JP7143696B2 - Anonymization device, anonymization system, anonymization method, and program - Google Patents

Description

The present invention relates to an anonymization device, an information anonymization method, and a program for anonymizing information, particularly personal information.

When acquiring and distributing personal information (providing it to a third party), it is necessary to obtain the consent of the individual. Personal information is, for example, information about a living individual, and is information that can identify a specific individual by name, date of birth, address, or the like.

On the other hand, anonymously processed information does not require the consent of the individual. Anonymously processed information is information obtained by processing personal information, and is information that cannot be used to identify an individual and cannot be restored to the personal information before processing. Therefore, unlike personal information, anonymously processed information can be used relatively freely.

In relation to the above, for example, Patent Literature 1 describes a technique for selecting attributes to be anonymized based on appearance rate and survival rate. Patent Literature 2 describes a technique for anonymization based on a predetermined anonymization rule for anonymization. The conditions for protecting the privacy of individuals who own personal information contained in data may have different definitions depending on the country, and may also change with the times. In order to deal with such changes, Patent Literature 3 describes a technique for preparing a plurality of pieces of privacy protection condition information.

JP 2013-200659 A JP 2017-168130 A JP 2014-229039 A

Process anonymously processed information until November 2016, when the Personal Information Protection Commission, an external bureau of the Cabinet Office of Japan, issues the "Guidelines for the Act on the Protection of Personal Information." There was no guideline as an example of anonymization rules for

In addition, even when creating anonymously processed information, the trader must comply with predetermined anonymous processing rules. In the above, the trader is, for example, a holding trader who holds anonymously processed information and a utilization trader who utilizes anonymously processed information. Further, in the above, the predetermined anonymization rule is a rule for maintaining a state in which an individual cannot be identified and personal information cannot be restored to the state before processing. Failure to comply with this anonymization rule may be considered a violation of the law. Therefore, for example, in order not to violate the law, the holding company has taken measures such as deleting all data items that can identify individuals.

Here, the attribute information name on the anonymization rule and the attribute information name of personal information do not necessarily match. For example, the attribute information name is "name" and the attribute information name is "name". Therefore, in the case of a device that determines whether or not to perform anonymization simply based on word matching determination between "attribute information names", it may be determined that the attribute information is not subject to anonymization. In this case, there is a risk that personal information with attribute information names that do not match in terms of words but have the same meaning conceptually will leak out as they are without being processed anonymously. If information that should be anonymized is leaked as it is, not only will the individual's privacy be violated, but the company that leaked it may be considered a violation of the law.

In order to avoid such a situation, it is conceivable that the operator visually compares the attribute names. However, it is extremely difficult to visually determine all information, which not only increases the burden on workers, but can also lead to unexpected work mistakes (sometimes mistakes that lead to information leakage). .

It is almost impossible to solve the above problems with the techniques of Patent Documents 1 to 3.

The present invention has been made to solve the above problems, and aims to provide a technology that can reduce the risk of privacy infringement and law violation without increasing the work burden on workers. do.

An anonymity processing device of the present invention includes personal information including first attribute information and individual personal information about the first attribute information, and anonymity including second attribute information and individual processing rule information about the second attribute information. obtaining processing rule information, determining whether or not the second attribute information belonging to the same semantic area as the first attribute information exists, and determining whether the second attribute information belonging to the same semantic area as the first attribute information exists; Anonymous processing for creating anonymously processed information by processing the individual personal information for the first attribute information, if the information exists, based on the individual processing rule information for the second attribute information belonging to the semantic area. A processing means is provided.

An anonymization method of the present invention includes personal information including first attribute information and individual personal information about the first attribute information, and anonymization including second attribute information and individual processing rule information about the second attribute information. obtaining processing rule information, determining whether or not the second attribute information belonging to the same semantic area as the first attribute information exists, and determining whether the second attribute information belonging to the same semantic area as the first attribute information exists; creating anonymously processed information by processing the individual personal information for the first attribute information, if the information exists, based on the individual processing rule information for the second attribute information belonging to the semantic area; Characterized by

The program of the present invention stores personal information including first attribute information and individual personal information about the first attribute information, second attribute information and individual processing rules about the second attribute information, in the computer of the anonymous processing device. and determining whether or not the second attribute information belonging to the same semantic area as the first attribute information exists, and determining whether the second attribute information has the same semantic as the first attribute information. When the second attribute information belonging to the area exists, based on the individual processing rule information for the second attribute information belonging to the semantic area, the individual personal information for the first attribute information is processed for anonymity. It is a program for executing a process of creating machining information.

ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to reduce the risk of a privacy invasion and a law violation, without increasing a worker's work burden.

1 is a block diagram showing a configuration example of an anonymous processing device according to a first embodiment of the present invention; FIG. 2 is a flowchart for explaining an operation example (anonymization method) of the anonymization device shown in FIG. 1; FIG. 11 is a block diagram showing a configuration example of an anonymous processing device according to a second embodiment of the present invention; A data configuration example of personal information is shown. A data configuration example of anonymous processing rule information is shown. A data configuration example of public personal information is shown. 4 shows a data configuration example of a semantic area; FIG. 4 is a flow chart for explaining an operation example (anonymization method) of the anonymization device shown in FIG. 3; FIG. FIG. 11 is a block diagram showing a configuration example of an anonymous processing device according to a third embodiment of the present invention; FIG. 14 is a block diagram showing a configuration example of an anonymous processing system according to a fourth embodiment of the present invention;

[First embodiment]
FIG. 1 is a block diagram showing a configuration example of an anonymous processing device 10 according to the first embodiment of the present invention. The anonymization device 10 is a device that creates anonymously processed information by performing anonymization processing on personal information.

Personal information is information about a living individual, and is information that can identify a specific individual by name, date of birth, address, or the like. On the other hand, according to the "Guidelines for the Act on the Protection of Personal Information," anonymously processed information refers to personal information that is processed in such a way that it is impossible to identify a specific individual by taking measures determined according to the classification of personal information. It is information about individuals obtained by processing into "Guidelines for the Act on the Protection of Personal Information" was issued in November 2016 by the Personal Information Protection Commission, an external bureau of the Cabinet Office of Japan. Hereinafter, in this document, the "Guidelines for the Act on the Protection of Personal Information" will be abbreviated as the "Guidelines for the Act on the Protection of Personal Information."

The anonymization device 10 includes an anonymization processing unit 14 (an example of anonymization processing means). Anonymization processing unit 14 performs anonymous processing including personal information including first attribute information and individual personal information about the first attribute information, and second attribute information and individual processing rule information about the second attribute information. Get rule information and

The anonymous processing unit 14 determines whether or not there is second attribute information belonging to the same semantic area as the first attribute information.

Here, the semantic domain refers to a group of concepts when a plurality of phrases are grouped together, which can be conceptually regarded as the same or can be regarded as having no problem. Here, the phrase is specifically used as a generic term for words and parts of speech (for example, nouns). A semantic domain may also be referred to, for example, simply as a "semantic", a "semantic domain", or a "semantic domain".

If there is second attribute information belonging to the same semantic area as the first attribute information, the anonymous processing unit 14 processes the first attribute information based on the individual processing rule information for the second attribute information belonging to the same semantic area. Create anonymously processed information by processing individual personal information about

The anonymous processing rule information is information in which processing rules described in guidelines in accordance with laws, for example, guidelines of the Personal Information Protection Act, are converted into electronic data. Anonymization rule information is stored, for example, in a rule information database. The rule information database may exist inside the anonymous processing device 10 or may exist outside the anonymous processing device 10 . When the rule information database exists outside the anonymization device 10, the rule information database is communicably connected to the anonymization device 10 via a predetermined communication interface.

FIG. 2 is a flowchart for explaining an operation example (anonymization method) of the anonymization device 10 shown in FIG. It is assumed that the above-described anonymous processing rule information is stored in advance in the rule information database prior to the execution of the anonymous processing. Also, in the following description, a case where the guideline in accordance with the law is, for example, the personal information protection law guideline will be taken as an example.

First, the anonymous processing unit 14 acquires personal information (step S1). The acquisition method of personal information is arbitrary. For example, the personal information is read from a personal information database (not shown in FIG. 1) provided inside the anonymous processing device 10, or supplied from a device external to the anonymous processing device 10. FIG. Thereafter, the anonymous processing unit 14 acquires anonymous processing rule information. Acquisition of the anonymization rule information may be completed before the personal information 200 is acquired.

The anonymous processing unit 14 determines whether or not there is second attribute information belonging to the same semantic area as the first attribute information.

If there is second attribute information belonging to the same semantic area as the first attribute information, the anonymous processing unit 14 performs process the individual personal information to create anonymously processed information (step S2).

The content of the personal information and the anonymization rule information and the anonymization processing in the anonymization processing unit 14 may be those described in the second embodiment below.

In the first embodiment described above, when there is second attribute information belonging to the same semantic area as the first attribute information, the anonymous processing unit 14 sets the individual processing rule for the second attribute information belonging to the same semantic area. Individual personal information about the first attribute information is processed based on the information. As described above, the semantic domain refers to a group of concepts when a plurality of phrases are grouped that can be conceptually regarded as the same or can be regarded as the same. Therefore, although the wording does not match, there is a low possibility that personal information with the same attribute information name will leak out as it is without being anonymized. Furthermore, the determination itself as to whether or not there is second attribute information belonging to the same semantic area is automatically performed by the anonymization device 10 rather than manually (that is, visual confirmation by an operator, etc.).

Therefore, according to the first embodiment, it is possible to reduce the risk of privacy infringement and law violation without increasing the work burden on the worker.
[Second embodiment]
(Description of configuration)
FIG. 3 is a block diagram showing a configuration example of an anonymous processing device 100 according to the second embodiment of the present invention. The anonymization device 100 includes a configuration based on the anonymization device 10 shown in FIG. create.

The anonymization device 100 includes an anonymization processor 102 (an example of anonymization processing means), a personal information database 104 , a rule information database 106 , a public personal information database 108 , and a semantic dictionary 109 .

Personal information database 104 stores personal information 200 . FIG. 4 shows a data configuration example of the personal information 200. As shown in FIG. The personal information 200 is composed of first attribute information 202 which is information indicating an attribute and individual personal information 204 which is information indicating an attribute value of the first attribute information 202 .

FIG. 4 illustrates a case where there is one piece of personal information 200 and the first attribute information 202 is each of four attributes (for example, "name", "age", "address", and "occupation"). be. In this case, the individual personal information 204, which is the attribute value of the first attribute information 202, has four attribute values (for example, "Nichiden Taro", "39", "Nakahara Ward, Kawasaki City, Kanagawa Prefecture", and "company employee"). Each of Of course, the number of pieces of personal information 200 may be two or more. Also, the number of pieces of first attribute information 202 may be 3 or less, or may be 5 or more.

The rule information database 106 stores anonymous processing rule information 210 in which processing rules described in legal guidelines are digitized.

In this embodiment, the case where the anonymous processing rule information 210 is the anonymous processing rule information described in the Personal Information Protection Law guidelines is taken as an example. FIG. 5 shows a data configuration example of the anonymous processing rule information 210. As shown in FIG. Anonymization rule information 210, as shown in FIG. Individual processing rule information 214 representing each processing rule (for example, "delete", "truncate first digit", "leave prefecture and city only", and "leave"). Of course, the number of pieces of second attribute information 212 may be three or less, or may be five or more.

The public personal information database 108 stores public personal information 220 which is personal information in which at least one piece of individual personal information 204 is anonymized and which can be disclosed to a third party. FIG. 6 shows a data configuration example of the public personal information 220. As shown in FIG. Public personal information 220 is composed of processed individual personal information 222 (for example, each of “30s”, “Kawasaki City, Kanagawa Prefecture”, and “office worker”).

Semantic dictionary 109 includes at least one semantic region 230 . A semantic domain refers to a group of concepts when a plurality of phrases are grouped that can be regarded as being conceptually the same or can be regarded as having no problem. A semantic domain may also be referred to, for example, simply as "semantic", "semantic domain", or "semantic domain".

FIG. 7 shows a data configuration example of the semantic area 230 . In this case, the semantic area 230 represents, as an example, the concept of “identifying a certain person”, and for example, “name”, “first name”, “personal name”, “first name”, and “last name” are the same concepts. Contains as an element.

The semantic dictionary 109 may be created by the provider of the anonymization device 100, or may be available free of charge as a cloud service.

The anonymous processing unit 102 basically performs anonymous processing on the acquired personal information 200 based on the anonymous processing rule information 210, similarly to the anonymous processing unit 14 shown in FIG.

Specifically, the anonymous processing unit 102 acquires the personal information 200 from the personal information database 104 . The anonymous processing unit 102 determines whether or not there is second attribute information 212 belonging to the same semantic area as the first attribute information 202 . In other words, the anonymous processing unit 102 determines whether or not there is second attribute information 212 having a common concept with the first attribute information 202 .

The semantic dictionary 109 is used in this determination. The anonymization processing unit 102 refers to the semantic dictionary 109 and identifies the semantic region 230 to which the second attribute information 212 (for example, "name") belongs. The anonymization processing unit 102 processes all elements in the specified semantic area 230 (for example, “name”, “name”, “personal name”, “first name”, and “last name” in FIG. 7) and the acquired personal information 200 are compared with all of the first attribute information 202 of .

If the first attribute information 202 is the same "name" as the second attribute information 212, the concepts of the first attribute information 202 and the second attribute information 212 are of course common. Further, when the first attribute information 202 is "name", the wording itself is not the same, but since "name" is one of the elements included in the semantic region 230, the first attribute information 202 and the first attribute information 202 are not the same. It can be judged that the concept of the two attribute information 212 is common.

If there is second attribute information 212 belonging to the same semantic area as the first attribute information 202, the anonymous processing unit 102 converts the individual personal information 204 of the first attribute information 202 into the second attribute belonging to the same semantic area. The information 212 is processed anonymously based on the individual processing rule information 214 .

The anonymization processor 102 stores public personal information 220 , which is personal information obtained by anonymizing at least one piece of individual personal information 204 , in the public personal information database 108 .

The personal information 200 may include information that is not subject to anonymous processing. That is, the personal information 200 may include information having the first attribute information 202 whose semantics do not match all the second attribute information 212 in the anonymization rule information 210 . Such information is referred to as attribute mismatch information in this embodiment. Anonymization is not performed on attribute mismatch information. Also, handling of attribute mismatch information is optional. For example, attribute mismatch information may be stored in public personal information database 108 as it is without anonymization processing.

The anonymous processing unit 102 may be configured by an electronic circuit such as an IC (Integrated Circuit) or FPGA (Field Programmable Gate Array). Alternatively, the anonymous processing unit 102 may be configured such that a computer (for example, a CPU (Central Processing Unit)) executes a program stored in memory. Of course, the anonymous processing unit 102 may be configured by a combination of an electronic circuit and a computer.
(Description of operation)
FIG. 8 is a flowchart for explaining an operation example (anonymization method) of the anonymization processing device 100 shown in FIG. Specifically, steps S10 to S14 described with reference to FIG. 8 describe processing executed by the anonymous processing unit 102. FIG. It is assumed that anonymization rule information 210 is stored in advance in the rule information database 106 prior to execution of these processes.

The anonymous processing unit 102 acquires personal information 200 from, for example, the personal information database 104 (step S10). Triggered by the acquisition of the personal information 200 , the anonymization processing unit 102 acquires the anonymization rule information 210 from the rule information database 106 . Acquisition of the anonymization rule information 210 may be completed before the personal information 200 is acquired.

The anonymous processing unit 102 determines whether or not there is second attribute information 212 belonging to the same semantic region as the first attribute information 202 (step S11). For example, as described above, the anonymization processing unit 102 refers to the semantic dictionary 109 and identifies the semantic region 230 to which the second attribute information 212 (for example, "name") belongs. The anonymization processing unit 102 extracts all elements in the specified semantic area 230 (for example, “name”, “name”, “personal name”, “first name”, and “last name” in FIG. 7) and the acquired personal information 200. All the first attribute information 202 are compared. Information without the second attribute information 212 is called attribute mismatch information as described above.

If the second attribute information 212 belonging to the same semantic domain as the first attribute information 202 exists (Yes in step S11), the anonymous processing unit 102 converts the individual personal information 204 for the first attribute information 202 into the same semantic domain. The second attribute information 212 belonging to the area is processed anonymously based on the individual processing rule information 214 (step S12).

For example, if one piece of the first attribute information 202 is "name" and the anonymization processing unit 102 sets the first attribute information 202 to "name", the attribute information name does not match but the semantics match. "Taro Nichiden" in the information 204 is deleted because the individual processing rule information 214 for "name" is "delete".

On the other hand, if the second attribute information 212 belonging to the same semantic area as the first attribute information 202 does not exist (No in step S11), the anonymous processing unit 102 processes the individual personal information 204 of the first attribute information 202 Anonymization processing is not performed (step S13).

Although not shown in FIG. 8, the processes of steps S11 to S13 are repeatedly executed until the round-robin comparison of all the first attribute information 202 of one piece of personal information 200 is completed. Furthermore, when a plurality of pieces of personal information 200 are stored in the personal information database 104, the processing of steps S10 to S13 is repeatedly executed until the processing of all the pieces of personal information 200 is completed.

The anonymization processor 102 stores public personal information 220, which is personal information obtained by anonymizing the individual personal information 204, in the public personal information database 108 (step S14). The anonymous processing unit 102 stores the public personal information 220 shown in FIG. 6, for example, in the public personal information database 108 . FIG. 6 shows public personal information 220 obtained by anonymizing the personal information 200 shown in FIG. 4 based on the anonymous processing rule information 210 shown in FIG.
(Explanation of effect)
In the second embodiment described above, when there is second attribute information 212 belonging to the same semantic area as the first attribute information 202, the anonymization processing unit 102 performs Based on the individual processing rule information 214, the individual personal information about the first attribute information 202 is processed. As described above, the semantic domain refers to a group of concepts when a plurality of phrases are grouped that can be conceptually regarded as the same or can be regarded as the same. Therefore, although the wording does not match, there is a low possibility that personal information with the same attribute information name will leak out as it is without being anonymized. Furthermore, the determination itself as to whether or not the second attribute information 212 belonging to the same semantic region exists is automatically performed by the anonymization processing device 100 rather than manually (that is, visual confirmation by the operator, etc.).

Therefore, according to the second embodiment, it is possible to reduce the risk of privacy infringement and law violation without increasing the work burden on the operator.

In the second embodiment described above, an example in which the personal information database 104 that stores the personal information 200 is built in the anonymization device 100 is shown. may be outside the However, in that case, the network between the personal information database 104 and the anonymization device 100 is provided with measures to prevent leakage of personal information.

Also, in the second embodiment, an example in which the semantic dictionary 109 is built in the anonymization device 100 is shown, but the semantic dictionary 109 may be outside the anonymization device 100 .
[Third Embodiment]
FIG. 9 is a block diagram showing a configuration example of an anonymous processing device 300 according to the third embodiment of the present invention. Specifically, the anonymous processing device 10 shown in FIG. 1 or the anonymous processing device 100 shown in FIG. is a block diagram of an anonymous processing device 300 implemented by a computer. The anonymous processing device 300 includes a storage device 302 and an arithmetic device 304 (computer) including a processor and the like. The storage device 302 is a computer-readable recording medium and stores a computer program 350 . The computer program 350 is, for example, a program for causing the arithmetic device 304 to execute the operations described in the first embodiment and the operations described in the second embodiment. For example, the computer program 350 acquires the anonymous processing rule information from the rule information database that stores the anonymous processing rule information, which is electronic data of the processing rules described in legal guidelines, and acquires the acquired anonymous processing rule. This is a process of processing personal information based on information to create anonymously processed information.

It should be noted that examples of computing device 304 include, for example, one or more CPUs that read and execute programs, and memory that stores instructions for execution by the CPUs. Also, the computer-readable recording medium is, for example, a non-temporary storage device. Examples of non-temporary storage devices include portable media such as optical disks, magnetic disks, ROMs (Read Only Memory), non-volatile semiconductor memories, and hard disks built into computer systems. A computer-readable recording medium may also be a temporary storage device. Examples of temporary storage devices include signal lines for transmitting programs via networks such as the Internet and communication lines such as telephone lines, and volatile memories within computer systems.

According to the third embodiment described above, similarly to the first and second embodiments, according to the third embodiment, there is no increase in the work burden on workers, and privacy violations and legal violations are prevented. Risk can be reduced.
[Fourth embodiment]
FIG. 10 is a block diagram showing a configuration example of an anonymous processing system 400 according to the fourth embodiment of the invention. The anonymous processing system 400 includes an anonymous processing device 402 and an information processing device 404 .

The anonymization device 402 is communicably connected to the information processing device 404 via a network 406 such as the Internet.

The information processing device 404 is a device of a user who desires anonymous processing of personal information. The anonymous processing device 402 is, for example, any one of the first to third embodiments. The anonymization device 402 performs anonymization processing on personal information based on a request from the information processing device 404 . Anonymous processing is as described above.

According to the fourth embodiment described above, for example, it is possible to provide the anonymous processing device 402 on the cloud. That is, according to this embodiment, it is possible to provide anonymization service over the network. In that case, it goes without saying that the effects of the first to third embodiments are achieved.

Although the present invention has been described using each embodiment, the technical scope of the present invention is not limited to the description of each embodiment. It is obvious to those skilled in the art that various modifications or improvements can be made to each of the above embodiments. Therefore, it is needless to say that the forms with such changes or improvements are also included in the technical scope of the present invention. Numerical values, names of components, and the like used in each of the embodiments described above are examples and can be changed as appropriate.

10 Anonymous processing device 14 Anonymous processing unit 100 Anonymous processing device 102 Anonymous processing unit 104 Personal information database 106 Rule information database 108 Public personal information database 109 Semantic dictionary 200 Personal information 202 First attribute information 204 Individual personal information 210 Anonymous processing Rule information 212 Second attribute information 214 Individual processing rule information 220 Public personal information 230 Semantic area 300 Anonymous processing device 302 Storage device 304 Arithmetic device 350 Computer program 400 Anonymous processing system 402 Anonymous processing device 404 Information processing device 406 Network

Claims (7)

Acquiring personal information including first attribute information and individual personal information about the first attribute information, and anonymous processing rule information including second attribute information and individual processing rule information about the second attribute information, determining whether the second attribute information belonging to the same semantic area as the first attribute information exists, and if the second attribute information belonging to the same semantic area as the first attribute information exists, the semantic an anonymous processing means for processing the individual personal information for the first attribute information to create anonymously processed information based on the individual processing rule information for the second attribute information belonging to an area ;
The second attribute information includes at least age and address,
The individual processing rule information includes truncating the first digit of the age and leaving the prefecture and city of the address.
An anonymous processing device characterized by: When it is determined that the second attribute information belonging to the same semantic area as the first attribute information does not exist, the anonymous processing means does not process the individual personal information of the first attribute information. The anonymous processing device according to claim 1. 3. When determining whether or not the second attribute information belonging to the same semantic area as the first attribute information exists, the anonymous processing means refers to a semantic dictionary. The anonymization device described. 4. Anonymous processing according to claim 3, wherein said semantic dictionary includes at least one said semantic area, and said semantic area includes as elements at least two words that can be regarded as being conceptually identical. Device. an anonymous processing device according to any one of claims 1 to 4;
a user's information processing device;
with
The anonymization device is communicably connected to the information processing device via a network,
An anonymization system, wherein the anonymization device performs anonymization processing on the personal information based on a request from the information processing device. Anonymous processing device
Acquiring personal information including first attribute information and individual personal information about the first attribute information, and anonymous processing rule information including second attribute information and individual processing rule information about the second attribute information,
determining whether the second attribute information belonging to the same semantic area as the first attribute information exists, and if the second attribute information belonging to the same semantic area as the first attribute information exists, the semantic creating anonymously processed information by processing the individual personal information for the first attribute information based on the individual processing rule information for the second attribute information belonging to an area;
The second attribute information includes at least age and address,
The individual processing rule information includes truncating the first digit of the age and leaving the prefecture and city of the address.
An anonymous processing method characterized by: on the computer of the anonymization device,
A process of acquiring personal information including first attribute information and individual personal information about the first attribute information, and anonymous processing rule information including second attribute information and individual processing rule information about the second attribute information When,
determining whether the second attribute information belonging to the same semantic area as the first attribute information exists, and if the second attribute information belonging to the same semantic area as the first attribute information exists, the semantic a process of processing the individual personal information about the first attribute information to create anonymously processed information based on the individual processing rule information about the second attribute information belonging to the area ;
The second attribute information includes at least age and address,
The individual processing rule information includes truncating the first digit of the age and leaving the prefecture and city of the address.
program.

Images