JP6779854B2 - Anonymization device, anonymization method and anonymization program - Google Patents

Description

The present invention relates to devices, methods and programs for anonymizing datasets.

Conventionally, for example, when analyzing a data set including personal information such as movement history or purchase history together with user attributes and using it for advertisement distribution, it is necessary to avoid the risk that an individual is identified from a record and personal information is leaked. was there. Therefore, the data set including the personal information is provided after the anonymization process.
When automatically anonymizing a dataset, a method is used in which records that are close to each other are rounded and clustered, or each attribute has a tree structure and k-anonymization is repeated by repeating generalization. (See, for example, Non-Patent Documents 1 and 2).

Ji-Won Byun, Ashish Kamra, Elisa Bertino, Ninghui Li, Efficient k-anonymization using clustering techniques, Proceedings of the 12th international conference on Database systems for advanced applications, April 09-12, 2007, Bangkok, Thailand Kristen LeFevre, David J. et al. DeWitt, Raghu Ramakrishnan, Incognito: effective full-domin K-anonymity, Proceedings of the 2005 ACM SIGMOD intermediary FQDN, FQDN, Maryland, FQDN

However, in the method of automatically rounding records that are close to each other, the records are clustered according to the distance between simple records without considering the meaning of the data. Therefore, for the user, for example, age "17-21". Generalization with low usefulness was performed.
Also, even if it is based on a tree structure, the purpose is to implement k-anonymization, and as the number of attributes increases, most of the attributes are significantly generalized, resulting in utility value. Often the data set was low.

An object of the present invention is to provide an anonymization device, an anonymization method, and an anonymization program that can output only safe records while leaving usefulness.

The anonymization device according to the present invention has a data set input unit that periodically accepts input of a data set having the same attribute consisting of a plurality of records, and a generalized upper level for each of the attributes included in the data set. A hierarchical tree input unit that accepts input of a generalized hierarchical tree that has nodes, an anonymization rule input unit that accepts input of anonymization rules according to the usage of the data set, and output based on the risk of identifying an individual. An output rule input unit that accepts input of an output rule that defines conditions for various records, an anonymization processing unit that anonymizes the entire data set based on the anonymization rule, and an anonymization processing unit. An anonymized data output unit that outputs only records that match the output rule and a save record storage unit that stores saved records that do not match the output rule in the state before anonymization from the data set. The anonymization processing unit adds the record stored in the saved record storage unit to the data set received by the data set input unit, and then anonymizes the data set.

When the record includes an attribute of date and time information, the saved record storage unit may delete and store the date and time information.

The saved record storage unit may delete a record for which a predetermined period has passed.

The anonymization method according to the present invention is a generalized upper level for each of a data set input step that periodically accepts input of a data set having the same attribute consisting of a plurality of records and attributes included in the data set. Hierarchical tree input step that accepts input of generalized hierarchical tree having nodes, anonymization rule input step that accepts input of anonymization rule according to the usage of the data set, and output based on the risk of identifying an individual An output rule input step that accepts input of an output rule that defines conditions for various records, an anonymization process step that anonymizes the entire data set based on the anonymization rule, and an anonymization process step. An anonymized data output step that outputs only records that match the output rule and a saved record storage step that stores the saved records that do not match the output rule in the state before anonymization from the data set. The computer executes, and in the anonymization processing step, the record stored in the saved record storage step is added to the data set received in the dataset input step, and then anonymized.

The anonymization program according to the present invention periodically receives input of a data set having the same attribute consisting of a plurality of records, and a generalized upper level for each of the attributes included in the data set. Hierarchical tree input step that accepts input of generalized hierarchical tree with nodes, anonymization rule input step that accepts input of anonymization rule according to the usage of the data set, and output based on the risk of identifying an individual An output rule input step that accepts input of an output rule that defines conditions for various records, an anonymization process step that anonymizes the entire data set based on the anonymization rule, and anonymization in the anonymization process step. An anonymized data output step that outputs only records that match the output rule and a save record storage step that stores the saved records that do not match the output rule in the state before anonymization from the data set. The purpose is to cause a computer to execute the data set, add the record stored in the saved record storage step to the data set received in the data set input step, and then anonymize the data set in the anonymization processing step.

According to the present invention, when anonymizing a data set, only a safe record can be output while leaving usefulness.

It is a figure which shows the functional structure of the anonymization apparatus which concerns on 1st Embodiment. It is a figure which shows the input / output information of the anonymization apparatus which concerns on 1st Embodiment. It is a figure which shows the input / output information of the anonymization apparatus which concerns on 2nd Embodiment.

Hereinafter, the first embodiment of the present invention will be described.
FIG. 1 is a diagram showing a functional configuration of the anonymization device 1 according to the present embodiment.
The anonymization device 1 is an information processing device (computer) such as a server device or a personal computer, and includes a control unit 10, a storage unit 20, and various input / output devices.

The control unit 10 is a part that controls the entire anonymization device 1, and realizes the functions in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for various programs and various data for making the hardware group function as the anonymization device 1, and may be a ROM, RAM, flash memory, hard disk (HDD), or the like. Specifically, the storage unit 20 stores the data set to be processed, various file groups, and the like, in addition to the anonymization program for causing the control unit 10 to execute the function of the present embodiment.

Further, the control unit 10 includes a data set input unit 11, a hierarchical tree input unit 12, an anonymization rule input unit 13, an output rule input unit 14, a setting information input unit 15, an anonymization processing unit 16, and the like. It includes an anonymized data output unit 17.

The data set input unit 11 periodically receives input of a data set having the same attribute composed of a plurality of records by batch processing or the like. For example, once a day, the data set for one day is taken in and provided to the anonymization processing unit 16.

Each record in the dataset to be anonymized consists of multiple attributes. The data type of each attribute includes qualitative data, quantitative data, code type data, and the like.
The qualitative data corresponds to addresses such as "Tokyo" and "Kyoto", for example.
Quantitative data corresponds to, for example, numerical data such as "1.5" and "30".
The code type data corresponds to data having a meaning in each digit, such as a postal code.

The hierarchical tree input unit 12 receives input of a generalized hierarchical tree having a generalized upper node for each attribute included in the data set.
In the generalized hierarchical tree, for example, nodes such as "Kanto" or "Kansai" are provided above the nodes such as "Tokyo" or "Kyoto" which are qualitative data. In addition, nodes such as "13-15" or "minors" are provided in the upper hierarchy of nodes such as "13", "14", and "15" which are quantitative data. Further, in the upper layer of the node such as "123-4567" which is the code type data, a node such as "123-45 **" in which some digits are omitted is provided.

The anonymization rule input unit 13 accepts file input of anonymization rules according to the usage method of the data set.
In the anonymization rule, for example, the attribute x is generalized to the height h of the tree, part or all of the attribute y is deleted, and the attribute z is the height of the tree for records having the same number of records n or more. Generalization rules, such as generalization to h, or conditional generalization rules are defined. A plurality of conditions may be provided, and are defined using, for example, and or or.
The anonymization rule is not limited to generalization based on the generalization hierarchy tree, and for example, anonymization methods such as sampling, swapping, and noise addition may be used.

The output rule input unit 14 accepts a file input of an output rule that defines conditions for records that can be output in order to reduce the risk of an individual being identified from the record information of the data set to less than a predetermined value.
The output rule may be expressed by a threshold value such as the number of overlapping records k or the personal identification probability p.
Further, the output rule may be set independently for each record. Further, the output rule may be determined according to the data set destination. For example, a certain record may be disclosed if the same number of records k ≧ 2 for a company with a company size of xx or more and k> 10 for a company with yy or less, and a conditional threshold is output. It may be defined as a rule.

The setting information input unit 15 accepts input of a file that specifies a storage destination of various output information such as a data set and a log file after anonymization.

The anonymization processing unit 16 anonymizes the entire data set based on the anonymization rule.
The resulting dataset is anonymized to a level tailored to the intended use of the data.

The anonymized data output unit 17 outputs only records that match the output rule from the data set anonymized by the anonymization processing unit 16.
The anonymized data output unit 17 appropriately executes processing such as deletion from the data set, mask processing, and repetition of generalization until the records do not match the output rule.
As a result, an anonymized data set with guaranteed security is output.

Further, the anonymized data output unit 17 outputs various log files and reports together with the anonymized data set and stores them in the storage unit 20.

FIG. 2 is a diagram showing input / output information of the anonymization device 1 according to the present embodiment.
As described above, the anonymization device 1 accepts a generalization hierarchy tree, an anonymization rule file, an output rule file, and other setting files in addition to the data set to be anonymized.
Then, when the anonymization device 1 outputs the anonymization data set, it outputs the anonymization log file, the error log file, and the anonymization report.

In the anonymization log file, the ID for associating the record that does not match the output rule with the anonymization data set and the original attribute information before this record is anonymized are recorded.
In the error log file, an error message is recorded when the anonymization process is not completed normally.
The anonymization report describes what kind of anonymization is performed based on the anonymization rule and how much risk remains based on the output rule for safety management measures.

According to the present embodiment, the anonymization device 1 outputs an output for reducing the risk of identifying an individual to less than a predetermined value after performing anonymization processing such as generalization based on an anonymization rule according to the purpose of use. Output only anonymized records that match the rules.
In the conventional anonymization method, since the entire data set is processed so as to match the output conditions, the outliers are greatly generalized together with other records, and the usefulness is reduced. The anonymization device 1 of the present embodiment is safe by clarifying the information to be kept, which differs depending on the use case, by the anonymization rule, and then outputting only the safe record that matches the output rule after the anonymization. High usefulness can be maintained by excluding outliers whose sex is less than predetermined.
As a result, unlike the conventional automatic anonymization method, the anonymization device 1 can guarantee certain processing rules and safety, and thus generates a data set useful for the user of the anonymized data. it can.

Further, the anonymization device 1 can more appropriately define the security of each record by independently defining the output rule for each record of the data set.
Further, the anonymization device 1 can output an appropriate data set according to the purpose of use by defining an output rule according to the data set provider.

[Second Embodiment]
Hereinafter, a second embodiment of the present invention will be described.
The same components as those in the first embodiment are designated by the same reference numerals, and the description thereof will be omitted or simplified.

When the data set is automatically anonymized, the amount of information will be reduced due to processing such as significant generalization or deletion of all or part of the record if there are no other similar records and the value is out of order. It was greatly reduced. Further, also in the first embodiment, if some records are deleted or significantly generalized in order to satisfy the safety based on the output rule, the usefulness may be reduced.
However, when the data set is input regularly, the number of records similar to outliers can be expected to increase with the passage of time, so that the degree of generalization may be suppressed.
Therefore, in the present embodiment, the anonymization device 1 maintains the usefulness by integrating and processing the records that do not match the output rule with the data set input later.

In the present embodiment, the functions of the anonymization processing unit 16 and the anonymization data output unit 17 are different from those of the first embodiment.
The anonymized data output unit 17 stores the saved record that does not match the output rule and is not output as the storage unit 20 (save record storage unit) as an over-anonymization target data set in the original state before the anonymization. Remember.
The anonymization processing unit 16 adds the over-anonymization target data set stored in the storage unit 20 to the data set received by the data set input unit 11 from the next time onward, and then anonymizes the data set.

When sampling is adopted as the anonymization rule, records that are not output targets are generated regardless of the output rule, but these records need not be included in the over-anonymization target data set.

Here, when the saved record includes the attribute of the date and time information, the anonymization data output unit 17 deletes the date and time information and sets it as the excessive anonymization target data set. The date and time information does not have the same value as the record of the data set input after the next time (for example, the next day). Therefore, when this date and time information is a processing target for anonymization, the anonymization data output unit 17 deletes the date and time information from the saved record, so that it will continue to be an outlier in the next and subsequent anonymization processes. Can be suppressed.
In addition, the anonymization processing unit 16 may delete the record for which a predetermined period has passed from the data set to be over-anonymized during the anonymization processing.

FIG. 3 is a diagram showing input / output information of the anonymization device 1 according to the present embodiment.
In the second embodiment, when the anonymization device 1 outputs the over-anonymization target data set in addition to the output data in the first embodiment, it stores it in the save database (DB) of the storage unit 20. At this time, the date and time information is deleted from the data set stored in the backup DB.
Then, at the next anonymization process, the anonymization device 1 adds the data set stored in the backup DB to the anonymization target data set to perform anonymization.

According to the present embodiment, the anonymization device 1 stores the save record that does not match the output rule in the save DB in the state before the anonymization, and adds it to the data set to be input from the next time onward to make it anonymous. Reuse for conversion process.
Therefore, when the anonymization device 1 repeatedly performs anonymization processing on a data set having the same attribute, it temporarily saves a high-risk record and then performs anonymization processing, which is an outlier this time. However, it is possible to increase the possibility that it will be output from the next time onward and improve its usefulness.

Further, when the anonymization device 1 includes the attribute of the date and time information in the record, the date and time information is deleted and stored in the save DB, so that the outlier value is stored in the next data set (for example, the next day). It is possible to avoid the situation and increase the possibility of being an output target.
Further, the anonymization device 1 can exclude records that are not suitable for integration as processing targets by deleting records for which a predetermined period has passed from the backup DB, and the usefulness of the output data can be enhanced.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. In addition, the effects described in the above-described embodiments are merely a list of the most preferable effects arising from the present invention, and the effects according to the present invention are not limited to those described in the embodiments.

The anonymization method by the anonymization device 1 is realized by software. When realized by software, the programs that make up this software are installed in the information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

1 Anonymization device 10 Control unit 11 Data set input unit 12 Hierarchical tree input unit 13 Anonymization rule input unit 14 Output rule input unit 15 Setting information input unit 16 Anonymous processing unit 17 Anonymous data output unit 20 Storage unit

Claims (5)

A data set input unit that periodically accepts input of a data set consisting of multiple records with the same attributes,
A hierarchical tree input unit that accepts input from a generalized hierarchical tree that has generalized higher-level nodes for each of the attributes contained in the dataset.
Anonymization rule input unit that accepts input of anonymization rule according to the usage method of the data set,
An output rule input unit that accepts input of output rules that define conditions for records that can be output based on the risk of identifying an individual,
Anonymization processing unit that anonymizes the entire data set based on the anonymization rule,
An anonymized data output unit that outputs only records that match the output rule from the data set anonymized by the anonymization processing unit.
It is provided with a saved record storage unit that stores a saved record that does not match the output rule in the state before anonymization.
The anonymization processing unit is an anonymization device that anonymizes a record stored in the saved record storage unit after adding it to a data set received by the data set input unit. The anonymization device according to claim 1, wherein the saved record storage unit deletes and stores the date and time information when the record includes an attribute of date and time information. The anonymization device according to claim 1 or 2, wherein the saved record storage unit deletes a record for which a predetermined period has passed. A dataset input step that periodically accepts the input of a dataset consisting of multiple records with the same attributes,
A hierarchical tree input step that accepts input for a generalized hierarchical tree that has generalized higher-level nodes for each of the attributes contained in the dataset.
Anonymization rule input step that accepts input of anonymization rule according to the usage method of the data set, and
An output rule input step that accepts input of an output rule that defines the conditions of records that can be output based on the risk of identifying an individual,
Anonymization processing steps that anonymize the entire dataset based on the anonymization rules,
Anonymized data output step that outputs only records that match the output rule from the data set anonymized in the anonymization processing step, and
The computer executes a save record storage step of storing the saved records that do not match the output rule in the state before anonymization.
An anonymization method of anonymizing after adding a record stored in the saved record storage step to the data set received in the data set input step in the anonymization processing step. A dataset input step that periodically accepts the input of a dataset consisting of multiple records with the same attributes,
A hierarchical tree input step that accepts input from a generalized hierarchical tree that has generalized higher-level nodes for each of the attributes contained in the dataset.
Anonymization rule input step that accepts input of anonymization rule according to the usage of the data set, and
An output rule input step that accepts input of an output rule that defines the conditions of records that can be output based on the risk of identifying an individual,
Anonymization processing steps that anonymize the entire dataset based on the anonymization rules,
Anonymized data output step that outputs only records that match the output rule from the data set anonymized in the anonymization processing step, and
A computer is made to execute a save record storage step of storing a saved record that does not match the output rule in the state before anonymization.
An anonymization program for anonymizing a record stored in the saved record storage step in the anonymization processing step after adding it to the data set received in the data set input step.

Images