JP7380856B2 - Quasi-identifier determination device, quasi-identifier determination method, program - Google Patents

Description

The present invention relates to a technique for concealing data in a database.

As techniques for concealing data in a database, there are deterministic methods such as Non-Patent Document 1 and Non-Patent Document 2, and probabilistic methods such as Non-Patent Document 3. Here, the target database stores N data sets (hereinafter referred to as records) consisting of M attribute values (M is an integer greater than or equal to 2) as shown in Figure 1 (N is greater than or equal to 1). (an integer of ). All of these methods are techniques for concealing data using a combination of attributes called quasi-identifiers that can uniquely identify a record.

These methods require the user to specify an attribute to be used as a quasi-identifier. Age, address, gender, etc. are known as examples of quasi-identifiers. It is easy for a user to designate an attribute known as a quasi-identifier as a quasi-identifier.

Kristen LeFevre, David J. DeWitt, and Raghu Ramakrishnan, “Incognito: Efficient Full-domain K-Anonymity,” In Proceedings of the 2005 ACM SIGMOD international conference on Management of data, pp.49-60, 2005. Florian Kohlmayer, Fabian Prasser, Claudia Eckert, Alfons Kemper, and Klaus A. Kuhn, “Flash: Efficient, Stable and Optimal K-Anonymity,” In Privacy, Security, Risk and Trust (PASSAT), 2012 International Conference on and 2012 International Confernece on Social Computing (SocialCom), pp.708-717. IEEE, 2012. Dai Ikarashi, Ryo Kikuchi, Koji Chida, and Katsumi Takahashi, “k-anonymous Microdata Release via Post Randomization Method,” In International Workshop on Security 2015, pp.225-241, 2015.

There may also be attributes that can be used as quasi-identifiers other than those known as quasi-identifiers. However, it is difficult to specifically determine which attributes can be used as quasi-identifiers. Therefore, if the user has low experience or skill, a problem may arise in that the attribute that should originally be used as a quasi-identifier is not specified, resulting in a decrease in security.

Therefore, an object of the present invention is to provide a technique for determining whether or not an attribute of a database is a quasi-identifier.

One aspect of the present invention is that X is a set of attributes of a database T that are definite as quasi-identifiers (hereinafter referred to as a first attribute set), and Y is a set of attributes of a database T that are candidates for quasi-identifiers. (hereinafter referred to as the second attribute set), and for a set of an attribute that is an element of the first attribute set X and an attribute that is an element of the second attribute set Y, calculate the degree of relationship between the two attributes of the set. , when the calculated degree of relationship is a value indicating a large value, the attribute that is an element of the second attribute set Y is determined to be a quasi-identifier, and the attribute determined to be the quasi-identifier is determined to be an element. and a quasi-identifier set generation unit that generates a subset of the second attribute set Y as a quasi-identifier set.

One aspect of the present invention is that X is a set of attributes of a database T that are definite as quasi-identifiers (hereinafter referred to as a first attribute set), and Y is a set of attributes of a database T that are candidates for quasi-identifiers. (hereinafter referred to as the second attribute set), the uniformity of the attribute is determined for the attributes that are elements of the first attribute set X, and the first A third attribute set generation unit that generates a subset of the set X as a third attribute set X', and a set of attributes that are elements of the third attribute set X' and attributes that are elements of the second attribute set Y. , calculates the degree of relationship between the two attributes of the set, and if the calculated degree of relationship is a value indicating that it is large, determines that the attribute that is an element of the second attribute set Y is a quasi-identifier; and a quasi-identifier set generation unit that generates, as a quasi-identifier set, a subset of the second attribute set Y whose elements are the attributes determined to be the quasi-identifiers.

According to the present invention, it is possible to determine whether an attribute of a database is a quasi-identifier.

It is a diagram showing an example of a database. 1 is a block diagram showing the configuration of a quasi-identifier determination device 100. FIG. 3 is a flowchart showing the operation of the quasi-identifier determination device 100. It is a diagram showing an example of a database. 2 is a block diagram showing the configuration of a quasi-identifier determination device 200. FIG. 3 is a flowchart showing the operation of the quasi-identifier determination device 200. 1 is a diagram illustrating an example of a functional configuration of a computer that implements each device in an embodiment of the present invention.

Embodiments of the present invention will be described in detail below. Note that components having the same functions are given the same numbers and redundant explanations will be omitted.

Prior to describing each embodiment, the notation method used in this specification will be explained.

^ (caret) represents a superscript. For example, x ^{y^z} indicates that y ^z is a superscript to x, and x _y^z indicates that y ^z is a subscript to x. Also, _ (underscore) represents a subscript. For example, x ^y_z indicates that y _z is a superscript to x, and x _{y_z} indicates that y _z is a subscript to x.

Also, the superscripts "^" and "~" such as ^x and ~x for a certain character x should originally be written directly above "x", but the notation in the specification is Due to restrictions, they are written as ^x or ~x.

<Technical background>
Each embodiment of the present invention determines whether or not an attribute other than an attribute that is clear as a quasi-identifier is an attribute that can be a quasi-identifier for a database. Here, the attributes that are clear as quasi-identifiers refer to, for example, attributes known as quasi-identifiers such as age, address, and gender, or attributes specified by the user as quasi-identifiers.

The determination procedure will be explained below. First, for the database T, a set X of attributes that are clear as quasi-identifiers and a set Y of attributes that are attributes other than the clear attributes that are clear as quasi-identifiers and are candidates for quasi-identifiers are prepared. Then, the degree of relationship indicating the strength of the relationship between an attribute x∈X that is clear as a quasi-identifier and an attribute y∈Y that is a candidate for a quasi-identifier is calculated, and it is determined that attribute y has a strong relationship with attribute x (i.e. , the degree of relationship is larger than a predetermined threshold, or is greater than or equal to a predetermined threshold), the attribute y is determined to be a quasi-identifier. For example, a correlation coefficient can be used as the degree of relationship.

In addition, in order to prevent the degree of relationship from being calculated in an unintended manner, the uniformity of a clear attribute x∈X is determined in advance as a quasi-identifier, and if the distribution of attribute x is uniform, attribute If the distribution of the attribute x is not uniform, the attribute x may be excluded from the calculation of the degree of relationship. Here, an attribute whose distribution is not uniform is sometimes referred to as an uneven attribute. Note that statistical hypothesis testing can be used to determine the uniformity.

<First embodiment>
T is a database containing N records (N is an integer greater than or equal to 1) that are a set of data consisting of the values of M attributes (M is an integer greater than or equal to 2), and X is a quasi-identifier among the attributes of database T. Let Y be a set of clear attributes (hereinafter referred to as the first attribute set), and Y be a set of attributes that are candidates for quasi-identifiers among the attributes of the database T (hereinafter referred to as the second attribute set).

The quasi-identifier determination device 100 inputs the first attribute set Generate and output.

The quasi-identifier determination device 100 will be described below with reference to FIGS. 2 and 3. FIG. 2 is a block diagram showing the configuration of the quasi-identifier determination device 100. FIG. 3 is a flowchart showing the operation of the quasi-identifier determination device 100. As shown in FIG. 2, the quasi-identifier determination device 100 includes a quasi-identifier set generation section 120 and a recording section 190. The recording unit 190 is a component that appropriately records information necessary for processing by the quasi-identifier determination device 100. For example, a first attribute set X and a second attribute set Y are recorded in the recording unit 190.

The operation of the quasi-identifier determination device 100 will be explained according to FIG. 3. Here, explanation will be given using the database shown in FIG. 4 as an example. The database has five attributes: gender, age, address, annual income (in thousands), and blood type. Let the first attribute set X and the second attribute set Y be X={gender, age, address} and Y={annual income, blood type}, respectively.

In S120, the quasi-identifier set generation unit 120 receives the first attribute set X and the second attribute set Y as input, and generates a set of attributes that are elements of the first attribute set X and attributes that are elements of the second attribute set Y. For each, calculate the degree of relationship between the two attributes of the set, and if the value indicates that the calculated degree of relationship is large, identify the attribute that is an element of the second attribute set Y as a quasi-identifier. In other cases, the attributes that are elements of the second attribute set Y are determined to be not quasi-identifiers, and a subset of the second attribute set Y whose elements are attributes determined to be quasi-identifiers is generated as a quasi-identifier set. and output. Here, the value indicating that the calculated degree of relationship is large means that the calculated degree of relationship is greater than or equal to a predetermined threshold.

A correlation coefficient can be used for the degree of relationship between two attributes. However, an appropriate correlation coefficient is used depending on the types of the two attributes for which the correlation coefficient is calculated. Here, there are two types of types: qualitative attributes and quantitative attributes. Qualitative attributes are attributes that take values other than numerical values, such as gender, and quantitative attributes are age. It refers to an attribute that takes a numerical value as the attribute value, such as.

The following correlation coefficients are used depending on the types of attributes that are elements of the first attribute set X and attributes that are elements of the second attribute set Y.

(1) If both the attribute that is an element of the first attribute set X and the attribute that is an element of the second attribute set Y are qualitative attributes, calculate the degree of relationship using Cramer's association coefficient. .

(2) If both the attribute that is an element of the first attribute set X and the attribute that is an element of the second attribute set Y are quantitative attributes, the degree of relationship is calculated using the Pearson correlation coefficient.

(3) If either the attribute that is an element of the first attribute set X or the attribute that is an element of the second attribute set Y is a qualitative attribute and the other is a quantitative attribute, use the correlation ratio. and calculate the degree of relationship.

For example, if the attribute that is an element of the first attribute set X is gender, and the attribute that is an element of the second attribute set Y is blood type, then using Cramer's association coefficient, If an attribute is age, and an attribute that is an element of the second attribute set Y is annual income, use the Pearson correlation coefficient, and if an attribute that is an element of the first attribute set X is address, and an element of the second attribute set Y is If a certain attribute is annual income, it is recommended to calculate the degree of relationship using a correlation ratio.

Note that since the correlation coefficient can take a value of [-1, 1], the absolute value of the correlation coefficient is calculated, and the attributes that are elements of the second attribute set Y that are greater than (or more than) a predetermined threshold are It is preferable to determine that it is a quasi-identifier. The predetermined threshold value is a standard specified by the user, and may be, for example, 0.7, 0.9, etc.

According to embodiments of the present invention, it is possible to determine whether an attribute of a database is a quasi-identifier. In particular, it becomes possible to determine whether a quasi-identifier includes attributes other than those known as quasi-identifiers, such as age, address, and gender.

By applying the embodiments of the present invention, it is possible to streamline the generation of information in which personal information is processed so that a specific individual cannot be identified and the personal information cannot be recovered (hereinafter referred to as anonymously processed information). It becomes possible. Furthermore, it is possible to prevent mistakes when generating anonymously processed information. In other words, it is possible to support the user's work when concealing database data, such as automatic generation of quasi-identifiers and prevention of omissions in processing quasi-identifiers into data.

<Second embodiment>
The quasi-identifier determination device 200 inputs the first attribute set Generate and output.

The quasi-identifier determination device 200 will be described below with reference to FIGS. 5 and 6. FIG. 5 is a block diagram showing the configuration of the quasi-identifier determination device 200. FIG. 6 is a flowchart showing the operation of the quasi-identifier determination device 200. As shown in FIG. 5, the quasi-identifier determination device 200 includes a third attribute set generation section 210, a quasi-identifier set generation section 120, and a recording section 190. The recording unit 190 is a component that appropriately records information necessary for processing by the quasi-identifier determination device 200.

The operation of the quasi-identifier determination device 200 will be explained according to FIG. 6.

In S210, the third attribute set generation unit 210 receives the first attribute set X as input, determines the uniformity of each attribute that is an element of the first attribute set A subset of the first set X having the determined attributes as elements is generated as a third attribute set X' and output.

Statistical hypothesis testing can be used to determine uniformity. When determining uniformity using statistical hypothesis testing, a null hypothesis is established that ``the uniform distribution and the distribution of the attribute to be determined are related,'' and the probability of this occurring is calculated and specified. If the value falls below a significance level (for example, 0.05, 0.01), the null hypothesis is rejected, and it is assumed that the distribution of the attribute to be determined has no relation to a uniform distribution. Note that an appropriate statistical hypothesis test is used depending on the type of attribute to be determined.

Depending on the type of attribute that is an element of the first attribute set X, the following statistical hypothesis test is used to determine uniformity.

(1) If the attribute that is an element of the first attribute set X is a qualitative attribute, uniformity is determined using a chi-square test or a Fisher exact test.

(2) If the attribute that is an element of the first attribute set X is a quantitative attribute, uniformity is determined using the Kolmogorov-Smirnov test.

For example, if the attribute that is an element of the first attribute set X is gender, use the chi-square test, and if the attribute that is the element of the first attribute set It is a good idea to judge the condition.

In the following, it is assumed that X'={gender, age} is obtained as the third attribute set X' as a result of the uniformity determination.

In S120, the quasi-identifier set generation unit 120 inputs the third attribute set X' and the second attribute set Y, and generates an attribute that is an element of the third attribute set X' and an attribute that is an element of the second attribute set Y. For each pair, calculate the degree of relationship between the two attributes of the pair, and if the value indicates that the calculated degree of relationship is large, the attribute that is an element of the second attribute set Y is a quasi-identifier. , otherwise, the attributes that are elements of the second attribute set Y are determined to be not quasi-identifiers, and a subset of the second attribute set Y whose elements are attributes determined to be quasi-identifiers is set as a quasi-identifier set. Generate and output as .

Note that the following correlation coefficients are used depending on the types of attributes that are elements of the third attribute set X' and attributes that are elements of the second attribute set Y.

(1) If both the attribute that is an element of the third attribute set X' and the attribute that is an element of the second attribute set Y are qualitative attributes, use Cramer's association coefficient to calculate the degree of relationship. do.

(2) If both the attribute that is an element of the third attribute set X' and the attribute that is an element of the second attribute set Y are quantitative attributes, the degree of relationship is calculated using the Pearson correlation coefficient.

(3) If either the attribute that is an element of the third attribute set X' or the attribute that is an element of the second attribute set Y is a qualitative attribute and the other is a quantitative attribute, calculate the correlation ratio. Use this to calculate the degree of relationship.

According to embodiments of the present invention, it is possible to determine whether an attribute of a database is a quasi-identifier. In particular, it becomes possible to determine whether a quasi-identifier includes attributes other than those known as quasi-identifiers, such as age, address, and gender.

Further, uniformity is determined for attributes that are elements of the first attribute set X, and attributes that are determined to have a uniform distribution are excluded, and a third attribute that is a subset of the first attribute set By using the set X' to determine whether an attribute that is an element of the second attribute set Y is a quasi-identifier, it is possible to reduce misjudgments. This will be explained in detail below. In general, simply measuring the correlation between a quasi-identifier that the user knows in advance and a candidate attribute of the quasi-identifier may result in an erroneous determination. For example, when an attribute called an address is defined to include a town area, the value of the attribute is likely to be unique, and the address is a uniform attribute. In this way, the correlation coefficient between attributes that have unique attribute values tends to be very high, but this is simply because the two attributes have unique attribute values, so the correlation is high. Since the correlation is not inherently high, it is not appropriate to judge it as a quasi-identifier. For this reason, it is uniformly determined in advance whether the value of an attribute is a unique attribute to reduce false determinations.

<Addendum>
FIG. 7 is a diagram showing an example of the functional configuration of a computer that implements each of the above-described devices (that is, each node). The processing in each of the above-mentioned devices can be carried out by having the recording section 2020 read a program for causing the computer to function as each of the above-mentioned devices, and causing the control section 2010, input section 2030, output section 2040, etc. to operate the program.

The device of the present invention includes, as a single hardware entity, an input section to which a keyboard or the like can be connected, an output section to which a liquid crystal display or the like can be connected, and a communication device (for example, a communication cable) capable of communicating with the outside of the hardware entity. A communication unit that can be connected to a CPU (Central Processing Unit, which may include cache memory, registers, etc.), RAM and ROM that are memories, external storage devices that are hard disks, and their input units, output units, and communication units. , CPU, RAM, ROM, and an external storage device. Further, if necessary, the hardware entity may be provided with a device (drive) that can read and write a recording medium such as a CD-ROM. A physical entity with such hardware resources includes a general-purpose computer.

The external storage device of the hardware entity stores the program required to realize the above-mentioned functions and the data required for processing this program (not limited to the external storage device, for example, when reading the program (It may be stored in a ROM, which is a dedicated storage device.) Further, data obtained through processing of these programs is appropriately stored in a RAM, an external storage device, or the like.

In the hardware entity, each program stored in an external storage device (or ROM, etc.) and the data necessary for processing each program are read into memory as necessary, and are interpreted and executed and processed by the CPU as appropriate. . As a result, the CPU realizes a predetermined function (each of the components expressed as . . . units, . . . means, etc.).

The present invention is not limited to the above-described embodiments, and can be modified as appropriate without departing from the spirit of the present invention. Further, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as necessary. .

As described above, when the processing functions of the hardware entity (device of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entity should have are described by a program. By executing this program on a computer, the processing functions of the hardware entity are realized on the computer.

A program describing the contents of this process can be recorded on a computer-readable recording medium. The computer-readable recording medium may be of any type, such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, magnetic recording devices include hard disk drives, flexible disks, magnetic tapes, etc., and optical disks include DVDs (Digital Versatile Discs), DVD-RAMs (Random Access Memory), and CD-ROMs (Compact Disc Read Only). Memory), CD-R (Recordable)/RW (ReWritable), etc. as magneto-optical recording media, MO (Magneto-Optical disc), etc. as semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. can be used.

Further, this program is distributed by, for example, selling, transferring, lending, etc. a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, this program may be distributed by storing the program in the storage device of the server computer and transferring the program from the server computer to another computer via a network.

A computer that executes such a program, for example, first stores a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing a process, this computer reads a program stored in its own storage device and executes a process according to the read program. In addition, as another form of execution of this program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and furthermore, the program may be transferred to this computer from the server computer. The process may be executed in accordance with the received program each time. In addition, the above-mentioned processing is executed by a so-called ASP (Application Service Provider) type service, which does not transfer programs from the server computer to this computer, but only realizes processing functions by issuing execution instructions and obtaining results. You can also use it as Note that the program in this embodiment includes information that is used for processing by an electronic computer and that is similar to a program (data that is not a direct command to the computer but has a property that defines the processing of the computer, etc.).

Further, in this embodiment, the hardware entity is configured by executing a predetermined program on a computer, but at least a part of these processing contents may be implemented in hardware.

The foregoing description of embodiments of the invention has been presented for purposes of illustration and description. There is no intent to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings. The embodiments are intended to provide the best illustration of the principles of the invention, and those skilled in the art will be able to explain the invention in various embodiments and in various ways as appropriate for contemplated practical use. It was chosen and expressed so that it can be used with additional transformations. All such modifications and variations are within the scope of the invention as defined by the appended claims, interpreted in accordance with the breadth to which they are fairly and legally entitled.

Claims (8)

X is a set of attributes in database T that are definite as quasi-identifiers (hereinafter referred to as the first attribute set), and Y is a set of attributes in database T that are candidates for quasi-identifiers (hereinafter referred to as the second attribute set). ) and
For a set of an attribute that is an element of the first attribute set If the value is a value that indicates, the attribute that is an element of the second attribute set Y is determined to be a quasi-identifier, and a subset of the second attribute set Y whose elements are the attributes determined to be the quasi-identifier is quasi-identified. A quasi-identifier determination device comprising: a quasi-identifier set generation unit that generates an identifier set; The quasi-identifier determination device according to claim 1,
The quasi-identifier set generation unit is
If both the attribute that is an element of the first attribute set X and the attribute that is an element of the second attribute set Y are qualitative attributes, the degree of relationship is calculated using Cramer's association coefficient,
If both the attribute that is an element of the first attribute set X and the attribute that is an element of the second attribute set Y are quantitative attributes, the degree of relationship is calculated using the Pearson correlation coefficient,
If one of the attributes that is an element of the first attribute set X and the attribute that is an element of the second attribute set Y is a qualitative attribute and the other is a quantitative attribute, the relationship is A quasi-identifier determination device characterized by calculating a degree. X is a set of attributes in database T that are definite as quasi-identifiers (hereinafter referred to as the first attribute set), and Y is a set of attributes in database T that are candidates for quasi-identifiers (hereinafter referred to as the second attribute set). ) and
For the attributes that are elements of the first attribute set X, the uniformity of the attributes is determined, and a subset of the first set '; a third attribute set generation unit that generates
For a set of an attribute that is an element of the third attribute set X' and an attribute that is an element of the second attribute set Y, the degree of relationship between the two attributes of the set is calculated, and the calculated degree of relationship is large. , the attribute that is an element of the second attribute set Y is determined to be a quasi-identifier, and a subset of the second attribute set Y whose elements are the attributes determined to be the quasi-identifier is determined. A quasi-identifier determination device comprising: a quasi-identifier set generation unit that generates a quasi-identifier set; The quasi-identifier determination device according to claim 3,
The quasi-identifier determination device, wherein the third attribute set generation unit determines uniformity using statistical hypothesis testing. The quasi-identifier determination device according to claim 4,
The third attribute set generation unit includes:
If the attribute that is an element of the first attribute set X is a qualitative attribute, use the chi-square test or Fisher exact test to determine the uniformity,
A quasi-identifier determination device characterized in that when an attribute that is an element of a first attribute set X is a quantitative attribute, uniformity is determined using a Kolmogorov-Smirnov test. The quasi-identifier determination device according to claim 3,
The quasi-identifier set generation unit is
If both the attribute that is an element of the third attribute set X' and the attribute that is an element of the second attribute set Y are qualitative attributes, the degree of relationship is calculated using Cramer's association coefficient,
If both the attribute that is an element of the third attribute set X' and the attribute that is an element of the second attribute set Y are quantitative attributes, the degree of relationship is calculated using the Pearson correlation coefficient,
If one of the attributes that is an element of the third attribute set X' and the attribute that is an element of the second attribute set Y is a qualitative attribute and the other is a quantitative attribute, using the correlation ratio, A quasi-identifier determination device characterized by calculating a degree of relationship. X is a set of attributes in database T that are definite as quasi-identifiers (hereinafter referred to as the first attribute set), and Y is a set of attributes in database T that are candidates for quasi-identifiers (hereinafter referred to as the second attribute set). ) and
The quasi-identifier determination device calculates the degree of relationship between the two attributes of the set for a set of an attribute that is an element of the first attribute set X and an attribute that is an element of the second attribute set Y, and If the value indicates that the degree of relationship is large, the attribute that is an element of the second attribute set Y is determined to be a quasi-identifier, and a second attribute set whose elements are the attributes determined to be the quasi-identifier. A quasi-identifier determination method comprising: a quasi-identifier set generation step of generating a subset of Y as a quasi-identifier set. A program for causing a computer to function as the quasi-identifier determination device according to claim 1.

Images