KR101948603B1 - Anonymization Device for Preserving Utility of Data and Method thereof - Google Patents

Abstract

An anonymizing device is disclosed. The anonymizing device may expand the range of the data of the quasi-identifier among the data of the record for the individual composed of at least one data classified by a quasi-identifier or a sensitive attribute, Wherein the generalization unit generalizes the generalized record so that the first generalization level of the generalized record is less than or equal to a predetermined value, and if the quasi-identifier is a numerical attribute, Wherein the data has a second generalization level determined by a difference between a maximum value and a minimum value of the generalized data and a ratio of a difference between a maximum value and a minimum value of the numeric attribute domain and if the quasi identifier is a categorical attribute, Each generalized data of a generalized record has the same structure as that of the classification tree for a categorical attribute. And a second generalization level determined according to a ratio of a value obtained by subtracting 1 from the number of leaf nodes and a value obtained by subtracting 1 from the number of leaf nodes of a node corresponding to generalized data in the classification tree, 1 generalization level is defined as a value obtained by dividing the sum of the second generalization levels by the number (n) of semi-identifiers, and the predetermined value is a real number between 0 and 1.

Description

An Anonymization Device for Preserving Utility of Data and Method Therefor,

The present invention relates to an apparatus and method for anonymizing data, and more particularly, to an anonymizing apparatus and method for preserving usefulness of data by generalizing the generalization level of a generalized record to a predetermined value or less.

Because unprocessed electronic health records (EHRs) contain sensitive information, there is a risk that their privacy will be violated if they are posted. A common method for preserving an individual's privacy is to anonymize it to satisfy a privacy model such as k-anonymity before posting the data.

Among the various anonymization techniques, generalization is most often used to process medical / health data. Since generalization inevitably leads to loss of information, various methods have been proposed to minimize the loss of information. However, existing anonymization methods based on generalization cause a huge loss of information and can not preserve the usefulness of data.

Japanese Patent Registration JP 5858292B2 (Registered on December 25, 2015) Japanese patent JP 5307499B2 (registered on May 3, 2015)

It is an object of the present invention to provide an anonymizing apparatus and method for ensuring the validity of data and preserving the usefulness of data and privacy of individuals by not only anonymized data is not overly generalized but also k- will be.

The anonymizing apparatus according to an embodiment of the present invention may further include an identifier storage unit for storing the data of the quasi-identifier among the data of the record for the individual composed of at least one data classified by a quasi-identifier or a sensitive attribute, Wherein the generalization unit generalizes the first generalization level of the generalized record so that the first generalized level is less than or equal to a preset value, and if the quasi-identifier is a numerical attribute, Each generalized data of the records having a second generalization level determined by a difference between a maximum value and a minimum value of the generalized data and a ratio of a difference between the maximum value and the minimum value of the numerical attribute domain, If the attribute is a categorical attribute, each generalized data of the generalized record is categorized Which is determined according to a ratio of a value obtained by subtracting 1 from the number of leaf nodes of the classification tree for the classification tree and a value obtained by subtracting 1 from the number of leaf nodes of the node corresponding to the generalized data in the classification tree, Wherein the first generalization level is defined as a value obtained by dividing the sum of the second generalization levels by the number (n) of semi-identifiers, and the predetermined value is a real number between 0 and 1.

An anonymizing method according to an embodiment of the present invention includes the steps of receiving a record of an individual performed by an input unit and composed of at least one data classified by a quasi identifier or a sensitive attribute, And expanding the range of the data of the quasi-identifier among the data of the record, wherein the generalizing comprises configuring at least one generalized record having the same data except for the sensitive data among the generalized records If the quasi-identifier is a numeric-type attribute, each generalized data of the generalized record has a difference between a maximum value and a minimum value of the generalized data and a numerical value Based on the ratio of the difference between the maximum and minimum values of the attribute domain Wherein if the quasi-identifier is a categorical attribute, each generalized data of the generalized record has a value obtained by subtracting 1 from the number of leaf nodes of the classification tree for the categorical attribute, And a second generalization level determined by a ratio of a number of leaf nodes of the node corresponding to the generalized data minus one, wherein the first generalization level is a sum of the number of quasi identifiers (n ), And the predetermined value is a real number between 0 and 1.

According to an embodiment of the present invention, the usability of the data can be preserved by generalizing the first generalization level of the generalized record to be less than a predetermined value.

In addition, the privacy of an individual can be preserved by inserting a fake record so that the equivalence class satisfies the k-anonymity.

 In addition, by providing information on fake records, it is possible to guarantee the authenticity of the data.

1 is an exemplary hardware block diagram of an anonymizing apparatus in accordance with an embodiment of the present invention.
2 is an exemplary functional block diagram of the anonymizing apparatus shown in Fig.
FIG. 3 shows a table of records to be anonymized by the generalization unit shown in FIG. 2. FIG.
FIG. 4 shows a table of records generalized by the generalization unit shown in FIG.
FIG. 5 shows an example of a classification tree for a categorical attribute.
FIG. 6 shows a table after insertion of a fake record by the insertion unit shown in FIG. 2. FIG.
FIG. 7 shows a table including information on fake records.
8 is a flowchart for explaining an anonymization method performed by the anonymizing apparatus shown in FIG.
FIG. 9A is a graph showing a RCE (Reconstruction Error Rate) value of an anonymized record when k values are different.
FIG. 9B is a graph showing RCE values of an anonymized record when a predetermined value is changed.

Prior to the description of the concrete contents of the present invention, for the sake of understanding, the outline of the solution of the problem to be solved by the present invention or the core of the technical idea is first given.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. It will be apparent to those skilled in the art, however, that these examples are provided to further illustrate the present invention, and the scope of the present invention is not limited thereto.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other features and advantages of the present invention will become more apparent by describing in detail preferred embodiments thereof with reference to the attached drawings in which: It is possible to quote the above. In the following detailed description of the principles of operation of the preferred embodiments of the present invention, it is to be understood that the present invention is not limited to the details of the known functions and configurations, and other matters may be unnecessarily obscured, A detailed description thereof will be omitted.

1 is an exemplary hardware block diagram of an anonymizing apparatus in accordance with an embodiment of the present invention.

1, an anonymizing device 10 includes a communication interface 101, an input interface 103, an output interface 105, a memory 107, a hard disk 109, one or more processors 111, / Control bus 113.

The anonymizing device 10 may be implemented by a personal computer (PC), a server accessible through an Internet network, a notebook computer, or the like.

Briefly explaining each hardware block, the communication interface 101 is configured to be able to communicate with a device external to the anonymizing device 10. [ The communication interface 101 includes a MAC chip that is configured to perform wired or wireless communication and can be connected to, for example, a wireless LAN or a wired LAN.

The input interface 103 receives a user input for controlling the anonymizing device 10. The input interface 103 may control the anonymizing device 10, including a keyboard, a mouse, and the like. For example, the input interface 103 receives user input for inputting a record to be generalized, generalizing a record, and satisfying k-anonymity.

The output interface 105 outputs the result of the anonymized record by the anonymizing device 10. The output interface 105 may include a display, a speaker, and the like.

Memory 107 includes volatile memory and / or non-volatile memory. The memory 107 stores various data and programs. Volatile memory temporarily stores various data and program segments, and nonvolatile memory permanently stores various setup data and boot programs necessary for setup or booting.

The hard disk 109 stores various data as a mass storage medium and stores various programs. The hard disk 109 includes at least a program for performing the anonymizing method according to the present invention. The hard disk 109 also contains data to be used in the program of the anonymization method. Such data may be accessed and managed by a particular program. The data used for anonymization and this particular program are preferably organized into a database.

The processor 111 can load the program code of a program stored in the nonvolatile memory or the hard disk 109 and execute the program code. The processor 111 may execute an anonymization program including an execution unit capable of executing an instruction of the program code, a program for training various data used for anonymization, and the like.

The system bus / control bus 113 is configured to transmit and receive (control) data between each hardware block. The system bus / control bus 113 may be a parallel bus, a serial bus, or the like.

2 is an exemplary functional block diagram of the anonymizing apparatus shown in Fig.

Referring to FIG. 2, an anonymizing apparatus 10 according to an embodiment of the present invention includes a generalization unit 200, a determination unit 300, an insertion unit 400, and an information provision unit 500. The anonymizing device 10 may further include an input unit 100 according to an embodiment.

The input unit 100 can receive a record of an individual to be anonymized. Here, the record may be an unprocessed electronic health record. Each piece of data in the record can be classified by semi-identifier or sensitivity attribute. A quasi-identifier is information such as an identifier that can not specify an individual but indicates the characteristics of the individual. It is desirable that the sensitive attribute is an important attribute in the data analysis and that the sensitive attribute data is not removed or modified. Also, the input unit 100 may receive a preset value arbitrarily set by the user to prevent excessive generalization.

Referring to FIG. 3 showing a table for a record to be anonymized by the generalization unit shown in FIG. 2, there are age, sex, and zip code as an example of a semi-identifier for the electronic health record, As an example, there is a disease.

The generalization unit 200 generalizes the record by extending the range of the data of the semi-identifier among the data of the record. Generalization means that it is difficult to identify a third party by changing the range of the data of the semi-identifier of the data of the record to a more general value. More specifically, a data value corresponding to a numerical attribute can be generalized by changing a range value, and a data value corresponding to a categorical attribute can be generalized by changing the value to a higher category value. The specific operation of the generalization unit 200 will be described later with reference to FIG. 3 to FIG.

The determination unit 300 determines whether the equivalence class satisfies k-anonymity. Here, the equivalence class is composed of at least one generalized record in which the data excluding the sensitive attribute data among the generalized records are the same. k-anonymity is a model that prevents privacy breach by making each record unidentifiable from k-1 other records. More specifically, if the number of generalized records in any equivalence class is at least k, k-anonymity is satisfied.

When the equivalent class does not satisfy the k-anonymity through the determining unit 300, the inserting unit 400 inserts the fake record into the equivalent class that does not satisfy the k-anonymity. More specifically, the inserted fake record has the same data as the data of the generalized record in the inserted equivalent class. However, the data of the sensitivity attribute of the counterfeit record may be any one of arbitrary selected data of the sensitivity attribute in the equivalence class.

The information providing unit 500 provides generalized records through the generalization unit 200 and information on the inserted falsification records through the insertion unit 400. At this time, the information on the fake record may be the ID of the equivalent class, the number of fake records, and the data of the sensitive property.

However, if the other party can specify the fake record based on the information provided, k-anonymity may be infringed, so it is necessary to provide information so that the fake record can not be specified.

When the other party analyzes the table, in the group G consisting of at least one or more arbitrary equivalence classes E ₁ and another equivalence classes E _other , the number of un-falsified records belonging to E _other and having the sensitive data value s E ₁ and is greater than or equal to the number of forged records with sensitive data value s, then the other party can not specify what the forged record is. Therefore, considering the above points, the privacy of an individual can be preserved by providing information on the ID of the equivalence class in the group G. [

FIG. 4 shows a table of records generalized by the generalization unit shown in FIG. Referring to FIG. 4, the range of the data of the semi-identifier of the data of the record is extended and generalized into a record that can not be identified. One example of a generalized record, <[35-37], [M], [22071-23061], [Pneumonia]>, is a generalization of records by extending the range of data for age and zip code identifiers.

The generalized record may have a first generalization level and each of the at least one generalized data may have a second generalization level. The first generalization level can be defined as the sum of the second generalization levels of each generalized data included in the generalized record divided by the number of quasi identifiers (n).

The second generalization level can be determined by the ratio of the difference between the maximum value and the minimum value of the generalized data and the difference between the maximum value and the minimum value of the numerical attribute domain if the quasi identifier is a numerical attribute.

Also, according to an embodiment of the present invention, if the quasi identifier is a numeric attribute, the second generalization level can be defined by Equation (1).

[Equation 1]

Where D _A is the second generalization level, U _q and L _q are the maximum and minimum values of the generalized data, and U and L are the maximum and minimum values of the numeric property domain.

Therefore, the second generalization level of the data [35-37] corresponding to one of the numerical attributes in the table of FIG. 4 is (37 - 35) / (99 - 0) = 0.02.

Next, if the quasi-identifier is a categorical attribute, the second generalization level is a value obtained by subtracting 1 from the number of leaf nodes in the classification tree for the categorical attribute and a leaf value of the leaf corresponding to the generalized data in the classification tree Can be determined according to the ratio of the number of nodes minus one.

Also, according to an exemplary embodiment of the present invention, if the quasi identifier is a categorical attribute, the second generalization level can be defined by Equation (2).

&Quot; (2) &quot;

Where D _A is a second generalized level, M is the number of leaf nodes in the classification tree for the categorical attribute, and M _q is the number of leaf nodes of the node corresponding to the generalized data in the classification tree.

FIG. 5 shows an example of a classification tree for a categorical attribute.

Referring to FIG. 5, since the number M of leaf nodes in the classification tree for one of the categorical attributes is 2, and the node corresponding to generalized data is * [sex], the number of leaf nodes _q is 2. Therefore, the second generalization level of the data * [sex] corresponding to the gender of one of the categorical attributes in the table of FIG. 3 is (2 - 1) / (2 - 1) = 1.

However, since generalization is inevitable to distort records, excessive generalization negatively affects the analysis of anonymized data. Accordingly, the generalization apparatus according to an embodiment of the present invention can generalize the first generalization level to be less than a predetermined value in order to prevent excessive generalization. The preset value represents a criterion for preventing excessive generalization, which can be a real number between 0 and 1. Therefore, through the generalization unit 200 of the present invention, the first generalization level may be less than a predetermined value to prevent excessive generalization, thereby preserving the usefulness of the data.

Referring to the table of FIG. 4, when a predetermined value input through the input unit 100 is 0.02, the first generalization level of the record of the equivalent class 1 is (2/99 + 0/1 + 990/99999) / 3 = 0.01 and the first generalization level of the record of the equivalent class 2 is (6/99 + 0/1 + 222/99999) / 3 = 0.02, so that it is generalized to be less than a predetermined value.

Some equivalence classes may not satisfy the k-anonymity even though all records of the equivalence class are generalized to be less than predetermined values through the generalization unit 200. [ Therefore, the discriminator 300 determines whether all equivalence classes satisfy the k-anonymity and are anonymized. If the number of generalized records in some equivalence classes is less than or equal to k, the counterfeit record is inserted into the equivalent class that does not satisfy k-anonymity.

FIG. 6 shows a table after insertion of a fake record by the insertion unit shown in FIG. 2. FIG.

6, when the determination unit 300 determines whether the table of FIG. 4 satisfies 4-anonymity, the equivalent class 2 satisfies the 4-anonymity, 1 does not satisfy 4-anonymity because the number of equivalent classes is 3. Therefore, by inserting the falsification records <[35-37], [M], [22071-23061], and [diabetes]> into the equivalence class 1 through the insertion unit 400 of the present invention, can do.

FIG. 7 shows a table including information on fake records.

As described above, the information providing unit 500 can increase the authenticity of data by providing generalized records through the generalizing unit 200 and information on the fake records inserted through the inserting unit 400. At this time, the information on the fake record may be the ID of the equivalent class, the number of fake records, and the data of the sensitive property.

However, if the other party can specify the fake record based on the information provided, k-anonymity may be infringed, so it is necessary to provide information so that the fake record can not be specified.

In a group G consisting of at least one arbitrary equivalence class E ₁ and another equivalence class E _other , the number of un-falsified records belonging to E _other and having the data value s of the sensitive attribute belongs to E ₁ , The counterpart can not specify the counterfeit record if information about the ID of the equivalence class is provided such that it is greater than or equal to the number of counterfeit records having the data value s of the counterpart.

Referring to FIG. 7, if the information on the ID of the equivalence class is given as 1, the 4-anonymity of the equivalence class 1 may be infringed by removing one record in which the sensitive attribute data is diabetes in the equivalent class 1. Therefore, by giving the information about the ID of the equivalence class to 1,2, the other party can not specify whether the forged record is in the equivalence class 1 or 2.

8 is a flowchart for explaining an anonymization method performed by the anonymizing apparatus shown in FIG. Hereinafter, a description overlapping with the above-described portions will be omitted.

The step S100 performed by the input unit 100 of the anonymizing device 10 is a step of receiving a record for an individual composed of at least one data classified by the semi-identifier or the sensitive attribute, respectively. In addition, in order to prevent excessive generalization, a predetermined value set by the user can be inputted.

The step S200 performed by the generalizing unit 200 of the anonymizing device 10 may be generalized such that the first generalization level of the generalized record is less than or equal to a preset value which is a real number between 0 and 1. [ In this case, the generalized data has a second generalization level determined according to the difference between the maximum value and the minimum value of the generalized data and the ratio of the difference between the maximum value and the minimum value of the numeric attribute domain if the quasi-identifier is a numeric type attribute A ratio of a value obtained by subtracting 1 from the number of leaf nodes of the classification tree for the categorical attribute and a value obtained by subtracting 1 from the number of leaf nodes of the node corresponding to the generalized data in the classification tree, Lt; RTI ID = 0.0 &gt; generalization level. &Lt; / RTI &gt; Also, the first generalization level may be defined as a value obtained by dividing the sum of the second generalization levels by the number (n) of semi-identifiers.

The step S300 performed by the discriminator 300 of the anonymizing device 10 may be such that an equivalent class consisting of at least one generalized record having the same data except for the sensitive data among the generalized records satisfies k-anonymity .

The step S400 performed by the inserting unit 400 of the anonymizing device 10 is a step of inserting a fake record into an equivalent class that does not satisfy the k-anonymity when the equivalent class does not satisfy the k-anonymity.

Here, the information providing unit 500 may further include providing information on the generalized record and the fake record.

Here, a grouping step may be added to provide information on the ID of the equivalence class in the group G so that the counterpart can not specify the forgery record based on the information provided through the information providing unit 500. [ More specifically, first, the equivalence classes are sorted according to the number of counterfeit records in the equivalence class. Next, compare the arbitrary equivalence class E ₁ with the other equivalence class E _other to determine that the number of un-falsified records belonging to E _other and having the sensitive data value s belongs to E ₁ and the data value s of the sensitive property equal to more than the number of records having forgery or the E ₁ and E _other may be grouped into a group G. Then, by providing information on the ID of the equivalence class in the group G, it is possible to prevent the other party from specifying the forgery record.

An RCE can be used as a quality indicator for measuring the usability of anonymized data according to an embodiment of the present invention. The RCE can compare the original data with the anonymized data based on the probability density function. The RCE can be defined as follows.

는 원본 데이터의 확률 밀도 함수,

는 익명화된 데이터의 확률 밀도 함수.Here, DS is a dimensional space including a semi-identifier and a sensitivity attribute,

Is a probability density function of the original data,

Is a probability density function of anonymized data.

FIG. 9A is a graph showing RCE values of an anonymized record when k values are different, and FIG. 9B is a graph showing RCE values of anonymized records when a predetermined value is different will be.

As shown in FIG. 9A, the larger the k value, the greater the RCE. The larger the k value, the greater the number of fake records inserted to satisfy the k-anonymity.

As shown in FIG. 9B, as the predetermined value decreases, the RCE increases because a large number of counterfeit records are created due to the strict restriction of the first generalization level as the predetermined value decreases. Therefore, it can be confirmed that anonymization preserving usefulness can reduce RCE.

The above-described anonymizing method can be realized by a general-purpose digital computer that can be created as a program that can be executed by a computer and operates the program using a computer-readable recording medium.

The multiprocessing program is stored in the recording medium, and the recording medium may be a storage medium such as a magnetic storage medium (e.g., ROM, floppy disk, hard disk, etc.), an optical reading medium (e.g. CD-ROM, Media. In addition, the recording medium may be distributed and distributed to a network-connected computer system so that a computer-readable instruction set can be stored and executed in a distributed manner.

It will be apparent to those skilled in the art that variations and modifications may be made without departing from the scope of the present invention. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims (9)

An apparatus for anonymizing a record for an individual consisting of at least one data classified by a quasi-identifier or a sensitive attribute,
And a generalization unit for generalizing the record by expanding a range of data of the semi-identifier among the data of the record,
Wherein the generalization unit generalizes the first generalization level of the generalized record to a predetermined value or less,
If the quasi-identifier is a numerical attribute, each generalized data of the generalized record is determined by the difference between the maximum value and the minimum value of the generalized data and the ratio of the difference between the maximum value and the minimum value of the numeric attribute domain Having a second generalization level,
If the quasi-identifier is a categorical attribute, each generalized data of the generalized record has a value obtained by subtracting 1 from the number of leaf nodes of the classification tree for the categorical attribute, And a second generalization level determined according to a ratio of a value obtained by subtracting 1 from the number of leaf nodes of the node corresponding to the data,
Wherein the first generalization level is defined as a value obtained by dividing the sum of the second generalization levels by the number (n) of semi-identifiers,
Wherein the predetermined value is a real number between 0 and 1,
Anonymizing device for usability preservation.
The method according to claim 1,
Further comprising a discrimination unit for discriminating whether or not an equivalent class consisting of at least one generalized record having the same data except the sensitivity attribute data among the generalized records satisfies k-anonymity An anonymizing device for preserving usability.
3. The method of claim 2,
Further comprising an inserter for inserting the fake record into an equivalence class that does not satisfy the k-anonymity when the equivalence class does not satisfy the k-anonymity.
The method of claim 3,
Wherein the forgery record includes any one of the data of the sensitive attribute.
The method of claim 3,
Further comprising an information providing unit for providing information on the generalized record and the fake record.
6. The method of claim 5,
Wherein the information on the fake record includes data of an ID of an equivalent class, the number of fake records, and sensitive attribute data.
The method comprising: receiving a record of an individual performed by an input unit and composed of at least one or more data classified by a semi-identifier or a sensitivity attribute; And
And generalizing the record by expanding a range of data of a semi-identifier among data of the record, the generalization being performed by a generalization unit,
Wherein the generalization is performed so that the first generalization level of the equivalent class, which is composed of at least one generalized record in which the data excluding the sensitive attribute data is the same among the generalized records, is less than a predetermined value,
If the quasi-identifier is a numeric attribute, each generalized data of the generalized record is a second generalization that is determined by the difference between the maximum and minimum values of the generalized data and the ratio of the difference between the maximum and minimum values of the numeric attribute domain. Having a level,
If the quasi-identifier is a categorical attribute, each generalized data of the generalized record includes a value obtained by subtracting 1 from the number of leaf nodes of the classification tree for the categorical attribute, and a leaf of the node corresponding to the generalized data in the classification tree Having a second generalization level determined by the ratio of the number of nodes minus one,
Wherein the first generalization level is defined as a value obtained by dividing the sum of the second generalization levels by the number (n) of semi-identifiers,
Wherein the predetermined value is a real number between 0 and 1,
Anonymization method for usability preservation.
8. The method of claim 7,
Determining whether an equivalence class, which is performed by a discrimination unit and is composed of at least one generalized record in which data excluding sensitive data among the generalized records are the same, satisfies k-anonymity; And
Further comprising inserting a forgery record in an equivalence class that is performed by an inserter and does not satisfy the k-anonymity when the equivalence class does not satisfy k-anonymity. Way.
9. The method of claim 8,
Further comprising providing information about the generalized record and the fake record, the information being provided by an information providing unit,
Wherein the information on the falsification record includes an ID of an equivalence class, a number of falsification records, and data of sensitivity attributes.

Images