JP7179795B2 - Anonymization device, anonymization method and anonymization program - Google Patents

Description

The present invention relates to a device, method and program for anonymizing datasets.

Conventionally, various techniques for anonymizing data from the viewpoint of privacy protection have been proposed, such as Non-Patent Documents 1 to 5, so that individuals cannot be identified from data set records.

K. LeFevre, D. J. DeWitt, and R. Ramakrishnan, "Mondrian multidimensional k-anonymity," in Proc. of the 22nd International Conference on Data Engineering (ICDE '06), pp. 25-35, IEEE, 2006. P. Samarati and L. Sweeney, "Generalizing data to provide anonymity when disclosing information," in Proc. of PODS 1998, 1998, p. 188. P. Samarati, "Protecting respondents' identities in microdata release," IEEE Trans. on Knowledge and Data Engineering, vol. 13, no. 6, pp. 1010-1027, 2001. L. Sweeney, "Achieving k-anonymity privacy protection using generalization and suppression," in J. Uncertainty, Fuzziness, and Knowledge-Base Systems, vol. 10(5), 2002, pp. 571-588. Byun, Ji-Won and Kamra, Ashish and Bertino, Elisa and Li, Ninghui, "Efficient k-anonymization using clustering techniques," International Conference on Database Systems for Advanced Applications, 188-200, 2007, Springer.

By the way, in the conventional anonymization method, all the attributes of the data to be anonymized had to match. However, some actual data, such as receipt data, have different payloads. In this case, the conventional anonymization method could not cope.

An object of the present invention is to provide an anonymization device, an anonymization method, and an anonymization program capable of anonymizing data with different payloads.

An anonymization device according to the present invention includes an input unit that receives an input of a data set consisting of records whose payload attributes can be specified by a code included in the payload, a storage unit that stores the order of the records, the code, Alternatively, an anonymization processing unit that extracts a partial record of the data set for each combination of the codes and performs anonymization processing on a common attribute, and the anonymized partial record according to the order an amalgamator for amalgamating and reconstructing the anonymized dataset.

The anonymization processing unit may process a plurality of codes having a common attribute into the same generalized code, and extract the partial records for each generalized code.

The anonymization processing unit may perform the anonymization processing for each detailed code after performing the anonymization processing for each generalized code.

An anonymization method according to the present invention includes an input step of accepting an input of a data set consisting of records whose payload attributes can be specified by a code included in the payload, a storage step of storing the order of the records, the code, Alternatively, an anonymization processing step of extracting partial records of the data set for each combination of the codes and performing anonymization processing on common attributes, and anonymizing the partial records in accordance with the order and an aggregating step of aggregating and reconstructing the anonymized data set.

An anonymization program according to the present invention is for causing a computer to function as the anonymization device.

According to the present invention, data with different payloads can be anonymized.

It is a figure which shows the functional structure of the anonymization apparatus in embodiment. It is a figure which illustrates the relationship between a code|cord|chord and a payload attribute in embodiment. It is a figure which shows the outline|summary of the anonymization method in embodiment. 4 is a flow chart illustrating the flow of an anonymization method in the embodiment;

An example of an embodiment of the present invention will be described below.
FIG. 1 is a diagram showing the functional configuration of an anonymization device 1 according to this embodiment.
The anonymization device 1 is an information processing device (computer) such as a server or a personal computer, and includes a control unit 10 and a storage unit 20, input/output devices for various data, communication devices, and the like.

The control unit 10 is a part that controls the entire anonymization device 1, and implements each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. FIG. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the anonymization device 1, and may be ROM, RAM, flash memory, hard disk (HDD), or the like. Specifically, the storage unit 20 stores a program (anonymization program) for causing the control unit 10 to execute each function of the present embodiment, an anonymization target dataset, and a payload of the dataset. It stores codes, etc. that define data attributes.

The control unit 10 includes an input unit 11 , an anonymization processing unit 12 and an integration unit 13 . The control unit 10 uses these functional units to anonymize and output data sets with different payload attributes.

Here, each record of the data set is divided into a common part and a payload (code, payload attributes 1, 2, . . . ). The common part consists of attributes common to all records (eg, age, address, etc.), the payload is not common within the dataset, and the code identifies the payload attributes contained in each record.
Correspondences between codes and payload attributes are stored in a predetermined database in the storage unit 20 and referenced as appropriate.

FIG. 2 is a diagram illustrating the relationship between codes and payload attributes in this embodiment.
For example, the payload with code 00 stores "hospitalization date", "discharge date", and "disease name". Similarly, payload attributes are defined for codes 01, 10, and 11.

The input unit 11 receives an input of a data set consisting of records whose payload attributes can be specified by a code included in the payload.
Also, the input unit 11 stores the order of each record of the received data set in the storage unit 20 .

The anonymization processing unit 12 extracts some records of the data set for each code or combination of codes, and performs anonymization processing on attributes common to the extracted records. Note that the anonymization method is not limited, and various existing methods can be applied.

At this time, the anonymization processing unit 12 may process a plurality of codes having common attributes into the same generalized code, and extract some records for each generalized code.
For example, if there is a relationship between the character strings that make up the code and the commonality of payload attributes, the code is processed based on this relationship. In the example of FIG. 2, codes 00 and 01 have attributes PL1 and PL2 in common, so by generalizing both with "0*", corresponding records are extracted at the same time. Similarly, codes 10 and 11 are both generalized to "1*" because they have a common attribute PL1.

Further, the anonymization processing unit 12 performs anonymization processing for each generalized code (eg, “0*”, “1*”), and then the detailed original code (eg, 00, 01, 10 and 11), anonymization processing may be performed.

The integration unit 13 integrates the partial anonymized records according to the stored order, reconstructs and outputs an anonymized data set.

FIG. 3 is a diagram showing an outline of an anonymization method according to this embodiment.
The anonymization device 1 first extracts common portions of attributes and codes from the data set (A) to which order data for shaping is added, and performs anonymization processing. At this time, the code (00, 01, 10, 11) is generalized to '0*' or '1*'.

When the anonymization device 1 extracts a part of the data set using each generalized code as a key, the anonymization process is performed on common attributes (bold frames) within each group (B, C).
Then, the anonymization device 1 integrates and outputs the plurality of anonymized groups based on the order data (D).

FIG. 4 is a flowchart illustrating the flow of the anonymization method in this embodiment.
In this example, the payload code has multiple levels of generalization, and anonymization processing is performed at each level.
For example, code 012 is hierarchically generalized as "01*" and "0**".

In step S1, the input unit 11 receives input of data sets having different payload portions. At this time, each attribute in the data set is known, including the code of the payload.

In step S2, the input unit 11 stores the order data of each record in the storage unit 20 in order to output the anonymization result.

In step S3, the anonymization processing unit 12 cuts out the common part in the data set and the code of the payload, and performs anonymization.
At this time, the anonymization processing unit 12 processes the code into the most generalized code according to its definition (for example, generalized hierarchical tree).

In step S4, the anonymization processing unit 12 extracts records with matching codes, and anonymizes common attributes within the extracted group.

In step S5, the anonymization processing unit 12 determines whether or not all attributes have been anonymized. If the determination is YES, the process moves to step S8, and if the determination is NO, the process moves to step S6.

In step S6, the anonymization processing unit 12 determines whether the code used in step S4 is the original code before generalization. If the determination is YES, the process moves to step S8, and if the determination is NO, the process moves to step S7.

In step S7, the anonymization processing unit 12 details the code by one level. After that, the process returns to step S4.

In step S8, the integration unit 13 integrates the groups anonymized in step S4, rearranges the processed records in the same order as the input data set based on pre-stored order data, and outputs the processed records. .

As described above, according to the present embodiment, the anonymization device 1 accepts input of a data set consisting of records whose payload attributes can be specified by code, stores the order of the records, and stores the code or a combination of codes. Extract some records from the data set for each, and perform anonymization processing on common attributes. As a result, the anonymization device 1 integrates some of the anonymized records according to the order in which they were stored, and reconstructs an anonymized data set.
Therefore, the anonymization device 1 can anonymize data sets with different payload attributes, whereas conventionally all records were required to have the same attribute.

At this time, the anonymization device 1 processes a plurality of codes having common attributes into the same generalized code, and extracts some records for each generalized code.
Therefore, the anonymization device 1 groups by the generalized code when the commonality of the code and the attribute is related, so that the anonymization process can be performed by efficiently extracting the part with the matching attribute. By repeating, the entire dataset can be adequately anonymized.

Further, the anonymization device 1 performs anonymization processing for each generalized code, and then performs anonymization processing for each detailed code.
Therefore, the anonymization device 1 can efficiently extract common attributes for each level of code generalization and appropriately anonymize the entire data set.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely enumerations of the most suitable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

In the above-described embodiment, the case where the commonality of attributes can be determined from the arrangement of the character strings of the code was shown, but the present invention is not limited to this.
For example, the anonymization device 1 may extract a combination of codes having at least part of the payload attributes in common from a database showing the correspondence between codes and payload attributes, and extract some records from this combination. .

The anonymization method by the anonymization device 1 is implemented by software. When it is implemented by software, a program that constitutes this software is installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to users' computers via a network. Furthermore, these programs may be provided to the user's computer as a web service through the network without being downloaded.

1 anonymization device 10 control unit 11 input unit 12 anonymization processing unit 13 integration unit 20 storage unit

Claims (5)

an input unit that receives an input of a data set consisting of records whose payload attributes can be specified by a code included in the payload;
a storage unit that stores the order of the records;
an anonymization processing unit that extracts a partial record of the data set for each of the codes or combinations of the codes and performs anonymization processing on common attributes;
An anonymization device comprising an integration unit that integrates the partial anonymized records according to the order and reconstructs an anonymized data set. 2. The anonymization processing unit according to claim 1, wherein a plurality of codes having common attributes are processed into the same generalized code, and the partial records are extracted for each generalized code. Anonymization device. 3. The anonymization device according to claim 2, wherein the anonymization processing unit performs the anonymization processing for each detailed code after performing the anonymization processing for each generalized code. an input step of accepting input of a data set consisting of records whose payload attributes are identifiable by a code contained in the payload;
a storage step of storing the order of said records;
an anonymization processing step of extracting partial records of the data set for each of the codes or combinations of the codes and performing anonymization processing on common attributes;
An anonymization method executed by a computer, and an integration step of integrating the partial anonymized records according to the order to reconstruct an anonymized data set. An anonymization program for causing a computer to function as the anonymization device according to any one of claims 1 to 3.

Images