JP7380183B2 - Anonymity-degraded information output prevention device, anonymity-degraded information output prevention method, and anonymity-degraded information output prevention program - Google Patents

Description

The present invention relates to an anonymity deterioration information output prevention device, an anonymity deterioration information output prevention method, and an anonymity deterioration information output prevention program. The present invention relates to an anonymity-degraded information output prevention device, an anonymity-degraded information output prevention method, and an anonymity-degraded information output prevention program that make it possible to prevent the output of information whose anonymity has deteriorated during matching.

In general, sharing personal information and information handled within a company between companies, and combining and analyzing the information is highly expected to create new social value.

However, from the perspective of privacy protection, provision of personal information or corporate information to third parties is often prohibited without the consent of the individual or company to be protected. Furthermore, companies themselves tend to dislike disclosing information that is the source of their competitiveness to competitors.

As a technology that focuses on such social needs, there is an anonymous processing technology that aims to promote the free distribution and utilization of information. The anonymization technology referred to in this application applies, for example, an anonymization technology described in Patent Document 1, JP 2019-95885A, "Anonymized data evaluation system and method, and anonymity level determination server", etc. It is something to do. This anonymous processing technology processes the target information itself and provides it as anonymously processed information with anonymity by hiding sensitive information from viewers who are trying to know the attributes of the target person. This is what makes it possible. By adopting this anonymous processing technology, it becomes possible to obtain information that could not be obtained with conventional statistical information, such as consumer purchase records, behavior history, and movement lines during disasters, and improve information. Detailed analysis becomes possible.

In other words, by using such anonymous processing technology, data provider companies can collect statistics on unprocessed personal information and corporate information (unprocessed information) collected by the data provider companies, etc. It becomes possible to process and anonymize information, obtain anonymous statistical information and anonymously processed information, and provide this anonymous statistical information and anonymously processed information to third-party companies.

JP2019-095885A

However, with regard to the current anonymous processing technology such as the above-mentioned Patent Document 1 related to the present invention, there are the following problems to be solved.

When multiple data provider companies provide anonymously processed information, third-party companies must collect and collate the anonymously processed information provided by each of the multiple data provider companies. In principle, it is prohibited because anonymization processing becomes meaningless and there is a risk that the original personal information or corporate information may be re-identified.

Additionally, each of the multiple data provider companies may enter into a contract with a private company that performs a combined analysis of the provided information, and provide personal information and corporate information held by the data provider company to the private company. In principle, it is also prohibited for private companies to collate the provided personal information and corporate information and provide it to other companies as statistical information or anonymously processed information.

Due to these circumstances, it is not possible to collate multiple pieces of anonymously processed information, including valid information such as market information that can create new social value, and this obstructs the distribution of valuable information. This is a contributing factor.

In other words, with regard to anonymization technology, it is difficult to handle data joint analysis between organizations, so it is not possible to compare multiple pieces of anonymously processed information, including useful information such as market information, and it is not possible to collect valuable information. This is a factor that hinders the distribution of

(Objective of the present invention)
In view of such circumstances, it is an object of the present invention to ensure that, when outputting information obtained by comparing anonymously processed information held by multiple data provider companies, information whose anonymity has deteriorated is output as compared anonymously processed information. Anonymity-degraded information output prevention device that enables securely collating anonymously processed information provided by each data provider company without leaking the original information before anonymous processing to a third party. An object of the present invention is to provide a method for preventing the output of information with degraded anonymity and a program for preventing the output of information with degraded anonymity.

In order to solve the above-mentioned problems, the anonymity deterioration information output prevention device, the anonymity deterioration information output prevention method, and the anonymity deterioration information output prevention program according to the present invention mainly adopt the following characteristic configuration. ing.

(1) The anonymous processing deterioration information output prevention device according to the present invention includes:
Anonymously processed information of each data provider company to be compared, unprocessed information that is the original information before anonymous processing of the anonymously processed information, and processing policy information for anonymously processing the unprocessed information into the anonymously processed information Anonymity deteriorates when comparing the anonymously processed information obtained from each of the anonymously processed data stores of each data provider company. An anonymity deterioration information output prevention device having a function of preventing information from being output as verified anonymously processed information,
a secure memory area section that applies security functions at the hardware level to provide a secure memory space that cannot be intercepted by a third party;
an anonymously processed information matching unit that operates in the secure memory area unit, matches anonymously processed information of each of the data provider companies to be matched, and generates matched anonymously processed information;
The matched information is generated by taking into consideration the processing policy information for anonymously processing the unprocessed information, which operates in the secure memory area and is applied by each of the data provider companies to be matched. An anonymously processed information inspection department that confirms whether the anonymity of anonymously processed information is guaranteed;
It is characterized by having the following.

(2) The method for preventing the output of anonymity-deteriorating information according to the present invention is as follows:
Anonymously processed information of each data provider company to be compared, unprocessed information that is the original information before anonymous processing of the anonymously processed information, and processing policy information for anonymously processing the unprocessed information into the anonymously processed information Anonymity deteriorates during the step of communicating with the anonymously processed data store that stores the data, and when the anonymously processed information obtained from each of the anonymously processed data stores of each data provider company is combined. A method for preventing the output of information with degraded anonymity, the method comprising: preventing information from being output as verified anonymously processed information;
Anonymously processed information of each data provider company that operates in a secure memory area that applies security functions at the hardware level to provide a secure memory space that cannot be intercepted by third parties, and is subject to verification. an anonymously processed information matching step of comparing the information to generate matched anonymously processed information;
The matched information is generated by taking into consideration the processing policy information for anonymously processing the unprocessed information, which operates in the secure memory area and is applied by each of the data provider companies to be matched. an anonymously processed information inspection step for confirming whether the anonymity of the anonymously processed information is guaranteed;
It is characterized by having the following.

(3) The anonymity deterioration information output prevention program according to the present invention is
As a program executed by a computer, the anonymously processed information of each data provider company to be compared, the unprocessed information that is the original information before anonymous processing of the anonymously processed information, and the unprocessed information are converted into the anonymously processed information. A step of communicating with an anonymously processed data store that stores processing policy information for anonymous processing is combined with the anonymously processed information obtained from each of the anonymously processed data stores of each data provider company. A program for preventing the output of information with deteriorated anonymity, the program comprising: preventing information whose anonymity has deteriorated during verification from being output as verified anonymously processed information;
Anonymously processed information of each data provider company that operates in a secure memory area that applies security functions at the hardware level to provide a secure memory space that cannot be intercepted by third parties, and is subject to verification. an anonymously processed information matching step of comparing the information to generate matched anonymously processed information;
The matched information is generated by taking into consideration the processing policy information for anonymously processing the unprocessed information, which operates in the secure memory area and is applied by each of the data provider companies to be matched. an anonymously processed information inspection step to confirm whether the anonymity of the anonymously processed information is guaranteed;
It is characterized by having the following.

According to the anonymity deterioration information output prevention device, the anonymity deterioration information output prevention method, and the anonymity deterioration information output prevention program of the present invention, the following effects can be achieved mainly.

In other words, when comparing anonymously processed information held by multiple data provider companies to generate matched anonymously processed information, the anonymity of the matched anonymously processed information is guaranteed, and each data provision to be compared is It is possible to check whether the information was generated as highly secure information while satisfying the original company's anonymization processing policy, so it has been verified that anonymity is sufficiently guaranteed. It is possible to provide anonymously processed information to external systems.

1 is a block configuration diagram showing an example of the internal configuration of an anonymity deterioration information output prevention device according to the present invention. FIG. 2 is a table showing a registration example of unprocessed information stored in an unprocessed information DB of an anonymously processed data store of Company A shown in FIG. 1; 2 is a table showing a registration example of processing policy information registered in the processing policy information DB of the anonymously processed data store of Company A shown in FIG. 1; 2 is a table showing a registration example of anonymously processed information stored in an anonymously processed information DB of an anonymously processed data store of Company A shown in FIG. 1; 2 is a table showing an example of registration of unprocessed information stored in an unprocessed information DB of an anonymously processed data store of Company B shown in FIG. 1. FIG. 2 is a table showing a registration example of processing policy information registered in the processing policy information DB of the anonymously processed data store of Company B shown in FIG. 1; 2 is a table showing a registration example of anonymously processed information stored in an anonymously processed information DB of an anonymously processed data store of Company B shown in FIG. 1; 2 is a table showing a registration example of unprocessed information stored in an unprocessed information DB of an anonymously processed data store of company C shown in FIG. 1; 2 is a table showing a registration example of processing policy information registered in the processing policy information DB of the anonymously processed data store of Company C shown in FIG. 1; 2 is a table showing a registration example of anonymously processed information stored in an anonymously processed information DB of an anonymously processed data store of company C shown in FIG. 1; 10 is a table showing a registration example different from FIG. 9 of processing policy information registered in the processing policy information DB of the anonymously processed data store of company C shown in FIG. 1. FIG. 11 is a table showing a different registration example from FIG. 10 of anonymously processed information stored in the anonymously processed information DB of the anonymously processed data store of company C shown in FIG. 1. FIG. 2 is a flowchart showing an example of the operation of the anonymity deterioration information output prevention device shown in FIG. 1 as an embodiment of the present invention. An example of matched anonymously processed information obtained by comparing the anonymously processed information read from the anonymously processed information DB of company A shown in FIG. 4 and the anonymously processed information read from the anonymously processed information DB of company C shown in FIG. This is the table shown below. An example of matched anonymously processed information obtained by comparing the anonymously processed information read from the anonymously processed information DB of company A shown in FIG. 4 with the anonymously processed information read from the anonymously processed information DB of company C shown in FIG. 12. This is the table shown below. An example of matched anonymously processed information obtained by comparing the anonymously processed information read from the anonymously processed information DB of company A shown in Figure 4 and the anonymously processed information read from the anonymously processed information DB of company B shown in Figure 7. This is the table shown below.

Hereinafter, preferred embodiments of an anonymity-degraded information output prevention device, an anonymity-degraded information output prevention method, and an anonymity-degraded information output prevention program according to the present invention will be described with reference to the accompanying drawings. In the following explanation, an anonymity-degraded information output prevention device and an anonymity-degraded information output prevention method according to the present invention will be explained. It goes without saying that the program may be implemented as a prevention program, or the anonymity deterioration information output prevention program may be recorded on a computer-readable recording medium. In addition, the drawing reference numerals attached to the following drawings are added to each element for convenience as an example to aid understanding, and it goes without saying that the present invention is not intended to be limited to the embodiments shown in the figures. stomach.

(Features of the present invention)
Prior to describing the embodiments of the present invention, an overview of the features of the present invention will be first explained. Since the level of anonymous processing may deteriorate when comparing the anonymously processed information held by multiple data provider companies, the present invention is designed to prevent We prevent the leakage of processed information (anonymously processed information generated by collating multiple pieces of anonymously processed information) to external systems, and provide information to external systems in a highly secure state where the level of anonymous processing has not deteriorated. Its main feature is that it has a mechanism to reliably provide verified anonymously processed information.

More specifically, the main features of the present invention are as follows.

Anonymity deterioration information output prevention device according to the present invention acquires anonymously processed information stored in an anonymously processed data store owned by each of a plurality of data provider companies, and A device having a function of preventing information whose anonymity has deteriorated from being output as matched anonymously processed information when comparing each anonymously processed information,
a secure memory area section that applies security functions at the hardware level to provide a secure memory space that cannot be intercepted by a third party;
an anonymously processed information collation unit that operates in the secure memory area unit, collates anonymously processed information of a plurality of data provider companies, and generates collated anonymously processed information;
The anonymity of the matched anonymously processed information that operates in the secure memory area and is generated by taking into consideration the processing policy information for anonymously processing unprocessed information applied by each of the multiple data provider companies. An anonymously processed information inspection department that confirms whether the information is secured;
have.

Here, the anonymously processed information inspection unit that inspects whether or not the anonymity of the verified anonymously processed information is ensured internally,
With reference to the anonymously processed information of each data provider company to be matched, it is determined whether the matched anonymously processed information has a level of anonymity higher than the level of anonymity of each of the anonymously processed information of each data provider company to be matched. an anonymity confirmation unit that confirms whether or not anonymity exists;
By referring to the processing policy information and the unprocessed information of each data provider company to be matched, the matched anonymously processed information is determined based on the anonymization processing policy of each data provider company to be matched. A processing policy confirmation department that confirms whether the requirements are met;
a matching result processing unit that performs a process of outputting or discarding the matched anonymously processed information to an external system based on the confirmation results of the anonymity confirmation unit and the processing policy confirmation unit;
have.

Then, the matching result processing unit
As a result of the confirmation by the anonymity confirmation unit, it is confirmed that the level of anonymity of the matched anonymously processed information is equal to or higher than the level of anonymity of each of the anonymously processed information of each data provider company to be matched. In the case that
and,
If it is confirmed as a confirmation result by the processing policy confirmation unit that the matched anonymously processed information satisfies the anonymization processing policy of each data provider company to be matched,
A process is performed to output the verified anonymously processed information to an external system.

On the other hand, the matching result processing unit
As a result of the confirmation by the anonymity confirmation unit, the level of anonymity of the matched anonymously processed information is lower than the level of anonymity of one or more of the anonymously processed information of each data provider company to be matched. If it is confirmed that
or,
When it is confirmed that the verified anonymously processed information does not satisfy the anonymization processing policy of one or more of the data provider companies to be verified as a result of the verification by the processing policy confirmation department. teeth,
The verified anonymously processed information is deleted and processing is performed so as not to output it to an external system.

(Configuration example of embodiment of the present invention)
Next, an embodiment of an anonymity deterioration information output prevention device according to the present invention will be described in detail with reference to FIG. FIG. 1 is a block diagram showing an example of the internal configuration of an anonymity-degraded information output prevention device according to the present invention. An example of this is shown, including anonymously processed data stores owned by multiple data provider companies (Company A, Company B, and Company C).

The anonymity degraded information output prevention device 300 shown in FIG. 1 has a function of preventing information whose anonymity has degraded from being output as matched anonymously processed information when a plurality of anonymously processed information provided by each company is compared. A device that has the function of communicating with an anonymously processed data store that stores anonymously processed information of each data provider company (Company A, Company B, and Company C) to be compared. It is. That is, by connecting a plurality of anonymously processed data stores to the anonymity deterioration information output prevention device 300 in a communicable state, the anonymous information provided by each data provider company (Company A, Company B, Company C) is It is possible to construct an anonymously processed information matching system that can prevent deterioration of anonymity due to combinations of processed information.

The anonymously processed data store is located for each data provider company (Company A, Company B, Company C) that provides anonymously processed information, and FIG. 1 shows anonymity degradation information output prevention device 300 and As a plurality of anonymously processed data stores that communicate, an anonymously processed data store 10 of company A, an anonymously processed data store 11 of company B, and an anonymously processed data store 12 of company C are connected to the anonymity deterioration information output prevention device 300. An example is shown below. However, the number of anonymously processed data stores to be connected is not limited to this case, and of course may be increased or decreased.

Here, the anonymously processed data store 10 of company A, the anonymously processed data store 11 of company B, and the anonymously processed data store 12 of company C each have an anonymously processed information DB 100 that stores the respective anonymously processed information, and an anonymously processed data store 10 that stores anonymously processed information. In addition to having each of the information DB 110 and the anonymously processed information DB 120, there is also an unprocessed information DB 101 that stores unprocessed information that is the original information before anonymous processing is performed at each of Company A, Company B, and Company C. It has an unprocessed information DB 111 and an unprocessed information DB 121, and also registers processing policy information for anonymously processing the unprocessed information and generating anonymously processed information in each of Company A, Company B, and Company C. It also has a processing policy information DB 102, a processing policy information DB 112, and a processing policy information DB 122.

Regarding the processing policy information of the processing policy information DB 102, processing policy information DB 112, and processing policy information DB 122 of Company A, Company B, and Company C, depending on the case, anonymous processing information DB 100, anonymous processing information DB 110, anonymous processing Although the information DB 120 may be configured to be included in each of the information DB 120, in order to simplify the explanation, the processing policy information DB 102, the processing policy information DB 112, and the processing policy information DB 122 are included here as anonymous processing information. A case where the DB 100, anonymously processed information DB 110, and anonymously processed information DB 120 are installed independently will be described.

Further, the anonymity deterioration information output prevention device 300 shown in FIG. 1 has a secure memory area section 310 inside. The secure memory area unit 310 applies security functions not only at the software level but also at the hardware level to provide a secure memory space that cannot be intercepted by a third party.

In other words, the secure memory area unit 310 has technical specifications (TEE: Trusted Execution Environment) for realizing a safe execution environment for applications by supporting not only software but also hardware within the anonymity degradation information output prevention device 300. is used to construct a secure memory space that cannot be intercepted by a third party. Here, the secure memory area unit 310 may construct a secure memory space using existing technologies such as TSM (Trust Service Management), SGX (Software Guard Extensions), and Trust Zone.

The secure memory area section 310 includes an anonymously processed information matching section 311 and an anonymously processed information inspection section 312 as processing sections operating inside the secure memory area section 310.

The anonymously processed information collation unit 311 operates within the secure memory area unit 310 and compares anonymously processed information DBs of multiple data provider companies (in the case of FIG. 1, anonymously processed information DB 100, anonymously processed information DB 110, anonymously processed information DB 120). ), the anonymously processed information to be compared is obtained and compared, and the anonymously processed information that has been compared is output to the anonymously processed information inspection unit 312 as compared anonymously processed information.

That is, the anonymously processed information collation unit 311 operates in the secure memory area unit 310, and collects anonymously processed information from multiple data provider companies (in the case of FIG. 1, from the anonymously processed information DB 100 of the anonymously processed data store 10 of Company A). (anonymously processed information provided from the anonymously processed information DB 110 of the anonymously processed data store 11 of company B, anonymously processed information provided from the anonymously processed information DB 120 of the anonymously processed data store 12 of company C) It is an anonymously processed information generation means that compares the information and generates the compared anonymously processed information.

Here, the operation of comparing multiple pieces of anonymously processed information is to check each item (each column: each column) constituting each record of the anonymously processed information, and select one of each item (each column: each column). , records having the same information in each item (each column) common to each of the plurality of anonymously processed information records to be matched are compared.

Similarly to the anonymously processed information matching unit 311, the anonymously processed information inspection unit 312 operates within the secure memory area unit 310, and upon receiving the matched anonymously processed information from the anonymously processed information matching unit 311, the anonymously processed information checking unit 312 checks the information to be compared. Pre-processing information DB and processing policy information DB for multiple data provider companies (in the case of Figure 1, company A's pre-processing information DB 101 and processing policy information DB 102, company B's pre-processing information DB 111 and processing policy information DB 112, and C The pre-processing information DB 121 and the processing policy information DB 122) of the company are communicated with to obtain the respective pre-processing information and processing policy information. Then, taking into account each acquired pre-processing information and processing policy information, a deterioration test for the anonymity of the matched anonymously processed information received from the anonymously processed information matching unit 311 is performed, and according to the results of the deterioration test conducted. , determines whether to permit output of the received verified anonymously processed information to an external system or to discard it.

In other words, the anonymously processed information inspection unit 312 operates in the secure memory area unit 310 similarly to the anonymously processed information matching unit 311, and checks each unprocessed information applied in each of a plurality of data provider companies to be compared. This is an inspection means for inspecting whether or not the anonymity of the verified anonymously processed information generated by the anonymously processed information matching unit 311 is guaranteed, taking into account the processing policy information for anonymously processing the information.

To explain further, the anonymously processed information inspection section 312 that inspects whether the anonymity of the matched anonymously processed information is secured includes an anonymity confirmation section 3121, a processing policy confirmation section 3122, and a comparison result processing section. 3123.

The anonymity confirmation unit 3121 refers to the anonymously processed information of each data provider company to be compared, and determines whether the matched anonymously processed information is the anonymously processed information of each data provider company to be compared. To provide an anonymity confirmation means for confirming whether or not the level of anonymity is higher than that of anonymity. Specifically, for example, the anonymity confirmation unit 3121 checks each record that constitutes the matched anonymously processed information, and determines the minimum number of records in which the information in the records is the same information (that is, the same records). is greater than or equal to the minimum number of the same records in the anonymously processed information of each data provider company to be matched, then the matched anonymously processed information is the same as each data to be compared. It is configured to determine that the anonymously processed information has a level of anonymity higher than the anonymity of the anonymously processed information of each provider company.

The processing policy confirmation unit 3122 refers to the processing policy information and the pre-processing information of each data provider company to be compared, and determines whether the matched anonymously processed information is the data provider company to be compared. Provides a processing policy confirmation means for checking whether each anonymization processing policy is satisfied.

Furthermore, the matching result processing section 3123 either outputs the matched anonymously processed information to an external system or discards it, based on the confirmation results of the anonymity confirmation section 3121 and the processing policy confirmation section 3122. A matching result processing means is provided.

The matching result processing unit 3123 determines, as a confirmation result in the anonymity confirmation unit 3121, that the level of anonymity of the matched anonymously processed information is the anonymity level of each of the anonymously processed information of each data provider company to be matched. , and as a result of the confirmation by the processing policy confirmation unit 3122, the matched anonymously processed information is verified to be anonymized by each data provider company to be matched. If it is confirmed that the policy is met, it is determined that the anonymity of the verified anonymously processed information is sufficiently guaranteed, and the verified anonymously processed information is output to an external system. Perform processing.

On the other hand, the matching result processing unit 3123 determines, as a confirmation result in the anonymity confirmation unit 3121, that the level of anonymity of the matched anonymously processed information is determined by the anonymity of one or more of the data provider companies to be matched. If it is confirmed that the processed information is below the level of anonymity, or as a result of the confirmation by the processing policy confirmation unit 3122, the matched anonymously processed information is verified by each data provider company to be matched. If it is confirmed that one or more of the anonymization processing policies are not satisfied, the matched anonymously processed information is determined to be information whose anonymity has deteriorated, and the matched anonymously processed information is determined to be information whose anonymity has deteriorated. Processing information is deleted and processing is performed so that it is not output to external systems.

Here, in the case of FIG. 1, the unprocessed information of multiple data provider companies is the unprocessed information provided from the unprocessed information DB 101 of the anonymously processed data store 10 of company A, and the anonymously processed data store of company B. 11, and the unprocessed information provided from the unprocessed information DB 121 of the anonymously processed data store 12 of Company C.

Furthermore, in the case of FIG. 1, the processing policy information for anonymously processing unprocessed information of a plurality of data provider companies is the processing policy provided from the processing policy information DB 102 of the anonymously processed data store 10 of company A. information, processing policy information provided from the processing policy information DB 112 of the anonymously processed data store 11 of company B, and processing policy information provided from the processing policy information DB 122 of the anonymously processed data store 12 of company C. In the case of FIG. 1, the anonymously processed information of multiple data provider companies includes the anonymously processed information provided from the anonymously processed information DB 100 of the anonymously processed data store 10 of company A, and the anonymously processed information provided by the anonymously processed data store 11 of company B. The anonymously processed information provided from the anonymously processed information DB 110 of Company C, and the anonymously processed information provided from the anonymously processed information DB 120 of the anonymously processed data store 12 of Company C.

Next, using specific examples of unprocessed information, processing policy information, and anonymously processed information of a plurality of data provider companies, we will discuss the anonymity of the matched anonymously processed information generated by the anonymity deterioration information output prevention device 300. An example of this will be explained.

FIG. 2 is a table showing an example of registration of unprocessed information stored in the unprocessed information DB 101 of the anonymously processed data store 10 of Company A shown in FIG. This shows an example of registration of the results of a research conducted by a research company regarding (gender and age), purchased items, and payment methods (cash, cashless methods A, B, and C).

Further, FIG. 3 is a table showing a registration example of processing policy information registered in the processing policy information DB 102 of the anonymously processed data store 10 of Company A shown in FIG. An example of registration of processing policy information to be applied when anonymously processing each piece of previous information is shown. In addition, in this embodiment, in order to simplify the explanation, as a processing policy for anonymously processing the unprocessed information, a processing method is specified for each item (each column: each column) of each record of the unprocessed information in FIG. 2. For example, specifying deletion of unprocessed information items, use of unprocessed information items as they are, or processing to generalize or create higher-level concepts of unprocessed information items, etc. It shows the case. Regarding the processing policy information of Company B (Figure 6) and the processing policy information of Company C (Figures 9 and 11), which will be explained below, as well as the processing policy information of Company A (Figure 3), the pre-processing information This example shows a case where processing methods are set for each item (each column: each column) of each record.

To explain further, for example, as the processing policy information in Figure 3, for each item column of the unprocessed information in Figure 2, the ID column indicating the item number is deleted, and the user company column indicating the convenience store name and the customer's gender are deleted. The gender column that indicates the gender is set to be used as is. In addition, the age column showing the age of the purchaser was rounded down to the nearest 10 years to make it more generalized, and the product column showing the purchased items was converted to a higher-level concept. The payment method field indicating the payment method is set to generalize to either cash or cashless payment.

Further, FIG. 4 is a table showing a registration example of anonymously processed information stored in the anonymously processed information DB 100 of the anonymously processed data store 10 of Company A shown in FIG. This figure shows an example of registration of anonymously processed information in which previous information has been anonymously processed according to the processing policy illustrated in FIG. 3 .

Here, when performing anonymous processing, it is necessary to perform processing that satisfies k-anonymity as a processing that aims to generalize and superordinate the items of the unprocessed information in order to guarantee the anonymization of anonymously processed information. It is a premise. k-anonymity means that as a result of anonymization processing, the number of records in which the information in each item (each column) of the processed anonymously processed information is the same is less than k, which is predetermined as the threshold for the number of identical records. This is an indicator to ensure that the number of records has not been narrowed down to , and can be used as an indicator to indicate the level of anonymization of anonymously processed information.

For example, for an example of processing that satisfies k-anonymity, the threshold for the number of identical records is k = 3 (that is, the threshold for confirming that the number of records that have the same record information as the result of anonymous processing is 3 or more). A case will be explained in which the index is set in advance as an index for guaranteeing the anonymity of anonymously processed information. In the case of the anonymously processed information shown in Figure 4, the minimum number of records in which the user company, gender, age, product, and payment method fields (each column) have the same information (that is, the same record) is 3. (i.e. 3 records from 1st record to 3rd record, 3 records from 4th record to 6th record, 3 records from 7th record to 9th record, 10th record to 12th record) (3 records), which is the same value as the same record count threshold k=3. Therefore, regarding the anonymously processed information shown in Figure 4, an anonymously processed result that satisfies k-anonymity (k = 3) has been obtained, indicating that the anonymity of the anonymously processed information has not deteriorated. There is.

Next, FIG. 5, FIG. 6, and FIG. 7 are tables related to the anonymously processed data store 11 of company B, and similarly to FIGS. 2, 3, and 4 in the anonymously processed data store 10 of company A, An example of registration of the previous information DB 111, processing policy information DB 112, and anonymous processing information DB 110 is shown.

Here, FIG. 5 is a table showing an example of registration of unprocessed information stored in the unprocessed information DB 111 of the anonymously processed data store 11 of Company B shown in FIG. An example of the registration of the results of a research conducted by a research company on the customer demographics (age) and cashless payment methods (cashless A, B, and C methods) that used convenience stores Convenience Store A and Convenience Store B. It shows. In other words, excluding cases where the payment method was cash, registration is limited to cases where the payment was made using any of the cashless methods.

Further, FIG. 6 is a table showing a registration example of processing policy information registered in the processing policy information DB 112 of the anonymously processed data store 11 of Company B shown in FIG. An example of registration of processing policy information to be applied when anonymously processing each piece of previous information is shown. In other words, as the processing policy information in Fig. 6, for each item column of the unprocessed information in Fig. 5, the ID column indicating the item number is deleted, and the user company column indicating the convenience store name and the cashless payment method of the price are deleted. The payment method column is used as is, and the age column indicating the age of the purchaser is set to be rounded down to the nearest 10 years.

Further, FIG. 7 is a table showing a registration example of anonymously processed information stored in the anonymously processed information DB 110 of the anonymously processed data store 11 of Company B shown in FIG. This figure shows an example of registration of anonymously processed information in which previous information has been anonymously processed according to the processing policy illustrated in FIG. 6 .

If the same record number threshold k = 3 is set in advance as an index for guaranteeing the anonymity of anonymously processed information, in the anonymously processed information shown in Figure 7, each column of user company, age, and payment method (each column ), the minimum number of records (i.e., identical records) is 3 (i.e., the first to third records, the fourth record), as in the case of FIG. 3 records from record to 6th record, and 3 records from 7th record to 9th record), which is the same value as the same record number threshold k=3. Therefore, regarding the anonymously processed information shown in Figure 7, anonymized processing results satisfying k-anonymity (k = 3) have been obtained, indicating that no deterioration in the anonymity of the anonymously processed information has occurred. There is.

Next, FIGS. 8, 9, and 10 are tables related to the anonymously processed data store 12 of company C, and similarly to FIGS. 2, 3, and 4 in the anonymously processed data store 10 of company A, the processing An example of registration of the previous information DB 121, processing policy information DB 122, and anonymous processing information DB 120 is shown.

Here, FIG. 8 is a table showing an example of registration of unprocessed information stored in the unprocessed information DB 121 of the anonymously processed data store 12 of Company C shown in FIG. This is an example of the results of a research conducted by a research company on the demographics of customers (gender and age) and the hours of use (rounded down to the nearest minute) indicating the times when each convenience store was used.

Further, FIG. 9 is a table showing a registration example of processing policy information registered in the processing policy information DB 122 of the anonymously processed data store 12 of Company C shown in FIG. An example of registration of processing policy information to be applied when anonymously processing each piece of previous information is shown. In other words, as the processing policy information in Figure 9, for each item column of the unprocessed information in Figure 8, the ID column indicating the item number is deleted, and the user company column indicating the convenience store name and the gender column indicating the gender of the customer are deleted. is used as is, and the age column indicating the age of the purchaser is rounded down to the nearest 10 years. In addition, the use time period column indicating the time of use includes early morning (for example, 4:00 to 7:00), morning (for example, 7:00 to 12:00), afternoon (for example, 12:00 to 17:00), Indicates a case where general processing is set to be performed as a time range indicating either night (for example, 17:00 to 21:00) or late night (for example, 21:00 to 28:00). There is.

Further, FIG. 10 is a table showing a registration example of anonymously processed information stored in the anonymously processed information DB 120 of the anonymously processed data store 12 of Company C shown in FIG. 9 shows an example of registration of anonymously processed information in which previous information has been anonymously processed according to the processing policy illustrated in FIG. 9.

As shown in the hours of use column in Figure 10, the hours of use for shoppers who use each convenience store, which shows the processing results that have been generalized as an anonymous processing method, are morning (7:00 to 12:00), afternoon ( 12:00 to 18:00), late night (21:00 to 28:00), early morning (4:00 to 7:00), and night (18:00 to 21:00). This is a processing result that is not used.

If the same record number threshold k = 3 is set in advance as an index to guarantee the anonymity of anonymously processed information, each column of company, gender, age, and time of use in the anonymously processed information shown in Figure 10. As in the case of Figure 4, the minimum number of records in which all of the (each column) have the same information (i.e., identical records) is 3 (i.e., 3 records from the 1st record to the 3rd record). , 6 records from the 4th record to the 9th record, and 3 records from the 10th record to the 12th record), which is the same value as the same record number threshold k=3. Therefore, regarding the anonymously processed information shown in Figure 10, anonymized processing results satisfying k-anonymity (k = 3) have been obtained, indicating that no deterioration in the anonymity of the anonymously processed information has occurred. There is.

In addition, in order to generate anonymously processed information different from that shown in FIG. 10, we reviewed the processing policy information regarding the usage time period in the processing policy information DB 122 shown in FIG. 9, and for example, as shown in FIG. It is also possible to generalize information regarding the usage time period using a processing policy.

FIG. 11 is a table showing a registration example different from that shown in FIG. 9 of the processing policy information registered in the processing policy information DB 122 of the anonymously processed data store 12 of Company C shown in FIG. As a processing policy to be applied when anonymously processing unprocessed information, an example is shown in which a processing policy different from the processing policy shown in FIG. 9 is set regarding usage time zone information.

In other words, in the processing policy information shown in FIG. 11, for each item column of the pre-processing information shown in FIG. It is exactly the same as in the case, and the ID field showing the item number is deleted, the user company field showing the convenience store name and the gender field showing the gender of the customer are used as they are, and the age field showing the customer's age is left unchanged. The column has been rounded down to the nearest 10 years.

On the other hand, regarding the use time period column that shows the time period of use, by changing from the case of FIG. 9 and adding the time period of the evening (for example, 16:30 to 18:00), Afternoon (for example, 12:00 to 18:00) is further subdivided into two time periods: afternoon (for example, 12:00 to 16:30) and evening (for example, 16:30 to 18:00). It has been changed to become .

FIG. 12 is a table showing a registration example different from that shown in FIG. 10 of anonymously processed information stored in the anonymously processed information DB of the anonymously processed data store of Company C shown in FIG. 12 shows an example of registration of anonymously processed information in which unprocessed information that is previously processed has been anonymously processed according to the processing policy illustrated in FIG. 11. In addition, in FIG. 12, unlike in the case of FIG. 10, the usage time period column does not use the time range to indicate each time period, but uses any of the terms early morning, morning, afternoon, evening, night, and late night. It shows.

As shown in the usage time column in Figure 12, the usage time of customers who used each convenience store, which shows the processing results that have been generalized as an anonymous processing method, is as in the case of Figure 10. Although no convenience stores are used during the hours (18:00 to 21:00) and at night (18:00 to 21:00), unlike the case in Figure 10, in the morning (7:00 to 12:00) and in the afternoon This means that you will be using a convenience store during one of four time periods: (12:00-16:30), evening (16:30-18:00), and late night (21:00-28:00).

However, in the anonymously processed information shown in Figure 12, the minimum number of records (i.e., identical records) in which all the fields (columns) of user company, gender, age, and time of use are the same is , unlike the case in FIG. record, 10th record to 12th record). In other words, the value is lower than the minimum number of identical records (3) in the case of anonymously processed information in FIG.

Therefore, as in the case of Fig. 10, if the same record number threshold k = 3 is set in advance as an index for guaranteeing the anonymity of anonymously processed information, in the anonymously processed information shown in Fig. 12, the minimum The number of identical records (2) becomes a value less than the threshold for the number of identical records k = 3, and anonymization processing results that satisfy k-anonymity (k = 3) are not obtained, and anonymity deteriorates. That means you are doing it. Therefore, regarding the processing policy for the usage time period column shown in Figure 11, if the same record number threshold k = 3 is used, the time period to be classified is changed so that the number of identical records is 3 or more. You will need to reselect either the option to delete the usage time slot field itself, or delete the usage time slot field itself.

(Explanation of operation example of embodiment of the present invention)
Next, an example of the operation of the anonymity degradation information output prevention device 300 shown as an embodiment of the present invention in FIG. 1 will be described in detail with reference to the flowchart in FIG. 13. FIG. 13 is a flowchart showing an example of the operation of the anonymity deterioration information output prevention device 300 shown in FIG. 1 as an embodiment of the present invention. 300, each anonymously processed data store 10 and anonymously processed data store 11 owned by a plurality of data provider companies (Company A, Company B, and Company C) that provide a plurality of anonymously processed information to be compared. , the anonymously processed data store 12 is connected in a communicable state and configured as a matching system that matches a plurality of pieces of anonymously processed information.

The flowchart in FIG. 13 is activated when the operator of the anonymity deterioration information output prevention device 300 instructs to compare anonymously processed information of each of a plurality of data provider companies (Company A, Company B, and Company C). First, the contents of the operator's instruction are transmitted to the anonymously processed information comparison unit 311 operating within the secure memory area unit 310 of the anonymity deterioration information output prevention device 300.

Upon receiving the instruction from the operator, the anonymously processed information matching unit 311 checks the data provider companies (Company A, Company B, Company C) specified in the instruction in the secure memory area unit 310. Access each anonymously processed data store (anonymously processed data store 10, anonymously processed data store 11, anonymously processed data store 12) and access each anonymously processed information DB (anonymously processed information DB100, anonymously processed information DB110, anonymously processed information DB 120), each piece of anonymously processed information is read as anonymously processed information to be compared (step S1).

Next, in accordance with the instructions from the operator, the anonymously processed information comparison unit 311 performs a process of comparing the anonymously processed information regarding each of the plurality of data provider companies (Company A, Company B, and Company C) that has been read as the anonymously processed information to be compared. and generates verified anonymously processed information as shown in FIGS. 14 to 16 (step S2). As mentioned above, the anonymously processed information comparison process involves comparing the items (columns) that are common to each of the anonymously processed information records to be compared among the items (columns) that make up each anonymously processed information record. Match records that have the same information (columns).

Here, FIG. 14 shows a comparison between the anonymously processed information read from the anonymously processed information DB 100 of company A shown in FIG. 4 and the anonymously processed information read from the anonymously processed information DB 120 of company C shown in FIG. This is a table showing an example of anonymously processed information, and the anonymously processed information in FIG. 4 and the anonymously processed information in FIG. An example of matched anonymously processed information generated by matching each item (each column: each column) is shown. In other words, the matched anonymously processed information in FIG. 14 corresponds to each item (each column: each column) of the anonymously processed information of company A in FIG. It is composed of information that is a combination of items.

In the case of the matched anonymously processed information in FIG. : The minimum number of records in which all of the columns have the same information is 3 (i.e., 3 records from the 1st record to the 3rd record, and 3 records from the 4th record to the 6th record). , three records from the 7th record to the 9th record, and 3 records from the 10th record to the 12th record).

Further, FIG. 15 shows the comparison process of the anonymously processed information read from the anonymously processed information DB 100 of company A shown in FIG. 4 and the anonymously processed information read from the anonymously processed information DB 120 of company C shown in FIG. This is a table showing an example of anonymously processed information, and the anonymously processed information in FIG. 4 and the anonymously processed information in FIG. ) shows an example of matched anonymously processed information generated by matching each item (each column: each column) whose information matches each other. In other words, the matched anonymously processed information in FIG. 15 corresponds to each item (each column: each column) of the anonymously processed information of company A in FIG. It is composed of information that is a combination of items.

In the case of the matched anonymously processed information in FIG. 15, the minimum number of identical records, that is, the minimum number of identical records in which the information in the record is the same information, is 1 (i.e., unlike in the case of FIG. 14). , 3 records from the 1st record to the 3rd record, 3 records from the 4th record to the 6th record, 1 record from the 7th record only, 2 records from the 8th record to the 9th record, There are three records (10th record to 12th record).

Further, FIG. 16 shows the comparison process of the anonymously processed information read from the anonymously processed information DB 100 of company A shown in FIG. 4 and the anonymously processed information read from the anonymously processed information DB 110 of company B shown in FIG. This is a table showing an example of anonymously processed information, and the anonymously processed information in FIG. 4 and the anonymously processed information in FIG. An example of matched anonymously processed information generated by comparing each column (each column) is shown. In other words, the verified anonymously processed information in FIG. 16 corresponds to each item (each column: each column) of the anonymously processed information of company A in FIG. 4, and the item in the payment method column of the anonymously processed information of company B in FIG. It is composed of information that combines.

Note that, as mentioned above, the anonymously processed information of Company B in Figure 7 is registered for the case where the payment was made using cashless payment methods instead of cash, so in the matched anonymously processed information in Figure 16, Regarding each record (7th record to 9th record) where the payment method in the anonymously processed information of Company A in 4. ``-'' (a symbol indicating that there is no data) is displayed in the ``method column''.

Here, in the case of the matched anonymously processed information in FIG. , 3 records from the 1st record to the 3rd record, 3 records from the 4th record to the 6th record, 3 records from the 7th record to the 9th record, and 3 records from the 10th record to the 12th record. record).

Returning to the explanation of the flowchart in FIG. 13, when the anonymously processed information matching unit 311 generates the matched anonymously processed information as illustrated in FIGS. 14 to 16, the anonymity of each of the generated matched anonymously processed information In order to inspect the information, the anonymously processed information inspection unit 312 is activated.

The activated anonymously processed information inspection unit 312 operates in the secure memory area unit 310 of the anonymity deterioration information output prevention device 300, similarly to the anonymously processed information matching unit 311. Then, the activated anonymously processed information inspection unit 312 first activates the anonymity confirmation unit 3121 to check whether each of the matched anonymously processed information generated in the anonymously processed information matching unit 311 is the data provider that is the respective matching source. It is confirmed whether the anonymous processed information of each of the original companies (Company A, Company B, and Company C) is more anonymous (Step S3).

In other words, each of the matched anonymously processed information generated by the anonymously processed information matching unit 311 and the anonymously processed information of each data provider company (Company A, Company B, and Company C) that are the sources of the matched anonymously processed information. and , that is, the minimum number of identical records in which the information in the records is the same information is acquired. Then, the minimum number of identical records of the obtained matched anonymously processed information is determined by the number of identical records of the anonymously processed information of each data provider company (Company A, Company B, Company C) that is the matching source of the anonymously processed information. Check whether the value is greater than or equal to the minimum number of identical records.

In other words, each record constituting the matched anonymously processed information generated by the anonymously processed information matching unit 311 is checked, and the minimum number of identical records in which the information in the records in the matched anonymously processed information is the same is determined. If the number is greater than or equal to the minimum number of identical records in the anonymously processed information of each data provider company to be compared, the matched anonymously processed information will be It is determined that the level of anonymity is higher than the anonymity of the anonymously processed information of each data provider company. On the other hand, if the minimum number of identical records in which the information in the records in the matched anonymously processed information is the same is the one or more of the data provider companies to be matched, the anonymously processed If the information has been narrowed down to a value that is less than the minimum number of identical records, the matched anonymously processed information will be the same as any of the anonymously processed information of each data provider company to be matched. It is judged that the level of anonymity is worse than that of sex.

Here, as described above, in this embodiment, the minimum number of identical records in the matched anonymously processed information shown in FIG. 14 is three, and the anonymous The minimum number of identical records of processed information and the minimum number of identical records of anonymously processed information in FIG. 10 are both three. Further, the minimum number of identical records in the matched anonymously processed information shown in FIG. 15 is one, and the minimum number of identical records in the anonymously processed information in FIG. 4, which is the matching source of the matched anonymously processed information, is three. Yes, and the minimum number of identical records in the anonymously processed information in FIG. 12 is two. Further, the minimum number of identical records in the matched anonymously processed information shown in FIG. 16 is three, and the minimum number of identical records in the anonymously processed information in FIG. The minimum number of identical records of anonymously processed information is three in each case.

Therefore, regarding the matched anonymously processed information shown in FIGS. 14 and 16, the anonymously processed information of each data provider company that is the matching source (anonymously processed information in FIG. 4, anonymously processed information in FIG. 10, and 7), the minimum number of identical records is 3, and the minimum number of identical records is 3, and the minimum number of identical records for each data provider company (Company A, Company B, Company C) that is the matching source is 3. The value is greater than the number of records. Therefore, regarding the matched anonymously processed information shown in FIGS. 14 and 16, the matched anonymously processed information is anonymized by each data provider company (Company A, Company B, Company C) that is the source of the respective matching It is determined that the anonymity is greater than that of the processed information (YES in step S3), and the process proceeds to step S4.

On the other hand, regarding the matched anonymously processed information shown in FIG. 15, the minimum number of identical records is one, and the minimum number of identical records in the anonymously processed information in FIG. 4, which is the matching source, is three. , the minimum number of identical records in the anonymously processed information of the other matching source in FIG. 12 is two. Therefore, the minimum number of identical records in the matched anonymously processed information shown in FIG. 15 is a value smaller than the minimum number of identical records in each of the anonymously processed information in FIG. 4 and FIG. Regarding anonymously processed information, if the matched anonymously processed information does not have more anonymity than the anonymously processed information of each data provider company (Company A, Company B, Company C) that is the source of the comparison. It is determined that this is the case (NO in step S3), and the process moves to step S7. In other words, if it is confirmed that the level of anonymity of the matched anonymously processed information is lower than the level of anonymity of one or more of the anonymously processed information of each data provider company to be matched. determines that the matched anonymously processed information is information whose anonymity is worse than the anonymously processed information of one or more of the data provider companies that are the matching sources, and moves to the process of step S7. do.

Regarding the matched anonymously processed information shown in each of Figures 14 and 16, the anonymity is greater than the anonymously processed information of each data provider company (Company A, Company B, Company C) that is the source of each comparison. When determining that there are The pre-processing information DB and processing policy information DB of companies B and C are accessed to read the respective pre-processing information and processing policy information (step S4).

That is, in the case of the verified anonymously processed information shown in FIG. 14, the unprocessed information of company A (the unprocessed information in FIG. 2) is retrieved from the unprocessed information DB 101 and the processing policy information DB 102 of the anonymously processed data store 10 of company A. The processing policy information (processing policy information in FIG. 3) is read, and the pre-processing information of company C (the pre-processing information in FIG. 8) is read from the pre-processing information DB 121 and processing policy information DB 122 of the anonymously processed data store 12 of company C. and processing policy information (processing policy information in FIG. 9).

In the case of the verified anonymously processed information shown in FIG. 16, the unprocessed information of company A (the information before processing in FIG. 2) is obtained from the unprocessed information DB 101 and the processing policy information DB 102 of the anonymously processed data store 10 of company At the same time, the processing policy information (processing policy information in FIG. 3) is read, and the pre-processing information of company B (pre-processing information in FIG. 5) is read from the pre-processing information DB 111 and processing policy information DB 112 of the anonymously processed data store 11 of company B. and processing policy information (processing policy information in FIG. 6).

The processing policy confirmation unit 3122 of the anonymously processed information inspection unit 312 checks the data provider companies (Company A, Company B, Company C) that are the respective matching sources for the verified anonymously processed information shown in FIGS. 14 and 16. ) After reading the respective pre-processing information and processing policy information, the figure is It is confirmed whether the verified anonymously processed information shown in FIG. 14 and FIG. 16 satisfies the anonymization processing policy of each data provider company that is the source of the comparison (step S5).

In other words, in the case of the matched anonymously processed information in Figure 14, the processing policy information (processing policy information in Figure 3) for anonymously processing the unprocessed information (unprocessed information in Figure 2) of company A, which is the matching source, and It is checked whether any of the processing policies of the processing policy information (processing policy information in FIG. 9) for anonymously processing the pre-processing information of company C (the pre-processing information in FIG. 8) is satisfied. In the case of the matched anonymously processed information in Figure 16, processing policy information (processing policy information in Figure 3) for anonymously processing the unprocessed information (unprocessed information in Figure 2) of company A, which is the matching source, and It is checked whether any of the processing policies of the processing policy information (processing policy information in FIG. 6) for anonymously processing the pre-processing information of company B (the pre-processing information in FIG. 5) is satisfied.

In the case of the matched anonymously processed information in Figure 14, which of the processing policy information of company A (processing policy information in Figure 3) which is the matching source and the processing policy information of company C (processing policy information in Figure 9) (YES in step S5), the verified anonymously processed information satisfies both the processing policy and k-anonymity, that is, the checked anonymously processed information is in a highly secure state with sufficient anonymity guaranteed. Therefore, it is determined that it is possible to output to an external system, and the process proceeds to step S6.

Proceeding to step S6, the anonymously processed information inspection unit 312 activates the matching result processing unit 3123 and determines that both the processing policy and k-anonymity are satisfied, that is, sufficient anonymity is ensured. The verified anonymously processed information in a highly secure state is output from the anonymity deterioration information output prevention device 300 to an external system, and the process ends (step S6).

On the other hand, in the case of the matched anonymously processed information in Figure 16, the information in the payment method column of the anonymously processed information of company C is further combined with the information in the payment method column of the processing policy information of company A, which is the matching source. As a result, the processing policy information of Company A (processed information in Figure 3), which had been anonymized to satisfy k-anonymization, on Company A's unprocessed information (before processing information in Figure 2). (policy information) has been generated.

A more specific explanation of the case of the matched anonymously processed information in FIG. 16 is as follows. In other words, regarding the anonymously processed information of Company A, which is one of the data provider companies that are the source of the comparison, based on the processing policy information of Company A (processing policy information in Figure 3), the unprocessed information of Company A (Fig. The information in the payment method column (in addition to cash, there is information on cashless methods A, B, and C) of the unprocessed information in 2) is anonymously processed to satisfy k-anonymity ( Anonymously processed information (anonymously processed information in Figure 4) was generated by applying generalized processing to either cash or cashless transactions.

Nevertheless, in the case of the matched anonymously processed information in Figure 16, as a result of combining the anonymously processed information of company A with the information in the payment method column of the anonymously processed information of company C, which is the target of matching, cashless payment is possible. Information regarding the A method, B method, and C method has been added, and information that is contrary to the processing policy shown in the processing policy information of the matching source company A (the processing policy information in FIG. 3) has been added.

Therefore, in the case of the matched anonymously processed information in FIG. 16, since it does not satisfy the processing policy of the processing policy information of company A (the processing policy information in FIG. 3), which is the matching source (NO in step S5), It is determined that the verified anonymously processed information does not satisfy the processing policy, that is, the anonymity has deteriorated, and the process moves to step S7. In other words, if it is confirmed that the matched anonymously processed information does not satisfy the anonymization processing policy of one or more of the data provider companies to be matched, the matched anonymously processed information It is determined that the anonymity of has deteriorated, and the process moves to step S7.

In step S7, the anonymously processed information inspection unit 312 activates the matching result processing unit 3123 to state that the anonymously processed information does not have more anonymity than the anonymously processed information of each data provider company that is the matching source (step S3 (NO state in step S5) or in a state that does not satisfy the processing policy of each data provider company that is the matching source (NO state in step S5). If it is determined that the information does not satisfy the matching source's processing policy and the anonymity has deteriorated, the process can be processed by discarding it without outputting it to an external system. (Step S7).

(Explanation of effects of embodiment)
As described above in detail, the anonymity deterioration information output prevention device 300 according to the present embodiment can achieve the following effects.

In other words, when comparing anonymously processed information held by multiple data provider companies to generate matched anonymously processed information, the anonymity of the matched anonymously processed information is guaranteed, and each data provision to be compared is It is possible to reliably confirm whether or not the information was generated as highly secure information while satisfying the original company's anonymization processing policy. It is possible to provide the verified anonymously processed information to an external system.

Furthermore, when generating the matched anonymously processed information, by operating using a secure memory space (secure memory area section 310) that cannot be intercepted by a third party, multiple pieces of data to be matched can be generated. It is possible to safely generate matched anonymously processed information by collating anonymously processed information provided by each data provider company without leaking the unprocessed information held by the provider company to a third party. It is possible.

The configuration of the preferred embodiment of the present invention has been described above. However, it should be noted that such embodiments are merely illustrative of the present invention and do not limit the present invention in any way. Those skilled in the art will readily understand that various modifications and changes can be made depending on specific applications without departing from the spirit of the invention.

10 Anonymously processed data store 11 Anonymously processed data store 12 Anonymously processed data store 100 Anonymously processed information DB
101 Pre-processing information DB
102 Processing policy information DB
110 Anonymous processing information DB
111 Pre-processing information DB
112 Processing policy information DB
120 Anonymous processing information DB
121 Pre-processing information DB
122 Processing policy information DB
300 Anonymity deterioration information output prevention device 310 Secure memory area unit 311 Anonymously processed information matching unit 312 Anonymously processed information inspection unit 3121 Anonymity confirmation unit 3122 Processing policy confirmation unit 3123 Matching result processing unit

Claims (10)

Anonymously processed information of each data provider company to be compared, unprocessed information that is the original information before anonymous processing of the anonymously processed information, and processing policy information for anonymously processing the unprocessed information into the anonymously processed information Anonymity deteriorates when comparing the anonymously processed information obtained from each of the anonymously processed data stores of each data provider company. An anonymity deterioration information output prevention device having a function of preventing information from being output as verified anonymously processed information,
a secure memory area section that applies security functions at the hardware level to provide a secure memory space that cannot be intercepted by a third party;
an anonymously processed information matching unit that operates in the secure memory area unit, matches anonymously processed information of each of the data provider companies to be matched, and generates matched anonymously processed information;
The matched information is generated by taking into consideration the processing policy information for anonymously processing the unprocessed information, which operates in the secure memory area and is applied by each of the data provider companies to be matched. An anonymously processed information inspection department that confirms whether the anonymity of anonymously processed information is guaranteed;
Anonymity deterioration information output prevention device characterized by having the following. The anonymously processed information inspection department internally has the following:
With reference to the anonymously processed information of each of the data provider companies to be compared, the compared anonymously processed information is at a level higher than or equal to the level of anonymity of the anonymously processed information of each of the data provider companies to be compared. an anonymity confirmation unit that confirms whether or not the anonymity of the
With reference to the processing policy information and the unprocessed information of each of the data provider companies to be matched, the matched anonymously processed information is processed for anonymization of each of the data provider companies to be matched. A processing policy confirmation department that confirms whether the policy is met;
a matching result processing unit that performs a process of outputting or discarding the matched anonymously processed information to an external system based on the confirmation results of the anonymity confirmation unit and the processing policy confirmation unit;
The anonymity deterioration information output prevention device according to claim 1, characterized in that it has the following. The anonymity confirmation unit is
Each record constituting the matched anonymously processed information is checked, and the minimum number of identical records in which the information in the records is the same is determined by the anonymously processed information of each of the data provider companies to be matched. If the value is greater than or equal to the minimum number of identical records in the information,
determining that the matched anonymously processed information has a level of anonymity greater than or equal to the anonymity of the anonymously processed information of each of the data provider companies to be compared;
3. The anonymity-degraded information output prevention device according to claim 2. The matching result processing unit includes:
As a result of the confirmation by the anonymity confirmation unit, it is confirmed that the level of anonymity of the matched anonymously processed information is equal to or higher than the level of anonymity of the anonymously processed information of each of the data provider companies to be matched. In the case where
and,
As a result of the confirmation by the processing policy confirmation unit, if it is confirmed that the matched anonymously processed information satisfies the anonymization processing policy of each of the data provider companies to be matched,
Perform processing to output the verified anonymously processed information to an external system,
on the other hand,
As a result of the confirmation by the anonymity confirmation unit, the level of anonymity of the matched anonymously processed information is lower than the level of anonymity of the anonymously processed information of any one or more of the data provider companies to be matched. If it is confirmed that
or
As a result of the confirmation by the processing policy confirmation unit, it is confirmed that the matched anonymously processed information does not satisfy the anonymization processing policy of one or more of the data provider companies to be matched; for,
Deleting the verified anonymously processed information and not outputting it to an external system;
The anonymity-degraded information output prevention device according to claim 2 or 3, characterized in that: Anonymously processed information of each data provider company to be compared, which operates in a secure memory area that applies security functions at the hardware level to provide a secure memory space that cannot be intercepted by third parties. and an anonymously processed data store that stores unprocessed information, which is the original information before anonymously processing the anonymously processed information, and processing policy information for anonymously processing the unprocessed information into the anonymously processed information. Information whose anonymity has deteriorated has already been compared during the step of communicating and the matching of the anonymously processed information acquired from the anonymously processed data stores of each of the data provider companies by operating in the secure memory area section. A method for preventing the output of information with degraded anonymity, the method comprising: preventing the output of anonymously processed information;
an anonymously processed information matching step that operates in the secure memory area unit and matches the anonymously processed information of each of the data provider companies to be matched to generate matched anonymously processed information;
The matched information is generated by taking into consideration the processing policy information for anonymously processing the unprocessed information, which operates in the secure memory area and is applied by each of the data provider companies to be matched. an anonymously processed information inspection step for confirming whether the anonymity of the anonymously processed information is guaranteed;
1. A method for preventing the output of information with degraded anonymity, the method comprising: The anonymously processed information inspection step includes:
With reference to the anonymously processed information of each of the data provider companies to be compared, the compared anonymously processed information is at a level higher than or equal to the level of anonymity of the anonymously processed information of each of the data provider companies to be compared. an anonymity confirmation step of confirming whether or not the anonymity of the
With reference to the processing policy information and the unprocessed information of each of the data provider companies to be matched, the matched anonymously processed information is processed for anonymization of each of the data provider companies to be matched. a processing policy confirmation step to confirm whether the policy is met;
a matching result processing step of outputting or discarding the matched anonymously processed information to an external system based on the confirmation results of the anonymity confirmation step and the processing policy confirmation step;
6. The method for preventing output of anonymity-deteriorating information according to claim 5, further comprising: The anonymity confirmation step includes:
Each record constituting the matched anonymously processed information is checked, and the minimum number of identical records in which the information in the records is the same is determined by the anonymously processed information of each of the data provider companies to be matched. If the value is greater than or equal to the minimum number of identical records in the information,
determining that the matched anonymously processed information has a level of anonymity greater than or equal to the anonymity of the anonymously processed information of each of the data provider companies to be compared;
7. The method for preventing output of anonymity-deteriorating information according to claim 6. The matching result processing step includes:
As a confirmation result in the anonymity confirmation step, it is confirmed that the level of anonymity of the matched anonymously processed information is equal to or higher than the level of anonymity of the anonymously processed information of each of the data provider companies to be matched. In the case where
and,
As a result of the confirmation in the processing policy confirmation step, if it is confirmed that the matched anonymously processed information satisfies the anonymization processing policy of each of the data provider companies to be matched,
Perform processing to output the verified anonymously processed information to an external system,
on the other hand,
As a result of the confirmation in the anonymity confirmation step, the level of anonymity of the matched anonymously processed information is lower than the level of anonymity of the anonymously processed information of any one or more of the data provider companies to be matched. If it is confirmed that
or
As a result of the confirmation in the processing policy confirmation step, it is confirmed that the matched anonymously processed information does not satisfy the anonymization processing policy of one or more of the data provider companies to be matched; for,
Deleting the verified anonymously processed information and not outputting it to an external system;
The method for preventing output of anonymity-deteriorating information according to claim 6 or 7, characterized in that: Anonymously processed information of each data provider company to be compared, unprocessed information that is the original information before anonymous processing of the anonymously processed information, and processing policy information for anonymously processing the unprocessed information into the anonymously processed information Anonymity deteriorated during the process of communicating with the anonymously processed data store that stores the data, and when comparing the anonymously processed information obtained from each of the anonymously processed data stores of each data provider company. A program for preventing the output of information with degraded anonymity, which is executed by a computer and includes the step of preventing information from being output as verified anonymously processed information,
Anonymously processed information of each data provider company that operates in a secure memory area that applies security functions at the hardware level to provide a secure memory space that cannot be intercepted by third parties, and is subject to verification. an anonymously processed information matching step of comparing the information to generate matched anonymously processed information;
The matched information is generated by taking into consideration the processing policy information for anonymously processing the unprocessed information, which operates in the secure memory area and is applied by each of the data provider companies to be matched. an anonymously processed information inspection step to confirm whether the anonymity of the anonymously processed information is guaranteed;
Anonymity deterioration information output prevention program characterized by having the following. In the anonymously processed information inspection step, internally,
With reference to the anonymously processed information of each of the data provider companies to be compared, the compared anonymously processed information is at a level higher than or equal to the level of anonymity of the anonymously processed information of each of the data provider companies to be compared. an anonymity confirmation step of confirming whether or not the anonymity of the
With reference to the processing policy information and the unprocessed information of each of the data provider companies to be matched, the matched anonymously processed information is processed for anonymization of each of the data provider companies to be matched. A processing policy confirmation process to confirm whether the policy is met or not;
a matching result processing step of outputting or discarding the matched anonymously processed information to an external system based on the confirmation results of the anonymity confirmation step and the processing policy confirmation step;
The anonymity deterioration information output prevention program according to claim 9, characterized in that it has the following.

Images