whose risk index is equal to or less than the second threshold value as the “use pattern”. While selecting as a candidate, the anonymization data corresponding to the candidate of a utilization pattern are selected as a candidate of "utilization object data".

FIG. 2 is a diagram for explaining an example of calculating a risk index. FIG. 2 shows respective values of k-anonymity, l-diversity, and Pk-anonymity corresponding to a certain abstraction pattern. For example, for k-anonymity, the value of k-anonymity (that is, the number of occurrences) corresponding to the abstract pattern is 10. That is, it shows that there are 10 anonymized data corresponding to the abstract pattern. Therefore, in this case, the probability value that the individual is specified is 1/10 = 10%. The l-diversity value for the abstraction pattern is 3. That is, it shows that there are three anonymized data for the abstraction pattern (including a plurality of items). Therefore, in this case, the probability value that the individual is specified is 1/3 = 33%. In addition, the value of Pk-anonymity corresponding to the abstract pattern is 2%, and the probability value that an individual is specified is 1%. Here, the “priority” in FIG. 2 is a “weighting coefficient” for each of k-anonymity, l-diversity, and Pk-anonymity. Therefore, the risk index in the case of FIG. 2 can be calculated as follows.
Risk index value = (1/10 × 0.8) + (1/3 × 0.2) = 0.1467

  Here, FIG. 2 shows an upper limit value (logical maximum value in FIG. 2) and a lower limit value (in FIG. 2) that can take values of k-anonymity, l-diversity, and Pk-anonymity. , Lower threshold).

[Control device operation example]
An example of the processing operation of the control device having the above configuration will be described. FIG. 3 is a flowchart illustrating an example of a processing operation of the control device according to the first embodiment.

  In the control device 10, the acquisition unit 12 acquires an anonymized data group (step S101).

  The selection unit 13 determines whether or not anonymity requirements are satisfied for each abstraction pattern (step S102).

  The selection unit 13 selects anonymized data corresponding to the abstract pattern that satisfies the anonymization requirement as a candidate for use target data (step S103).

  As described above, according to the present embodiment, in the control device 10, the acquisition unit 12 acquires an anonymized data group. And the selection part 13 selects the anonymization data corresponding to the abstract pattern which satisfy | filled the anonymity requirement among several abstract patterns as a candidate of utilization object data.

  With the configuration of the control device 10, only anonymized data corresponding to an abstract pattern that satisfies the anonymity requirement can be used as a candidate for use target data. That is, the “anonymization filter” can be applied at the stage prior to the provision and use of anonymized data. Thereby, an individual specific risk can be reduced.

  Anonymity requirements are based at least on k-anonymity. Furthermore, the anonymity requirement may be based on at least one of l-diversity and Pk-anonymity in addition to k-anonymity.

  When the anonymity requirement is based only on k-anonymity, the anonymization requirement may be that the number of anonymization data corresponding to the abstract pattern is equal to or greater than a first threshold value.

  Further, when the anonymity requirement is based on k-anonymity, l-diversity, and Pk-anonymity, the anonymity requirement may be that a risk index representing an individual identification risk is equal to or less than a second threshold value. . For example, the risk index is calculated based on a probability value for identifying an individual calculated for each of k-anonymity, l-diversity, and Pk-anonymity in a risk calculation unit (not shown). May be.

  In the above description, the description has been made on the assumption that the anonymization data table is stored in the control device 10, but the present invention is not limited to this. For example, the anonymization data table may be stored in a device separate from the control device 10 (for example, a device such as a company that is a collection subject of personal information data).

[Example 2]
The second embodiment relates to a process for determining the use target data candidate selected in the first embodiment as the use target data.

  FIG. 4 is a block diagram illustrating an example of a control device according to the second embodiment. In FIG. 4, the control device 20 includes a determination unit 21 and an output control unit 22.

  When the use target data candidate selected by the selection unit 13 satisfies the “use requirement”, the determination unit 21 determines the use target data candidate as “use target data”.

  “Usage requirements” include, for example, “moral requirements”. The “moral requirement” includes, for example, at least one of the attribute of the user of the anonymized data and the usage mode by the user of the anonymized data. In addition, as a “moral requirement”, companies that prohibit the use of anonymized data may be defined. For example, when the user attribute is customs business or the like, the usage requirement is not satisfied, and the candidate for the usage target data is not used as the usage target data for the user. Also, when the usage mode by the user is adult-related advertisement delivery or the like, the usage requirements are not satisfied, and the usage target data candidate is not used as the usage target data for the user.

  In addition, as a parameter of “use requirements”, “qualitative indicators” obtained from questionnaire results of users or third parties (including lawyers) and reputations on the Internet (may include the number of customer complaints) May be used. FIG. 5 is a diagram for explaining the qualitative index of the second embodiment.

  The “qualitative index table” in FIG. 5 includes “opinion listener”, “number of people”, “frequency”, “confirmation”, “lower limit setting”, “current value”, and “priority” as items. .

  In the qualitative index table of FIG. 5, as “listeners”, “law scholars / researchers”, “sensitive customers”, “normal users”, “other than their own customers”, “Facebook (registered trademark)” "The number of comments on the corresponding page of" and "tweets including the corresponding product of Twitter (registered trademark)".

  When paying attention to “law scholars / researchers”, the item value “10 people” of “number of people” means that the number of “law scholars / researchers” who answered the questionnaire is ten. In addition, the item value of “frequency” “once / month” indicates that the questionnaire is executed once a month. In addition, the “non-permission rate” which is the item value of “confirmation” is the item value of “current value”, which is the ratio of the number of people who answered that the target user is not allowed to use anonymized data It is shown that. In addition, “6 people”, which is the item value of “lower limit setting”, is the minimum necessary value for questionnaire respondents. If the number is below 6, the anonymized data is temporarily provided to the user. Stopped. The “priority” is a weighting coefficient for the item value “current value”. That is, in the table of FIG. 5, the importance is low in the order of “law scholar / researcher”, “sensitive customer”, “normal user”, and “other than own customer”. Various settings can be performed by adjusting the priority. The number of negative comments corresponding to “the number of comments on the relevant page of Facebook (registered trademark)” and “tweet including the corresponding product of Twitter (registered trademark)” is collected by cloning, and data mining for that number is performed. The result is the item value of “current value”.

  In addition, the parameter of “use requirement” may include, for example, “k-minimum target value of anonymity” specified in advance by a candidate user of anonymized data. That is, even if it is a candidate for the usage target data, the k-anonymity value of the abstract pattern corresponding to the usage target data candidate is smaller than the “k-minimum anonymity target value” specified by the user candidate. In this case, the use target data candidate is not used as the use target data for the user candidate. That is, “use requirement” is that “the k-anonymity value of the abstraction pattern corresponding to the candidate for use target data is not less than the minimum target value of k-anonymity specified by the user candidate”. .

  Further, the “use requirement” parameter may include, for example, the “value” of the abstract pattern corresponding to the use target data candidate. This “value” is calculated, for example, by a value calculation unit (not shown) of the control device 20 based on the number of accesses or clicks on the Internet for each item value constituting the abstract pattern. The For example, “being a candidate for use target data corresponding to an abstract pattern with the highest calculated value” is a “use requirement”.

  Further, the “use requirement” parameter may include a “use desired abstraction pattern” designated in advance by a candidate user of anonymized data. That is, “use requirement data candidate corresponding to the use desired abstraction pattern” is the “use requirement”.

  Note that the plurality of usage requirements exemplified above may be used alone or in any combination. In addition, when there are a plurality of anonymized data that are usage target data for one individual, the determination unit 21 determines the most detailed, that is, the anonymization data corresponding to the abstract pattern whose item value is a subordinate concept as the usage target data. do it.

  Returning to the description of FIG. 4, the output control unit 22 performs output control of “information” corresponding to the “user usage mode” corresponding to the usage target data determined by the determination unit 21.

  For example, when the user has designated “advertising delivery” as the usage mode in advance, the output control unit 22 pre-selects the individual corresponding to the usage target data determined by the determination unit 21 from the user. Control for notifying information (for example, advertisements, coupons, etc.) acquired in is performed. For example, a “personal information table” is stored in the storage unit 11 (see, for example, FIG. 9 described later). The “personal information table” stores personal information data that is the source of anonymized data. Each personal information data includes, for example, a personal ID and at least one item value related to personal information. For example, a personal mail address is included as one of the item values. Further, for example, the storage unit 11 stores an “identification information correspondence table” that stores the personal ID and the anonymized data identification information in association with each other (see, for example, FIG. 12 described later). And the output control part 22 specifies the identification information of the utilization object data determined by the determination part 21 using said anonymization data table. And the output control part 22 specifies personal ID corresponding to the identification information of the specified utilization object data using an identification information corresponding table. And the output control part 22 transmits an advertisement using the mail address corresponding to the specified personal ID.

  For example, when the user has designated “distribution of anonymized data” as the usage mode in advance, the output control unit 22 transmits the usage target data to the terminal of the user.

  Note that the output control unit 22 may cause the storage unit 11 to store log information including the k-anonymity value of the abstract pattern corresponding to the actually used usage target data and the user identification information.

  As described above, according to the present embodiment, in the control device 20, the determination unit 21 determines that the usage target selected by the selection unit 13 satisfies the “use requirement”, and the usage selected by the selection unit 13. Target data candidates are determined as use target data.

  With this configuration of the control device 20, since only the candidates for the usage target data that satisfy the usage requirements in addition to the anonymous requirements can be used as the usage target data, the risks of individuals and users in the use of anonymized data are reduced. Can be made.

  Here, according to the control device 20 of the second embodiment, for example, as shown in FIG. 6, the anonymized data is converted into “legal / moral violation state”, “legal high risk state”, “moral high risk”. It can be classified into six states: “risk state”, “individual specific high risk state”, “moral violation state”, and “available state”. Only anonymized data classified as “available state” can be used as usable data.

[Example 3]
The third embodiment relates to a process of determining the usage target data candidates selected in the first and second embodiments as usage target data in an auction format.

  FIG. 7 is a block diagram illustrating an example of a control device according to the third embodiment. In FIG. 7, the control device 30 includes an auction control unit 31.

  The auction control unit 31 performs control for disclosing information on the abstract pattern corresponding to the usage target data selected by the selection unit 13 (that is, the usage pattern candidate) to the user candidates as auction target information. Do. For example, when accessed from a user candidate terminal, the auction control unit 31 performs control to display a “public table” on the user candidate terminal. The “public table” includes, for example, “abstract pattern”, “abstract pattern number”, and “k-anonymity value” as items (see, for example, FIG. 18 described later). That is, in the “public table”, a plurality of abstraction patterns respectively corresponding to a plurality of candidates for use target data selected by the selection unit 13, identification information and k-anonymity values corresponding to each abstraction pattern, and Are associated.

  Then, the auction control unit 31 performs a bid acceptance process for accepting a bid for each abstract pattern (that is, each auction target) that has been released, and makes the user candidate with the highest bid amount bid for that auction target for each auction target. .

  Then, if the candidate for use target data selected by the selection unit 13 corresponding to the auction target for which a successful bid is satisfied satisfies the “use requirement”, the auction control unit 31 selects the use target data candidate as the use target data. Determine as. The auction control unit 31 specifies anonymized data corresponding to the abstract pattern that has been awarded using the identification information of the abstract pattern that has been awarded and the pattern correspondence table, and uses the anonymized data. May be determined as In addition, the auction control unit 31 associates the identification information of the abstract pattern that has been awarded, the identification information of the user who has made a successful bid, and the identification information of the usage mode designated by the user. May be stored in the storage unit 11.

  Here, as the “use requirement” of the auction control unit 31, the one described in the second embodiment can be used.

  Then, the output control unit 22 performs output control of “information” corresponding to the “user usage mode” corresponding to the usage target data determined by the auction control unit 31.

  As described above, according to the present embodiment, in the control device 30, the auction control unit 31 uses the information related to the abstract pattern corresponding to the use target data candidate selected by the selection unit 13 as the user candidate information as the user candidate information. And make the auction target a successful bid for the user candidate.

  With this configuration of the control device 30, only the abstract pattern that satisfies the anonymity requirement can be disclosed as an auction target, so that the personal identification risk in the auction can be reduced.

  In addition, when the candidate for the usage target data selected by the selection unit 13 corresponding to the auction target for which a successful bid is made satisfies the usage requirements, the auction control unit 31 selects the usage target data candidate selected by the selection unit 13 as It is determined as usage target data.

  Since the configuration of the control device 30 can use only the candidate for the usage target data that satisfies the usage requirement in addition to the anonymous requirement as the usage target data, the risk of individuals and users in using the anonymized data can be reduced. Can be reduced.

[Example 4]
The fourth embodiment relates to a specific usage mode example of the anonymization filter described in the second embodiment.

[Outline of the system used]
FIG. 8 is a diagram illustrating an example of a system for using anonymized data according to the fourth embodiment. In FIG. 8, the usage system 100 includes a control device 120, a collection system 130 that collects personal information data, and a terminal 150. The control device 120 corresponds to the control device 20 described in the second embodiment, and has basically the same function as the control device 20. The collection system 130 is a system installed in a hospital, for example. The terminal 150 is a terminal of a candidate user for anonymized data. In FIG. 8, one collection system 130 and one terminal 150 are shown, but this number is not limited to this. That is, the usage system 100 may include two or more collection systems 130 and two terminals 150, respectively. In the following description, it is assumed that the collection system 130 is a system installed in a hospital.

  First, in the collection system 130, personal information data groups (for example, medical record information data) are anonymized according to a plurality of abstract patterns to be anonymized data groups. This anonymized data group is provided to the control device 120.

  And the control apparatus 120 determines utilization object data using the anonymization data group provided from the collection system 130. FIG.

  Then, the control device 120 performs output control of “information” corresponding to the “user usage mode” corresponding to the determined usage target data.

  For example, when the “use mode of anonymized data” designated from the terminal 150 is “advertising delivery”, the control device 120 gives the individual corresponding to the determined use target data from the user in advance. Control to notify the acquired information (that is, advertisement) is performed.

  In addition, when the “use mode of anonymized data” designated from the terminal 150 is “distribution of anonymized data”, the control device 120 transmits the usage target data to the terminal 150.

  After the above-described operation processing (hereinafter, this operation processing may be referred to as “batch processing”), patient reception processing may be performed by a reception device 136 described later of the collection system 130. In this case, the personal ID of the patient for which the reception process has been performed is provided to the control device 120.

  And the control apparatus 120 specifies the utilization object data corresponding to the provided personal ID. Then, the control device 120 performs output control of “information” corresponding to the “user usage mode” corresponding to the specified usage target data. For example, when the “use mode of anonymized data” specified from the terminal 150 is “advertisement delivery”, the control device 120 sends an advertisement to a receipt that is output at the time of patient settlement from a later-described settlement device 137 of the collection system 130. Performs control to print. Further, as an advertisement distribution mode, for example, the advertisement may be displayed on a signage that is disposed in a settlement apparatus 137 described later or installed near the installation location of the settlement apparatus 137 described later. A series of processing performed after the batch processing described here may be referred to as “real-time processing” below.

[Example of collection system configuration]
In FIG. 8, the collection system 130 includes a personal information table 131, an anonymization processing unit 132, an anonymization data table 133, an identification information correspondence table 134, an interface (IF) 135, an accepting device 136, and a checkout device. 137.

  The personal information table 131 stores personal information data groups. FIG. 9 is a diagram illustrating an example of the personal information table. The personal information table shown in FIG. 9 includes “personal ID”, “name”, “age”, “sex”, “address”, “disease name”, and “mail address” as items.

  The anonymization processing unit 132 abstracts the personal information data in the personal information table 131 based on a plurality of “abstraction patterns” to form an anonymization data group. The plurality of abstraction patterns can be represented by, for example, a “tree structure” as shown in FIG. FIG. 10 is a diagram for explaining the abstraction pattern. The formed anonymized data group is stored in the anonymized data table 133. The correspondence relationship between the personal ID of the personal information data and the identification information of the anonymized data formed from the personal information data is stored in the identification information correspondence table 134.

  FIG. 11 is a diagram illustrating an example of the anonymization data table. FIG. 12 is a diagram illustrating an example of the identification information correspondence table. In FIG. 12, three anonymized data of anonymized data numbers 0001-0003 are formed from personal information data of personal ID “0001”.

  The correspondence stored in the anonymized data group stored in the anonymized data table 133 and the identification information correspondence table 134 is provided to the control device 120 via the IF 135.

  The accepting device 136 executes a patient accepting process. Then, the reception device 136 provides the personal ID of the patient who has performed the reception process to the control device 120 via the IF 135.

  The settlement apparatus 137 executes a patient settlement process. When the settlement apparatus 137 receives an advertisement output command and an advertisement corresponding to the personal ID from the control apparatus 120, the settlement apparatus 137 prints the advertisement on a receipt.

[Configuration example of control device]
In FIG. 8, the control device 120 includes IFs 15 and 16, a storage unit 11, an acquisition unit 12, a selection unit 13, a determination unit 21, and an output control unit 22.

  The storage unit 11 receives and stores the anonymized data table and the identification information correspondence table transmitted from the collection system 130 via the IF 15.

  The acquisition unit 12 acquires the anonymized data group from the storage unit 11 and outputs the acquired anonymized data group to the selection unit 13.

  The selection unit 13 specifies an abstract pattern having a corresponding number of anonymized data, that is, a k-anonymity value (k value) equal to or greater than the “first threshold value” as a candidate for use pattern. For example, when the number of each abstraction pattern is as shown in FIG. 13 and the first threshold is 10, the abstraction pattern of the abstraction pattern identification information “0003” is regarded as a usage pattern candidate. The FIG. 13 is a diagram for explaining the abstraction pattern selection processing.

  In addition, the selection unit 13 causes the storage unit 11 to store a “use pattern candidate table” that stores the identification information of the use pattern candidates and the personal ID of the personal information data corresponding to the use pattern candidates in association with each other. FIG. 14 is a diagram illustrating an example of a usage pattern candidate table. The abstract pattern corresponding to the identification information “0003” of the usage pattern candidate corresponds to the anonymized data of the anonymized data number “0003”, and the anonymized data corresponds to the personal information data of the personal ID “0001”. To do. Therefore, in the usage pattern candidate table of FIG. 14, the personal information ID “0001” and the usage pattern candidate identification information “0003” are associated with each other.

  When the use target data candidate selected by the selection unit 13 satisfies the “use requirement”, the determination unit 21 determines the use target data candidate as “use target data”.

  Further, the determination unit 21 receives specification of usage requirements such as “minimum target value of k-anonymity” and “use desired abstraction pattern” and “user usage mode” from the terminal 150 via the IF 16. .

  The output control unit 22 performs output control of “information” corresponding to the “user usage mode” corresponding to the usage target data determined by the determination unit 21.

  For example, when the “use mode of anonymized data” designated from the terminal 150 is “advertisement delivery”, the output control unit 22 gives advance notification to the individual corresponding to the determined use target data from the user. Control to notify the information (that is, the advertisement) acquired in is performed.

  The output control unit 22 transmits the usage target data to the terminal 150 when the “use mode of anonymized data” designated from the terminal 150 is “distribution of anonymized data”.

[Example of system operation]
A processing operation example of the usage system 100 having the above configuration will be described. 15 and 16 are flowcharts illustrating an example of the processing operation of the control device according to the fourth embodiment.

  In the control device 120, the determination unit 21 executes a use request acceptance process (step S201). For example, the terminal 150 transmits a “use request signal” of a user candidate to the control device 120. The “usage request signal” includes, for example, information on the desired usage abstraction pattern and information on the usage mode. The determination unit 21 receives the usage request signal transmitted from the terminal 150 via the IF 16. And the determination part 21 memorize | stores the identification information of the user candidate who is a transmission source, the identification information of a utilization-desired abstraction pattern, and the information of a usage mode in association. The usage request signal may further include the contents of advertisements and coupons.

<Batch processing>
The acquisition unit 12 acquires an anonymized data group (step S202).

  The selection unit 13 counts the number of anonymized data corresponding to each abstract pattern in the anonymized data group acquired by the acquisition unit 12 (step S203).

  The selection unit 13 selects a usage pattern candidate and a usage target data candidate based on the counted existence number (step S204). For example, the selection unit 13 selects an abstract pattern whose counted existence number is equal to or more than a first threshold as a usage pattern candidate. Then, the selection unit 13 selects anonymized data corresponding to the usage pattern candidate as a usage target pattern candidate.

  The selection unit 13 updates the “use pattern candidate table” (step S205). As described above, the “use pattern candidate table” stores the use pattern candidate identification information and the personal ID of the personal information data corresponding to the use pattern candidate in association with each other.

  When the use target data candidate selected by the selection unit 13 satisfies the “use requirement”, the determination unit 21 determines the use target data candidate as “use target data” (step S206). Here, to simplify the description, it is assumed that the “use requirement” is only the “use desired abstraction pattern” accepted in step S201. In this case, the determination unit 21 determines the usage target data candidate corresponding to the usage pattern candidate that matches the usage abstraction pattern as the usage target data.

  The output control unit 22 uses the usage target data determined by the determination unit 21 (step S207). For example, when the user has designated “distribution of anonymized data” in advance as the usage mode, the output control unit 22 transmits the usage target data to the terminal 150 of the user. To do.

<Real-time processing>
The above batch processing is executed before the real time processing is executed.

  In the control device 120, the acquisition unit 12 acquires the personal ID of the patient for which the reception process has been performed in the collection system 130 (step S301).

  Based on the personal ID acquired by the acquisition unit 12 and the usage pattern candidate table, the determination unit 21 selects a usage pattern candidate corresponding to the personal ID (step S302).

  When the selected usage pattern candidate matches the usage desired abstraction pattern, the determination unit 21 determines a usage target data candidate corresponding to the usage pattern candidate as usage target data (step S303).

  The output control unit 22 executes use of the usage target data determined by the determination unit 21 (step S304). For example, when the user has designated “advertisement distribution” as the usage mode in advance, the output control unit 22 transmits the advertisement information together with the personal ID to the settlement apparatus 137 via the IF 15 and IF 135. Thereby, for example, an advertisement can be printed on a receipt that is output when the patient is settled.

  For example, if a taxi agent candidate specifies an abstraction pattern that includes an item value of “lower body fracture” as an abstraction pattern that he / she wishes to use, the receipt will say “How about using a taxi on the way home? An advertisement such as “taxi company phone number yyy-456-7899” can be printed.

[Example 5]
Example 5 relates to a specific usage example of an auction related to anonymized data described in Example 3. The basic configuration of the usage system of the fifth embodiment is the same as that of the usage system 100 of the fourth embodiment. The difference between the fourth embodiment and the fifth embodiment is mainly the processing operation of the auction control unit in the control device.

  FIG. 17 is a diagram illustrating an example of the anonymized data use system according to the fifth embodiment. In FIG. 17, the usage system 200 includes a control device 230. The control device 230 corresponds to the control device 30 described in the third embodiment, and has basically the same function as the control device 30.

  In FIG. 17, the control device 230 includes an auction control unit 31.

  The auction control unit 31 performs control for disclosing information on the abstract pattern corresponding to the usage target data selected by the selection unit 13 (that is, the usage pattern candidate) to the user candidates as auction target information. Do. For example, when accessed from a user candidate terminal, the auction control unit 31 performs control to display a “public table” on the user candidate terminal. FIG. 18 is a diagram illustrating an example of a public table. As illustrated in FIG. 18, the public table includes an abstract pattern number, an abstract pattern, and the number of existence (that is, k-anonymity value). The public table shown in FIG. 18 further includes the number of accesses, the number of clicks, and the price.

  And the auction control part 31 performs the bid reception process which receives the bid with respect to each open | released abstract pattern (namely, each auction object). Then, the auction control unit 31 causes the user candidate with the highest bid amount to make a successful bid for each auction target.

  Then, the auction control unit 31 associates the identification information of the abstract pattern that has been awarded, the identification information of the user who has made a successful bid, and the identification information of the usage mode designated by the user. Is stored in the storage unit 11.

  Then, if the candidate for use target data selected by the selection unit 13 corresponding to the auction target for which a successful bid is satisfied satisfies the “use requirement”, the auction control unit 31 selects the use target data candidate as the use target data. Determine as.

  A processing operation example of the usage system 200 having the above configuration will be described.

<Batch processing>
FIG. 19 is a flowchart illustrating an example of a processing operation of the control device according to the fifth embodiment. The processing steps from step S202 to step S205 in FIG. 19 are equivalent to the processing steps in FIG. FIG. 19 corresponds to so-called batch processing.

  The auction control unit 31 discloses information on the abstract pattern corresponding to the usage target data candidate selected by the selection unit 13 to the user candidates as auction target information (step S401).

  The auction control unit 31 accepts a bid for each abstract pattern (that is, each auction target) disclosed (step S402).

  The auction control unit 31 determines the winning bidder for each auction target (step S403). For example, the auction control unit 31 causes the user candidate with the highest bid amount to make a successful bid for each auction target.

  The auction control unit 31 updates the “successful bid pattern table” (step S404). As described above, the “successful bid pattern table” stores the identification information of the abstract pattern that has been awarded, the identification information of the user who has made a successful bid, and the identification information of the usage mode designated by the user. doing.

  When the use target data candidate selected by the selection unit 13 corresponding to the successful bid auction target satisfies the “use requirement”, the auction control unit 31 determines the use target data candidate as the use target data. (Step S405).

  The output control unit 22 uses the usage target data determined by the auction control unit 31 (step S406).

<Real-time processing>
The above batch processing is executed before the real time processing is executed. FIG. 20 is a flowchart illustrating an example of a processing operation of the control device according to the fifth embodiment. FIG. 20 corresponds to so-called real-time processing.

  In the control device 230, the acquisition unit 12 acquires the personal ID of the patient for which the reception process has been performed in the collection system 130 (step S501).

  The auction control unit 31 selects a usage pattern candidate corresponding to the personal ID based on the personal ID acquired by the acquisition unit 12 and the usage pattern candidate table (step S502).

  The auction control unit 31 determines use target data candidates corresponding to the use pattern candidates stored in the successful bid pattern table among the selected use pattern candidates as the use target data (step S503).

  The output control unit 22 executes use of the usage target data determined by the auction control unit 31 (step S504).

[Other embodiments]
[1] In the fourth and fifth embodiments, the collection system is described as a hospital system. However, the present invention is not limited to this. For example, it may be a supermarket system. And the information regarding the product which the customer (individual) purchased or the product which purchase is considered is transmitted to the control device via the Internet, and the control device performs a control process for notifying a recipe or a bargain sale advertisement of other companies. Also good.

  [2] In the first to fifth embodiments, the items of personal information data are items that are substantially fixed, that is, items that hardly change, but are not limited thereto. For example, personal location information or shopping history information may be used.

  [3] Each component of each part illustrated in the first to fifth embodiments does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each part is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed / integrated in arbitrary units according to various loads and usage conditions. Can be configured.

  Furthermore, various processing functions performed in each device are performed on a CPU (Central Processing Unit) (or a microcomputer such as an MPU (Micro Processing Unit), MCU (Micro Controller Unit), etc.) in whole or in part. You may make it perform. Various processing functions may be executed entirely or arbitrarily on a program that is analyzed and executed by a CPU (or a microcomputer such as an MPU or MCU) or hardware based on wired logic. .

  The control devices according to the first to fifth embodiments can be realized by the following hardware configuration, for example.

  FIG. 21 is a diagram illustrating a hardware configuration example of the control device. As illustrated in FIG. 21, the control device 300 includes a processor 301, a memory 302, and an IF 303.

  Examples of the processor 301 include a central processing unit (CPU), a digital signal processor (DSP), and a field programmable gate array (FPGA). Further, examples of the memory 302 include a RAM (Random Access Memory) such as an SDRAM (Synchronous Dynamic Random Access Memory), a ROM (Read Only Memory), a flash memory, and the like.

  Various processing functions performed by the control device according to the first to fifth embodiments may be realized by executing a program stored in various memories such as a nonvolatile storage medium using a processor included in the control device. That is, a program corresponding to each process executed by the acquisition unit 12, the selection unit 13, the determination unit 21, the output control unit 22, and the auction control unit 31 is recorded in the memory 302. May be executed. The storage unit 11 is realized by the memory 302. The IFs 15 and 16 are realized by the IF 303.

10, 20, 30 Control device 11 Storage unit 12 Acquisition unit 13 Selection unit 16, 15, 135 IF
21 decision unit 22 output control unit 31 auction control unit 100, 200 utilization system 120, 230 control device 130 collection system 131 personal information table 132 anonymization processing unit 133 anonymization data table 134 identification information correspondence table 136 reception device 137 settlement device 150 Terminal

Claims (11)

A control device that controls the use of anonymized data,
An acquisition unit that acquires anonymized data in which personal information data including at least one item value related to personal information is anonymized according to an abstraction pattern;
When the abstraction pattern corresponding to the acquired anonymized data satisfies the anonymity requirement based on k-anonymity, a selection unit that selects the acquired anonymized data as a candidate for use target data;
A control device comprising: The acquisition unit acquires an anonymized data group,
The anonymized data group includes a plurality of anonymized data obtained by abstracting personal information data based on a plurality of abstraction patterns for item values,
The selection unit selects anonymization data corresponding to an abstraction pattern that satisfies the anonymity requirement among the plurality of abstraction patterns as a candidate for the usage target data;
The control device according to claim 1.   2. The method according to claim 1, further comprising a determination unit that determines the selected candidate for use target data as the use target data when the selected candidate for use target data satisfies a use requirement. 2. The control device according to 2.   Information regarding an abstraction pattern corresponding to the selected candidate for use target data is disclosed to the user candidate as auction target information, the user candidate is made a successful bid, and the auction target for which a bid is made The auction control unit may further comprise an auction control unit that determines the selected use target data candidate as the use target data when the selected use target data candidate satisfies a use requirement. The control device according to 1 or 2.   The output control part which alert | reports the information acquired from the user of the determined utilization target data with respect to the individual corresponding to the determined utilization target data is further provided. Control device.   The control apparatus according to claim 3, further comprising an output control unit that transmits the determined usage target data to a user terminal corresponding to the determined usage target data. The anonymity requirement is based on at least one of l-diversity and Pk-anonymity in addition to the k-anonymity.
The control device according to claim 1, wherein the control device is a control device. A probability value for identifying an individual for each of the k-anonymity, the l-diversity, and the Pk-anonymity is calculated, and a risk index for identifying the individual is calculated based on the calculated probability value. Further comprising a calculation unit for calculating as an anonymous requirement,
The selection unit determines that the anonymity requirement is satisfied when the calculated risk index is equal to or less than a threshold value,
The control device according to claim 7 . The usage requirement includes a moral requirement including an attribute of a user of the anonymized data and at least one of usage modes by the user of the anonymized data.
The control device according to claim 3 or 4, wherein A control method for controlling the use of anonymized data,
The computer acquires anonymized data in which personal information data including at least one item value is anonymized according to an abstract pattern,
The computer determines whether the acquired anonymized data satisfies anonymity requirements based on k-anonymity,
When it is determined that the computer satisfies the anonymity requirement, the acquired anonymized data is selected as a candidate for use target data.
A control method characterized by performing processing . A control program for controlling the use of anonymized data,
Obtaining anonymized data in which personal information data including at least one item value is anonymized according to an abstraction pattern;
Determining whether the acquired anonymized data satisfies anonymity requirements based on k-anonymity,
When it is determined that the anonymity requirement is satisfied, the acquired anonymized data is selected as a candidate for use target data.
Let the computer execute the process,
A control program characterized by that.

Images